See discussion: #1639

The proposal is for a new validation type to make it easy to allow or deny changes to certain fields:

validate:
  changes:
     allow:
     - spec.replicas
     deny:
     - spec.template.spec.containers[*].image