Invalid Image Tag

apiVersion: rules.spotter.dev/v1alpha1
kind: SpotterRule
metadata:
  name: spotter-supply-001
  labels:
    severity: "medium"
    category: "supply"
  annotations:
    rules.spotter.dev/title: "Invalid Image Tag"
    rules.spotter.dev/version: "1.0.0"
    rules.spotter.dev/cwe: "CWE-829"
    rules.spotter.dev/description: "Container image tags should be specific and not use mutable tags like 'latest'."
spec:
  match:
    resources:
      kubernetes:
        apiGroups:
          - ""
          - "apps"
        versions:
          - "v1"
        kinds:
          - Pod
          - Deployment
          - StatefulSet
          - DaemonSet
          - Job
          - CronJob
        namespaces:
          include: ["*"]
          exclude: ["kube-system", "kube-public"]
        labels:
          exclude:
            rules.spotter.dev/ignore: ["true"]
  cel: |
    (object.kind == 'Pod' && has(object.spec.containers) && object.spec.containers.exists(c, has(c.image) && (c.image.endsWith(":latest") || !c.image.contains(":")))) ||
    (object.kind != 'Pod' && has(object.spec.template.spec.containers) && object.spec.template.spec.containers.exists(c, has(c.image) && (c.image.endsWith(":latest") || !c.image.contains(":"))))
  remediation:
    manual: "Use a specific, immutable image tag or a digest to ensure that you are using the correct version of the image."
  references:
    - title: "Kubernetes Best Practices: Images"
      url: "https://kubernetes.io/docs/concepts/containers/images/"