imagePullPolicy for the injected agent image fails admission control about vault-k8s HOT 6 CLOSED

In v1.1.0 we added support for JSON-patch via annotations. You should now be able to specify the vault-agent ImagePullPolicy from the vault.hashicorp.com/agent-json-patch annotation.

Example:

spec:
  template:
    metadata:
      annotations:
        vault.hashicorp.com/agent-json-patch: '[{"op": "replace", "path": "/imagePullPolicy", "value": "IfNotPresent"}]'

from vault-k8s.

Hi @goffinf, this is interesting because we aren't actually setting the pull policy for the init container: https://github.com/hashicorp/vault-k8s/blob/master/agent-inject/agent/container_init_sidecar.go#L57-L70. Regardless I think this is a good option to have.

As a work around, I think you can set .Values.injector.agentImage.tag to "latest", Kube will default to "Always" in this case.

from vault-k8s.

Hey Jason,

I can confirm that using the latest tag does default the imagePullPolicy to 'Always' and thus is a reasonable workaround for now. Clearly we want to remove that when this enhancement is implemented and merged.

from vault-k8s.

Even make it configurable, default to Always or allow it to be changed using an annotation.
It seems so trivial, I can PR if you want.

Thanks

from vault-k8s.

I can confirm that using the latest tag does default the imagePullPolicy to 'Always' and thus is a reasonable workaround for now. Clearly we want to remove that when this enhancement is implemented and merged.

@jasonodonnell , one of the use-cases of not using latest was to pin specific versions to know which versions were running in each of our kubernetes clusters/environments. That way, we could easily track the updates across our SDLC process. We also had an egde case where we had to compile and build a s390x arch agent to support our zLinux k8s workloads which had specific version associated to it.

Like @prune998 mentioned, this should be a change in the helm templates. I can take a stab at it if it's not in the works (and it seems there's no design consideration on limiting the pull policy based on the above discussion)

I however am not familar with Go to contribute to the agent-inject part in this repo (will still read through if I can)

from vault-k8s.

We're having a related issue. We deployed a POD annotated for secrets and I see the init and agent containers when I describe the POD, but the POD is failing on ImagePullBackOff even though the image already exists on the node.

from vault-k8s.