ignore update pod without new image in alwayspullimages admission controller

[pacoxu]

What type of PR is this?
/kind bug

What this PR does / why we need it:
When AlwaysPullImages is enabled, the annotations/labels/finalizers of existing(old) pod(ImagePullPolicy=IfNotPresent) can not be updated.

The reason is that ImagePullPolicy is immutable container attribute. When we try to update the image of the pod, the ImagePullPolicy will be changed as AlwaysPullImages is enabled. The image change update will failed.

https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.19/#container-v1-core

Fixed the `AlwaysPullImages` admission plugin to tolerate updates of pods with an imagePullPolicy other than `Always` already set

Which issue(s) this PR fixes:

Fixes #96624

Special notes for your reviewer:
As @bjrara and liggit commented in 96624, This pr tries to ignore update pod when alwayspullimages is enabled.

Another workaround would be that pod need to be recreated after enabling AlwaysPullImages.

The pod will be still ifNotPresent after updating, even if the AlwaysPullImages is enabled.

Does this PR introduce a user-facing change?:

ignore update pod with no new images in alwaysPullImages admission controller

Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:

None

[pacoxu]

/sig node auth
/triage accepted

[liggitt]

rather than allowing the imagePullPolicy to be updated, I'd expect the AlwaysPullImages admission plugin to be fixed to ignore/tolerate updates to pods which do not change the container images, even if the pull policy is not Always.

[pacoxu]

rather than allowing the imagePullPolicy to be updated, I'd expect the AlwaysPullImages admission plugin to be fixed to ignore/tolerate updates to pods which do not change the container images, even if the pull policy is not Always.

changed to the other solution, ignore update pod in alwayspullimages.

[liggitt]

we can ignore update requests if no images change like this:

if attributes.GetOperation() == admission.Update {
  oldImages := sets.NewString()
  pods.VisitContainersWithPath(&oldPod.Spec, field.NewPath("spec"), func(c *api.Container, _ *field.Path) bool {
    oldImages.Insert(c.Image)
    return true
  })
  newImages := sets.NewString()
  pods.VisitContainersWithPath(&newPod.Spec, field.NewPath("spec"), func(c *api.Container, _ *field.Path) bool {
    newImages.Insert(c.Image)
    return true
  })
  if oldImages.HasAll(newImages) {
    // ignore updates that don't change the images referenced by the pod spec
    return nil
  }
}

[zhouhaibing089]

we can ignore update requests if no images change like this:

Could this strategy be applied to other admissions as well? For example:

1. LimitRanger which might defaults resources.limits on updates.
2. PodSecurityPolicy which might defaults securityContexts on updates.

[pacoxu]

/triage accepted

[liggitt]

thanks, looks good, just a couple stylistic comments

go ahead and squash to a single commit as well

[pacoxu]

/retest

[pacoxu]

squashed and fixed

[liggitt]

/priority backlog
/lgtm
/approve
/milestone v1.21

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: liggitt, pacoxu

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• plugin/pkg/admission/OWNERS [liggitt]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[zhouhaibing089]

I guess this could be extracted as a utility function and then can be shared in other admissions. :)

[pacoxu]

Could this strategy be applied to other admissions as well? For example:

LimitRanger which might defaults resources.limits on updates.
PodSecurityPolicy which might defaults securityContexts on updates.

@zhouhaibing089
I will extract isUpdateWithNoNewImages as util and check whether it can add to plugin PodSecurityPolicy and LimitRanger recently.