Require imagePullPolicy Always

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4  name: imagepullpolicy-always
 5  annotations:
 6    policies.kyverno.io/title: Require imagePullPolicy Always
 7    policies.kyverno.io/category: Sample
 8    policies.kyverno.io/severity: medium
 9    policies.kyverno.io/subject: Pod
10    policies.kyverno.io/description: >-
11      If the `latest` tag is allowed for images, it is a good idea to have the
12      imagePullPolicy field set to `Always` to ensure should that tag be overwritten that future
13      pulls will get the updated image. This policy validates the imagePullPolicy is set to `Always`
14      when the `latest` tag is specified explicitly or where a tag is not defined at all.      
15spec:
16  validationFailureAction: audit
17  background: false
18  rules:
19  - name: imagepullpolicy-always
20    match:
21      resources:
22        kinds:
23        - Pod
24    validate:
25      message: >-
26                The imagePullPolicy must be set to `Always` when the tag `latest` is used.
27      pattern:
28        spec:
29          containers:
30          - (image): "*:latest | !*:*"
31            imagePullPolicy: "Always"