/sig node auth
/triage accepted

rather than allowing the imagePullPolicy to be updated, I'd expect the AlwaysPullImages admission plugin to be fixed to ignore/tolerate updates to pods which do not change the container images, even if the pull policy is not Always.

rather than allowing the imagePullPolicy to be updated, I'd expect the AlwaysPullImages admission plugin to be fixed to ignore/tolerate updates to pods which do not change the container images, even if the pull policy is not Always.

changed to the other solution, ignore update pod in alwayspullimages.

we can ignore update requests if no images change like this:

if attributes.GetOperation() == admission.Update {
  oldImages := sets.NewString()
  pods.VisitContainersWithPath(&oldPod.Spec, field.NewPath("spec"), func(c *api.Container, _ *field.Path) bool {
    oldImages.Insert(c.Image)
    return true
  })
  newImages := sets.NewString()
  pods.VisitContainersWithPath(&newPod.Spec, field.NewPath("spec"), func(c *api.Container, _ *field.Path) bool {
    newImages.Insert(c.Image)
    return true
  })
  if oldImages.HasAll(newImages) {
    // ignore updates that don't change the images referenced by the pod spec
    return nil
  }
}

we can ignore update requests if no images change like this:

Could this strategy be applied to other admissions as well? For example:

1. LimitRanger which might defaults resources.limits on updates.
2. PodSecurityPolicy which might defaults securityContexts on updates.

/triage accepted

/retest

squashed and fixed

/priority backlog
/lgtm
/approve
/milestone v1.21

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: liggitt, pacoxu

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Could this strategy be applied to other admissions as well? For example:

LimitRanger which might defaults resources.limits on updates.
PodSecurityPolicy which might defaults securityContexts on updates.

@zhouhaibing089
I will extract isUpdateWithNoNewImages as util and check whether it can add to plugin PodSecurityPolicy and LimitRanger recently.