---
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  annotations:
    policies.kyverno.io/category: Best Practices
    policies.kyverno.io/description: 'The '':latest'' tag is mutable and can lead
      to unexpected errors if the  image changes. A best practice is to use an immutable
      tag that maps to  a specific version of an application pod.      '
  name: disallow-latest-tag
spec:
  admission: true
  background: true
  rules:
  - match:
      any:
      - resources:
          kinds:
          - Pod
          namespaces:
          - test
    name: require-image-tag
    validate:
      failureAction: Audit
      message: An image tag is required.
      pattern:
        spec:
          containers:
          - image: '*:*'
  - match:
      any:
      - resources:
          kinds:
          - Pod
          namespaces:
          - test
    name: validate-image-tag
    validate:
      message: Using a mutable image tag e.g. 'latest' is not allowed.
      pattern:
        spec:
          containers:
          - image: '!*:latest'
      failureAction: Audit