<p>What are the packages inside Kubernetes ConstraintTemplate policy definition? and can we create our own packages using rego?
I have a use case wherein I want to disallow the use of a <strong>stable</strong> image tag for any deployments. I have seen the Github repository of OPA gatekeeper samples and I see they have used packages while defining policies.</p>

<blockquote>
<p>Packages group the rules defined in one or more modules into a
particular namespace. Because rules are namespaced they can be safely
shared across.</p>
</blockquote>
<p>You can try this <strong>ConstraintTemplate</strong>, also set it as per requirement to disable <strong>stable</strong> image</p>
<pre><code>apiVersion: templates.gatekeeper.sh/v1beta1
kind: ConstraintTemplate
metadata:
  name: k8sblocklatesttag
  annotations:
    description: Blocks images with the &quot;stable&quot; tag.
spec:
  crd:
    spec:
      names:
        kind: K8sBlockLatestTag
  targets:
    - target: admission.k8s.gatekeeper.sh
      rego: |
        package k8sblocklatesttag
        violation[{&quot;msg&quot;: msg, &quot;details&quot;: {}}]{
        input.review.object.kind == &quot;Pod&quot;
        imagename := input.review.object.spec.containers[_].image
        endswith(imagename,&quot;stable&quot;)
        msg := &quot;Image with \&quot;stable\&quot; tab is not allowed&quot;
        }
</code></pre>
