A pod gets evicted at 3am because a node ran out of memory. The ReplicaSet controller does what it's supposed to do and creates a replacement. The replacement never gets admitted, because six weeks earlier someone applied a disallow-latest-tag policy and that Deployment still references :latest .

Source: [Dev.to](https://dev.to/futhgar/kyverno-allowlatesttag-pitfalls-how-policy-can-stop-pods-from-restarting-3dki)

Sponsored