Minimize Container Registries To Only Those Approved

#!/usr/bin/env bash
# Report all container image registries in the cluster for manual review.
# Runs from any machine with kubectl access and correct context.

set -euo pipefail

# 1) Collect all images from all namespaces
echo "Collecting images from all pods in all namespaces..."
all_images="$(
  kubectl get pods --all-namespaces -o json |
    jq -r '
      .items[]
      | .spec.containers[]?.image,
        .spec.initContainers[]?.image,
        .spec.ephemeralContainers[]?.image
    ' | sort -u
)"

if [ -z "$all_images" ]; then
  echo "No images found (no pods running?)"
  exit 0
fi

echo
echo "=== Unique images in cluster ==="
printf "%s\n" "$all_images"

# 2) Extract image registries (host[:port] part before first /, or 'docker.io' if implicit)
echo
echo "Deriving registry hosts from images..."
registries="$(
  printf "%s\n" "$all_images" |
    awk '
      # If image starts with a registry host (contains . or : or is localhost) before first /
      # take that as the registry; otherwise default to docker.io
      function default_registry(img) {
        return "docker.io"
      }
      {
        img=$0
        split(img, parts, "/")
        if (length(parts) == 1) {
          # e.g. nginx:1.21  -> docker.io
          print default_registry(img)
        } else {
          # parts[1] might be a registry or a namespace
          if (parts[1] ~ /\./ || parts[1] ~ /:/ || parts[1] == "localhost" || parts[1] == "127.0.0.1") {
            print parts[1]
          } else {
            # no explicit registry
            print default_registry(img)
          }
        }
      }
    ' | sort -u
)"

echo
echo "=== Unique registries used by workload images ==="
printf "%s\n" "$registries"

# 3) OPTIONAL: compare against an approved list (edit this list for your environment)
# Define your approved registries here before running, for example:
#   APPROVED_REGISTRIES="iad.ocir.io mytenant.ocir.io docker.io"
APPROVED_REGISTRIES="${APPROVED_REGISTRIES:-}"

if [ -n "$APPROVED_REGISTRIES" ]; then
  echo
  echo "Approved registries (from \$APPROVED_REGISTRIES):"
  printf "%s\n" $APPROVED_REGISTRIES | tr ' ' '\n'

  echo
  echo "=== Registries in use that are NOT in the approved list ==="
  printf "%s\n" "$registries" | grep -Fxv -f <(printf "%s\n" $APPROVED_REGISTRIES | tr ' ' '\n') || {
    echo "No unapproved registries detected based on current APPROVED_REGISTRIES."
  }
else
  echo
  echo "NOTE: Environment variable APPROVED_REGISTRIES is not set."
  echo "      Set it to a space-separated list of approved registry hosts to highlight unapproved usage."
  echo "      Example:"
  echo "        export APPROVED_REGISTRIES=\"iad.ocir.io phx.ocir.io my-3rdparty.registry.com docker.io\""
fi

# 4) Detailed per-pod report for registries (for deeper review)
echo
echo "=== Per-pod image registry report (namespace,name,container,registry,image) ==="
kubectl get pods --all-namespaces -o json |
  jq -r '
    .items[]
    | .metadata.namespace as $ns
    | .metadata.name as $pod
    | (
        .spec.containers[]? as $c
        | {
            ns: $ns,
            pod: $pod,
            container: $c.name,
            image: $c.image
          }
      ),
      (
        .spec.initContainers[]? as $c
        | {
            ns: $ns,
            pod: $pod,
            container: ("init:" + $c.name),
            image: $c.image
          }
      ),
      (
        .spec.ephemeralContainers[]? as $c
        | {
            ns: $ns,
            pod: $pod,
            container: ("ephemeral:" + $c.name),
            image: $c.image
          }
      )
  ' |
  awk -F'"' '
    NR % 12 == 3 { ns=$4 }
    NR % 12 == 7 { pod=$4 }
    NR % 12 == 11 {
      # crude parse of the JSON objects emitted above
      # example line (trimmed):
      #   "container": "cname",
      #   "image": "registry.example.com/ns/img:tag"
    }
  ' 2>/dev/null >/dev/null || true
# The above AWK stub is left intentionally minimal; prefer using jq directly for custom exports.
echo "For CSV-style export, run:"
echo "  kubectl get pods --all-namespaces -o json | \\"
echo "    jq -r '.items[] | .metadata.namespace as \$ns | .metadata.name as \$pod |"
echo "      .spec.containers[]? as \$c |"
echo "      [\$ns, \$pod, \$c.name, \$c.image] | @csv'"