feat(sync): always pull mutable sidecar image tags

Author: acmore

internal/kube/podspec.go

@@ -2,10 +2,14 @@ package kube
 
 import (
 	"fmt"
+	"regexp"
+	"strings"
 
 	corev1 "k8s.io/api/core/v1"
 )
 
+var semverTagPattern = regexp.MustCompile(`^v?\d+\.\d+\.\d+([.-][0-9A-Za-z.-]+)?$`)
+
 func PreparePodSpec(podSpec corev1.PodSpec, workspaceClaim, workspaceMountPath string, syncthingEnabled bool, syncthingImage string) (corev1.PodSpec, error) {
 	spec := podSpec.DeepCopy()
 	if spec == nil {
@@ -43,9 +47,10 @@ func PreparePodSpec(podSpec corev1.PodSpec, workspaceClaim, workspaceMountPath s
 		})
 		if !hasContainer(spec.Containers, "syncthing") {
 			spec.Containers = append(spec.Containers, corev1.Container{
-				Name:    "syncthing",
-				Image:   syncthingImage,
-				Command: []string{"sh", "-lc", "syncthing serve --home /var/syncthing --no-browser --gui-address=http://0.0.0.0:8384 --no-restart --skip-port-probing"},
+				Name:            "syncthing",
+				Image:           syncthingImage,
+				ImagePullPolicy: syncthingImagePullPolicy(syncthingImage),
+				Command:         []string{"sh", "-lc", "syncthing serve --home /var/syncthing --no-browser --gui-address=http://0.0.0.0:8384 --no-restart --skip-port-probing"},
 				Ports: []corev1.ContainerPort{
 					{ContainerPort: 8384, Name: "st-gui"},
 					{ContainerPort: 22000, Name: "st-sync"},
@@ -61,6 +66,29 @@ func PreparePodSpec(podSpec corev1.PodSpec, workspaceClaim, workspaceMountPath s
 	return *spec, nil
 }
 
+func syncthingImagePullPolicy(image string) corev1.PullPolicy {
+	if strings.Contains(image, "@sha256:") {
+		return corev1.PullIfNotPresent
+	}
+	tag := imageTag(image)
+	if tag == "" {
+		return corev1.PullAlways
+	}
+	if semverTagPattern.MatchString(tag) {
+		return corev1.PullIfNotPresent
+	}
+	return corev1.PullAlways
+}
+
+func imageTag(image string) string {
+	lastSlash := strings.LastIndex(image, "/")
+	lastColon := strings.LastIndex(image, ":")
+	if lastColon <= lastSlash {
+		return ""
+	}
+	return strings.TrimSpace(image[lastColon+1:])
+}
+
 func ensureVolume(volumes []corev1.Volume, v corev1.Volume) []corev1.Volume {
 	for _, item := range volumes {
 		if item.Name == v.Name {

internal/kube/podspec_test.go

@@ -17,6 +17,16 @@ func TestPreparePodSpecAddsWorkspaceAndSyncthing(t *testing.T) {
 	if !hasContainer(spec.Containers, "syncthing") {
 		t.Fatal("expected syncthing container")
 	}
+	var st corev1.Container
+	for _, c := range spec.Containers {
+		if c.Name == "syncthing" {
+			st = c
+			break
+		}
+	}
+	if st.ImagePullPolicy != corev1.PullAlways {
+		t.Fatalf("expected PullAlways for mutable tag, got %s", st.ImagePullPolicy)
+	}
 }
 
 func TestPreparePodSpecWithoutSyncthing(t *testing.T) {
@@ -28,3 +38,22 @@ func TestPreparePodSpecWithoutSyncthing(t *testing.T) {
 		t.Fatal("did not expect syncthing container")
 	}
 }
+
+func TestSyncthingImagePullPolicy(t *testing.T) {
+	cases := []struct {
+		image string
+		want  corev1.PullPolicy
+	}{
+		{image: "ghcr.io/acmore/okdev:edge", want: corev1.PullAlways},
+		{image: "ghcr.io/acmore/okdev:latest", want: corev1.PullAlways},
+		{image: "ghcr.io/acmore/okdev", want: corev1.PullAlways},
+		{image: "ghcr.io/acmore/okdev:v0.1.0", want: corev1.PullIfNotPresent},
+		{image: "ghcr.io/acmore/okdev:1.2.3", want: corev1.PullIfNotPresent},
+		{image: "ghcr.io/acmore/okdev@sha256:deadbeef", want: corev1.PullIfNotPresent},
+	}
+	for _, tc := range cases {
+		if got := syncthingImagePullPolicy(tc.image); got != tc.want {
+			t.Fatalf("image %q: want %s, got %s", tc.image, tc.want, got)
+		}
+	}
+}