Important Change for CRI-O Users: Fully Qualified Image Names Required in Kubernetes 1.34
If you’re using a Kubernetes distribution with CRI-O as the container runtime and planning to upgrade to Kubernetes 1.34, there’s a breaking change you need to know about.
Who Is Affected?
This change ONLY affects Kubernetes distributions using CRI-O:
- Red Hat OpenShift
- Oracle Cloud Infrastructure Kubernetes Engine (OKE)
This change does NOT affect:
- Amazon EKS (uses containerd)
- Azure AKS (uses containerd)
- Google GKE (uses containerd)
- k0s (uses containerd)
Not sure which runtime you’re using? Run this command to check:
kubectl get nodes -o wide
Look at the CONTAINER-RUNTIME column. If it shows cri-o://, you’re affected. If it shows containerd://, you’re not affected by this change.
What Changed?
Starting with Kubernetes 1.34, ambiguous short image names will no longer work in CRI-O and will result in an error. This change comes from CRI-O pull request #9401, which enforces stricter image name resolution.
The Error You’ll See
When using short image names, you’ll encounter errors like this:
Back-off pulling image "nginx": ErrImagePull: short name mode is enforcing, but image name nginx:latest returns ambiguous list
Before and After
Kubernetes 1.33 (works):
kubectl run nginx --image=nginx
Kubernetes 1.34 (fails):
kubectl run nginx --image=nginx
# Error: short name mode is enforcing...
Kubernetes 1.34 (works):
kubectl run nginx --image=docker.io/nginx
Why This Change?
This change improves security and clarity by:
- Eliminating ambiguity – “nginx” could refer to images from multiple registries
- Making deployments more explicit – You know exactly where your images come from
- Preventing supply chain attacks – Reduces the risk of pulling images from unintended sources
What You Need to Do
Before upgrading to Kubernetes 1.34, update your image specifications to use fully qualified names:
-
nginx -
docker.io/nginx -
redis:latest -
docker.io/library/redis:latest -
myapp -
gcr.io/myproject/myapp
Check these locations:
- Pod specifications
- Deployment manifests
- Helm charts
- CI/CD pipelines
- Documentation and runbooks
Common Registry Prefixes
- Docker Hub:
docker.io/ - Docker Hub official images:
docker.io/library/ - Google Container Registry:
gcr.io/ - AWS ECR:
<account-id>.dkr.ecr.<region>.amazonaws.com/ - Azure ACR:
<registry-name>.azurecr.io/ - GitHub Container Registry:
ghcr.io/
Best Practices Going Forward
- Always use fully qualified image names in production manifests
- Audit your existing deployments before upgrading
Need Help?
If you have questions about this change or need assistance updating your Kubernetes deployments, please reach out to our support team.
This change affects Kubernetes 1.34+ clusters using CRI-O as the container runtime (primarily OpenShift and Oracle OKE). If you’re using EKS, AKS, GKE, or k0s (which use containerd), you are not affected by this change. We recommend reviewing and updating your image specifications before upgrading if you use CRI-O.