OPA Image Security Templates

When to Use This Skill

Image security policies control which container images can run in your cluster. These templates enforce registry allowlists, require immutable digests, and validate cryptographic signatures.

Image Tags Are Mutable

Tags like latest or v1.2.3 can be overwritten by attackers who compromise registries. Use digest-based references (sha256:...) for immutable deployments.

When to Apply

Scenario 1: Block Public Registries

Prevent deployment of images from untrusted sources:

# Enforced by: base.yaml
# Result: Only images from registry.company.com allowed
# Impact: Eliminates supply chain attacks via public registries

Scenario 2: Prevent Tag Mutation

Require digest-based image references:

# Enforced by: digest.yaml
# Result: Image references must use @sha256:... format
# Impact: Guarantees deployed image matches approved version

Scenario 3: Block Vulnerable Images

Reject images with known CVEs:

# Enforced by: security.yaml
# Result: Images must have scan results with no high/critical vulnerabilities
# Impact: Prevents deployment of exploitable container images

Scenario 4: Verify Build Provenance

Validate cryptographic signatures on all images:

# Enforced by: verification.yaml
# Result: Images must be signed by trusted key in KMS
# Impact: Ensures images originated from approved CI/CD pipelines

Implementation

See the full implementation guide in the source documentation.

Examples

See examples.md for code examples.

Full Reference

See reference.md for complete documentation.

Related Patterns

• OPA Templates Overview
• OPA Pod Security
• Kyverno Image Validation

References

• Source Documentation
• AEL Enforce