Pinning Images by Digest
CI scans registry.example.com/api:1.8 with Trivy and it passes. Later someone pushes a different image under the same tag. How do you make sure Pods run exactly the image that was scanned?
registry.example.com/api:1.8
Choose one answer
Reference the image by digest, e.g. registry.example.com/api@sha256:<digest>.
registry.example.com/api@sha256:<digest>
Use the latest tag so the scan and the deploy always agree.
latest
Set imagePullPolicy: Never on every node.
imagePullPolicy: Never
Set imagePullPolicy: Always so the newest image is always pulled.
imagePullPolicy: Always