One image from outside the approved registries
Compare every running image against the approved registry list with kubectl and jq, then trace the odd one back to the ReplicaSet that keeps recreating it.
Briefing
Policy says cluster images come from four registries, written down in approved-registries.txt. Admission enforcement is still in audit mode, so nothing has been blocked yet.
jq can pull every image out of kubectl get pods -A -o json. ownerReferences on a pod names the controller that created it.
ops-bastion · Kubernetes review
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.