kubelet: invoke part of image verification policy earlier

atykhyy · atykhyy · commit e62c46106a99 · 2025-07-22T01:16:45.000+03:00
Some decisions about image pull credential verification can be applied without reference to image pull credentials: if the policy is NeverVerify, or if it is NeverVerifyPreloadedImages and the image is preloaded, or if is NeverVerifyAllowListedImages and the image is white-listed. In these cases, there is no need to look up credentials. Related PR: #133079
diff --git a/pkg/kubelet/images/image_manager.go b/pkg/kubelet/images/image_manager.go
@@ -178,7 +178,8 @@ func (m *imageManager) EnsureImageExists(ctx context.Context, objRef *v1.ObjectR
 		return "", message, err
 	}
 
-	if imageRef != "" && !utilfeature.DefaultFeatureGate.Enabled(features.KubeletEnsureSecretPulledImages) {
+	// run the part of image verification policy that does not depend on credentials before looking them up
+	if imageRef != "" && !(utilfeature.DefaultFeatureGate.Enabled(features.KubeletEnsureSecretPulledImages) && m.imagePullManager.MustAttemptImagePull(requestedImage, imageRef, nil, nil)) {
 		msg := fmt.Sprintf("Container image %q already present on machine", requestedImage)
 		m.logIt(objRef, v1.EventTypeNormal, events.PulledImage, logPrefix, msg, klog.Info)
 		return imageRef, msg, nil

Original file line number	Diff line number	Diff line change
`@@ -178,7 +178,8 @@ func (m imageManager) EnsureImageExists(ctx context.Context, objRef v1.ObjectR`
`178`	`178`	`return "", message, err`
`179`	`179`	`}`
`180`	`180`
`181`		`- if imageRef != "" && !utilfeature.DefaultFeatureGate.Enabled(features.KubeletEnsureSecretPulledImages) {`
	`181`	`+ // run the part of image verification policy that does not depend on credentials before looking them up`
	`182`	`+ if imageRef != "" && !(utilfeature.DefaultFeatureGate.Enabled(features.KubeletEnsureSecretPulledImages) && m.imagePullManager.MustAttemptImagePull(requestedImage, imageRef, nil, nil)) {`
`182`	`183`	`msg := fmt.Sprintf("Container image %q already present on machine", requestedImage)`
`183`	`184`	`m.logIt(objRef, v1.EventTypeNormal, events.PulledImage, logPrefix, msg, klog.Info)`
`184`	`185`	`return imageRef, msg, nil`