From 164f7fbf40defd400ba3d99144107144e59835a8 Mon Sep 17 00:00:00 2001
From: Max Gautier <mg@max.gautier.name>
Date: Fri, 9 Jan 2026 11:09:17 +0100
Subject: [PATCH 1/4] download: merge repo and tag key in downloads container
 dict

Those key are only used as part of the downloads role which will be
removed, and it's more convenient to use a single key directly in Jinja
pipelines.
---
 .../defaults/main/download.yml                | 135 ++++++------------
 1 file changed, 45 insertions(+), 90 deletions(-)

diff --git a/roles/kubespray_defaults/defaults/main/download.yml b/roles/kubespray_defaults/defaults/main/download.yml
index 91c12c5fb..7aecbb622 100644
--- a/roles/kubespray_defaults/defaults/main/download.yml
+++ b/roles/kubespray_defaults/defaults/main/download.yml
@@ -377,8 +377,7 @@ downloads:
     file: "{{ etcd_deployment_type == 'host' }}"
     enabled: true
     dest: "{{ local_release_dir }}/etcd-{{ etcd_version }}-linux-{{ image_arch }}.tar.gz"
-    repo: "{{ etcd_image_repo }}"
-    tag: "{{ etcd_image_tag }}"
+    image_name: "{{ etcd_image_repo }}:{{ etcd_image_tag }}"
     checksum: >-
       {{ etcd_binary_checksum if (etcd_deployment_type == 'host')
       else etcd_digest_checksum | d(None) }}
@@ -586,8 +585,7 @@ downloads:
   cilium:
     enabled: "{{ kube_network_plugin == 'cilium' or cilium_deploy_additionally }}"
     container: true
-    repo: "{{ cilium_image_repo }}"
-    tag: "{{ cilium_image_tag }}"
+    image_name: "{{ cilium_image_repo }}:{{ cilium_image_tag }}"
     checksum: "{{ cilium_digest_checksum | default(None) }}"
     groups:
       - k8s_cluster
@@ -595,8 +593,7 @@ downloads:
   cilium_operator:
     enabled: "{{ kube_network_plugin == 'cilium' or cilium_deploy_additionally }}"
     container: true
-    repo: "{{ cilium_operator_image_repo }}-generic"
-    tag: "{{ cilium_operator_image_tag }}"
+    image_name: "{{ cilium_operator_image_repo }}-generic:{{ cilium_operator_image_tag }}"
     checksum: "{{ cilium_operator_digest_checksum | default(None) }}"
     groups:
       - k8s_cluster
@@ -604,8 +601,7 @@ downloads:
   cilium_hubble_relay:
     enabled: "{{ cilium_enable_hubble }}"
     container: true
-    repo: "{{ cilium_hubble_relay_image_repo }}"
-    tag: "{{ cilium_hubble_relay_image_tag }}"
+    image_name: "{{ cilium_hubble_relay_image_repo }}:{{ cilium_hubble_relay_image_tag }}"
     checksum: "{{ cilium_hubble_relay_digest_checksum | default(None) }}"
     groups:
       - k8s_cluster
@@ -613,8 +609,7 @@ downloads:
   cilium_certgen:
     enabled: "{{ kube_network_plugin == 'cilium' }}"
     container: true
-    repo: "{{ cilium_certgen_image_repo }}"
-    tag: "{{ cilium_certgen_image_tag }}"
+    image_name: "{{ cilium_certgen_image_repo }}:{{ cilium_certgen_image_tag }}"
     checksum: "{{ cilium_certgen_digest_checksum | default(None) }}"
     groups:
       - k8s_cluster
@@ -622,8 +617,7 @@ downloads:
   cilium_hubble_ui:
     enabled: "{{ cilium_enable_hubble }}"
     container: true
-    repo: "{{ cilium_hubble_ui_image_repo }}"
-    tag: "{{ cilium_hubble_ui_image_tag }}"
+    image_name: "{{ cilium_hubble_ui_image_repo }}:{{ cilium_hubble_ui_image_tag }}"
     checksum: "{{ cilium_hubble_ui_digest_checksum | default(None) }}"
     groups:
       - k8s_cluster
@@ -631,8 +625,7 @@ downloads:
   cilium_hubble_ui_backend:
     enabled: "{{ cilium_enable_hubble }}"
     container: true
-    repo: "{{ cilium_hubble_ui_backend_image_repo }}"
-    tag: "{{ cilium_hubble_ui_backend_image_tag }}"
+    image_name: "{{ cilium_hubble_ui_backend_image_repo }}:{{ cilium_hubble_ui_backend_image_tag }}"
     checksum: "{{ cilium_hubble_ui_backend_digest_checksum | default(None) }}"
     groups:
       - k8s_cluster
@@ -640,8 +633,7 @@ downloads:
   cilium_envoy:
     enabled: "{{ kube_network_plugin == 'cilium' }}"
     container: true
-    repo: "{{ cilium_envoy_image_repo }}"
-    tag: "{{ cilium_envoy_image_tag }}"
+    image_name: "{{ cilium_envoy_image_repo }}:{{ cilium_envoy_image_tag }}"
     checksum: "{{ cilium_envoy_digest_checksum | default(None) }}"
     groups:
       - k8s_cluster
@@ -661,8 +653,7 @@ downloads:
   multus:
     enabled: "{{ kube_network_plugin_multus }}"
     container: true
-    repo: "{{ multus_image_repo }}"
-    tag: "{{ multus_image_tag }}"
+    image_name: "{{ multus_image_repo }}:{{ multus_image_tag }}"
     checksum: "{{ multus_digest_checksum | default(None) }}"
     groups:
       - k8s_cluster
@@ -670,8 +661,7 @@ downloads:
   flannel:
     enabled: "{{ kube_network_plugin == 'flannel' }}"
     container: true
-    repo: "{{ flannel_image_repo }}"
-    tag: "{{ flannel_image_tag }}"
+    image_name: "{{ flannel_image_repo }}:{{ flannel_image_tag }}"
     checksum: "{{ flannel_digest_checksum | default(None) }}"
     groups:
       - k8s_cluster
@@ -679,8 +669,7 @@ downloads:
   flannel_init:
     enabled: "{{ kube_network_plugin == 'flannel' }}"
     container: true
-    repo: "{{ flannel_init_image_repo }}"
-    tag: "{{ flannel_init_image_tag }}"
+    image_name: "{{ flannel_init_image_repo }}:{{ flannel_init_image_tag }}"
     checksum: "{{ flannel_init_digest_checksum | default(None) }}"
     groups:
       - k8s_cluster
@@ -700,8 +689,7 @@ downloads:
   calico_node:
     enabled: "{{ kube_network_plugin == 'calico' }}"
     container: true
-    repo: "{{ calico_node_image_repo }}"
-    tag: "{{ calico_node_image_tag }}"
+    image_name: "{{ calico_node_image_repo }}:{{ calico_node_image_tag }}"
     checksum: "{{ calico_node_digest_checksum | default(None) }}"
     groups:
       - k8s_cluster
@@ -709,8 +697,7 @@ downloads:
   calico_cni:
     enabled: "{{ kube_network_plugin == 'calico' }}"
     container: true
-    repo: "{{ calico_cni_image_repo }}"
-    tag: "{{ calico_cni_image_tag }}"
+    image_name: "{{ calico_cni_image_repo }}:{{ calico_cni_image_tag }}"
     checksum: "{{ calico_cni_digest_checksum | default(None) }}"
     groups:
       - k8s_cluster
@@ -718,8 +705,7 @@ downloads:
   calico_policy:
     enabled: "{{ enable_network_policy and kube_network_plugin in ['calico'] }}"
     container: true
-    repo: "{{ calico_policy_image_repo }}"
-    tag: "{{ calico_policy_image_tag }}"
