.k8s-image-swapper.yml

dryRun: true

logLevel: trace
logFormat: console

# imageSwapPolicy defines the mutation strategy used by the webhook.
# - always: Will always swap the image regardless of the image existence in the target registry.
#           This can result in pods ending in state ImagePullBack if images fail to be copied to the target registry.
# - exists: Only swaps the image if it exits in the target registry.
#           This can result in pods pulling images from the source registry, e.g. the first pod pulls
#           from source registry, subsequent pods pull from target registry.
imageSwapPolicy: exists

# imageCopyPolicy defines the image copy strategy used by the webhook.
# - delayed: Submits the copy job to a process queue and moves on.
# - immediate: Submits the copy job to a process queue and waits for it to finish (deadline 8s).
# - force: Attempts to immediately copy the image (deadline 8s).
# - none: Do not copy the image.
imageCopyPolicy: delayed

source:
  # Filters provide control over what pods will be processed.
  # By default all pods will be processed. If a condition matches, the pod will NOT be processed.
  # For query language details see https://jmespath.org/
  filters:
    # Do not process if namespace equals "kube-system"
    - jmespath: "obj.metadata.namespace == 'kube-system'"

    # Only process if namespace equals "playground"
    #- jmespath: "obj.metadata.namespace != 'playground'"

    # Only process if namespace ends with "-dev"
    #- jmespath: "ends_with(obj.metadata.namespace,'-dev')"

#  registries:
#    - type: "generic"
#      generic:
#        repository: "repo1.azurecr.io"
#        username: "user"
#        password: "pass"

target:
  type: aws
  aws:
    accountId: 123456789
    region: ap-southeast-2
    role: arn:aws:iam::123456789012:role/roleName
    ecrOptions:
      tags:
        - key: CreatedBy
          value: k8s-image-swapper
        - key: AnotherTag
          value: another-tag
      imageTagMutability: MUTABLE
      imageScanningConfiguration:
        imageScanOnPush: true
      encryptionConfiguration:
        encryptionType: AES256
        kmsKey: string
      accessPolicy: |
        {
          "Version": "2008-10-17",
          "Statement": [
            {
              "Sid": "AllowCrossAccountPull",
              "Effect": "Allow",
              "Principal": {
                "AWS": "*"
              },
              "Action": [
                "ecr:GetDownloadUrlForLayer",
                "ecr:BatchGetImage",
                "ecr:BatchCheckLayerAvailability"
              ],
              "Condition": {
                "StringEquals": {
                  "aws:PrincipalOrgID": [
                    "o-xxxxxxxx"
                  ]
                }
              }
            }
          ]
        }

      lifecyclePolicy: |
        {
          "rules": [
            {
              "rulePriority": 1,
              "description": "Rule 1",
              "selection": {
                "tagStatus": "any",
                "countType": "imageCountMoreThan",
                "countNumber": 1
              },
              "action": {
                "type": "expire"
              }
            }
          ]
        }

#target:
#  type: generic
#  generic:
#    repository: "repo1.azurecr.io"
#    username: "user"
#    password: "pass"
#    ignoreCert: false