Mutator removes tag when tag+sha are provided

[gmoirod]

Hi !

Actually, the webhook is eating an important part of my image spec.

My config defined below allows me to pull through a cache implemented by Harbor :

    rules:
     - name: 'company.jfrog.io rewrite rule'
       matches:
         - '^company.jfrog.io'
       replace: 'cacheregistry.company.com/artifactory'

But when I specify in my Deployment

    image: company.jfrog.io/docker/wso2/apim-universal-gw:4.5.0@sha256:eb63242664badb9b22049160822d7968c1847698ddea3a887279022658282ec5

I got in the resulting pod (tag information disappears) :

    image: cacheregistry.company.com/artifactory/docker/wso2/apim-universal-gw@sha256:eb63242664badb9b22049160822d7968c1847698ddea3a887279022658282ec5

Logs :

2026-01-20T14:14:58Z  INFO    mutator transformer "company.jfrog.io rewrite rule" rewriting "company.jfrog.io/docker/wso2/apim-universal-gw:4.5.0@sha256:eb63242664badb9b22049160822d7968c1847698ddea3a887279022658282ec5" to "cacheregistry.company.com/artifactory/docker/wso2/apim-universal-gw@sha256:eb63242664badb9b22049160822d7968c1847698ddea3a887279022658282ec5"
2026-01-20T14:14:58Z  INFO    mutator rewriting the image of "wso2am-gateway" from "company.jfrog.io/docker/wso2/apim-universal-gw:4.5.0@sha256:eb63242664badb9b22049160822d7968c1847698ddea3a887279022658282ec5" to "cacheregistry.company.com/artifactory/docker/wso2/apim-universal-gw@sha256:eb63242664badb9b22049160822d7968c1847698ddea3a887279022658282ec5"