It's possible in kubernetes to specify an image digest when putting together the spec for a pod or deployment, but this doesn't seem to be documented in the documentation itself.

Fortunately, it's really easy to do, and just involves you using an @ instead of a : between the image name and the digest, being sure to include the leading sha256: so if your image definition looks like this with a tag:

image: foo/bar:latest

Change it to:

image: foo/bar@sha256:8dc07735a8ffe78835c91e1e278b8cd75ce7ca6e08ed3d36d4b46e9297434157

to deploy the image by its digest.