Home / server / Questions / 1049555
In Process
Steve Folly
Asked: 2021-01-13 07:46:51 +0800 CST

Kubernetes deployment - don't restart pods if image checksum hasn't changed

  • 772

We have a system that currently uses docker-compose for deployment of containers (effectively docker-compose pull && docker-compose up) and are in the process of converting the system to Kubernetes.

We have CI/CD that deploys to production automatically based on git tags pushed to the git repository. For staging, we keeping advancing a branch. The docker images are built and tagged with either the git production tag or git staging branch name.

At deployment, docker-compose is intelligent enough to not restart the container if the image is actually the same, i.e. two production tags point to the same image.

I'm looking for a way to do the same thing in Kubernetes - if at deployment the actual image used for the container of the pod is the same as what's already running (based on the image checksum, not just the image tag), then it shouldn't have to restart the pod. Is this possible?

Thanks

kubernetes docker-compose

1 Answers

  1. As I mentioned in comments, it should work out of the box with imagePullPolicy:Always.

    According to documentation

    Container Images

    The imagePullPolicy and the tag of the image affect when the kubelet attempts to pull the specified image.

    imagePullPolicy: Always: every time the kubelet launches a container, the kubelet queries the container image registry to resolve the name to an image digest. If the kubelet has a container image with that exact digest cached locally, the kubelet uses its cached image; otherwise, the kubelet downloads (pulls) the image with the resolved digest, and uses that image to launch the container.

    Note: To make sure the container always uses the same version of the image, you can specify its digest; replace : with @ (for example, image@sha256:45b23dee08af5e43a7fea6c4cf9c25ccf269ee113168c19722f87876677c5cb2). The digest uniquely identifies a specific version of the image, so it is never updated by Kubernetes unless you change the digest value.

    Also there is a tool called imago, worth to take a look on it. Imago checks running pods sha256 and just restart resource that need to use newer images.

    • 1