iac/kubernetes/k8s-image-latest

Container image uses a mutable tag

lowKubernetesiac-kubernetes

What it detects

An image pinned to `:latest` (or with no tag at all) is non-reproducible: the same manifest can pull different code over time, and a compromised upstream tag silently enters the cluster.

Remediation

Pin images to an immutable digest (`image: repo/app@sha256:...`) or at least a specific version tag.

How it runs

Run against YAML files that look like Kubernetes manifests (top-level `apiVersion:` + `kind:`). Line-based checks across multi-document files; Helm-templated lines are skipped.

Found a false positive or want this rule tuned? File an issue. You can also suppress per-repo via a .repoguardignore line.