Merge pull request #18532 from bparees/ist_defaulting

Automatic merge from submit-queue (batch tested with PRs 18587, 18296, 18667, 18665, 18532).

explicitly prohibit updates to imagestream tags that are not spec tags

fixes #18519

pkg/image/registry/imagestreamtag/rest.go

@@ -263,6 +263,11 @@ func (r *REST) Update(ctx apirequest.Context, tagName string, objInfo rest.Updat
 		imageStream.Spec.Tags = map[string]imageapi.TagReference{}
 	}
 	tagRef, exists := imageStream.Spec.Tags[tag]
+
+	if !exists && istag.Tag == nil {
+		return nil, false, kapierrors.NewBadRequest(fmt.Sprintf("imagestreamtag %s is not a spec tag in imagestream %s/%s, cannot be updated", tag, imageStream.Namespace, imageStream.Name))
+	}
+
 	// if the caller set tag, override the spec tag
 	if istag.Tag != nil {
 		tagRef = *istag.Tag