Skip to main content
Version: latest

Restrict Container Images

You can specify image URLs in a workspace to restrict access to those images for specific namespaces. Restricted images cannot be loaded into any cluster in the namespaces you specify.

Access control to images is achieved using Kyverno policies. For more information about Kyverno, refer to Kyverno documentation.

Prerequisites​

  • An active Palette workspace. Refer to Create a Workspace to learn how to create one.

  • You are logged in as a Palette user that has the permission to modify workspaces. For more information, refer to Permissions.

Restrict Container Image​

  1. Log in to Palette.

  2. In the drop-down Menu at the top of the page, choose the project that has your workspace.

  3. On the left Main Menu, click Workspaces.

  4. Click on the workspace you want to delete.

  5. In the upper-right corner, click Settings.

  6. Click Container Images.

  7. Enter the namespace you want to restrict image access for. Then enter the images by tag, separated by commas.

  8. Click Save Changes.

Validate​

  1. Connect to a cluster in your workspace using kubectl. For more information, refer to Access Cluster with kubectl.

  2. Issue the following command to view the Kyverno policy used to control image access.

    kubectl describe cpol cluster-policy-palette-system

  3. Check under spec.rules.preconditions and spec.rules.validate. Confirm that the matching namespaces have restricted the container images from loading.