fix: default init container imagePullPolicy to IfNotPresent (#1692)

Set default init container imagePullPolicy to IfNotPresent for project-clone, restore containers, and DWOC-defined (.config.workspace.initContainers) init containers.

Signed-off-by: David Kwon <dakwon@redhat.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Author: dkwon17

apis/controller/v1alpha1/devworkspaceoperatorconfig_types.go

@@ -438,6 +438,7 @@ type ProjectCloneConfig struct {
 	Image string `json:"image,omitempty"`
 	// ImagePullPolicy configures the imagePullPolicy for the project clone container.
 	// If undefined, the general setting .config.workspace.imagePullPolicy is used instead.
+	// If neither is set, defaults to IfNotPresent.
 	ImagePullPolicy corev1.PullPolicy `json:"imagePullPolicy,omitempty"`
 	// Resources defines the resource (cpu, memory) limits and requests for the project
 	// clone container. To explicitly not specify a limit or request, define the resource
@@ -449,7 +450,7 @@ type ProjectCloneConfig struct {
 
 type RestoreConfig struct {
 	// ImagePullPolicy configures the imagePullPolicy for the restore container.
-	// If undefined, the general setting .config.workspace.imagePullPolicy is used instead.
+	// If undefined, defaults to IfNotPresent.
 	ImagePullPolicy corev1.PullPolicy `json:"imagePullPolicy,omitempty"`
 	// Resources defines the resource (cpu, memory) limits and requests for the restore
 	// container. To explicitly not specify a limit or request, define the resource

controllers/workspace/devworkspace_controller.go

@@ -373,8 +373,8 @@ func (r *DevWorkspaceReconciler) Reconcile(ctx context.Context, req ctrl.Request
 			Env:       env.GetEnvironmentVariablesForProjectRestore(workspace),
 			Resources: workspace.Config.Workspace.RestoreConfig.Resources,
 		}
-		if config.Workspace.ImagePullPolicy != "" {
-			restoreOptions.PullPolicy = corev1.PullPolicy(config.Workspace.ImagePullPolicy)
+		if workspace.Config.Workspace.RestoreConfig.ImagePullPolicy != "" {
+			restoreOptions.PullPolicy = workspace.Config.Workspace.RestoreConfig.ImagePullPolicy
 		} else {
 			restoreOptions.PullPolicy = corev1.PullIfNotPresent
 		}
@@ -445,13 +445,16 @@ func (r *DevWorkspaceReconciler) Reconcile(ctx context.Context, req ctrl.Request
 			return r.failWorkspace(workspace, fmt.Sprintf("Failed to merge init containers: %s", err), metrics.ReasonBadRequest, reqLogger, &reconcileStatus), nil
 		}
 
-		// Ensure init-persistent-home container has correct fields after merge
+		// Post-merge fixups on init containers
 		for i := range merged {
 			if merged[i].Name == constants.HomeInitComponentName {
 				if err := home.EnsureHomeInitContainerFields(&merged[i]); err != nil {
 					return r.failWorkspace(workspace, fmt.Sprintf("Failed to configure %s container: %s", constants.HomeInitComponentName, err), metrics.ReasonBadRequest, reqLogger, &reconcileStatus), nil
 				}
 			}
+			if merged[i].ImagePullPolicy == "" {
+				merged[i].ImagePullPolicy = corev1.PullIfNotPresent
+			}
 		}
 
 		devfilePodAdditions.InitContainers = merged

controllers/workspace/devworkspace_controller_test.go

@@ -1555,6 +1555,222 @@ var _ = Describe("DevWorkspace Controller", func() {
 
 	})
 
