Add support for disabling tag resolution in revisions

[ycd]

In what area(s)?

/area API
/kind spec

Describe the feature

Currently when a new revision is applied, the controller component, queries the Docker Registry API, performs tag resolution for the given image tag and retrieves the sha256 hash of the image and uses imageDigest instead of the tag and as a result we have a reproducible image deployment.

This is great for most cases, but what I expect from activator component is respect to image pull policy.

imagePullPolicy: Always

Currently even if a new image pushed to the image:latest it is not respected by the activator component since it uses the imageDigest as long as you don't create a new revision.

It would be great if there is an option to disable tag resolution like we do for enable-scale-to-zero and allow-zero-initial-scale.

[dprotaso]

This is great for most cases, but what I expect from activator component is respect to image pull policy.

Can you clarify what you mean? The activator component isn't responsible for any tag-to-digest resolution

[ycd]

Thank you for the response @dprotaso.

The activator component isn't responsible for any tag-to-digest resolution

Yes. I am aware of that, that's why I mentioned this above.

Currently when a new revision is applied, the controller component, queries the Docker Registry API, performs tag resolution for the given image tag and retrieves the sha256 hash of the image and uses imageDigest instead of the tag and as a result we have a reproducible image deployment.

---

Can you clarify what you mean?

Sure thing. Once Knative does tag-to-digest resolution, in revision we have an immutable image reference.

Imagine I deploy a Knative service with the image hello-go:latest, it creates a new revision and in the created revision image becomes hello-go@sha256:123456789abcdef.

Then a new image pushed to latest tag, even if my service scaled down to zero, the activator will buffer the request until a new pod is created. The thing is the new pod is going to use the old image even if a have imagePullPolicy: Always.

It would be great to have an option to disable tag-to-digest resolution.

[dprotaso]

We allow operators to configure which registries to skip tag to digest resolution
See: https://knative.dev/docs/serving/configuration/deployment/#skipping-tag-resolution

There are issues using tags only which we documented here:
https://docs.google.com/presentation/d/e/2PACX-1vTgyp2lGDsLr_bohx3Ym_2mrTcMoFfzzd6jocUXdmWQFdXydltnraDMoLxvEe6WY9pNPpUUvM-geJ-g/pub?resourcekey=0-FH5lN4C2sbURc_ds8XRHeA#slide=id.p

So I would be very cautious with using tags since it nullifies the benefit of revisions - ie. rolling back to a working version, consistency in the code deployed etc

[ycd]

This is great, exactly what I wanted in the first place.

Thank you for the slides and the response, much appreciated!