anchor.diff:            - docker.io
   
   ----
  -
  -<1> Try to resolve images to an immutable image digest and update the image pull spec in the pod
  -<2> Array of rules to evaluate against incoming resources.  If you only have reject==true rules
  -    the default is "allow all".  If you have any accept rule, the default is "deny all".
  -<3> Indicates which resources to enforce rules upon.  If nothing is specified, the default is "pods"
  -<4> Indicates that if this rule matches, the pod should be rejected
  -<5> List of annotations to match on the Image object's metadata
  -<6> If you are not able to resolve the image, do not fail the pod
  -
  +<1> Try to resolve images to an immutable image digest and update the image pull specification in the pod.
  +<2> Array of rules to evaluate against incoming resources. If you only have reject==true rules,
  +    the default is *allow all*. If you have any accept rule, the default is *deny all*.
  +<3> Indicates which resources to enforce rules upon. If nothing is specified, the default is *pods*.
  +<4> Indicates that if this rule matches, the pod should be rejected.
  +<5> List of annotations to match on the image object's metadata.
  +<6> If you are not able to resolve the image, do not fail the pod.
   ====
   
   [[image-policy-testing-image-policy-admission-plug-in]]
   == Testing the ImagePolicy Admission Plug-in
   
  -You can use the `openshift/image-policy-check` to test your configuration.
  +. Use the `openshift/image-policy-check` to test your configuration.
  ++
   For example, use the information above, then test like this:
  ++
  +----
  +oc import-image openshift/image-policy-check:latest --confirm
  +----
   
  -```
  -oc import-image openshift/image-policy-check:latest --confirm
  -
  -```
  -
  -Create a pod using this yaml.  The pod should be created.
  -```
  +. Create a pod using this YAML. The pod should be created.
  ++
  +----
   apiVersion: v1
   kind: Pod
   metadata:
  
positive.code:   containers:
    - image: docker.io/openshift/image-policy-check:latest
      name: first
  ```
  
  Create another pod pointing to a different registry.  The pod should be rejected.
  ```
  apiVersion: v1
  kind: Pod
  metadata:
  
negative.code:   containers:
    - image: <internal registry IP>:5000/<namespace>/image-policy-check:latest
      name: first
  ----
  