anchor.diff:    containers:
     - image: <internal registry IP>:5000/<namespace>/image-policy-check:latest
       name: first
  -```+----
  
positive.code:           - docker.io
  
  ----
  
  <1> Try to resolve images to an immutable image digest and update the image pull spec in the pod
  <2> Array of rules to evaluate against incoming resources.  If you only have reject==true rules
      the default is "allow all".  If you have any accept rule, the default is "deny all".
  <3> Indicates which resources to enforce rules upon.  If nothing is specified, the default is "pods"
  <4> Indicates that if this rule matches, the pod should be rejected
  <5> List of annotations to match on the Image object's metadata
  <6> If you are not able to resolve the image, do not fail the pod
  
  ====
  
  [[image-policy-testing-image-policy-admission-plug-in]]
  == Testing the ImagePolicy Admission Plug-in
  
  You can use the `openshift/image-policy-check` to test your configuration.
  For example, use the information above, then test like this:
  
  ```
  oc import-image openshift/image-policy-check:latest --confirm
  
  ```
  
  Create a pod using this yaml.  The pod should be created.
  ```
  apiVersion: v1
  kind: Pod
  metadata:
  
negative.code: 
  toc::[]
  
  == Overview
  
  You can control which images are allowed to run on your cluster using the ImagePolicy
  admission plug-in (currently considered beta). It allows you to control:
  
  - *The source of images*: which registries can be used to pull images
  - *Image resolution*: force pods to run with immutable digests to ensure the image does not change due to a re-tag
  - *Docker image label restrictions*: force an image to have or not have particular labels
  - *Image annotation restrictions*: force an image in the integration docker registry to have or not have particular annotations
  
  
  [[image-policy-configuring-the-image-policy-admission-plug-in]]
  == Configuring the ImagePolicy Admission Plug-in
  
  To enable this feature, configure the plug-in in `*_master-config.yaml_*`:
  
  .Annotated Example File
  ====
  
  [source,yaml]
  