<p>I'm using <a href="https://www.conftest.dev/" rel="nofollow noreferrer">conftest</a> for validating policies on Kubernetes manifests.</p>
<p>Below policy validates that images in StatefulSet manifests have to come from specific registry <code>reg_url</code></p>
<pre><code>package main

deny[msg] {
  input.kind == &quot;StatefulSet&quot;
  not regex.match(&quot;[reg_url]/.+&quot;, input.spec.template.spec.initContainers[0].image)

  msg := &quot;images come from artifactory&quot;
}
</code></pre>
<p>Is there a way to enforce such policy for all kubernetes resources that have image field somewhere in their description? This may be useful for policy validation on all <code>helm</code> chart manifests, for instance.</p>
<p>I'm looking for something like:</p>
<pre><code>package main

deny[msg] {
  input.kind == &quot;*&quot; // all resources
  not regex.match(&quot;[reg_url]/.+&quot;, input.*.image) // any nested image field

  msg := &quot;images come from artifactory&quot;
}
</code></pre>

rok
<p>You <em>could</em> do this using something like the <a href="https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-graph-walk" rel="nofollow noreferrer">walk</a> built-in function. However, I would recommend against it, because:</p>
<ul>
<li>You'd need to scan every attribute of every request/resource (expensive).</li>
<li>You can't know for sure that e.g. &quot;image&quot; means the same thing across all current and future resouce manifests, including CRDs.</li>
</ul>
<p>I'd probably just stick with checking for a match of resource kind here, and include any resource type known to have an image attribute with a shared meaning.</p>