+    image_name: "{{ calico_policy_image_repo }}:{{ calico_policy_image_tag }}"
     checksum: "{{ calico_policy_digest_checksum | default(None) }}"
     groups:
       - k8s_cluster
@@ -727,8 +713,7 @@ downloads:
   calico_typha:
     enabled: "{{ typha_enabled }}"
     container: true
-    repo: "{{ calico_typha_image_repo }}"
-    tag: "{{ calico_typha_image_tag }}"
+    image_name: "{{ calico_typha_image_repo }}:{{ calico_typha_image_tag }}"
     checksum: "{{ calico_typha_digest_checksum | default(None) }}"
     groups:
       - k8s_cluster
@@ -736,8 +721,7 @@ downloads:
   calico_apiserver:
     enabled: "{{ calico_apiserver_enabled }}"
     container: true
-    repo: "{{ calico_apiserver_image_repo }}"
-    tag: "{{ calico_apiserver_image_tag }}"
+    image_name: "{{ calico_apiserver_image_repo }}:{{ calico_apiserver_image_tag }}"
     checksum: "{{ calico_apiserver_digest_checksum | default(None) }}"
     groups:
       - k8s_cluster
@@ -756,8 +740,7 @@ downloads:
   kube_ovn:
     enabled: "{{ kube_network_plugin == 'kube-ovn' }}"
     container: true
-    repo: "{{ kube_ovn_container_image_repo }}"
-    tag: "{{ kube_ovn_container_image_tag }}"
+    image_name: "{{ kube_ovn_container_image_repo }}:{{ kube_ovn_container_image_tag }}"
     checksum: "{{ kube_ovn_digest_checksum | default(None) }}"
     groups:
       - k8s_cluster
@@ -765,8 +748,7 @@ downloads:
   kube_router:
     enabled: "{{ kube_network_plugin == 'kube-router' }}"
     container: true
-    repo: "{{ kube_router_image_repo }}"
-    tag: "{{ kube_router_image_tag }}"
+    image_name: "{{ kube_router_image_repo }}:{{ kube_router_image_tag }}"
     checksum: "{{ kube_router_digest_checksum | default(None) }}"
     groups:
       - k8s_cluster
@@ -774,8 +756,7 @@ downloads:
   pod_infra:
     enabled: true
     container: true
-    repo: "{{ pod_infra_image_repo }}"
-    tag: "{{ pod_infra_image_tag }}"
+    image_name: "{{ pod_infra_image_repo }}:{{ pod_infra_image_tag }}"
     checksum: "{{ pod_infra_digest_checksum | default(None) }}"
     groups:
       - k8s_cluster
@@ -783,8 +764,7 @@ downloads:
   kube-vip:
     enabled: "{{ kube_vip_enabled }}"
     container: true
-    repo: "{{ kube_vip_image_repo }}"
-    tag: "{{ kube_vip_image_tag }}"
+    image_name: "{{ kube_vip_image_repo }}:{{ kube_vip_image_tag }}"
     checksum: "{{ kube_vip_digest_checksum | default(None) }}"
     groups:
       - kube_control_plane
@@ -792,8 +772,7 @@ downloads:
   nginx:
     enabled: "{{ loadbalancer_apiserver_localhost and loadbalancer_apiserver_type == 'nginx' }}"
     container: true
-    repo: "{{ nginx_image_repo }}"
-    tag: "{{ nginx_image_tag }}"
+    image_name: "{{ nginx_image_repo }}:{{ nginx_image_tag }}"
     checksum: "{{ nginx_digest_checksum | default(None) }}"
     groups:
       - kube_node
@@ -801,8 +780,7 @@ downloads:
   haproxy:
     enabled: "{{ loadbalancer_apiserver_localhost and loadbalancer_apiserver_type == 'haproxy' }}"
     container: true
-    repo: "{{ haproxy_image_repo }}"
-    tag: "{{ haproxy_image_tag }}"
+    image_name: "{{ haproxy_image_repo }}:{{ haproxy_image_tag }}"
     checksum: "{{ haproxy_digest_checksum | default(None) }}"
     groups:
       - kube_node
@@ -810,8 +788,7 @@ downloads:
   coredns:
     enabled: "{{ dns_mode in ['coredns', 'coredns_dual'] }}"
     container: true
-    repo: "{{ coredns_image_repo }}"
-    tag: "{{ coredns_image_tag }}"
+    image_name: "{{ coredns_image_repo }}:{{ coredns_image_tag }}"
     checksum: "{{ coredns_digest_checksum | default(None) }}"
     groups:
       - k8s_cluster
@@ -819,8 +796,7 @@ downloads:
   nodelocaldns:
     enabled: "{{ enable_nodelocaldns }}"
     container: true
-    repo: "{{ nodelocaldns_image_repo }}"
-    tag: "{{ nodelocaldns_image_tag }}"
+    image_name: "{{ nodelocaldns_image_repo }}:{{ nodelocaldns_image_tag }}"
     checksum: "{{ nodelocaldns_digest_checksum | default(None) }}"
     groups:
       - k8s_cluster
@@ -828,8 +804,7 @@ downloads:
   dnsautoscaler:
     enabled: "{{ dns_mode in ['coredns', 'coredns_dual'] and enable_dns_autoscaler }}"
     container: true
-    repo: "{{ dnsautoscaler_image_repo }}"
-    tag: "{{ dnsautoscaler_image_tag }}"
+    image_name: "{{ dnsautoscaler_image_repo }}:{{ dnsautoscaler_image_tag }}"
     checksum: "{{ dnsautoscaler_digest_checksum | default(None) }}"
     groups:
       - kube_control_plane
@@ -849,8 +824,7 @@ downloads:
   registry:
     enabled: "{{ registry_enabled }}"
     container: true
-    repo: "{{ registry_image_repo }}"
-    tag: "{{ registry_image_tag }}"
+    image_name: "{{ registry_image_repo }}:{{ registry_image_tag }}"
     checksum: "{{ registry_digest_checksum | default(None) }}"
     groups:
       - kube_node
@@ -858,8 +832,7 @@ downloads:
   metrics_server:
     enabled: "{{ metrics_server_enabled }}"
     container: true
-    repo: "{{ metrics_server_image_repo }}"
-    tag: "{{ metrics_server_image_tag }}"
+    image_name: "{{ metrics_server_image_repo }}:{{ metrics_server_image_tag }}"
     checksum: "{{ metrics_server_digest_checksum | default(None) }}"
     groups:
       - kube_control_plane
@@ -867,8 +840,7 @@ downloads:
   local_volume_provisioner:
     enabled: "{{ local_volume_provisioner_enabled }}"
     container: true
-    repo: "{{ local_volume_provisioner_image_repo }}"
-    tag: "{{ local_volume_provisioner_image_tag }}"
+    image_name: "{{ local_volume_provisioner_image_repo }}:{{ local_volume_provisioner_image_tag }}"
     checksum: "{{ local_volume_provisioner_digest_checksum | default(None) }}"
     groups:
       - kube_node
@@ -876,8 +848,7 @@ downloads:
   local_path_provisioner:
     enabled: "{{ local_path_provisioner_enabled }}"
     container: true
-    repo: "{{ local_path_provisioner_image_repo }}"
-    tag: "{{ local_path_provisioner_image_tag }}"
+    image_name: "{{ local_path_provisioner_image_repo }}:{{ local_path_provisioner_image_tag }}"
     checksum: "{{ local_path_provisioner_digest_checksum | default(None) }}"
     groups:
       - kube_node
@@ -885,8 +856,7 @@ downloads:
   ingress_alb_controller:
     enabled: "{{ ingress_alb_enabled }}"
     container: true
-    repo: "{{ alb_ingress_image_repo }}"
-    tag: "{{ alb_ingress_image_tag }}"
