Minimize Container Registries To Only Those Approved

#!/usr/bin/env bash
#
# Report all unique image registries used by workloads in a GKE cluster.
# Run on: any machine with kubectl access and context set to the target cluster.
#
# This does NOT change anything; it only reports for review.

set -euo pipefail

echo "Collecting images from all namespaces and workload types..." >&2

# Collect images from common workload types
images=$(
  {
    kubectl get pods --all-namespaces -o json;
    kubectl get deployments.apps --all-namespaces -o json;
    kubectl get daemonsets.apps --all-namespaces -o json;
    kubectl get statefulsets.apps --all-namespaces -o json;
    kubectl get jobs.batch --all-namespaces -o json;
    kubectl get cronjobs.batch --all-namespaces -o json 2>/dev/null || true;
  } \
  | jq -r '
      .. | .image? // empty
    ' \
  | sort -u
)

if [[ -z "${images}" ]]; then
  echo "No images found in the cluster (no running or configured workloads?)" >&2
  exit 0
fi

echo
echo "=== Unique images found in the cluster ================================="
printf '%s\n' "${images}"
echo "========================================================================"
echo

# Derive registries from images
# Rules:
# - If image contains '/', take the first path segment as 'registry_or_namespace'
# - If that segment contains a '.', ':' or is 'localhost', treat it as a registry
# - Otherwise, treat image as using the default Docker Hub registry
registries=$(
  printf '%s\n' "${images}" \
  | awk -F/ '
      {
        if (NF == 1) {
          # No "/" → implicit default registry (Docker Hub)
          print "<default-docker-registry>"
        } else {
          first = $1
          if (first ~ /\./ || first ~ /:/ || first == "localhost") {
            print first
          } else {
            # Looks like a namespace on Docker Hub (e.g. library/nginx)
            print "<default-docker-registry>"
          }
        }
      }
    ' \
  | sort -u
)

echo "=== Derived image registries in use ====================================="
printf '%s\n' "${registries}"
echo "======================================================================="
echo
echo "Review guidance:"
echo "1) Define your APPROVED registries list (for example):"
echo "   - gcr.io"
echo "   - us.gcr.io"
echo "   - eu.gcr.io"
echo "   - asia.gcr.io"
echo "   - <your-project>.gcr.io"
echo "   - <default-docker-registry>  (ONLY if Docker Hub is explicitly approved)"
echo
echo "2) Any registry shown above that is NOT on your approved list is a potential problem."
echo "   Examples of suspicious output:"
echo "   - docker.io or <default-docker-registry> if public Docker Hub is not approved"
echo "   - quay.io, ghcr.io, registry.hub.docker.com, or arbitrary hostnames"
echo "   - localhost:5000 or other ad-hoc registries not in policy"
echo
echo "3) For each unapproved registry:"
echo "   - Identify which workloads use it:"
echo "       kubectl get pods --all-namespaces -o wide | grep '<registry-fragment>'"
echo "       kubectl get deploy,sts,ds,job,cronjob --all-namespaces -o yaml | grep '<registry-fragment>' -n"
echo "   - Decide whether to:"
echo "       * Migrate images to an approved registry, and/or"
echo "       * Block them via a Binary Authorization policy as per CISGKE 5.1.4."
echo
echo "This script only surfaces current usage; enforcement must be configured via"
echo "GKE/Binary Authorization policy (cloud provider control plane), not kubectl."