What does an images entry with name: nginx and a digest: sha256:... value do?

Answer: Pins nginx containers to that exact image digest

Explanation

With digest set, Kustomize writes the image as nginx@sha256:..., so every node runs exactly that image even if the tag moves later. Kustomize never contacts the registry; a CI job usually looks up the digest and writes it.