A Running pod is not a security check

The phase is a lifecycle word

kubectl get pods prints a phase such as Running, Pending, or Succeeded. Running means the pod’s phase field is Running. It does not say which image digest was pulled, and it does not say a policy engine looked at the spec.

Pending is also only a phase. It is not a denial message. If you need the denial, it is on the event or the apply error, not inside the word Pending.

Checks are other commands

A signature check, a digest pin, or an admission dry run would be a separate result. If that result is not in the note, write “not run.” Do not infer it from Running.

The image string on the pod is the spec’s image field. If the line shows a tag and no digest, write “digest not in this output.”

What to write down

File the namespace, the pod name, the phase, and the image field as printed. File verification only if you saved that command’s output. Do not file Running as a pass.

Lab: Running read as a verified image

In namespace team-a, pod lab-web shows phase Running and image registry.lab.example/web:1.4. No digest is on the line, and no verify command was saved. A draft says the image was verified because the pod is Running.

The note quotes Running and the image string. Digest: not in this output. Verification: not run. The draft’s verified claim is removed.

namespace: team-a
pod: lab-web
phase: Running
image: registry.lab.example/web:1.4
digest: not in this output
verify command: not run
write: phase and image string
not: verified