apiVersion: "helm-expt.confighub.com/v1alpha1"
kind: "ImageDigestResolutionReceipt"
metadata:
  name: "secrets-store-csi-driver-secrets-store-csi-driver-default-image-digest-resolution"
spec:
  chart: "secrets-store-csi-driver/secrets-store-csi-driver"
  version: "1.6.0"
  variant: "default"
  resolvedAt: "2026-06-09T19:13:55.439Z"
  renderedObjectSet:
    path: "recipes/secrets-store-csi-driver/secrets-store-csi-driver/1.6.0/revisions/default/r001/rendered/release-objects.yaml"
    sha256: "2490f14dd08f7e309f8f78cd1c2f1b05eb5b8995343b33ad6b3b243401a39ead"
  sourceImageReview:
    path: "data/attack-plan-workdown/image-digest-review.csv"
    rows: 3
    uniqueImages: 3
  resolver:
    name: "docker-buildx-imagetools"
    commandTemplate: "docker buildx imagetools inspect <image>"
  images:
    -
      image: "registry.k8s.io/csi-secrets-store/driver:v1.6.0"
      digest: "sha256:110344819630bfd41e0c6d3f215d325ad1a4d5d5b1d298f8af7d0edf4df64a4e"
      digestReference: "registry.k8s.io/csi-secrets-store/driver:v1.6.0@sha256:110344819630bfd41e0c6d3f215d325ad1a4d5d5b1d298f8af7d0edf4df64a4e"
      mediaType: "application/vnd.docker.distribution.manifest.list.v2+json"
      resolverOutput:
        name: "registry.k8s.io/csi-secrets-store/driver:v1.6.0"
      occurrences:
        -
          object: "apps/v1/DaemonSet/kube-system/secrets-store-csi-driver"
          fieldPath: "spec.template.spec.containers.1.image"
    -
      image: "registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.16.0"
      digest: "sha256:ab482308a4921e28a6df09a16ab99a457e9af9641ff44fb1be1a690d07ce8b70"
      digestReference: "registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.16.0@sha256:ab482308a4921e28a6df09a16ab99a457e9af9641ff44fb1be1a690d07ce8b70"
      mediaType: "application/vnd.docker.distribution.manifest.list.v2+json"
      resolverOutput:
        name: "registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.16.0"
      occurrences:
        -
          object: "apps/v1/DaemonSet/kube-system/secrets-store-csi-driver"
          fieldPath: "spec.template.spec.containers.0.image"
    -
      image: "registry.k8s.io/sig-storage/livenessprobe:v2.18.0"
      digest: "sha256:c4cc074199c045dd73ab85f28897e2a32f4d6f38ffdba4f3b13b8007ccbd3570"
      digestReference: "registry.k8s.io/sig-storage/livenessprobe:v2.18.0@sha256:c4cc074199c045dd73ab85f28897e2a32f4d6f38ffdba4f3b13b8007ccbd3570"
      mediaType: "application/vnd.docker.distribution.manifest.list.v2+json"
      resolverOutput:
        name: "registry.k8s.io/sig-storage/livenessprobe:v2.18.0"
      occurrences:
        -
          object: "apps/v1/DaemonSet/kube-system/secrets-store-csi-driver"
          fieldPath: "spec.template.spec.containers.2.image"
  productionSupportUse:
    status: "digest-resolution-recorded"
    claim: "The mutable rendered image references for this Secrets Store CSI Driver base were resolved to registry manifest digests at the recorded time."
    limits: "This receipt does not mean the rendered manifests are digest-pinned and does not by itself make the chart production-supported."
    nextRequired: "Choose a digest-pinned base, image override policy, or explicit mutable-image exception before broader production support."