Can I disable the digest mutation in the policiy controller?

[BitRacer]

I'm using a managed version of service mesh in GKE, Anthos Service Mesh. The managed service mesh references containers by tag, not with a sha. The result of mutating the sha on the sidecar is that ASM cannot determine what version is installed and chaos ensues.

Is there a way to disable mutation for a container, or set of containers. for example gcr.io/releases/asm*

I only want to skip this mutation for theses sidecars. Not for the main container, which is signed and delivered with a sha

I can't find any examples of how to set this in the cluster policy or mutating webhook config.

[BitRacer]

Reposted as a Question here #1220