Kubernetes image not pinned (ARCH10025)

Key config.k8s.unpinned-image · Severity warning · Category quality

Without a version a rescheduled pod may run something else than the one before it, and two replicas of one Deployment may run different code.

Incorrect

apiVersion: apps/v1
kind: Deployment
metadata:
  name: web
spec:
  selector:
    matchLabels:
      app: web
  template:
    metadata:
      labels:
        app: web
    spec:
      containers:
        - name: web
          image: nginx

Correct

apiVersion: apps/v1
kind: Deployment
metadata:
  name: web
spec:
  selector:
    matchLabels:
      app: web
  template:
    metadata:
      labels:
        app: web
    spec:
      containers:
        - name: web
          image: nginx:1.27.2

Fix

Pin a version tag or a digest.

Not flagged

• A digest and an image given by a variable.