Admission Controller on Images

[tomkennes]

Hi there!

I have an (in my opinion) interesting question for you guys. I am using Argo Workflows to automate continuous data extraction out several systems and I was wondering whether it would be possible to limit the images Argo Workflows is allowed to run as a Workflow image. Somebody already tackled this issue and would like to share his/her experience?

Any thoughts, tips, ideas?

Thanks!

[terrytangyuan]

Yes, you should be able to use admission controllers such as validating webhooks to check the images applied to your workflow pods. This is not a question related to Argo Workflows though. https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/

[tomkennes]

Thanks. You are right, there are already tools out there that allow you to do this. We are going for Open Policy Agent.