OPA gatekeeper — Mutation CRDs assign default pod/deployment imagePullPolicy “IfNotPresent”

apiVersion: mutations.gatekeeper.sh/v1
kind: Assign
metadata:
  name: deployment-imagepullpolicy
spec:
  applyTo:
  - groups: ["apps"]
    kinds: ["Deployment"]
    versions:
    - v1
  match:
    excludedNamespaces:
    - kube-system
  location: "spec.template.spec.containers[name: *].imagePullPolicy"
  parameters:
    assign:
      value: "IfNotPresent"
---
apiVersion: mutations.gatekeeper.sh/v1
kind: Assign
metadata:
  name: pod-imagepullpolicy
spec:
  applyTo:
  - groups: [""]
    kinds: ["Pod"]
    versions:
    - v1
  match:
    excludedNamespaces:
    - kube-system
  location: "spec.containers[name: *].imagePullPolicy"
  parameters:
    assign:
      value: "IfNotPresent"

demo:

refer: https://open-policy-agent.github.io/gatekeeper/website/docs/mutation/