Repository navigation
Kubescape flags digest-pinned CronJob images as floating #5982
Description
🤖 Generated by the Agentic Engineer
Description
Kubescape flags CronJobs whose image references carry both the latest tag and an immutable digest. Kubernetes pulls the exact digest. The extra tag creates noise in the posture report and makes genuinely floating references harder to spot.
Steps to Reproduce
- Scan a CronJob with an explicit latest tag, an image digest, and its existing pull policy.
- Remove the tag while retaining the digest and repeat the same control scan.
Expected Behavior
The CronJobs use unambiguous digest references and continue to receive automated digest updates.
Actual Behavior
The control flags the redundant tag even though the image selection is already immutable.
Acceptance Criteria
- Canonicalize the affected CronJob references and preserve their digests, pull policies, and schedules.
- Verify scanner behavior, Renovate digest updates, and the rendered workloads.
- Deliver through protected GitOps and verify a fresh posture result for the deployed workloads.
Activity
devantler commentedon Nov 11, 2026
Post-merge verification is complete, so this issue can close.
latesttag and kept the digests, pull policies and schedules. All 14 deployed CronJobs that use the curl-jq helper now run it by digest only. None of the cluster's CronJobs uses a:latest@sha256reference any more.All three acceptance criteria are met.