From 506c493febfe54fe53dc7ea63c41d47e34d88bc7 Mon Sep 17 00:00:00 2001
From: Ruben Hensen <ruben.hensen@protonmail.com>
Date: Mon, 20 Oct 2025 13:54:43 +0200
Subject: [PATCH] Add Kyverno policy to redirect Bitnami images

---
 apps/templates/bitnami-redirect.yaml | 51 ++++++++++++++++++++++++++++
 1 file changed, 51 insertions(+)
 create mode 100644 apps/templates/bitnami-redirect.yaml

diff --git a/apps/templates/bitnami-redirect.yaml b/apps/templates/bitnami-redirect.yaml
new file mode 100644
index 0000000..677224d
--- /dev/null
+++ b/apps/templates/bitnami-redirect.yaml
@@ -0,0 +1,51 @@
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: replace-bitnami-image-repository-with-bitnamilegacy
+  annotations:
+    policies.kyverno.io/title: Replace Bitnami Image Repository With Bitnami Legacy
+    pod-policies.kyverno.io/autogen-controllers: none
+    policies.kyverno.io/subject: Pod
+spec:
+  rules:
+    - name: redirect-bitnami-to-bitnamilegacy
+      match:
+        any:
+          - resources:
+              kinds:
+                - Pod
+              operations:
+                - CREATE
+                - UPDATE
+      mutate:
+        foreach:
+          - list: request.object.spec.initContainers[]
+            context:
+              - name: imageData
+                imageRegistry:
+                  reference: "{{ element.image }}"
+            preconditions:
+              any:
+                - key: "{{ regex_match('^(docker\\.io)/(bitnami)/(.*)$', '{{element.image}}') }}"
+                  operator: Equals
+                  value: true
+            patchStrategicMerge:
+              spec:
+                initContainers:
+                  - name: "{{ element.name }}"
+                    image: "{{ regex_replace_all('^(docker\\.io)/(bitnami)/(.*)$', '{{element.image}}', '$1/bitnamilegacy/$3' )}}"
+          - list: request.object.spec.containers[]
+            context:
+              - name: imageData
+                imageRegistry:
+                  reference: "{{ element.image }}"
+            preconditions:
+              any:
+                - key: "{{ regex_match('^(docker\\.io)/(bitnami)/(.*)$', '{{element.image}}') }}"
+                  operator: Equals
+                  value: true
+            patchStrategicMerge:
+              spec:
+                containers:
+                  - name: "{{ element.name }}"
+                    image: "{{ regex_replace_all('^(docker\\.io)/(bitnami)/(.*)$', '{{element.image}}', '$1/bitnamilegacy/$3' )}}"