
title: "Allowed registries are configured"

description: |-
    The configuration <tt>registrySources.allowedRegistries</tt> determines the
    permitted registries that the OpenShift container runtime can access for builds
    and pods. This configuration setting ensures that all registries other than
    those specified are blocked.

    You can set the allowed repositories by applying the following manifest using
    <pre>oc patch</pre>, e.g. if you save the following snippet to
    <pre>/tmp/allowed-registries-patch.yaml</pre>
    <pre>
    spec:
      registrySources:
        allowedRegistries:
        - my-trusted-registry.internal.example.com
    </pre> you would call
    <pre>oc patch image.config.openshift.io cluster --patch="$(cat /tmp/allowed-registries-patch.yaml)" --type=merge</pre>

rationale: |-
    Allowed registries should be configured to restrict the registries that the
    OpenShift container runtime can access, and all other registries should be
    blocked.

severity: medium

ocil_clause: 'allowed registries are not set explicitly'

ocil: |-
  To verify that the allowed registries are configured, run the following:
  <pre>$ oc get image.config.openshift.io cluster -ojsonpath='{.spec.registrySources.allowedRegistries}'</pre>
  make sure the output is not empty and matches the registries that you wish to allow.

references:
    cis@ocp4: '5.5.1'
    nist: CM-5(3),CM-7(2),CM-7(5),CM-11
    srg: SRG-APP-000456-CTR-001125

warnings:
    - general: |-
        {{{ openshift_cluster_setting("/apis/config.openshift.io/v1/images/cluster") | indent(8) }}}

template:
    name: yamlfile_value
    vars:
        ocp_data: 'true'
        filepath: /apis/config.openshift.io/v1/images/cluster
        yamlpath: ".spec.registrySources.allowedRegistries[:]"
        entity_check: "at least one"
        values:
            - value: ".*"
              operation: "pattern match"
