Minimize Container Registries Only Those Approved

#!/usr/bin/env bash
# Purpose: Report all container image registries used in an EKS cluster so they
# can be reviewed against your approved ECR registry list.
# Run on: any machine with kubectl access and the correct kubeconfig for the EKS cluster.

set -o errexit
set -o nounset
set -o pipefail

# ---------- CONFIGURATION ----------
# Comma-separated list of approved registry prefixes (edit for your org).
# Examples:
#   123456789012.dkr.ecr.us-east-1.amazonaws.com
#   public.ecr.aws
#   602401143452.dkr.ecr.${AWS_REGION}.amazonaws.com
APPROVED_REGISTRIES_CSV="123456789012.dkr.ecr.us-east-1.amazonaws.com,public.ecr.aws"

# -----------------------------------

IFS=',' read -r -a APPROVED_REGISTRIES <<< "$APPROVED_REGISTRIES_CSV"

timestamp() {
  date -u +"%Y-%m-%dT%H:%M:%SZ"
}

echo "[$(timestamp)] Collecting images from all namespaces..."

# Collect all unique images (includes pods, daemonsets, statefulsets, jobs, cronjobs, replicasets, deployments, replicas, replicationcontrollers)
ALL_IMAGES_JSON=$(kubectl get pods,daemonsets,statefulsets,jobs,cronjobs,replicasets,deployments,replicationcontrollers --all-namespaces -o json 2>/dev/null || echo '{"items":[]}')

# Extract all container images (containers + initContainers) with owner references and namespace.
# This produces lines: "<namespace> <workloadKind>/<workloadName> <podName> <containerType> <containerName> <image>"
IMAGES_REPORT=$(
  echo "$ALL_IMAGES_JSON" \
  | jq -r '
    .items[]
    | . as $pod
    | ($pod.metadata.ownerReferences[0].kind // "Pod") as $ownerKind
    | ($pod.metadata.ownerReferences[0].name // $pod.metadata.name) as $ownerName
    | ($pod.metadata.namespace // "default") as $ns
    | [ "containers", "initContainers" ][]
    | . as $ctype
    | ($pod.spec[$ctype] // [])[]
    | [$ns,
       ($ownerKind + "/" + $ownerName),
       $pod.metadata.name,
       $ctype,
       .name,
       .image] 
    | @tsv
  ' 2>/dev/null || true
)

if [[ -z "$IMAGES_REPORT" ]]; then
  echo "[$(timestamp)] No images found (cluster may be empty)."
  exit 0
fi

echo "[$(timestamp)] Unique registry usage:"
# Extract registry (first path component before first '/') and count
echo "$IMAGES_REPORT" \
  | awk '{print $6}' \
  | sed 's#^#//##' \
  | awk -F/ '{print $2}' \
  | sort -u \
  | while read -r registry; do
      [[ -z "$registry" ]] && continue
      echo "  - $registry"
    done

echo
echo "[$(timestamp)] Checking images against approved registries:"
echo "Approved registry prefixes:"
for r in "${APPROVED_REGISTRIES[@]}"; do
  echo "  - $r"
done
echo

# Function: return 0 if image is from an approved registry, 1 otherwise
is_approved_image() {
  local image="$1"
  local registry

  # Extract registry: if image has '/', take first part; otherwise treat as "docker.io" style (no explicit registry)
  if [[ "$image" == *"/"* ]]; then
    registry="${image%%/*}"
  else
    registry="docker.io"
  fi

  # Check against approved registry prefixes (simple prefix match)
  for approved in "${APPROVED_REGISTRIES[@]}"; do
    if [[ "$registry" == "$approved"* ]]; then
      return 0
    fi
  done
  return 1
}

# Build a report of non-approved images
NON_APPROVED_FILE="$(mktemp)"
APPROVED_FILE="$(mktemp)"

while IFS=$'\t' read -r ns owner pod ctype cname image; do
  if is_approved_image "$image"; then
    printf "%s\t%s\t%s\t%s\t%s\t%s\n" "$ns" "$owner" "$pod" "$ctype" "$cname" "$image" >> "$APPROVED_FILE"
  else
    printf "%s\t%s\t%s\t%s\t%s\t%s\n" "$ns" "$owner" "$pod" "$ctype" "$cname" "$image" >> "$NON_APPROVED_FILE"
  fi
done <<< "$IMAGES_REPORT"

echo "[$(timestamp)] Summary:"
echo "  Total image references: $(echo "$IMAGES_REPORT" | wc -l | xargs)"
echo "  Approved image references: $(wc -l < "$APPROVED_FILE" | xargs)"
echo "  Non-approved image references: $(wc -l < "$NON_APPROVED_FILE" | xargs)"
echo

echo "[$(timestamp)] Detailed non-approved image usage:"
if [[ -s "$NON_APPROVED_FILE" ]]; then
  printf "namespace\tworkload\tpod\tcontainerType\tcontainerName\timage\n"
  sort -u "$NON_APPROVED_FILE"
else
  echo "  None detected (all images are from approved registries as per current list)."
fi

echo
echo "[$(timestamp)] NOTE:"
echo "  - Lines listed under 'Detailed non-approved image usage' indicate potential policy violations."
echo "  - For each such line, review whether the registry is intentionally allowed."
echo "  - Update APPPROVED_REGISTRIES_CSV in this script as your approved ECR/public registries evolve."