<p>Docker image tags are mutable, in that <code>image:latest</code> and <code>image:1.0</code> can both point to <code>image@sha256:.....</code>, but when version <code>1.1</code> is released, <code>image:latest</code> stored within a registry can be pointed to an image with a different sha digest.  Pulling an image with a particular tag now does not mean that an identical image will be pulled next time.</p>

<p>If a Kubernetes YAMl resource definition refers to an image by tag (not by digest), is there a means of determining what sha digest each image will actually resolve to, before the resource definition is deployed?  Is this functionality supported using <a href="https://github.com/kubernetes-sigs/kustomize" rel="nofollow noreferrer">kustomize</a> or <code>kubectl</code>?</p>

<p>Use case is wanting to determine what has actually been deployed in one environment before deploying to another (I'd like to take a hash of the resolved resource definition and could then use this to understand whether <code>image:1.0</code> to be deployed to PROD refers to the same <code>image:1.0</code> that was deployed to UAT).</p>

<p>Are there any tools that can be used to support this functionality?</p>

<p>For example, given the following YAML, is there a way of replacing all images with their resolved digests?</p>

<pre><code>apiVersion: v1
kind: Pod
metadata:
  name: example
spec:
  containers:
    - name: image1
      image: image1:1.1
      command:
        - /bin/sh -c some command
    - name: image2
      image: image2:2.2
      command:
        - /bin/sh -c some other command
</code></pre>

<p>To get something like this:</p>

<pre><code>apiVersion: v1
kind: Pod
metadata:
  name: example
spec:
  containers:
    - name: image1
      image: image1@sha:....
      command:
        - /bin/sh -c some command
    - name: image2
      image: image2@sha:....
      command:
        - /bin/sh -c some other command
</code></pre>

<p>I'd like to be able to do something like pipe yaml (that might come from <code>cat</code>, <code>kustomize</code> or <code>kubectl ... --dry-run</code>) through a tool and then pass to <code>kubectl apply -f</code>:</p>

<pre><code>cat mydeployment.yaml | some-tool | kubectl apply -f -
</code></pre>

<p>EDIT:</p>

<p>The background to this is the need to be able to prove to auditors/regulators that what is about to be deployed to one env (PROD) is <em>exactly</em> what has been successfully deployed to another env (UAT).  I'd like to use normal tags in the deployment template and at the time of deploying to UAT, take a snapshot of the template with the tags replaced with the digests of the resolved images.  That snapshot will be what is deployed (via <code>kubectl</code> or similar).  When deploying to PROD, that same snapshot will be used.</p>

<p>This tool is supporting exactly what you need...</p>

<p><strong>kbld</strong>: <a href="https://get-kbld.io/" rel="noreferrer">https://get-kbld.io/</a></p>

<blockquote>
  <p>Resolves name-tag pair reference (nginx:1.17) into digest reference
  (index.docker.io/library/nginx@sha256:2539d4344...)</p>
</blockquote>

<p>Looks integrates quite well with templating tools like Kustomize or even Helm</p>
