Image pull policy is not set to Always misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_K8S_15
Category - Subcategory	Kubernetes - Resource Management
Provider	OTHER
Severity	LOW
Framework	Helm, Kubernetes, Kustomize, Terraform, Terraform Plan

Impact

The Image Pull Policy of a container is set using the imagePullPolicy. The imagePullPolicy and the tag of the image are triggered when the kubelet attempts to pull the specified image. When the imagePullPolicy is set to Always, you ensure the latest version of the image is deployed every time the pod is started. Avoid using the :latest tag when deploying containers in production, it is harder to track which version of the image is running and more difficult to roll back correctly.

How to Fix

Resource: Container Argument: imagePullPolicy (Optional)

Defines for the kubelet when he should attempt to pull the specified image. [source,go]

apiVersion: v1 kind: Pod metadata: name: spec: containers:

• name:
• imagePullPolicy: Always

---