+    image_name: "{{ alb_ingress_image_repo }}:{{ alb_ingress_image_tag }}"
     checksum: "{{ ingress_alb_controller_digest_checksum | default(None) }}"
     groups:
       - kube_node
@@ -894,8 +864,7 @@ downloads:
   cert_manager_controller:
     enabled: "{{ cert_manager_enabled }}"
     container: true
-    repo: "{{ cert_manager_controller_image_repo }}"
-    tag: "{{ cert_manager_controller_image_tag }}"
+    image_name: "{{ cert_manager_controller_image_repo }}:{{ cert_manager_controller_image_tag }}"
     checksum: "{{ cert_manager_controller_digest_checksum | default(None) }}"
     groups:
       - kube_node
@@ -903,8 +872,7 @@ downloads:
   cert_manager_cainjector:
     enabled: "{{ cert_manager_enabled }}"
     container: true
-    repo: "{{ cert_manager_cainjector_image_repo }}"
-    tag: "{{ cert_manager_cainjector_image_tag }}"
+    image_name: "{{ cert_manager_cainjector_image_repo }}:{{ cert_manager_cainjector_image_tag }}"
     checksum: "{{ cert_manager_cainjector_digest_checksum | default(None) }}"
     groups:
       - kube_node
@@ -912,8 +880,7 @@ downloads:
   cert_manager_webhook:
     enabled: "{{ cert_manager_enabled }}"
     container: true
-    repo: "{{ cert_manager_webhook_image_repo }}"
-    tag: "{{ cert_manager_webhook_image_tag }}"
+    image_name: "{{ cert_manager_webhook_image_repo }}:{{ cert_manager_webhook_image_tag }}"
     checksum: "{{ cert_manager_webhook_digest_checksum | default(None) }}"
     groups:
       - kube_node
@@ -945,8 +912,7 @@ downloads:
   csi_attacher:
     enabled: "{{ cinder_csi_enabled or aws_ebs_csi_enabled }}"
     container: true
-    repo: "{{ csi_attacher_image_repo }}"
-    tag: "{{ csi_attacher_image_tag }}"
+    image_name: "{{ csi_attacher_image_repo }}:{{ csi_attacher_image_tag }}"
     checksum: "{{ csi_attacher_digest_checksum | default(None) }}"
     groups:
       - kube_node
@@ -954,8 +920,7 @@ downloads:
   csi_provisioner:
     enabled: "{{ cinder_csi_enabled or aws_ebs_csi_enabled }}"
     container: true
-    repo: "{{ csi_provisioner_image_repo }}"
-    tag: "{{ csi_provisioner_image_tag }}"
+    image_name: "{{ csi_provisioner_image_repo }}:{{ csi_provisioner_image_tag }}"
     checksum: "{{ csi_provisioner_digest_checksum | default(None) }}"
     groups:
       - kube_node
@@ -963,8 +928,7 @@ downloads:
   csi_snapshotter:
     enabled: "{{ cinder_csi_enabled or aws_ebs_csi_enabled }}"
     container: true
-    repo: "{{ csi_snapshotter_image_repo }}"
-    tag: "{{ csi_snapshotter_image_tag }}"
+    image_name: "{{ csi_snapshotter_image_repo }}:{{ csi_snapshotter_image_tag }}"
     checksum: "{{ csi_snapshotter_digest_checksum | default(None) }}"
     groups:
       - kube_node
@@ -972,8 +936,7 @@ downloads:
   snapshot_controller:
     enabled: "{{ csi_snapshot_controller_enabled }}"
     container: true
-    repo: "{{ snapshot_controller_image_repo }}"
-    tag: "{{ snapshot_controller_image_tag }}"
+    image_name: "{{ snapshot_controller_image_repo }}:{{ snapshot_controller_image_tag }}"
     checksum: "{{ snapshot_controller_digest_checksum | default(None) }}"
     groups:
       - kube_node
@@ -981,8 +944,7 @@ downloads:
   csi_resizer:
     enabled: "{{ cinder_csi_enabled or aws_ebs_csi_enabled }}"
     container: true
-    repo: "{{ csi_resizer_image_repo }}"
-    tag: "{{ csi_resizer_image_tag }}"
+    image_name: "{{ csi_resizer_image_repo }}:{{ csi_resizer_image_tag }}"
     checksum: "{{ csi_resizer_digest_checksum | default(None) }}"
     groups:
       - kube_node
@@ -990,8 +952,7 @@ downloads:
   csi_livenessprobe:
     enabled: "{{ cinder_csi_enabled or aws_ebs_csi_enabled }}"
     container: true
-    repo: "{{ csi_livenessprobe_image_repo }}"
-    tag: "{{ csi_livenessprobe_image_tag }}"
+    image_name: "{{ csi_livenessprobe_image_repo }}:{{ csi_livenessprobe_image_tag }}"
     checksum: "{{ csi_livenessprobe_digest_checksum | default(None) }}"
     groups:
       - kube_node
@@ -999,8 +960,7 @@ downloads:
   csi_node_driver_registrar:
     enabled: "{{ cinder_csi_enabled or aws_ebs_csi_enabled }}"
     container: true
-    repo: "{{ csi_node_driver_registrar_image_repo }}"
-    tag: "{{ csi_node_driver_registrar_image_tag }}"
+    image_name: "{{ csi_node_driver_registrar_image_repo }}:{{ csi_node_driver_registrar_image_tag }}"
     checksum: "{{ csi_node_driver_registrar_digest_checksum | default(None) }}"
     groups:
       - kube_node
@@ -1008,8 +968,7 @@ downloads:
   cinder_csi_plugin:
     enabled: "{{ cinder_csi_enabled }}"
     container: true
-    repo: "{{ cinder_csi_plugin_image_repo }}"
-    tag: "{{ cinder_csi_plugin_image_tag }}"
+    image_name: "{{ cinder_csi_plugin_image_repo }}:{{ cinder_csi_plugin_image_tag }}"
     checksum: "{{ cinder_csi_plugin_digest_checksum | default(None) }}"
     groups:
       - kube_node
@@ -1017,8 +976,7 @@ downloads:
   aws_ebs_csi_plugin:
     enabled: "{{ aws_ebs_csi_enabled }}"
     container: true
-    repo: "{{ aws_ebs_csi_plugin_image_repo }}"
-    tag: "{{ aws_ebs_csi_plugin_image_tag }}"
+    image_name: "{{ aws_ebs_csi_plugin_image_repo }}:{{ aws_ebs_csi_plugin_image_tag }}"
     checksum: "{{ aws_ebs_csi_plugin_digest_checksum | default(None) }}"
     groups:
       - kube_node
@@ -1026,8 +984,7 @@ downloads:
   metallb_speaker:
     enabled: "{{ metallb_speaker_enabled }}"
     container: true
-    repo: "{{ metallb_speaker_image_repo }}"
-    tag: "{{ metallb_image_tag }}"
+    image_name: "{{ metallb_speaker_image_repo }}:{{ metallb_image_tag }}"
     checksum: "{{ metallb_speaker_digest_checksum | default(None) }}"
     groups:
       - kube_control_plane
@@ -1035,8 +992,7 @@ downloads:
   metallb_controller:
     enabled: "{{ metallb_enabled }}"
     container: true
-    repo: "{{ metallb_controller_image_repo }}"
-    tag: "{{ metallb_image_tag }}"
+    image_name: "{{ metallb_controller_image_repo }}:{{ metallb_image_tag }}"
     checksum: "{{ metallb_controller_digest_checksum | default(None) }}"
     groups:
       - kube_control_plane
@@ -1070,8 +1026,7 @@ downloads:
 download_defaults:
   container: false
   file: false
-  repo: None
-  tag: None
+  image_name: None
   enabled: false
   dest: None
   url: None