+	Context("Init container imagePullPolicy", func() {
+		const testURL = "test-url"
+
+		BeforeEach(func() {
+			httpfactory.SetupHttpClientsForTesting(&http.Client{
+				Transport: &testutil.TestRoundTripper{
+					Data: map[string]testutil.TestResponse{
+						fmt.Sprintf("%s/healthz", testURL): {
+							StatusCode: http.StatusOK,
+						},
+					},
+				},
+			})
+		})
+
+		AfterEach(func() {
+			deleteDevWorkspace(devWorkspaceName)
+			httpfactory.SetupHttpClientsForTesting(getBasicTestHttpClient())
+		})
+
+		It("Defaults project-clone imagePullPolicy to IfNotPresent", func() {
+			createDevWorkspace(devWorkspaceName, "test-devworkspace.yaml")
+			devworkspace := getExistingDevWorkspace(devWorkspaceName)
+			workspaceID := devworkspace.Status.DevWorkspaceId
+
+			By("Manually making Routing ready to continue")
+			markRoutingReady(testURL, common.DevWorkspaceRoutingName(workspaceID))
+
+			deploy := &appsv1.Deployment{}
+			deployNN := namespacedName(common.DeploymentName(workspaceID), testNamespace)
+			Eventually(func() error {
+				return k8sClient.Get(ctx, deployNN, deploy)
+			}, timeout, interval).Should(Succeed(), "Getting workspace deployment from cluster")
+
+			var projectClone *corev1.Container
+			for i := range deploy.Spec.Template.Spec.InitContainers {
+				if deploy.Spec.Template.Spec.InitContainers[i].Name == projects.ProjectClonerContainerName {
+					projectClone = &deploy.Spec.Template.Spec.InitContainers[i]
+				}
+			}
+			Expect(projectClone).NotTo(BeNil(), "project-clone init container should be present")
+			Expect(projectClone.ImagePullPolicy).To(Equal(corev1.PullIfNotPresent), "project-clone should default to IfNotPresent")
+		})
+
+		It("Uses DWOC override for project-clone imagePullPolicy", func() {
+			config.SetGlobalConfigForTesting(&controllerv1alpha1.OperatorConfiguration{
+				Workspace: &controllerv1alpha1.WorkspaceConfig{
+					ProjectCloneConfig: &controllerv1alpha1.ProjectCloneConfig{
+						ImagePullPolicy: corev1.PullAlways,
+					},
+				},
+			})
+			defer config.SetGlobalConfigForTesting(nil)
+
+			createDevWorkspace(devWorkspaceName, "test-devworkspace.yaml")
+			devworkspace := getExistingDevWorkspace(devWorkspaceName)
+			workspaceID := devworkspace.Status.DevWorkspaceId
+
+			By("Manually making Routing ready to continue")
+			markRoutingReady(testURL, common.DevWorkspaceRoutingName(workspaceID))
+
+			deploy := &appsv1.Deployment{}
+			deployNN := namespacedName(common.DeploymentName(workspaceID), testNamespace)
+			Eventually(func() error {
+				return k8sClient.Get(ctx, deployNN, deploy)
+			}, timeout, interval).Should(Succeed(), "Getting workspace deployment from cluster")
+
+			var projectClone *corev1.Container
+			for i := range deploy.Spec.Template.Spec.InitContainers {
+				if deploy.Spec.Template.Spec.InitContainers[i].Name == projects.ProjectClonerContainerName {
+					projectClone = &deploy.Spec.Template.Spec.InitContainers[i]
+				}
+			}
+			Expect(projectClone).NotTo(BeNil(), "project-clone init container should be present")
+			Expect(projectClone.ImagePullPolicy).To(Equal(corev1.PullAlways), "project-clone should use DWOC override")
+		})
+
+		It("Defaults DWOC init container imagePullPolicy to IfNotPresent", func() {
+			config.SetGlobalConfigForTesting(&controllerv1alpha1.OperatorConfiguration{
+				Workspace: &controllerv1alpha1.WorkspaceConfig{
+					InitContainers: []corev1.Container{
+						{
+							Name:    "test-init",
+							Image:   "busybox:latest",
+							Command: []string{"sh", "-c", "echo hello"},
+						},
+					},
+				},
+			})
+			defer config.SetGlobalConfigForTesting(nil)
+
+			createDevWorkspace(devWorkspaceName, "test-devworkspace.yaml")
+			devworkspace := getExistingDevWorkspace(devWorkspaceName)
+			workspaceID := devworkspace.Status.DevWorkspaceId
+
+			By("Manually making Routing ready to continue")
+			markRoutingReady(testURL, common.DevWorkspaceRoutingName(workspaceID))
+
+			deploy := &appsv1.Deployment{}
+			deployNN := namespacedName(common.DeploymentName(workspaceID), testNamespace)
+			Eventually(func() error {
+				return k8sClient.Get(ctx, deployNN, deploy)
+			}, timeout, interval).Should(Succeed(), "Getting workspace deployment from cluster")
+
+			var testInit *corev1.Container
+			for i := range deploy.Spec.Template.Spec.InitContainers {
+				if deploy.Spec.Template.Spec.InitContainers[i].Name == "test-init" {
+					testInit = &deploy.Spec.Template.Spec.InitContainers[i]
+				}
+			}
+			Expect(testInit).NotTo(BeNil(), "test-init container should be present")
+			Expect(testInit.ImagePullPolicy).To(Equal(corev1.PullIfNotPresent), "DWOC init container should default to IfNotPresent")
+		})
+
