Require imagePullPolicy Always

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4  name: imagepullpolicy-always
 5  annotations:
 6    policies.kyverno.io/title: Require imagePullPolicy Always
 7    policies.kyverno.io/category: Sample
 8    policies.kyverno.io/severity: medium
 9    policies.kyverno.io/subject: Pod
10    policies.kyverno.io/minversion: 1.6.0
11    policies.kyverno.io/description: >-
12      If the `latest` tag is allowed for images, it is a good idea to have the
13      imagePullPolicy field set to `Always` to ensure should that tag be overwritten that future
14      pulls will get the updated image. This policy validates the imagePullPolicy is set to `Always`
15      when the `latest` tag is specified explicitly or where a tag is not defined at all.
16spec:
17  validationFailureAction: Audit
18  background: true
19  rules:
20  - name: imagepullpolicy-always
21    match:
22      any:
23      - resources:
24          kinds:
25          - Pod
26    validate:
27      message: >-
28        The imagePullPolicy must be set to `Always` when the tag `latest` is used.
29      pattern:
30        spec:
31          containers:
32          - (image): "*:latest | !*:*"
33            imagePullPolicy: "Always"