From e013507027b8bbf79c4ca14ce48b3c083c42c61c Mon Sep 17 00:00:00 2001
From: Max Gautier <mg@max.gautier.name>
Date: Thu, 17 Sep 2026 09:47:59 +0200
Subject: [PATCH 2/4] download/container: adapt to single key repo+tag ->
 image_name

This code will be deleted for the rework of the download role, for now
we minimally adapt it to the new structure of downloads.
---
 roles/download/tasks/check_pull_required.yml |  2 +-
 roles/download/tasks/download_container.yml  |  6 +++---
 roles/download/tasks/prep_kubeadm_images.yml |  3 +--
 roles/download/tasks/set_container_facts.yml | 20 ++++++++------------
 4 files changed, 13 insertions(+), 18 deletions(-)

diff --git a/roles/download/tasks/check_pull_required.yml b/roles/download/tasks/check_pull_required.yml
index d367dd279..5d7cc5cae 100644
--- a/roles/download/tasks/check_pull_required.yml
+++ b/roles/download/tasks/check_pull_required.yml
@@ -10,7 +10,7 @@
 
 - name: Check_pull_required | Set pull_required if the desired image is not yet loaded
   set_fact:
-    pull_required: "{{ (image_reponame | regex_replace('^docker\\.io/(library/)?', '')) not in docker_images.stdout.split(',') }}"
+    pull_required: "{{ (download.image_name | regex_replace('^docker\\.io/(library/)?', '')) not in docker_images.stdout.split(',') }}"
   when: not download_always_pull
 
 - name: Check_pull_required | Check that the local digest sha256 corresponds to the given image tag
diff --git a/roles/download/tasks/download_container.yml b/roles/download/tasks/download_container.yml
index c27043c79..9f9fe4df9 100644
--- a/roles/download/tasks/download_container.yml
+++ b/roles/download/tasks/download_container.yml
@@ -21,7 +21,7 @@
         - not download_always_pull
 
     - debug:  # noqa name[missing]
-        msg: "Pull {{ image_reponame }} required is: {{ pull_required }}"
+        msg: "Pull {{ download.image_name }} required is: {{ pull_required }}"
 
     - name: Download_container | Determine if image is in cache
       stat:
@@ -49,13 +49,13 @@
     - name: Stop if image not in cache on ansible host when download_force_cache=true
       assert:
         that: image_is_cached
-        msg: "Image cache file {{ image_path_cached }} not found for {{ image_reponame }} on localhost"
+        msg: "Image cache file {{ image_path_cached }} not found for {{ download.image_name }} on localhost"
       when:
         - download_force_cache
         - not download_run_once
 
     - name: Download_container | Download image if required
-      command: "{{ image_pull_command_on_localhost if download_localhost else image_pull_command }} {{ image_reponame }}"
+      command: "{{ image_pull_command_on_localhost if download_localhost else image_pull_command }} {{ download.image_name }}"
       delegate_to: "{{ download_delegate if download_run_once else inventory_hostname }}"
       delegate_facts: true
       run_once: "{{ download_run_once }}"
diff --git a/roles/download/tasks/prep_kubeadm_images.yml b/roles/download/tasks/prep_kubeadm_images.yml
index 5c706d8f3..56327f949 100644
--- a/roles/download/tasks/prep_kubeadm_images.yml
+++ b/roles/download/tasks/prep_kubeadm_images.yml
@@ -42,8 +42,7 @@
       value:
         enabled: true
         container: true
-        repo: "{{ item | regex_replace('^(.*):.*$', '\\1') }}"
-        tag: "{{ item | regex_replace('^.*:(.*)$', '\\1') }}"
+        image_name: "{{ item }}"
         groups:
           - k8s_cluster
   loop: "{{ kubeadm_images_list | flatten(levels=1) }}"
diff --git a/roles/download/tasks/set_container_facts.yml b/roles/download/tasks/set_container_facts.yml
index 5b93f2953..cbaf133e4 100644
--- a/roles/download/tasks/set_container_facts.yml
+++ b/roles/download/tasks/set_container_facts.yml
@@ -1,8 +1,4 @@
 ---
-- name: Set_container_facts | Display the name of the image being processed
-  debug:
-    msg: "{{ download.repo }}"
-
 - name: Set_container_facts | Set if containers should be pulled by digest
   set_fact:
     pull_by_digest: "{{ download.sha256 is defined and download.sha256 }}"
@@ -14,7 +10,7 @@
 
