Image identity and software supply chain

The mechanism

An image tag is a name that may be moved; a digest identifies particular content. A reviewed digest improves reproducibility, but it does not establish that the content is safe or that the application behaves correctly. Provenance, dependency review and runtime controls answer different questions.

Image pulling also has prerequisites: registry reachability, authentication, platform architecture and configured policy. A Pod that cannot pull an image has not yet tested the application process. Separate supply-chain verification from runtime diagnosis.

For ParcelOps, record the source revision, build process, artifact digest, scan scope and approval. Do not claim a clean scan proves absence of vulnerabilities. A scanner’s database, configuration and date affect what it can detect.

Worked example

This is a release evidence template, not a real build attestation. Null values remain null until observed. The handbook supplies no invented image digest or vulnerability result.

{"application":"parcelops","source_revision":null,
 "builder_identity":null,"image_digest":null,"platform":null,
 "scan":{"tool":null,"database_date":null,"result":"not_run"},
 "provenance_verification":"not_run","approval":"pending"}

Practice: predict, inspect, explain

Offline exercise. Explain how a mutable tag could point to different content between review and rollout. Then identify which evidence a digest does provide and which it does not. Add a dependency vulnerability discovered after deployment and describe the update-and-retest workflow.

Expected observation: artifact identity makes investigation reproducible but does not eliminate patching or behavioral testing. Keep image pull credentials out of manifests committed to the site. Optional admission verification requires a real configured policy and compatible implementation, which are not installed by this book.

Troubleshooting and trade-offs

If a rollout uses unexpected code, compare the observed image identity with the reviewed release record. If pull fails, inspect reference, registry access and platform compatibility without exposing credentials. If a scan is old, update the evidence rather than presenting it as current. Do not substitute an unreviewed public image just to make a lab start.

Interview practice

Completion check

Create a release record with honest unknowns and explain the difference between identity, provenance and safety.

Sources and version notes

Baseline checked 6 October 2026: the official release page lists Kubernetes 1.37.1. Verify your cluster and distribution prerequisites. All manifests are offline teaching examples; no cluster mutations or cloud resources are executed by this handbook.

• Official documentation: Images
• Official documentation: Overview
• Official documentation: Pod security standards