// Module included in the following assemblies
//
// * serverless/admin_guide/serverless-configuration.adoc

:_mod-docs-content-type: CONCEPT
[id="serverless-tag-to-digest-resolution_{context}"]
= Tag-to-digest resolution

To give the controller access to the container registry on {product-title}, you must create a secret and then configure controller custom certificates. You can configure controller custom certificates by modifying the `controller-custom-certs` spec in the `KnativeServing` custom resource (CR). The secret must reside in the same namespace as the `KnativeServing` CR.

If a secret is not included in the `KnativeServing` CR, this setting defaults to using public key infrastructure (PKI). When using PKI, the cluster-wide certificates are automatically injected into the Knative Serving controller by using the `config-service-sa` config map. The {ServerlessOperatorName} populates the `config-service-sa` config map with cluster-wide certificates and mounts the config map as a volume to the controller.
