Skip to content
CKSSupply Chain SecuritySingle nodeEasy

Pin a workload image by digest

Scenario cks-sup-003 · about 6 minutes · 7 points · 4 grader checks

Replace a mutable image tag with the digest of the image the running pods already use.

  • image-digest
  • supply-chain
  • immutability
  • deployment
  • containerd

What you will practise

  • Read the resolved image digest from pod status
  • Reference an image by digest instead of by tag
  • Roll out an image change without recreating the Deployment

Start this lab

With the CLI installed and signed in, this command provisions a single node cluster on your Mac, applies the scenario setup and prints the task below.

goldenkube start cks-sup-003

Task

The task text exactly as the CLI shows it. Solve it on the cluster, then run goldenkube submit.

The Deployment "web" in namespace "pinned" (container "nginx") uses the mutable tag nginx:1.27. A tag can be re-pointed to different content at any time; a digest cannot. Pin the Deployment to the exact image content its pods run right now: change the container image to a reference by digest (<repository>@sha256:<digest>, no tag), using the digest of the image the current pods are running. Edit the Deployment, do not recreate it. Both replicas must be Ready with the pinned image.

Requirements and details

Certification
CKS · Certified Kubernetes Security Specialist
Domain
Supply Chain Security
Difficulty
Easy
Cluster topology
Single node
Cluster features
None beyond the base cluster
Recommended time
6 minutes
Points
7
Grader checks
4
Kubernetes version
1.35
Minimum CLI version
0.1.0
Scenario version
1
Published

Grading runs locally: 4 state checks read your cluster when you submit; the scenario passes when every check passes. Hints, the reference solution and the check definitions are available only inside the CLI, not on this page.

Install the CLICreate a free account

More Supply Chain Security labs

CKSSupply Chain SecurityHard

Permitted registries with ValidatingAdmissionPolicy

Allow only images from one registry in labelled namespaces using a CEL ValidatingAdmissionPolicy and its binding.

Single node · ~9 min · 9 points

  • validatingadmissionpolicy
  • cel
  • admission
  • image-registry
  • supply-chain

goldenkube start cks-sup-001

CKSSupply Chain SecurityEasy

Static analysis of workload manifests

Review six Deployment manifests against four security rules, report the violators and deploy only the compliant ones.

Single node · ~8 min · 7 points

  • static-analysis
  • manifests
  • supply-chain
  • securitycontext
  • review

goldenkube start cks-sup-002

CKSSupply Chain SecurityEasy

Verify platform binaries before deploying

Check downloaded Kubernetes binaries against published SHA-512 checksums and discard the tampered ones.

Single node · ~6 min · 6 points

  • checksums
  • sha512
  • binaries
  • supply-chain
  • upgrade

goldenkube start cks-sup-004

Independent community project, not affiliated with or endorsed by CNCF or The Linux Foundation. Lab results are practice feedback, not an exam score.