Pull Policy for WebAssembly Modules

Analogous to of Kubernetes, also has the notion of IfNotPresent and Always, which means “use the cached module” and “always pull the module regardless of the cache”, respectively.

1. If the url field points to an OCI image and it has a digest suffix (e.g., ), IfNotPresent policy is used.

When ImagePullPolicy is not specified for a resource, Istio defaults to IfNotPresent behavior. However, if the provided url field specifies an OCI image that has a tag value of latest, Istio will use Always behavior.

This expiration can be configured via the environment variables WASM_MODULE_EXPIRY and of , which are the duration of expiration and the interval for checking the expiration respectively.

For a WasmPlugin, ImagePullPolicy: Always means that Istio will pull an image directly from its source each time the corresponding WasmPlugin Kubernetes resource is created or changed. Please note that a change not only in spec but also metadata triggers the pulling of a Wasm module when the Always policy is used. This can mean that an image is pulled from source several times over the lifetime of a pod, and over the lifetime of an individual proxy.