Require tenants to block the latest Tag

[bsctl]

Describe the feature

The :latest tag is mutable and can lead to unexpected errors if the image changes. A best practice is to use an immutable tag that maps to a specific version of an application pod. Always considered a bad practice, we still see people and examples out there to use it. In a multitenancy environment, the cluster admin can disallow tenants to use this bad practice.

What would the new user story look like?

1. the cluster admin creates a tenant manifest as:

apiVersion: capsule.clastix.io/v1alpha1
kind: Tenant
metadata:
  name: oil
spec:
  owner:
    name: alice
    kind: User
  allowedLatestImageTag: true

2. Tenant owner creates a new Namespace
3. This is going to be attached to the Tenant
4. Tenant owner cannot create pods with latest tag image. When not specified, any value is admitted.

Expected behavior

see above

[prometherion]

Is this something related to the multi-tenancy benchmark?

Asking this because we had a discussion on #132 and we agreed on implementing this once the Policy Engine is set.

[bsctl]

@prometherion yep, it's correct. Currently, it's not part of the multi-tenancy benchmark and it's proposing the same of #132. I suggest to keep it open till the Policy Engine implementation, just to avoid people to suggest the same once again. And it happened to me too ;)

[prometherion]

Implemented with v1beta1 (#286) and by commit 4166093.