 - name: Set_container_facts | Define file name of image
   set_fact:
-    image_filename: "{{ image_reponame | regex_replace('/|\0|:', '_') }}.tar"
+    image_filename: "{{ download.image_name | regex_replace('/|\0|:', '_') }}.tar"
 
 - name: Set_container_facts | Define path of image
   set_fact:
@@ -23,33 +19,33 @@
 
 - name: Set image save/load command for docker
   set_fact:
-    image_save_command: "{{ docker_bin_dir }}/docker save {{ image_reponame }} | gzip -{{ download_compress }} > {{ image_path_final }}"
+    image_save_command: "{{ docker_bin_dir }}/docker save {{ download.image_name }} | gzip -{{ download_compress }} > {{ image_path_final }}"
     image_load_command: "{{ docker_bin_dir }}/docker load < {{ image_path_final }}"
   when: container_manager == 'docker'
 
 - name: Set image save/load command for containerd
   set_fact:
-    image_save_command: "{{ bin_dir }}/nerdctl -n k8s.io image save -o {{ image_path_final }} {{ image_reponame }}"
+    image_save_command: "{{ bin_dir }}/nerdctl -n k8s.io image save -o {{ image_path_final }} {{ download.image_name }}"
     image_load_command: "{{ bin_dir }}/nerdctl -n k8s.io image load < {{ image_path_final }}"
   when: container_manager == 'containerd'
 
 - name: Set image save/load command for crio
   set_fact:
-    image_save_command: "{{ bin_dir }}/skopeo copy containers-storage:{{ image_reponame }} docker-archive:{{ image_path_final }} 2>/dev/null"
-    image_load_command: "{{ bin_dir }}/skopeo copy docker-archive:{{ image_path_final }} containers-storage:{{ image_reponame }} 2>/dev/null"
+    image_save_command: "{{ bin_dir }}/skopeo copy containers-storage:{{ download.image_name }} docker-archive:{{ image_path_final }} 2>/dev/null"
+    image_load_command: "{{ bin_dir }}/skopeo copy docker-archive:{{ image_path_final }} containers-storage:{{ download.image_name }} 2>/dev/null"
   when: container_manager == 'crio'
 
 - name: Set image save/load command for docker on localhost
   set_fact:
-    image_save_command_on_localhost: "{{ docker_bin_dir }}/docker save {{ image_reponame }} | gzip -{{ download_compress }} > {{ image_path_cached }}"
+    image_save_command_on_localhost: "{{ docker_bin_dir }}/docker save {{ download.image_name }} | gzip -{{ download_compress }} > {{ image_path_cached }}"
   when: container_manager_on_localhost == 'docker'
 
 - name: Set image save/load command for containerd on localhost
   set_fact:
-    image_save_command_on_localhost: "{{ containerd_bin_dir }}/ctr -n k8s.io image export --platform linux/{{ image_arch }} {{ image_path_cached }} {{ image_reponame }}"
+    image_save_command_on_localhost: "{{ containerd_bin_dir }}/ctr -n k8s.io image export --platform linux/{{ image_arch }} {{ image_path_cached }} {{ download.image_name }}"
   when: container_manager_on_localhost == 'containerd'
 
 - name: Set image save/load command for crio on localhost
   set_fact:
-    image_save_command_on_localhost: "{{ bin_dir }}/skopeo copy containers-storage:{{ image_reponame }} docker-archive:{{ image_path_final }} 2>/dev/null"
+    image_save_command_on_localhost: "{{ bin_dir }}/skopeo copy containers-storage:{{ download.image_name }} docker-archive:{{ image_path_final }} 2>/dev/null"
   when: container_manager_on_localhost == 'crio'

From 6ff47af1ce5d6df46881993a2a8b8685357cdb52 Mon Sep 17 00:00:00 2001
From: Max Gautier <mg@max.gautier.name>
Date: Thu, 17 Sep 2026 09:55:39 +0200
Subject: [PATCH 3/4] download: Remove checksums for all container

The pull by digest hasn't been working since 800c84dcc (download: use
full hash form (including hash alg), 2025-01-14), where the key was
renamed to checksum, but the download_container still checked sha256.

Stop pretending we pull by digest.
---
 roles/download/tasks/check_pull_required.yml  | 10 ----
 roles/download/tasks/set_container_facts.yml  |  9 ----
 .../defaults/main/download.yml                | 47 +------------------
 3 files changed, 1 insertion(+), 65 deletions(-)

diff --git a/roles/download/tasks/check_pull_required.yml b/roles/download/tasks/check_pull_required.yml
index 5d7cc5cae..6c62ff519 100644
--- a/roles/download/tasks/check_pull_required.yml
+++ b/roles/download/tasks/check_pull_required.yml
@@ -12,13 +12,3 @@
   set_fact:
     pull_required: "{{ (download.image_name | regex_replace('^docker\\.io/(library/)?', '')) not in docker_images.stdout.split(',') }}"
   when: not download_always_pull
-
-- name: Check_pull_required | Check that the local digest sha256 corresponds to the given image tag
-  assert:
-    that: "{{ download.repo }}:{{ download.tag }} in docker_images.stdout.split(',')"
-  when:
-    - not download_always_pull
-    - not pull_required
-    - pull_by_digest
-  tags:
-    - asserts
diff --git a/roles/download/tasks/set_container_facts.yml b/roles/download/tasks/set_container_facts.yml
index cbaf133e4..2a5e93adf 100644
--- a/roles/download/tasks/set_container_facts.yml
+++ b/roles/download/tasks/set_container_facts.yml
@@ -1,13 +1,4 @@
 ---
-- name: Set_container_facts | Set if containers should be pulled by digest
-  set_fact:
-    pull_by_digest: "{{ download.sha256 is defined and download.sha256 }}"
-
-- name: Set_container_facts | Define by what name to pull the image
-  set_fact:
-    image_reponame: >-
-      {%- if pull_by_digest %}{{ download.repo }}@sha256:{{ download.sha256 }}{%- else -%}{{ download.repo }}:{{ download.tag }}{%- endif -%}
-
 - name: Set_container_facts | Define file name of image
   set_fact:
     image_filename: "{{ download.image_name | regex_replace('/|\0|:', '_') }}.tar"
diff --git a/roles/kubespray_defaults/defaults/main/download.yml b/roles/kubespray_defaults/defaults/main/download.yml
index 7aecbb622..442436588 100644
--- a/roles/kubespray_defaults/defaults/main/download.yml
+++ b/roles/kubespray_defaults/defaults/main/download.yml
@@ -378,9 +378,7 @@ downloads:
     enabled: true
     dest: "{{ local_release_dir }}/etcd-{{ etcd_version }}-linux-{{ image_arch }}.tar.gz"
     image_name: "{{ etcd_image_repo }}:{{ etcd_image_tag }}"
-    checksum: >-
-      {{ etcd_binary_checksum if (etcd_deployment_type == 'host')
-      else etcd_digest_checksum | d(None) }}
+    checksum: "{{ etcd_binary_checksum if etcd_deployment_type == 'host' else None }}"
     url: "{{ etcd_download_url }}"
     unarchive: "{{ etcd_deployment_type == 'host' }}"
     owner: "root"
@@ -586,7 +584,6 @@ downloads:
     enabled: "{{ kube_network_plugin == 'cilium' or cilium_deploy_additionally }}"
     container: true
     image_name: "{{ cilium_image_repo }}:{{ cilium_image_tag }}"
-    checksum: "{{ cilium_digest_checksum | default(None) }}"
     groups:
       - k8s_cluster
 
