The pull policy defines the behavior when kubelet pulls images. The default pull policy is IfNotPresent, that is, it will pull the image if it is not present locally. If this plugin is enabled, the default pull policy will become Always, which is to always pull the latest image. This plugin also brings another benefit if your cluster is shared by different teams. Whenever a pod is scheduled, it'll always pull the latest image, regardless of whether the image exists locally or not. Then, we can ensure that a pod creation request always goes through an authorization check against the image.