# base/deployment.yaml sets imagePullPolicy: Always, which is the right
# default for a mutable tag like :latest. The dev overlay pins an immutable
# sha-<commit> tag instead (see image-tag/), and for an immutable tag Always
# is pure waste - the content behind that tag can never change, so re-pulling
# it on every pod start only adds a registry round-trip and a hard dependency
# on the registry being reachable at scheduling time.
#
# It is also load-bearing right now: until CI can actually push (GitLab's
# registry vhost serves Rails, not the registry - see .gitlab-ci.yml's
# "Registry history" note), sha- tagged images are side-loaded straight into
# each node's containerd:
#
#   docker save --platform linux/amd64 -o vncmail.tar <image>:<tag>
#   scp vncmail.tar dev-k8s-N:/tmp/ && ssh dev-k8s-N \
#     'microk8s ctr images import /tmp/vncmail.tar'
#
# imported to ALL of dev-k8s-1/2/3 so the pod can schedule anywhere. With
# Always, kubelet would ignore that local image and fail on a registry pull
# for a tag the registry has never seen.
apiVersion: apps/v1
kind: Deployment
metadata:
  name: vncmail-plus
spec:
  template:
    spec:
      containers:
        - name: vncmail-plus
          imagePullPolicy: IfNotPresent