@@ -594,7 +591,6 @@ downloads:
     enabled: "{{ kube_network_plugin == 'cilium' or cilium_deploy_additionally }}"
     container: true
     image_name: "{{ cilium_operator_image_repo }}-generic:{{ cilium_operator_image_tag }}"
-    checksum: "{{ cilium_operator_digest_checksum | default(None) }}"
     groups:
       - k8s_cluster
 
@@ -602,7 +598,6 @@ downloads:
     enabled: "{{ cilium_enable_hubble }}"
     container: true
     image_name: "{{ cilium_hubble_relay_image_repo }}:{{ cilium_hubble_relay_image_tag }}"
-    checksum: "{{ cilium_hubble_relay_digest_checksum | default(None) }}"
     groups:
       - k8s_cluster
 
@@ -610,7 +605,6 @@ downloads:
     enabled: "{{ kube_network_plugin == 'cilium' }}"
     container: true
     image_name: "{{ cilium_certgen_image_repo }}:{{ cilium_certgen_image_tag }}"
-    checksum: "{{ cilium_certgen_digest_checksum | default(None) }}"
     groups:
       - k8s_cluster
 
@@ -618,7 +612,6 @@ downloads:
     enabled: "{{ cilium_enable_hubble }}"
     container: true
     image_name: "{{ cilium_hubble_ui_image_repo }}:{{ cilium_hubble_ui_image_tag }}"
-    checksum: "{{ cilium_hubble_ui_digest_checksum | default(None) }}"
     groups:
       - k8s_cluster
 
@@ -626,7 +619,6 @@ downloads:
     enabled: "{{ cilium_enable_hubble }}"
     container: true
     image_name: "{{ cilium_hubble_ui_backend_image_repo }}:{{ cilium_hubble_ui_backend_image_tag }}"
-    checksum: "{{ cilium_hubble_ui_backend_digest_checksum | default(None) }}"
     groups:
       - k8s_cluster
 
@@ -634,7 +626,6 @@ downloads:
     enabled: "{{ kube_network_plugin == 'cilium' }}"
     container: true
     image_name: "{{ cilium_envoy_image_repo }}:{{ cilium_envoy_image_tag }}"
-    checksum: "{{ cilium_envoy_digest_checksum | default(None) }}"
     groups:
       - k8s_cluster
 
@@ -654,7 +645,6 @@ downloads:
     enabled: "{{ kube_network_plugin_multus }}"
     container: true
     image_name: "{{ multus_image_repo }}:{{ multus_image_tag }}"
-    checksum: "{{ multus_digest_checksum | default(None) }}"
     groups:
       - k8s_cluster
 
@@ -662,7 +652,6 @@ downloads:
     enabled: "{{ kube_network_plugin == 'flannel' }}"
     container: true
     image_name: "{{ flannel_image_repo }}:{{ flannel_image_tag }}"
-    checksum: "{{ flannel_digest_checksum | default(None) }}"
     groups:
       - k8s_cluster
 
@@ -670,7 +659,6 @@ downloads:
     enabled: "{{ kube_network_plugin == 'flannel' }}"
     container: true
     image_name: "{{ flannel_init_image_repo }}:{{ flannel_init_image_tag }}"
-    checksum: "{{ flannel_init_digest_checksum | default(None) }}"
     groups:
       - k8s_cluster
 
@@ -690,7 +678,6 @@ downloads:
     enabled: "{{ kube_network_plugin == 'calico' }}"
     container: true
     image_name: "{{ calico_node_image_repo }}:{{ calico_node_image_tag }}"
-    checksum: "{{ calico_node_digest_checksum | default(None) }}"
     groups:
       - k8s_cluster
 
@@ -698,7 +685,6 @@ downloads:
     enabled: "{{ kube_network_plugin == 'calico' }}"
     container: true
     image_name: "{{ calico_cni_image_repo }}:{{ calico_cni_image_tag }}"
-    checksum: "{{ calico_cni_digest_checksum | default(None) }}"
     groups:
       - k8s_cluster
 
@@ -706,7 +692,6 @@ downloads:
     enabled: "{{ enable_network_policy and kube_network_plugin in ['calico'] }}"
     container: true
     image_name: "{{ calico_policy_image_repo }}:{{ calico_policy_image_tag }}"
-    checksum: "{{ calico_policy_digest_checksum | default(None) }}"
     groups:
       - k8s_cluster
 
@@ -714,7 +699,6 @@ downloads:
     enabled: "{{ typha_enabled }}"
     container: true
     image_name: "{{ calico_typha_image_repo }}:{{ calico_typha_image_tag }}"
-    checksum: "{{ calico_typha_digest_checksum | default(None) }}"
     groups:
       - k8s_cluster
 
@@ -722,7 +706,6 @@ downloads:
     enabled: "{{ calico_apiserver_enabled }}"
     container: true
     image_name: "{{ calico_apiserver_image_repo }}:{{ calico_apiserver_image_tag }}"
-    checksum: "{{ calico_apiserver_digest_checksum | default(None) }}"
     groups:
       - k8s_cluster
 
@@ -741,7 +724,6 @@ downloads:
     enabled: "{{ kube_network_plugin == 'kube-ovn' }}"
     container: true
     image_name: "{{ kube_ovn_container_image_repo }}:{{ kube_ovn_container_image_tag }}"
-    checksum: "{{ kube_ovn_digest_checksum | default(None) }}"
     groups:
       - k8s_cluster
 
@@ -749,7 +731,6 @@ downloads:
     enabled: "{{ kube_network_plugin == 'kube-router' }}"
     container: true
     image_name: "{{ kube_router_image_repo }}:{{ kube_router_image_tag }}"
-    checksum: "{{ kube_router_digest_checksum | default(None) }}"
     groups:
       - k8s_cluster
 
