feat(k8s): always re-pull remote game server images (v1.0.2)

[devin-ai-integration]

Summary

Game server Pods and installation Jobs hard-coded ImagePullPolicy: IfNotPresent, so once an image was cached on a node, restarting or redeploying a server reused the stale local copy and never picked up an updated tag — with no config knob to change it. This aligns the Kubernetes backend with the Docker backend, which always attempts a pull before (re)creating a container.

New resolveImagePullPolicy centralizes the decision and is used by both the server Pod (container.go) and the install Job (installer.go):

func resolveImagePullPolicy(image string) (string, corev1.PullPolicy) {
    cleaned := strings.TrimPrefix(image, "~")
    if override := config.Get().Kubernetes.ImagePullPolicy; override != "" {
        return cleaned, corev1.PullPolicy(override)   // explicit operator override
    }
    if strings.HasPrefix(image, "~") {
        return cleaned, corev1.PullIfNotPresent        // ~-prefixed = local image, don't pull
    }
    return cleaned, corev1.PullAlways                  // remote image, re-pull updated tags
}

• New optional kubernetes.image_pull_policy config (Always / IfNotPresent / Never) for air-gapped clusters; empty = the smart default above.
• Helm chart surfaces it: wings.kubernetes.imagePullPolicy (values) → rendered into the ConfigMap as image_pull_policy (omitted when empty). This is independent of image.pullPolicy, which is for the Wings daemon image itself.
• Docs added to the chart README and kubernetes/README.md.
• Chart version/appVersion bumped to 1.0.2.

Note: the power-lock restart-while-off fix (#3) is already merged to main, so this is the only remaining change since v1.0.1. Tagging v1.0.2 after merge will trigger the release + helm/container publish workflows.

Test plan

• go build ./..., go vet ./environment/kubernetes/... — clean
• go test ./environment/kubernetes/... — new TestResolveImagePullPolicy covers remote→Always, ~-local→IfNotPresent, and override→configured value
• helm lint chart/pelican-wings — passes
• gofmt — clean

Link to Devin session: https://app.devin.ai/sessions/c6e2874ef8924e68a929e491c2018270
Requested by: @Exonical

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

Devin Review found 1 potential issue.

[devin-ai-integration]

🚩 Behavioral change: default pull policy shifted from IfNotPresent to Always for remote images

Before this PR, both game server Pods (container.go:151 old) and installer Jobs (installer.go:124 old) used corev1.PullIfNotPresent unconditionally. After this PR, remote (non-~) images default to corev1.PullAlways. This is an intentional change to match Docker backend behavior (which always attempts a pull for remote images, see environment/docker/container.go:381-382), but it's a meaningful behavioral difference for existing deployments: Kubernetes will now attempt to pull on every Pod/Job creation, adding latency and requiring registry access. Operators relying on pre-cached images without registry access will see failures after upgrading unless they set image_pull_policy: IfNotPresent.

---

Was this helpful? React with 👍 or 👎 to provide feedback.