Hands-On Microservices with Kubernetes

Always pull images

In the container spec, there is an optional key called ImagePullPolicy. The default is IfNotPresent. There are a few problems with this default, as follows:

• If you use tags such as latest (you shouldn't), then you will not pick up updated images.
• You may have conflicts with other tenants on the same node.
• Other tenants on the same node can run your images.

Kubernetes has an admission controller called AlwaysPullImages that sets the ImagePullPolicy of every pod to AlwaysPullImages. This prevents all the issues at the expense of pulling images, even if they are present and you had the right to use them. You turn on this admission controller by adding it to the list of enabled admission controllers that are passed to kube-apiserver ...