@@ -757,7 +738,6 @@ downloads:
     enabled: true
     container: true
     image_name: "{{ pod_infra_image_repo }}:{{ pod_infra_image_tag }}"
-    checksum: "{{ pod_infra_digest_checksum | default(None) }}"
     groups:
       - k8s_cluster
 
@@ -765,7 +745,6 @@ downloads:
     enabled: "{{ kube_vip_enabled }}"
     container: true
     image_name: "{{ kube_vip_image_repo }}:{{ kube_vip_image_tag }}"
-    checksum: "{{ kube_vip_digest_checksum | default(None) }}"
     groups:
       - kube_control_plane
 
@@ -773,7 +752,6 @@ downloads:
     enabled: "{{ loadbalancer_apiserver_localhost and loadbalancer_apiserver_type == 'nginx' }}"
     container: true
     image_name: "{{ nginx_image_repo }}:{{ nginx_image_tag }}"
-    checksum: "{{ nginx_digest_checksum | default(None) }}"
     groups:
       - kube_node
 
@@ -781,7 +759,6 @@ downloads:
     enabled: "{{ loadbalancer_apiserver_localhost and loadbalancer_apiserver_type == 'haproxy' }}"
     container: true
     image_name: "{{ haproxy_image_repo }}:{{ haproxy_image_tag }}"
-    checksum: "{{ haproxy_digest_checksum | default(None) }}"
     groups:
       - kube_node
 
@@ -789,7 +766,6 @@ downloads:
     enabled: "{{ dns_mode in ['coredns', 'coredns_dual'] }}"
     container: true
     image_name: "{{ coredns_image_repo }}:{{ coredns_image_tag }}"
-    checksum: "{{ coredns_digest_checksum | default(None) }}"
     groups:
       - k8s_cluster
 
@@ -797,7 +773,6 @@ downloads:
     enabled: "{{ enable_nodelocaldns }}"
     container: true
     image_name: "{{ nodelocaldns_image_repo }}:{{ nodelocaldns_image_tag }}"
-    checksum: "{{ nodelocaldns_digest_checksum | default(None) }}"
     groups:
       - k8s_cluster
 
@@ -805,7 +780,6 @@ downloads:
     enabled: "{{ dns_mode in ['coredns', 'coredns_dual'] and enable_dns_autoscaler }}"
     container: true
     image_name: "{{ dnsautoscaler_image_repo }}:{{ dnsautoscaler_image_tag }}"
-    checksum: "{{ dnsautoscaler_digest_checksum | default(None) }}"
     groups:
       - kube_control_plane
 
@@ -825,7 +799,6 @@ downloads:
     enabled: "{{ registry_enabled }}"
     container: true
     image_name: "{{ registry_image_repo }}:{{ registry_image_tag }}"
-    checksum: "{{ registry_digest_checksum | default(None) }}"
     groups:
       - kube_node
 
@@ -833,7 +806,6 @@ downloads:
     enabled: "{{ metrics_server_enabled }}"
     container: true
     image_name: "{{ metrics_server_image_repo }}:{{ metrics_server_image_tag }}"
-    checksum: "{{ metrics_server_digest_checksum | default(None) }}"
     groups:
       - kube_control_plane
 
@@ -841,7 +813,6 @@ downloads:
     enabled: "{{ local_volume_provisioner_enabled }}"
     container: true
     image_name: "{{ local_volume_provisioner_image_repo }}:{{ local_volume_provisioner_image_tag }}"
-    checksum: "{{ local_volume_provisioner_digest_checksum | default(None) }}"
     groups:
       - kube_node
 
@@ -849,7 +820,6 @@ downloads:
     enabled: "{{ local_path_provisioner_enabled }}"
     container: true
     image_name: "{{ local_path_provisioner_image_repo }}:{{ local_path_provisioner_image_tag }}"
-    checksum: "{{ local_path_provisioner_digest_checksum | default(None) }}"
     groups:
       - kube_node
 
@@ -857,7 +827,6 @@ downloads:
     enabled: "{{ ingress_alb_enabled }}"
     container: true
     image_name: "{{ alb_ingress_image_repo }}:{{ alb_ingress_image_tag }}"
-    checksum: "{{ ingress_alb_controller_digest_checksum | default(None) }}"
     groups:
       - kube_node
 
@@ -865,7 +834,6 @@ downloads:
     enabled: "{{ cert_manager_enabled }}"
     container: true
     image_name: "{{ cert_manager_controller_image_repo }}:{{ cert_manager_controller_image_tag }}"
-    checksum: "{{ cert_manager_controller_digest_checksum | default(None) }}"
     groups:
       - kube_node
 
@@ -873,7 +841,6 @@ downloads:
     enabled: "{{ cert_manager_enabled }}"
     container: true
     image_name: "{{ cert_manager_cainjector_image_repo }}:{{ cert_manager_cainjector_image_tag }}"
-    checksum: "{{ cert_manager_cainjector_digest_checksum | default(None) }}"
     groups:
       - kube_node
 
@@ -881,7 +848,6 @@ downloads:
     enabled: "{{ cert_manager_enabled }}"
     container: true
     image_name: "{{ cert_manager_webhook_image_repo }}:{{ cert_manager_webhook_image_tag }}"
-    checksum: "{{ cert_manager_webhook_digest_checksum | default(None) }}"
     groups:
       - kube_node
 
@@ -913,7 +879,6 @@ downloads:
     enabled: "{{ cinder_csi_enabled or aws_ebs_csi_enabled }}"
     container: true
     image_name: "{{ csi_attacher_image_repo }}:{{ csi_attacher_image_tag }}"
-    checksum: "{{ csi_attacher_digest_checksum | default(None) }}"
     groups:
       - kube_node
 
@@ -921,7 +886,6 @@ downloads:
     enabled: "{{ cinder_csi_enabled or aws_ebs_csi_enabled }}"
     container: true
     image_name: "{{ csi_provisioner_image_repo }}:{{ csi_provisioner_image_tag }}"
-    checksum: "{{ csi_provisioner_digest_checksum | default(None) }}"
     groups:
       - kube_node
 
@@ -929,7 +893,6 @@ downloads:
     enabled: "{{ cinder_csi_enabled or aws_ebs_csi_enabled }}"
     container: true
     image_name: "{{ csi_snapshotter_image_repo }}:{{ csi_snapshotter_image_tag }}"
-    checksum: "{{ csi_snapshotter_digest_checksum | default(None) }}"
     groups:
       - kube_node
 
@@ -937,7 +900,6 @@ downloads:
     enabled: "{{ csi_snapshot_controller_enabled }}"
     container: true
     image_name: "{{ snapshot_controller_image_repo }}:{{ snapshot_controller_image_tag }}"
-    checksum: "{{ snapshot_controller_digest_checksum | default(None) }}"
     groups:
       - kube_node
 
