Kubernetes Best Practices

Chapter 1 · Practice 3 of 5

Reference images by an exact version or digest, never latest

From Workloads and manifests

Why it matters

With :latest or no tag, you cannot tell which build is running, a rollback may pull the same broken image again, and two nodes can run different code under the same manifest. The Kubernetes security checklist says to reference images by digest rather than by tag, and especially not latest.

Pick one of two levels of precision:

  • A specific version tag such as checkout:4.2.1. Readable, but a tag can be moved by whoever controls the registry.
  • A digest such as checkout@sha256:.... A digest always refers to the same image, and the checklist accepts signature checks at admission as the alternative.

The default imagePullPolicy follows the tag: with latest or no tag it becomes Always, otherwise IfNotPresent. Set it explicitly when you rely on one behaviour.

To check what is really running, compare kubectl get pods -o jsonpath='{..imageID}' with the digest your CI built.

Do

  • Tag images with a release version or the commit SHA
  • Use digests in production, or verify signatures at admission
  • Turn on tag immutability in your registry if it supports it

Avoid

  • :latest or untagged images in any shared environment