diff --git a/contrib/offline/generate_list.sh b/contrib/offline/generate_list.sh
index 6472044b2..cf05b96a8 100755
--- a/contrib/offline/generate_list.sh
+++ b/contrib/offline/generate_list.sh
@@ -15,8 +15,8 @@ grep 'download_url:' ${REPO_ROOT_DIR}/${DOWNLOAD_YML} \
 
 # generate all images list template
 sed -n '/^downloads:/,/download_defaults:/p' ${REPO_ROOT_DIR}/${DOWNLOAD_YML} \
-    | sed -n "s/repo: //p;s/tag: //p" | tr -d ' ' \
-    | sed 'N;s#\n# #g' | tr ' ' ':' | sed 's/\"//g' > ${TEMP_DIR}/images.list.template
+    | sed -n "s/image_name: //p" | tr -d ' ' \
+    | tr ' ' ':' | sed 's/\"//g' > ${TEMP_DIR}/images.list.template
 
 # add kube-* images to images list template
 # Those container images are downloaded by kubeadm, then roles/kubespray_defaults/defaults/main/download.yml
diff --git a/docs/advanced/downloads.md b/docs/advanced/downloads.md
index 9961eab5a..b1a9fa7fa 100644
--- a/docs/advanced/downloads.md
+++ b/docs/advanced/downloads.md
@@ -4,7 +4,7 @@ Kubespray supports several download/upload modes. The default is:
 
 * Each node downloads binaries and container images on its own, which is ``download_run_once: False``.
 * For K8s apps, pull policy is ``k8s_image_pull_policy: IfNotPresent``.
-* For system managed containers, like kubelet or etcd, pull policy is ``download_always_pull: False``, which is pull if only the wanted repo and tag/sha256 digest differs from that the host has.
+* For system managed containers, like kubelet or etcd, pull policy is ``download_always_pull: False``, which is pull if only the wanted repo and tag differs from that the host has.
 
 There is also a "pull once, push many" mode as well:
 
@@ -21,17 +21,11 @@ On caching:
 
 Container images and binary files are described by the vars like ``foo_version``,
 ``foo_download_url``, ``foo_checksum`` for binaries and ``foo_image_repo``,
-``foo_image_tag`` or optional  ``foo_digest_checksum`` for containers.
+``foo_image_tag`` for containers.
 
 Container images may be defined by its repo and tag, for example:
-`andyshinn/dnsmasq:2.72`. Or by repo and tag and sha256 digest:
-`andyshinn/dnsmasq@sha256:7c883354f6ea9876d176fe1d30132515478b2859d6fc0cbf9223ffdc09168193`.
-
-Note, the SHA256 digest and the image tag must be both specified and correspond
-to each other. The given example above is represented by the following vars:
 
 ```yaml
-dnsmasq_digest_checksum: 7c883354f6ea9876d176fe1d30132515478b2859d6fc0cbf9223ffdc09168193
 dnsmasq_image_repo: andyshinn/dnsmasq
 dnsmasq_image_tag: '2.72'
 ```
diff --git a/roles/kubespray_defaults/defaults/main/download.yml b/roles/kubespray_defaults/defaults/main/download.yml
index 442436588..c13f57024 100644
--- a/roles/kubespray_defaults/defaults/main/download.yml
+++ b/roles/kubespray_defaults/defaults/main/download.yml
@@ -40,7 +40,7 @@ download_container: true
 # in the download_run_once mode.
 download_localhost: false
 
-# Always pull images if set to True. Otherwise check by the repo's tag/digest.
+# Always pull images if set to True. Otherwise check by the repo's tag.
 download_always_pull: false
 
 # Some problems may occur when downloading files over https proxy due to ansible bug