@@ -945,7 +907,6 @@ downloads:
     enabled: "{{ cinder_csi_enabled or aws_ebs_csi_enabled }}"
     container: true
     image_name: "{{ csi_resizer_image_repo }}:{{ csi_resizer_image_tag }}"
-    checksum: "{{ csi_resizer_digest_checksum | default(None) }}"
     groups:
       - kube_node
 
@@ -953,7 +914,6 @@ downloads:
     enabled: "{{ cinder_csi_enabled or aws_ebs_csi_enabled }}"
     container: true
     image_name: "{{ csi_livenessprobe_image_repo }}:{{ csi_livenessprobe_image_tag }}"
-    checksum: "{{ csi_livenessprobe_digest_checksum | default(None) }}"
     groups:
       - kube_node
 
@@ -961,7 +921,6 @@ downloads:
     enabled: "{{ cinder_csi_enabled or aws_ebs_csi_enabled }}"
     container: true
     image_name: "{{ csi_node_driver_registrar_image_repo }}:{{ csi_node_driver_registrar_image_tag }}"
-    checksum: "{{ csi_node_driver_registrar_digest_checksum | default(None) }}"
     groups:
       - kube_node
 
@@ -969,7 +928,6 @@ downloads:
     enabled: "{{ cinder_csi_enabled }}"
     container: true
     image_name: "{{ cinder_csi_plugin_image_repo }}:{{ cinder_csi_plugin_image_tag }}"
-    checksum: "{{ cinder_csi_plugin_digest_checksum | default(None) }}"
     groups:
       - kube_node
 
@@ -977,7 +935,6 @@ downloads:
     enabled: "{{ aws_ebs_csi_enabled }}"
     container: true
     image_name: "{{ aws_ebs_csi_plugin_image_repo }}:{{ aws_ebs_csi_plugin_image_tag }}"
-    checksum: "{{ aws_ebs_csi_plugin_digest_checksum | default(None) }}"
     groups:
       - kube_node
 
@@ -985,7 +942,6 @@ downloads:
     enabled: "{{ metallb_speaker_enabled }}"
     container: true
     image_name: "{{ metallb_speaker_image_repo }}:{{ metallb_image_tag }}"
-    checksum: "{{ metallb_speaker_digest_checksum | default(None) }}"
     groups:
       - kube_control_plane
 
@@ -993,7 +949,6 @@ downloads:
     enabled: "{{ metallb_enabled }}"
     container: true
     image_name: "{{ metallb_controller_image_repo }}:{{ metallb_image_tag }}"
-    checksum: "{{ metallb_controller_digest_checksum | default(None) }}"
     groups:
       - kube_control_plane
 

From 2f42f98d229b102302f9b4ffa942515335eb143e Mon Sep 17 00:00:00 2001
From: Max Gautier <mg@max.gautier.name>
Date: Tue, 22 Sep 2026 23:02:42 +0200
Subject: [PATCH 4/4] Update docs and offline scripts for merged repo + tag in
 downloads

---
 contrib/offline/generate_list.sh                    |  4 ++--
 docs/advanced/downloads.md                          | 10 ++--------
 roles/kubespray_defaults/defaults/main/download.yml |  2 +-
 3 files changed, 5 insertions(+), 11 deletions(-)

diff --git a/contrib/offline/generate_list.sh b/contrib/offline/generate_list.sh
index 6472044b2..cf05b96a8 100755
--- a/contrib/offline/generate_list.sh
+++ b/contrib/offline/generate_list.sh
@@ -15,8 +15,8 @@ grep 'download_url:' ${REPO_ROOT_DIR}/${DOWNLOAD_YML} \
 
 # generate all images list template
 sed -n '/^downloads:/,/download_defaults:/p' ${REPO_ROOT_DIR}/${DOWNLOAD_YML} \
-    | sed -n "s/repo: //p;s/tag: //p" | tr -d ' ' \
-    | sed 'N;s#\n# #g' | tr ' ' ':' | sed 's/\"//g' > ${TEMP_DIR}/images.list.template
+    | sed -n "s/image_name: //p" | tr -d ' ' \
+    | tr ' ' ':' | sed 's/\"//g' > ${TEMP_DIR}/images.list.template
 
 # add kube-* images to images list template
 # Those container images are downloaded by kubeadm, then roles/kubespray_defaults/defaults/main/download.yml
diff --git a/docs/advanced/downloads.md b/docs/advanced/downloads.md
index 9961eab5a..b1a9fa7fa 100644
--- a/docs/advanced/downloads.md
+++ b/docs/advanced/downloads.md
@@ -4,7 +4,7 @@ Kubespray supports several download/upload modes. The default is:
 
 * Each node downloads binaries and container images on its own, which is ``download_run_once: False``.
 * For K8s apps, pull policy is ``k8s_image_pull_policy: IfNotPresent``.
-* For system managed containers, like kubelet or etcd, pull policy is ``download_always_pull: False``, which is pull if only the wanted repo and tag/sha256 digest differs from that the host has.
+* For system managed containers, like kubelet or etcd, pull policy is ``download_always_pull: False``, which is pull if only the wanted repo and tag differs from that the host has.
 
 There is also a "pull once, push many" mode as well:
 
@@ -21,17 +21,11 @@ On caching:
 
 Container images and binary files are described by the vars like ``foo_version``,
 ``foo_download_url``, ``foo_checksum`` for binaries and ``foo_image_repo``,
-``foo_image_tag`` or optional  ``foo_digest_checksum`` for containers.
+``foo_image_tag`` for containers.
 
 Container images may be defined by its repo and tag, for example:
-`andyshinn/dnsmasq:2.72`. Or by repo and tag and sha256 digest:
-`andyshinn/dnsmasq@sha256:7c883354f6ea9876d176fe1d30132515478b2859d6fc0cbf9223ffdc09168193`.
-
-Note, the SHA256 digest and the image tag must be both specified and correspond
-to each other. The given example above is represented by the following vars:
 
 ```yaml
-dnsmasq_digest_checksum: 7c883354f6ea9876d176fe1d30132515478b2859d6fc0cbf9223ffdc09168193
 dnsmasq_image_repo: andyshinn/dnsmasq
 dnsmasq_image_tag: '2.72'
 ```
diff --git a/roles/kubespray_defaults/defaults/main/download.yml b/roles/kubespray_defaults/defaults/main/download.yml
index 442436588..c13f57024 100644
--- a/roles/kubespray_defaults/defaults/main/download.yml
+++ b/roles/kubespray_defaults/defaults/main/download.yml
@@ -40,7 +40,7 @@ download_container: true
 # in the download_run_once mode.
 download_localhost: false
 
-# Always pull images if set to True. Otherwise check by the repo's tag/digest.
+# Always pull images if set to True. Otherwise check by the repo's tag.
 download_always_pull: false
 
 # Some problems may occur when downloading files over https proxy due to ansible bug