apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: disallow-latest-tag
status:
  autogen:
    rules:
    - match:
        any:
        - resources:
            kinds:
            - Deployment
            - Job
            - StatefulSet
      name: autogen-require-image-tag
      validate:
        failureAction: Audit
        message: An image tag is required.
        pattern:
          spec:
            template:
              spec:
                containers:
                - image: '*:*'
    - match:
        any:
        - resources:
            kinds:
            - Deployment
            - Job
            - StatefulSet
      name: autogen-validate-image-tag
      validate:
        failureAction: Audit
        message: Using a mutable image tag e.g. 'latest' is not allowed.
        pattern:
          spec:
            template:
              spec:
                containers:
                - image: '!*:latest'