# Kubernetes 1.34 "short name mode is enforcing"

**URL:** <https://community.replicated.com/t/kubernetes-1-34-short-name-mode-is-enforcing/1591>\
**Category:** Packaging an application\
**Created:** [October 9, 2025, 1:19am UTC](https://community.replicated.com/t/kubernetes-1-34-short-name-mode-is-enforcing/1591 "2025-10-09T01:19:26Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Xav\_Paice](https://yyz2.discourse-cdn.com/flex030/user_avatar/community.replicated.com/xav_paice/32/472_2.png) [@Xav\_Paice](https://community.replicated.com/u/Xav_Paice)\
**Post date:** [October 9, 2025, 1:19am UTC](https://community.replicated.com/t/kubernetes-1-34-short-name-mode-is-enforcing/1591/1 "2025-10-09T01:19:26Z")

</div>

# Important Change for CRI-O Users: Fully Qualified Image Names Required in Kubernetes 1.34

If you’re using a Kubernetes distribution with CRI-O as the container runtime and planning to upgrade to Kubernetes 1.34, there’s a breaking change you need to know about.

## Who Is Affected?

**This change ONLY affects Kubernetes distributions using CRI-O:**

- Red Hat OpenShift
- Oracle Cloud Infrastructure Kubernetes Engine (OKE)

**This change does NOT affect:**

- Amazon EKS (uses containerd)
- Azure AKS (uses containerd)
- Google GKE (uses containerd)
- k0s (uses containerd)

**Not sure which runtime you’re using?** Run this command to check:

```bash
kubectl get nodes -o wide

```

Look at the `CONTAINER-RUNTIME` column. If it shows `cri-o://`, you’re affected. If it shows `containerd://`, you’re not affected by this change.

## What Changed?

Starting with Kubernetes 1.34, ambiguous short image names will no longer work in CRI-O and will result in an error. This change comes from [CRI-O pull request #9401](https://github.com/cri-o/cri-o/pull/9401), which enforces stricter image name resolution.

## The Error You’ll See

When using short image names, you’ll encounter errors like this:

```auto
Back-off pulling image "nginx": ErrImagePull: short name mode is enforcing, but image name nginx:latest returns ambiguous list

```

## Before and After

**Kubernetes 1.33 (works):**

```bash
kubectl run nginx --image=nginx

```

**Kubernetes 1.34 (fails):**

```bash
kubectl run nginx --image=nginx
# Error: short name mode is enforcing...

```

**Kubernetes 1.34 (works):**

```bash
kubectl run nginx --image=docker.io/nginx

```

## Why This Change?

This change improves security and clarity by:

- **Eliminating ambiguity** – “nginx” could refer to images from multiple registries
- **Making deployments more explicit** – You know exactly where your images come from
- **Preventing supply chain attacks** – Reduces the risk of pulling images from unintended sources

## What You Need to Do

Before upgrading to Kubernetes 1.34, update your image specifications to use fully qualified names:

- ❌ `nginx`

- ✅ `docker.io/nginx`

- ❌ `redis:latest`

- ✅ `docker.io/library/redis:latest`

- ❌ `myapp`

- ✅ `gcr.io/myproject/myapp`

**Check these locations:**

- Pod specifications
- Deployment manifests
- Helm charts
- CI/CD pipelines
- Documentation and runbooks

## Common Registry Prefixes

- Docker Hub: `docker.io/`
- Docker Hub official images: `docker.io/library/`
- Google Container Registry: `gcr.io/`
- AWS ECR: `<account-id>.dkr.ecr.<region>.amazonaws.com/`
- Azure ACR: `<registry-name>.azurecr.io/`
- GitHub Container Registry: `ghcr.io/`

## Best Practices Going Forward

1. **Always use fully qualified image names** in production manifests
2. **Audit your existing deployments** before upgrading

## Need Help?

If you have questions about this change or need assistance updating your Kubernetes deployments, please reach out to our support team.

* * *

_This change affects Kubernetes 1.34+ clusters using CRI-O as the container runtime (primarily OpenShift and Oracle OKE). If you’re using EKS, AKS, GKE, or k0s (which use containerd), you are not affected by this change. We recommend reviewing and updating your image specifications before upgrading if you use CRI-O._