Skip to content


All images (but a few cloud provider images) in the eurodat cluster are pulled via digests. The image format is:


where the tag is optional and will be ignored if a digest is given.

It is not possible to use an external or self-built image without a digest except for the images used by the cloud provider. There is a gitlab job verify-digest-usage-in-cluster which enforces this by checking all the images pulled after deployment by the cluster. It only runs once in the pipeline and does not check the images afterwards again.

How to pull an image

To allow an external image to be pulled, it has to be included in the external_images file with a digest or it has to be directly hardcoded with a digest.

To use a self-built image, you have to include the repository name of the image in the eurodat-images file. Since the digest is probably not known prior to the image build, you can't directly provide a digest for this image.

A build job must publish a file with arbitrary name in image_references/* that contains the image ID with a digest. You can use the .build:save-image-reference job for that purpose by including

- !reference [ ".build:save-image-reference", "script" ]

in the respective gitlab build job.

How does the pipeline determine the digest

The create-images-lock-file job takes the external images and the digests from the self-built images in the build stage before and creates an images.lock file containing a list of images IDs with digests.

During deployment, the image IDs of the respective app-of-apps ArgoCD application are checked. The override-dev-image-refs job injects the image digests from the images.lock file for all image IDs without a digest into a modified app-of-apps which will then be used for the deployment in the app-of-apps job.

Note that the override-dev-image-refs job matches the image IDs with tags. If no tag is provided, the first digest matching the respective image in the images.lock file will be taken. Images with digests will not be changed.