Image Pull Policies

Kubernetes does not necessarily pull a fresh image every time a Pod starts. It might use a copy already on the node from a previous pull. Whether it does or not is controlled by imagePullPolicy, and the default behavior is less obvious than it appears. Getting this wrong is a common source of “why is my update not showing up” confusion during the CKA exam and in real clusters.

The three pull policies

imagePullPolicy has three possible values: Always, IfNotPresent, and Never. Each one controls what the kubelet does at Pod startup when it is about to run a container.

Always tells the kubelet to contact the registry on every Pod start, regardless of whether a local copy of the image exists on the node. This ensures you always run exactly what the registry currently has at that tag. The trade-off is that every Pod start incurs a network round-trip to the registry, and startup is slower if the image is large.

IfNotPresent tells the kubelet to use the local copy if one exists and only pull if the node has never seen this image before. This is the most common policy in practice: fast startup once an image is cached, and no unnecessary registry traffic. The risk is that the local copy might be stale if the tag was moved at the registry.

Never tells the kubelet to never contact the registry. If the image is not already on the node, the Pod fails immediately. This is used in air-gapped environments or when images are pre-loaded onto nodes by a separate mechanism.

Default rules

Why does Kubernetes not simply pick one default for all images? Because the right default depends on the tag. If you use latest or omit the tag entirely, Kubernetes assumes the image is mutable and defaults to Always. If you use a specific tag like 1.28, Kubernetes assumes you intentionally pinned a version and defaults to IfNotPresent.

Seeing the policy in action

Create a manifest with an explicit pull policy:

nano pull-policy-pod.yaml

# illustrative only
apiVersion: v1
kind: Pod
metadata:
  name: pull-policy-pod
spec:
  containers:
    - name: app
      image: nginx:1.28
      imagePullPolicy: Always

Apply it:

kubectl apply -f pull-policy-pod.yaml

Check that the Pod started:

kubectl get pod pull-policy-pod

Then describe it to see the resolved policy:

kubectl describe pod pull-policy-pod

In the Containers section, look for the Image pull policy: field. It will confirm the value Kubernetes applied, whether you set it explicitly or let it default. This field is the authoritative source of truth for what the kubelet will do on the next restart.

The most deterministic combination

IfNotPresent with a pinned tag is common, but there is a stronger pattern for production: Always combined with a digest reference.

# illustrative only
image: nginx@sha256:abc123...
imagePullPolicy: Always

A digest cannot change, so every pull is guaranteed to fetch the exact same image content. The Always policy ensures the kubelet verifies against the registry on every Pod start rather than trusting the local cache. Together, these two settings eliminate the two most common sources of image drift: a moved tag and a stale cache.

You now control all three layers of image runtime behavior: the image reference that tells Kubernetes where to find the image, the pull secret that authenticates against private registries, and the pull policy that governs when the kubelet actually contacts the registry. The next module covers Admission Controllers, which operate one layer higher and let you enforce cluster-wide rules about what can be created in the first place.