If you leave imagePullPolicy unset, Kubernetes picks Always for the latest tag or no tag, and IfNotPresent for any other tag or a digest. The value is set when the object is created and is not updated if the tag or digest later changes. That default decides whether nodes ever see your patched image.
The three policies
From the Kubernetes images documentation:
- IfNotPresent. The image is pulled only if it is not already on the node.
- Always. Every time the kubelet launches a container, it asks the runtime to pull. The runtime resolves the tag or name to a digest and downloads any layers not already cached locally.
- Never. The kubelet does not try to fetch the image. If it is missing, startup fails.
What gets set when you omit it
The documentation lists the defaults.
- A digest: IfNotPresent
- The latest tag: Always
- No tag at all: Always
- Any other tag: IfNotPresent
Two points deserve attention. The page says that with no tag, Kubernetes assumes you mean latest. And it says the default is set when the object is first created, so changing the tag in a template later does not rewrite a policy that was already stored.
Why this matters for security
Moving tags and IfNotPresent do not mix. Tags can be moved to point to different images, but digests are fixed. Suppose a deployment uses a version tag with IfNotPresent, and the publisher rebuilds that tag with a patched base. A node that already holds the old image keeps running the old one for new pods. Two nodes can run different content under the same name.
Latest in production is a documented bad idea. The docs say to avoid the latest tag when deploying containers in production, because it is harder to track which version is running and harder to roll back.
Digest pinning removes the ambiguity. Replace the tag with an at-sign and the digest, and the image identifies one exact version. The cost is that you must update the reference yourself to get fixes, so pair it with an update process. See pinning by digest.
A sensible setup
- Reference images by digest, or by unique version tags your registry does not allow to be overwritten.
- Keep IfNotPresent for those, since the content cannot change under the name.
- If you must use a moving tag, set Always explicitly. The documentation also mentions the AlwaysPullImages admission controller to force pulls cluster-wide.
- Roll out a new reference to get a patch, instead of hoping a node re-pulls.
What Always does and does not do
Always does not mean every request hits the registry for the whole image. The runtime resolves the tag to a digest, and layers already cached are not downloaded again. It does mean the tag is re-resolved at each container start, which adds a dependency on the registry being reachable at that moment.
If an outage of your registry should not stop pods from restarting, pinned digests with IfNotPresent are more resilient.
Safeguard's continuous monitoring and SBOM scanning can flag when a deployed image has a new finding, so you know which reference to update. A free scan can start the inventory.
Quick check
If I change the tag in my Deployment, does the old policy update?
Per the docs, the defaulted value is set at object creation and not updated when the tag or digest changes. Set the policy explicitly if you rely on it.
Is Always more secure than IfNotPresent?
Not by itself. It refreshes moving tags, but digests give a stronger guarantee about what runs.
Sources
Last reviewed: 19 October 2026.
