CKS Practice Question 8: Image Digest Pinning
Certified Kubernetes Security Specialist (CKS) · Test 1 · question 8 of 10
An incident review finds that two Pods created a week apart from the identical manifest image: registry.example.com/payments:1.4 are running different binaries: someone pushed new content over the existing 1.4 tag in the registry between the two pulls.
You must guarantee that the workload always runs the exact artifact that was reviewed and signed. What should the manifest specify?
Show answer and explanation
Answer:
A tag is a mutable pointer: anyone with push access can move 1.4 to different content, and nothing in Kubernetes detects that. A digest is the content-addressable identifier of the image manifest, so @sha256:... names one immutable artifact, the same bytes that were scanned and signed, and a registry cannot serve anything else under it. This is the standard supply-chain hardening for production manifests.
Option B makes the problem worse rather than better. imagePullPolicy: Always guarantees the node fetches whatever the tag currently points at, so the substituted image is pulled sooner.
Option C freezes the workload onto whatever happens to be cached on each node. It is fragile (scheduling onto a fresh node fails with ErrImageNeverPull), it depends on out-of-band node provisioning, and it still does not verify which content is present.
Option D is the worst case of the mutable-tag problem. latest is only a conventional default tag with no special meaning to Kubernetes, and it moves constantly.
Reference: Images