Custom Registries and SHA256 in GKE Autopilot

This section explains how to work with custom registries, SHA256 digests, and the Google allow list when deploying Sysdig on GKE Autopilot. It also provides a list of approved versions and SHA256 digests.

Why This Matters

GKE Autopilot allows workloads only from approved images, verified by their SHA256 digest.

When using a custom registry, you must mirror the public image (sysdig/agent-slim) without altering the digest so it matches Google’s allow list.

Mirror public image to custom registry

To mirror the public sysdig/agent-slim to your custom registry without altering the digest, you can use skopeo with the following command:

skopeo copy --multi-arch all --preserve-digests docker://quay.io/sysdig/agent-slim:14.1.1 docker://company-registry/sysdig/agent-slim:14.1.1

Set custom registry on Shield Chart

You can use the following table or run the command below to retrieve the proper SHA256 Digest

docker pull quay.io/sysdig/agent-slim:14.1.1
docker inspect quay.io/sysdig/agent-slim:14.1.1 --format='{{index .RepoDigests 0}}'

Then update the host.image section in your values.yaml:

host:
  image:
    registry: your_company_registry
    repository: sysdig
    kmodule_name: agent-kmodule
    shield_name: agent-slim
    tag: sha256:1111112222233333

List of Approved Versions and SHA256 Digests

This table is updated when Google adds new SHA256 digests to the allow list. There may be a delay of ~10 business days after a new Sysdig release before its SHA is approved.