allow override of queue-proxy imagePullPolicy from config-deployment ConfigMap

[timholt81]

In what area(s)?

/area API

Describe the feature

When the queue-proxy container is created (https://github.com/knative/serving/blob/main/pkg/reconciler/revision/resources/queue.go#L349), it would be nice to be able to override the imagePullPolicy from a value in the config-deployment ConfigMap. If not specified it would revert to the current logic i.e. not set.

Policies in my organisation prohibit any deployment with an imagePullPolicy not set as "Always". I'd rather not have to create a custom webhook to achieve this.

[dprotaso]

@timholt81 Have you looked into having a Mutating Admission Policy that sets that field for you?

I would assume your requirement applies to other workloads as well.

[timholt81]

@dprotaso unfortunately mutatingadmissionpolicies aren't supported in our organisation.

[dprotaso]

@timholt81 can you elaborate why?

Generally going forward my own preference is not including specific field knobs in our config-deployment when mutatingadmissionpolicies (MAP) exists. When we created config-deployment in the past Kubernetes didn't support MAPs.

The big reason is we consider editing the config-deployment an operator concern. Which is what MAPs fall under.