unknown registry fires if image is empty

[garethahealy]

Policy: https://github.com/redhat-cop/rego-policies/tree/master/policy/ocp/bestpractices/container-image-unknownregistries
Example: https://github.com/redhat-cop/helm-charts/blob/master/charts/dev-ex-dashboard/templates/deploymentconfig.yaml#L29

It should ignore/skip over this.

[garethahealy]

CC @ckavili

[garethahealy]

It also needs to handle images from the local registry, i.e.:

• https://github.com/redhat-cop/helm-charts/blob/master/charts/etherpad/templates/deployment.yaml#L32

In this example, it fires:

container 'etherpad' is from (etherpad/etherpad:latest), which is an unknown registry.

Suggest we split on / to check there is a registry specified, if not, skip.

[garethahealy]

Also, another reason for checking for /

container 'sonarqube' is from (sonarqube:8.2-community), which is an unknown registry.

[ckavili]

hmm I can check it like here but need to think how to differentiate between something likedocker.io/ngnix:latest and etherpad/etherpad:latest ..and I think etherpad/etherpad:latest or sonarqube:8.2-community points to docker.io anyway 😅