+		It("Preserves explicit imagePullPolicy on DWOC init containers", func() {
+			config.SetGlobalConfigForTesting(&controllerv1alpha1.OperatorConfiguration{
+				Workspace: &controllerv1alpha1.WorkspaceConfig{
+					InitContainers: []corev1.Container{
+						{
+							Name:            "test-init",
+							Image:           "busybox:latest",
+							Command:         []string{"sh", "-c", "echo hello"},
+							ImagePullPolicy: corev1.PullAlways,
+						},
+					},
+				},
+			})
+			defer config.SetGlobalConfigForTesting(nil)
+
+			createDevWorkspace(devWorkspaceName, "test-devworkspace.yaml")
+			devworkspace := getExistingDevWorkspace(devWorkspaceName)
+			workspaceID := devworkspace.Status.DevWorkspaceId
+
+			By("Manually making Routing ready to continue")
+			markRoutingReady(testURL, common.DevWorkspaceRoutingName(workspaceID))
+
+			deploy := &appsv1.Deployment{}
+			deployNN := namespacedName(common.DeploymentName(workspaceID), testNamespace)
+			Eventually(func() error {
+				return k8sClient.Get(ctx, deployNN, deploy)
+			}, timeout, interval).Should(Succeed(), "Getting workspace deployment from cluster")
+
+			var testInit *corev1.Container
+			for i := range deploy.Spec.Template.Spec.InitContainers {
+				if deploy.Spec.Template.Spec.InitContainers[i].Name == "test-init" {
+					testInit = &deploy.Spec.Template.Spec.InitContainers[i]
+				}
+			}
+			Expect(testInit).NotTo(BeNil(), "test-init container should be present")
+			Expect(testInit.ImagePullPolicy).To(Equal(corev1.PullAlways), "Explicit imagePullPolicy should be preserved")
+		})
+
+		It("Does not override base imagePullPolicy when DWOC init container has no explicit policy", func() {
+			config.SetGlobalConfigForTesting(&controllerv1alpha1.OperatorConfiguration{
+				Workspace: &controllerv1alpha1.WorkspaceConfig{
+					ProjectCloneConfig: &controllerv1alpha1.ProjectCloneConfig{
+						ImagePullPolicy: corev1.PullAlways,
+					},
+					InitContainers: []corev1.Container{
+						{
+							Name: projects.ProjectClonerContainerName,
+							Env:  []corev1.EnvVar{{Name: "EXTRA_VAR", Value: "injected"}},
+						},
+					},
+				},
+			})
+			defer config.SetGlobalConfigForTesting(nil)
+
+			createDevWorkspace(devWorkspaceName, "test-devworkspace.yaml")
+			devworkspace := getExistingDevWorkspace(devWorkspaceName)
+			workspaceID := devworkspace.Status.DevWorkspaceId
+
+			By("Manually making Routing ready to continue")
+			markRoutingReady(testURL, common.DevWorkspaceRoutingName(workspaceID))
+
+			deploy := &appsv1.Deployment{}
+			deployNN := namespacedName(common.DeploymentName(workspaceID), testNamespace)
+			Eventually(func() error {
+				return k8sClient.Get(ctx, deployNN, deploy)
+			}, timeout, interval).Should(Succeed(), "Getting workspace deployment from cluster")
+
+			var projectClone *corev1.Container
+			for i := range deploy.Spec.Template.Spec.InitContainers {
+				if deploy.Spec.Template.Spec.InitContainers[i].Name == projects.ProjectClonerContainerName {
+					projectClone = &deploy.Spec.Template.Spec.InitContainers[i]
+				}
+			}
+			Expect(projectClone).NotTo(BeNil(), "project-clone init container should be present")
+			Expect(projectClone.ImagePullPolicy).To(Equal(corev1.PullAlways), "DWOC patch should not override base imagePullPolicy")
+		})
+
+		It("Keeps workspace container imagePullPolicy as Always", func() {
+			createDevWorkspace(devWorkspaceName, "test-devworkspace.yaml")
+			devworkspace := getExistingDevWorkspace(devWorkspaceName)
+			workspaceID := devworkspace.Status.DevWorkspaceId
+
+			By("Manually making Routing ready to continue")
+			markRoutingReady(testURL, common.DevWorkspaceRoutingName(workspaceID))
+
+			deploy := &appsv1.Deployment{}
+			deployNN := namespacedName(common.DeploymentName(workspaceID), testNamespace)
+			Eventually(func() error {
+				return k8sClient.Get(ctx, deployNN, deploy)
+			}, timeout, interval).Should(Succeed(), "Getting workspace deployment from cluster")
+
+			var devContainer *corev1.Container
+			for i := range deploy.Spec.Template.Spec.Containers {
+				if deploy.Spec.Template.Spec.Containers[i].Name == "web-terminal" {
+					devContainer = &deploy.Spec.Template.Spec.Containers[i]
+				}
+			}
+			Expect(devContainer).NotTo(BeNil(), "web-terminal container should be present")
+			Expect(devContainer.ImagePullPolicy).To(Equal(corev1.PullAlways), "Workspace containers should still default to Always")
+		})
+	})
+
 	Context("Edge cases", func() {
 
 		It("Allows Kubernetes and Container components to share same target port on endpoint", func() {

deploy/bundle/manifests/controller.devfile.io_devworkspaceoperatorconfigs.yaml

@@ -1,3 +1,4 @@
+---
 apiVersion: operators.coreos.com/v1alpha1
 kind: ClusterServiceVersion
 metadata: