# upgraded to use calico-ipam.
        - name: upgrade-ipam
          image: gcr.io/istio-testing/calico/cni:v3.27.0
          imagePullPolicy: IfNotPresent
          command: ["/opt/cni/bin/calico-ipam", "-upgrade"]
          envFrom:
          - configMapRef:

	out.TerminationMessagePath = in.TerminationMessagePath
	out.TerminationMessagePolicy = core.TerminationMessagePolicy(in.TerminationMessagePolicy)
	out.ImagePullPolicy = core.PullPolicy(in.ImagePullPolicy)
	out.SecurityContext = (*core.SecurityContext)(unsafe.Pointer(in.SecurityContext))
	out.Stdin = in.Stdin
	out.StdinOnce = in.StdinOnce
	out.TTY = in.TTY
	return nil
}

	// Cannot be updated.
	// More info: https://kubernetes.io/docs/concepts/containers/images#updating-images
	// +optional
	ImagePullPolicy PullPolicy `json:"imagePullPolicy,omitempty" protobuf:"bytes,14,opt,name=imagePullPolicy,casttype=PullPolicy"`
	// SecurityContext defines the security options the container should be run with.

	//
	// More info: https://kubernetes.io/docs/concepts/containers/images#updating-images
	ImagePullPolicy string `protobuf:"bytes,13,opt,name=imagePullPolicy,proto3" json:"imagePullPolicy,omitempty"`
	// ImagePullSecrets for the control plane ServiceAccount, list of secrets in the same namespace
	// to use for pulling any images in pods that reference this ServiceAccount.

	allErrs = append(allErrs, ValidateVolumeDevices(ctr.VolumeDevices, volMounts, volumes, path.Child("volumeDevices"))...)
	allErrs = append(allErrs, validatePullPolicy(ctr.ImagePullPolicy, path.Child("imagePullPolicy"))...)
	allErrs = append(allErrs, ValidateResourceRequirements(&ctr.Resources, podClaimNames, path.Child("resources"), opts)...)

  // Cannot be updated.
  // More info: https://kubernetes.io/docs/concepts/containers/images#updating-images
  // +optional
  optional string imagePullPolicy = 14;

  // SecurityContext defines the security options the container should be run with.
  // If set, the fields of SecurityContext override the equivalent fields of PodSecurityContext.

	// Required.
	// +optional
	TerminationMessagePath string
	// +optional
	TerminationMessagePolicy TerminationMessagePolicy
	// Required: Policy for pulling images for this container
	ImagePullPolicy PullPolicy
	// Optional: SecurityContext defines the security options the container should be run with.
	// If set, the fields of SecurityContext override the equivalent fields of PodSecurityContext.
	// +optional

	"imagePullPolicy":          "Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. Cannot be updated. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images",...

  // Cannot be updated.
  // More info: https://kubernetes.io/docs/concepts/containers/images#updating-images
  // +optional
  optional string imagePullPolicy = 14;

  // SecurityContext defines the security options the container should be run with.
  // If set, the fields of SecurityContext override the equivalent fields of PodSecurityContext.

### **Multicluster**

#### **Federation**

*   Kubefed init now supports --imagePullSecrets and --imagePullPolicy, making it possible to use private registries. ([#50740](https://github.com/kubernetes/kubernetes/pull/50740),[ @dixudx](https://github.com/dixudx))