# Ensure that the admission control plugin AlwaysPullImages is set

- Source: https://support.icompaas.com/support/solutions/articles/62000234615-ensure-that-the-admission-control-plugin-alwayspullimages-is-set
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [CIS Kubernetes Benchmark v1.9.0](https://support.icompaas.com/support/solutions/62000112690) › [CIS Kubernetes Benchmark](https://support.icompaas.com/support/solutions/folders/62000169256)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

Profile Applicability:

-   **Level 1**  
      
    

### Description:

The AlwaysPullImages admission control plugin ensures that every time a container is launched, the image is pulled from the image registry, even if the image already exists on the node. This setting guarantees that the most up-to-date image is used, preventing the use of outdated or vulnerable container images that may already be cached on the node.

### Rationale:

By enabling the AlwaysPullImages plugin, you ensure that the most recent version of container images is always used. This helps mitigate risks related to running outdated images that may contain known vulnerabilities or bugs. It is especially important in environments where image versions are frequently updated to address security issues.

### Impact:

Pros:  

-   Ensures that containers run with the most recent image, improving security and reliability.  
    
-   Prevents the use of stale, vulnerable, or misconfigured images that may exist in node caches.  
    

Cons:  

-   Additional network bandwidth usage due to pulling images every time, potentially impacting performance, especially in environments with large images or slow network connections.  
    

### Default Value:

Not enabled by default. The default behavior is to use cached images if they are already present on the node.

### Pre-requisites:

-   The Kubernetes environment must have access to a reliable and up-to-date image registry.  
    
-   Container images should be properly versioned to ensure correct updates.  
    

### Test Plan:

#### Using AWS Console:

1.  Sign in to the AWS Management Console.  
    
2.  Navigate to your EKS Cluster.  
    
3.  Go to the Node Group or EKS configuration details.  
    
4.  Check the \--enable-admission-plugins flag and verify that AlwaysPullImages is listed among the enabled plugins.
    

#### Using AWS CLI:

Run the following AWS CLI command to describe your EKS cluster's configuration:  
aws eks describe-cluster --name <cluster-name> --query "cluster.config"

1.  Ensure that AlwaysPullImages is included in the \--enable-admission-plugins list.
    

### Implementation Plan

#### Using AWS Console:

1.  Navigate to the EKS cluster in the AWS Console.  
    
2.  Under the Cluster Configuration section, modify the API server's settings.  
    
3.  Add AlwaysPullImages to the list of enabled admission control plugins.
    
4.  Save the configuration and apply the changes.  
    

#### Using AWS CLI:

Update the \--enable-admission-plugins argument to include AlwaysPullImages:

aws eks update-cluster-config --name <cluster-name> --kubernetes-version <kubernetes-version> --enable-admission-plugins AlwaysPullImages

### Backout Plan

#### Using AWS Console:

1.  Navigate to the EKS cluster's API server configuration.  
    
2.  Remove AlwaysPullImages from the list of enabled admission control plugins if necessary.
    
3.  Save the configuration and redeploy the cluster.  
    

#### Using AWS CLI:

If issues occur, revert the change using:

aws eks update-cluster-config --name <cluster-name> --kubernetes-version <kubernetes-version> --disable-admission-plugins AlwaysPullImages

### References:

-   Kubernetes Admission Control Documentation  
    [EKS Cluster Management  
    ](https://docs.aws.amazon.com/eks/latest/userguide/what-is-eks.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.