Igelchen1

# open-policy-agent/helm/opa/values.yml
...
validating: true                       
mutating: true
...

Igelchen1

# trust-pinning-test
apiVersion: v1
kind: Pod
metadata:
  name: trust-pinning-test
  namespace: default
spec:
  containers:
  # trigger rule 1:
  - image: GUN/<hub-id>/nginx:1

Igelchen1

package policy.validating

operations := {"CREATE", "UPDATE"}

kind := {"Pod", "Deployment"}

# rule to deny digests for pods and deployments
deny[msg] {
	operations[input.request.operation]
	kind[input.request.kind.kind]

Igelchen1

# open-policy-agent/helm/opa/values.yml
...
validating: true                       
mutating: false
...

Igelchen1

package policy.mutating

import data.k8s.matches

main = {
	"apiVersion": "admission.k8s.io/v1",
	"kind": "AdmissionReview",
	"response": response,
}