An image reference can carry a tag and a digest at

once, as in busybox:1.37.0@sha256:73aaf090… . Kubernetes runs the image

the digest names. The tag is removed before the pull and never compared

with the digest. If the two disagree, the pod runs the digest's image while

the spec shows the tag's version.

The recipes in kadet-hub/recipes could produce exactly that

mismatch. They kept the tag in one file and the digest in another, until

kadet-hub/recipes#50 put

both into one literal line.

Everything below ran on 2026-11-02 with kind v0.33.0 and its default node

image kindest/node:v1.37.0@sha256:a1ed56cf… (Kubernetes v1.37.0,

containerd v2.3.4), kubectl v1.37.2 and oras 1.3.6.

A tag that disagrees with its digest

The two busybox tags resolved to these digests:

$ oras manifest fetch --descriptor docker.io/library/busybox:1.36.1 {"mediaType":"application/vnd.oci.image.index.v1+json","digest":"sha256:73aaf090f3d85aa34ee199857f03fa3a95c8ede2ffd4cc2cdb5b94e566b11662","size":9535} $ oras manifest fetch…