apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: require-image-digests
  annotations:
    policies.kyverno.io/title: Require Image Digests
    policies.kyverno.io/category: Supply Chain
    policies.kyverno.io/severity: high
    policies.kyverno.io/subject: Pod
spec:
  validationFailureAction: audit
  background: true
  rules:
    - name: require-digest-reference
      match:
        any:
          - resources:
              kinds:
                - Pod
      validate:
        message: "Container images must reference a digest (e.g. image@sha256:...), not a mutable tag."
        pattern:
          spec:
            containers:
              - name: "*"
                image: "*@sha256:*"