feat: add GitOps compatibility

docs/configuration.md

@@ -32,6 +32,7 @@ The option `imageSwapPolicy` (default: `exists`) defines the mutation strategy u
 * `exists`: Only swaps the image if it exits in the target registry.
             This can result in pods pulling images from the source registry, e.g. the first pod pulls
             from source registry, subsequent pods pull from target registry.
+* `never` : Do not swap the image.
 
 ## ImageCopyPolicy
 

pkg/types/types.go

@@ -29,10 +29,11 @@ type ImageSwapPolicy int
 const (
 	ImageSwapPolicyAlways = iota
 	ImageSwapPolicyExists
+	ImageSwapPolicyNever
 )
 
 func (p ImageSwapPolicy) String() string {
-	return [...]string{"always", "exists"}[p]
+	return [...]string{"always", "exists", "never"}[p]
 }
 
 func ParseImageSwapPolicy(p string) (ImageSwapPolicy, error) {
@@ -41,6 +42,8 @@ func ParseImageSwapPolicy(p string) (ImageSwapPolicy, error) {
 		return ImageSwapPolicyAlways, nil
 	case ImageSwapPolicy(ImageSwapPolicyExists).String():
 		return ImageSwapPolicyExists, nil
+	case ImageSwapPolicy(ImageSwapPolicyNever).String():
+		return ImageSwapPolicyNever, nil
 	}
 	return ImageSwapPolicyExists, fmt.Errorf("unknown image swap policy string: '%s', defaulting to exists", p)
 }

pkg/types/types_test.go

@@ -22,6 +22,11 @@ func TestParseImageSwapPolicy(t *testing.T) {
 			args: args{p: "exists"},
 			want: ImageSwapPolicyExists,
 		},
+		{
+			name: "never",
+			args: args{p: "never"},
+			want: ImageSwapPolicyNever,
+		},
 		{
 			name:    "random-non-existent",
 			args:    args{p: "random-non-existent"},

pkg/webhook/image_swapper.go

@@ -253,6 +253,8 @@ func (p *ImageSwapper) Mutate(ctx context.Context, ar *kwhmodel.AdmissionReview,
 				} else {
 					log.Ctx(lctx).Debug().Str("image", targetImage).Msg("container image not found in target registry, not swapping")
 				}
+			case types.ImageSwapPolicyNever:
+				// do not swap image
 			default:
 				panic("unknown imageSwapPolicy")
 			}