Resolving Tags

Tags are used by images to create named human readable references to manifest digests. Commonly tags are computed from git tags or commit sha sums. This results in a predictable tag that also changes as new versions of an image is pushed to a registry. While tags make image references simple it has a big downside. We put a lot of trust in the registry that the digest the tag is resolved to is the truth. In a perfect world we would always use the image digest to reference the top level image manifest, but that is rarely reality.

Things become increasingly complicated when tags are reused for different versions of the same image. This is especially common with the practice of reusing the latest tag to indicate the latest version of an image. When tags are reused it is important to ensure that we always resolve the newest digest for the tag, and make it clear what that digest is.

Optik implements a tag digester that resolves iamages to their newest digest for every new pod. This ensures that additional functions like policy enforcement can work properly without additional lookups. Compared to alternative solutions Optik integrates with Spegel to ensure that tag resolution continues to work during upstream registry outages. Normally Optik will resolve the tag with the upstream registry, but once the registry becomes available Optik will fallback to applying the latest resolved digest to all new pods. The end result will remain the same no matter if the upstream registry is available or not.

Tag resolution is enabled by default and can be configured in the Optik Helm chart.

optik:
  resolveTags:
    enabled: true

When a new Ubuntu pod is created using the latest tag.

apiVersion: v1
kind: Pod
metadata:
  name: ubuntu
  namespace: default
spec:
  containers:
    - name: ubuntu
      image: ubuntu:latest

The resulting image reference will be fully resolved including the latest resolved digest.

apiVersion: v1
kind: Pod
metadata:
  name: ubuntu
  namespace: default
spec:
  containers:
    - name: ubuntu
      image: docker.io/library/ubuntu:latest@sha256:2260313b31c8c011cd2eebe728008efac1b3982be73eb71348ea2648d2c0e09b