Difference between Always and IfNotPresent imagePullPolicy

Question

I was checking Kubernetes documentation for pulling images. In that, I saw two policies IfNotPresent and Always. In "Always" its stated that

If the kubelet has a container image with that exact digest cached locally, the kubelet uses its cached image; otherwise, the kubelet pulls the image with the resolved digest, and uses that image to launch the container.

I am unable to understand what is local here. Is it a node, pod, or cluster? What is the difference between Always and IfNotPresent if it is at node level? It's very confusing.

Answer 1

When you use an image WITHOUT a tag, Kubernetes will assume that you want the latest version of the image, which is identified by the latest tag by default. If you have multiple versions of the same image in your repository with different tags, such as img1:1.0.0, img1:1.1.0, and img1:latest, Kubernetes will use the image with the tag specified in the pod specification.

If you use IfNotPresent and the image with the specified tag is already present on the worker node, Kubernetes will use that image to start the container, even if there is a newer version of the image available in the repository with the same tag.

If you use Always, however, Kubernetes will always attempt to download the latest version of the image with the specified tag from the repository, even if a cached copy of the image is already present on the worker node. This can be useful if you want to ensure that your containers are always running the latest version of the image.

consider a scenario where a container is running on a worker node with img1:latest as the latest tag, and then the container restarts or reschedules on another worker node with the same tag pointing to an older version of the image, IfNotPresent will use the local image present on the worker node, while Always will attempt to download the latest version of the image from the repository.

However, it's important to note that the behavior of Always is based on the digest of the image, not the tag. The digest is a unique identifier for a specific version of an image that is based on the content of the image. When you specify Always, Kubernetes will check the digest of the image on the worker node against the digest of the latest version of the image in the repository with the same tag. If the digests match, Kubernetes will use the cached copy of the image on the worker node. If the digests differ, Kubernetes will download the latest version of the image from the repository and use it to start the container.