explicitly reject updates to non-spec imagestreamtags

pkg/image/registry/imagestreamtag/rest.go

@@ -263,12 +263,21 @@ func (r *REST) Update(ctx apirequest.Context, tagName string, objInfo rest.Updat
 		imageStream.Spec.Tags = map[string]imageapi.TagReference{}
 	}
 	tagRef, exists := imageStream.Spec.Tags[tag]
+
+	if !exists {
+		return nil, false, kapierrors.NewBadRequest(fmt.Sprintf("imagestreamtag %s is not a spec tag in imagestream %s/%s, cannot be updated", tag, imageStream.Namespace, imageStream.Name))
+	}
+
 	// if the caller set tag, override the spec tag
 	if istag.Tag != nil {
 		tagRef = *istag.Tag
 		tagRef.Name = tag
 	}
 	tagRef.Annotations = istag.Annotations
+
+	if len(tagRef.ReferencePolicy.Type) == 0 {
+		tagRef.ReferencePolicy.Type = imageapi.SourceTagReferencePolicy
+	}
 	imageStream.Spec.Tags[tag] = tagRef
 
 	// mutate the image stream