FairwindsOps / polaris

Validation of best practices in your Kubernetes clusters
https://www.fairwinds.com/polaris
Apache License 2.0
3.14k stars 210 forks source link

`pullPolicyNotAlways` shouldn't trigger if the image is pinned by digest #1058

Open chgl opened 2 weeks ago

chgl commented 2 weeks ago

Is your feature request related to a problem? Please describe.

The pullPolicyNotAlways triggers whenever imagePullPolicy != "Always". However, if an image is already specified by its digest the danges described in https://polaris.docs.fairwinds.com/checks/reliability/#image-pull-policy don't apply.

Describe the solution you'd like

If an image is specified by its digest, then the pullPolicyNotAlways shouldn't apply.

E.g. a container spec with

image: "docker.io/curlimages/curl:8.8.0@sha256:73e4d532ea62d7505c5865b517d3704966ffe916609bedc22af6833dc9969bcd"
imagePullPolicy: IfNotPresent

should not cause the check to fail.

Describe alternatives you've considered

Additional context