Parent: #739

Summary

Several embedded Kubernetes manifests under recipes/components/*/manifests/ reference images without an explicit tag or with partial registry/repo paths. These should be pinned for reproducibility and to avoid surprises from upstream :latest rolls.

Findings

recipes/components/gke-nccl-tcpxo/manifests/nccl-tcpxo-installer.yaml

• ubuntu — no tag; resolves to :latest from Docker Hub. Pin to a specific Ubuntu LTS tag (e.g., ubuntu:24.04).

recipes/components/network-operator/manifests/nic-cluster-policy-aks.yaml

• doca-driver — no registry, no tag
• k8s-rdma-shared-dev-plugin — no registry, no tag
• doca_telemetry — no registry, no tag

These appear to be partial references that the NVIDIA Network Operator chart fills in at runtime. Verify this is intentional and either:

• Document the resolution mechanism, or
• Pin to fully-qualified registry/repo:tag values.

recipes/components/nodewright-customizations/manifests/tuning.yaml and tuning-gke.yaml

• ghcr.io/nvidia/skyhook-packages/shellscript — no tag
• ghcr.io/nvidia/skyhook-packages/nvidia-tuning-gke — no tag
• ghcr.io/nvidia/nodewright-packages/nvidia-setup — no tag (×2)
• ghcr.io/nvidia/nodewright-packages/nvidia-tuned — no tag

Pin each to a specific tag/digest.

Success criteria

• Every image: reference in recipes/components/*/manifests/ resolves to a fully-qualified registry/repo:tag (or :digest).
• For the network-operator AKS partial refs, either pinned or documented as chart-substituted.
• A unit test or lint rule prevents future untagged image references in manifests.

Notes

• Use the BOM tool (separate issue) to validate completeness once it lands.
• gke-nccl-tcpxo and nodewright-customizations are manifest-only components, so this is the only place these refs exist.