Invalidate imageCache if the pinned image from config exists

Signed-off-by: roman-kiselenko <roman.kiselenko.dev@gmail.com>

internal/storage/image.go

@@ -151,6 +151,10 @@ type ImageServer interface {
 	// CandidatesForPotentiallyShortImageName resolves an image name into a set of fully-qualified image names (domain/repo/image:tag|@digest).
 	// It will only return an empty slice if err != nil.
 	CandidatesForPotentiallyShortImageName(systemContext *types.SystemContext, imageName string) ([]RegistryImageReference, error)
+
+	// UpdateImageCache invalidate imageCache if the pinned image from config exists;
+	// this method doesn't change the Pinned attribute, only removes the image item.
+	UpdateImageCache(configPinnedImage []string) error
 }
 
 func parseImageNames(image *storage.Image) (someName *RegistryImageReference, tags []reference.NamedTagged, digests []reference.Canonical, err error) {
@@ -897,6 +901,26 @@ func (st nativeStorageTransport) ResolveReference(ref types.ImageReference) (typ
 	return istorage.ResolveReference(ref)
 }
 
+// UpdateImageCache invalidate imageCache if the pinned image from config exists;
+// this method doesn't change the Pinned attribute, only removes the image item.
+func (svc *imageService) UpdateImageCache(configPinnedImage []string) error {
+	images, err := svc.store.Images()
+	if err != nil {
+		return err
+	}
+	for i := range images {
+		img := &images[i]
+		for _, name := range img.Names {
+			if FilterPinnedImage(name, CompileRegexpsForPinnedImages(configPinnedImage)) {
+				svc.imageCacheLock.Lock()
+				delete(svc.imageCache, img.ID)
+				svc.imageCacheLock.Unlock()
+			}
+		}
+	}
+	return nil
+}
+
 // FilterPinnedImage checks if the given image needs to be pinned
 // and excluded from kubelet's image GC.
 func FilterPinnedImage(image string, pinnedImages []*regexp.Regexp) bool {

server/server.go

@@ -573,7 +573,7 @@ func (s *Server) startReloadWatcher(ctx context.Context) {
 		for {
 			// Block until the signal is received
 			<-ch
-			if err := s.config.Reload(); err != nil {
+			if err := s.reloadConfigByHUP(); err != nil {
 				logrus.Errorf("Unable to reload configuration: %v", err)
 				continue
 			}
@@ -583,6 +583,19 @@ func (s *Server) startReloadWatcher(ctx context.Context) {
 	log.Infof(ctx, "Registered SIGHUP reload watcher")
 }
 
+// reloadConfigByHUP reload the config and UpdateImageCache
+func (s *Server) reloadConfigByHUP() error {
+	if err := s.config.Reload(); err != nil {
+		return err
+	}
+	if len(s.config.PinnedImages) > 0 {
+		if err := s.StorageImageServer().UpdateImageCache(s.config.PinnedImages); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
 func useDefaultUmask() {
 	const defaultUmask = 0o022
 	oldUmask := unix.Umask(defaultUmask)