Currently, we enforce using versioned tags for containers in Dockerfile Base images and Deployment/Pod Containers and fail the validation results if the images use the latest tag.
To further improve the workflow and follow best practices in defining the containers, it's proposed to update the image tag with image Digest after the validation is complete. In this way instead of failing the validation for images/containers using the latest tag, we can update the image tag with the Digest of the latest image used.
So it would look like:
FROM nginx:latest
# Would be updated to
FROM nginx@sha256:xxxx
For Kubernetes Pods/Deployments:
containers:
- name: nginx
image: nginx:latest
# Would now updated to
containers:
- name: nginx
image: nginx@sha256:xxxx