The pull policy defines the behavior when kubelet is pulling images. The default pull policy is IfNotPresent; that is, it will pull the image if it is not present locally. If this plugin is enabled, the default pull policy will become Always, which is, always pull the latest image. This plugin also provides another benefit if your cluster is shared by different teams. Whenever a pod is scheduled, it'll always pull the latest image whether the image exists locally or not. Then we can ensure pod creation requests always go through an authorization check against the image.

For a full list of admission controllers, visit the official site (https://kubernetes.io/docs/admin/admission-controllers) for more information.