apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata: {name: disallow-latest-tag}
spec:
  validationFailureAction: Enforce
  background: false
  rules:
    - name: require-pinned-tag
      match: {any: [{resources: {kinds: [Pod]}}]}
      validate:
        message: "Pin your image to a version. ':latest' is not allowed on this platform."
        pattern: {spec: {containers: [{image: "!*:latest"}]}}