Image Pull Policy

The kubelet pulls the image only if it does not already exist locally on the node's filesystem.

• Mechanism: Checks the local container runtime image store by tag. If the tag is found, the local copy is used without contacting the registry.
• Use Case: The default policy for images with a specific tag (e.g., :v1.2.3). Essential for cost control and operational stability.
• Sovereign AI Impact: Minimizes external bandwidth consumption. Ideal for air-gapped registries where images are pre-loaded; ensures nodes use the pre-seeded artifact.
• Caveat: If a tag is mutated upstream, the node will not detect the change, leading to potential configuration drift.

The kubelet assumes the image exists locally and makes zero outbound network requests to any registry.

• Mechanism: The container runtime immediately attempts to start the container using only the local image store. If the image is absent, the container fails to start.
• Use Case: Enforces strict pre-staging requirements. Used in high-security disconnected environments where any external communication is forbidden.
• Sovereign AI Impact: The strongest enforcement of data residency and network isolation. Requires a mandatory sidecar process to pre-populate nodes with golden images via physical media or a one-way data diode.
• Failure Mode: Results in ErrImageNeverPull if the image is not manually cached on the node.

Kubernetes dynamically sets the pull policy based on the tag format when the field is omitted from the spec.

• :latest tag: The kubelet defaults to Always.
• Specific tag or digest: The kubelet defaults to IfNotPresent.
• Sovereign Best Practice: Never rely on defaults. Explicitly declare the policy to avoid ambiguity. Always deploy using an image digest (SHA256) rather than a mutable tag to guarantee cryptographic identity, rendering the pull policy a secondary safety net.

To prevent misconfiguration at scale, admission controllers can mutate or reject pods based on their pull policy.

• Mutation: A webhook can silently overwrite a :latest tag with a specific digest and change the policy to IfNotPresent.
• Validation: A policy agent (e.g., OPA/Gatekeeper) can reject any pod that specifies Always in a production namespace to prevent registry dependency.
• Sovereign AI Integration: Combined with Binary Authorization, admission controllers ensure that only signed images with a Never or IfNotPresent policy are executed, closing the gap between policy declaration and runtime enforcement.

The pull policy directly dictates the effectiveness of local registry mirrors and node-level caching.

• IfNotPresent: Maximizes cache hits. The node acts as a persistent warm cache, reducing load on the central sovereign registry.
• Always: Bypasses the node cache but can still hit a local pull-through cache if the registry endpoint is configured as a mirror.
• Disk Pressure: Always can lead to image accumulation. The kubelet's garbage collection thresholds trigger based on disk usage, potentially evicting unused images regardless of the pull policy, which can cause latency spikes if IfNotPresent is expected.

A unique, content-addressable SHA256 hash that immutably identifies a specific container image manifest or layer. Unlike mutable tags, a digest guarantees cryptographic verification of integrity.

• Pinning deployments to a digest ensures the kubelet always pulls the exact same bytes
• Works with IfNotPresent to avoid unnecessary registry calls while maintaining immutability
• Example: myapp@sha256:abc123...

A security mechanism using digital signatures to ensure only authorized, untampered container images are pulled and executed. Integrates directly with pull policy enforcement.

• Docker Content Trust uses Notary and The Update Framework (TUF)
• When enabled, the kubelet verifies signatures before honoring any pull policy
• Prevents supply chain attacks even if a registry is compromised

A Kubernetes secret object containing registry credentials used by the kubelet to authenticate to a private container registry.

• Required when pulling from private registries regardless of pull policy setting
• Can be attached at the pod, service account, or namespace level
• Without valid credentials, Always and IfNotPresent policies will fail with ImagePullBackOff

A Kubernetes-native plugin that intercepts authenticated API requests and can mutate or validate objects before persistence. Critical for enforcing image pull policies at scale.

• Can mutate pod specs to enforce imagePullPolicy: Always for specific namespaces
• Validating admission controllers can reject pods using the :latest tag
• Integrates with Binary Authorization for deploy-time signature verification

A systematic convention for assigning mutable or immutable tags to container images, directly influencing pull policy behavior.

• Semantic versioning (v1.2.3): Works with IfNotPresent for reproducible builds
• Git commit SHA: Immutable tags ideal for IfNotPresent with digest verification
• :latest tag: Requires imagePullPolicy: Always to avoid stale cached images, but introduces non-determinism

A local, read-only replica of an upstream container registry serving as a pull-through cache. Reduces external bandwidth consumption and latency in air-gapped or bandwidth-constrained environments.

• Kubelet pull policies operate against the mirror transparently
• IfNotPresent hits the local mirror first, drastically reducing pull latency
• Essential for air-gapped deployments where Always would fail without a local source