From 30e5cdd6412c9efe28ac6cb44402b0fb82ef6361 Mon Sep 17 00:00:00 2001 From: Anton Tykhyy Date: Sat, 19 Jul 2025 16:20:34 +0300 Subject: [PATCH] kubelet: don't fetch image credentials if the image is present and if we don't need to check if the pod is allowed to pull it --- pkg/kubelet/images/image_manager.go | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/pkg/kubelet/images/image_manager.go b/pkg/kubelet/images/image_manager.go index b76f87d19aa..67165596206 100644 --- a/pkg/kubelet/images/image_manager.go +++ b/pkg/kubelet/images/image_manager.go @@ -178,6 +178,12 @@ func (m *imageManager) EnsureImageExists(ctx context.Context, objRef *v1.ObjectR return "", message, err } + if imageRef != "" && !utilfeature.DefaultFeatureGate.Enabled(features.KubeletEnsureSecretPulledImages) { + msg := fmt.Sprintf("Container image %q already present on machine", requestedImage) + m.logIt(objRef, v1.EventTypeNormal, events.PulledImage, logPrefix, msg, klog.Info) + return imageRef, msg, nil + } + repoToPull, _, _, err := parsers.ParseImageName(spec.Image) if err != nil { return "", err.Error(), err @@ -207,12 +213,6 @@ func (m *imageManager) EnsureImageExists(ctx context.Context, objRef *v1.ObjectR pullCredentials, _ := keyring.Lookup(repoToPull) if imageRef != "" { - if !utilfeature.DefaultFeatureGate.Enabled(features.KubeletEnsureSecretPulledImages) { - msg := fmt.Sprintf("Container image %q already present on machine", requestedImage) - m.logIt(objRef, v1.EventTypeNormal, events.PulledImage, logPrefix, msg, klog.Info) - return imageRef, msg, nil - } - var imagePullSecrets []kubeletconfiginternal.ImagePullSecret for _, s := range pullCredentials { if s.Source == nil {