Kubescape flags digest-pinned CronJob images as floating #5982

🤖 Generated by the Agentic Engineer

Description

Kubescape flags CronJobs whose image references carry both the latest tag and an immutable digest. Kubernetes pulls the exact digest. The extra tag creates noise in the posture report and makes genuinely floating references harder to spot.

Steps to Reproduce

1. Scan a CronJob with an explicit latest tag, an image digest, and its existing pull policy.
2. Remove the tag while retaining the digest and repeat the same control scan.

Expected Behavior

The CronJobs use unambiguous digest references and continue to receive automated digest updates.

Actual Behavior

The control flags the redundant tag even though the image selection is already immutable.

Acceptance Criteria

• Canonicalize the affected CronJob references and preserve their digests, pull policies, and schedules.
• Verify scanner behavior, Renovate digest updates, and the rendered workloads.
• Deliver through protected GitOps and verify a fresh posture result for the deployed workloads.