Add admission controller to force image pulls

Add an admission controller that forces every container's image pull policy to
Always when a pod is created.

docs/admin/admission-controllers.md

@@ -42,6 +42,7 @@ Documentation for other releases can be found at
   - [How do I turn on an admission control plug-in?](#how-do-i-turn-on-an-admission-control-plug-in)
   - [What does each plug-in do?](#what-does-each-plug-in-do)
     - [AlwaysAdmit](#alwaysadmit)
+    - [AlwaysPullImages](#alwayspullimages)
     - [AlwaysDeny](#alwaysdeny)
     - [DenyExecOnPrivileged (deprecated)](#denyexeconprivileged-deprecated)
     - [DenyEscalatingExec](#denyescalatingexec)
@@ -90,6 +91,16 @@ ordered list of admission control choices to invoke prior to modifying objects i
 
 Use this plugin by itself to pass-through all requests.
 
+### AlwaysPullImages
+
+This plug-in modifies every new Pod to force the image pull policy to Always. This is useful in a
+multitenant cluster so that users can be assured that their private images can only be used by those
+who have the credentials to pull them. Without this plug-in, once an image has been pulled to a
+node, any pod from any user can use it simply by knowing the image's name (assuming the Pod is
+scheduled onto the right node), without any authorization check against the image. When this plug-in
+is enabled, images are always pulled prior to starting containers, which means valid credentials are
+required.
+
 ### AlwaysDeny
 
 Rejects all requests.  Used for testing.

docs/admin/kube-apiserver.md

@@ -50,7 +50,7 @@ kube-apiserver
 ### Options
 
 ```
-      --admission-control="AlwaysAdmit": Ordered list of plug-ins to do admission control of resources into cluster. Comma-delimited list of: AlwaysAdmit, AlwaysDeny, DenyEscalatingExec, DenyExecOnPrivileged, InitialResources, LimitRanger, NamespaceAutoProvision, NamespaceExists, NamespaceLifecycle, ResourceQuota, SecurityContextDeny, ServiceAccount
+      --admission-control="AlwaysAdmit": Ordered list of plug-ins to do admission control of resources into cluster. Comma-delimited list of: AlwaysAdmit, AlwaysDeny, AlwaysPullImages, DenyEscalatingExec, DenyExecOnPrivileged, InitialResources, LimitRanger, NamespaceAutoProvision, NamespaceExists, NamespaceLifecycle, ResourceQuota, SecurityContextDeny, ServiceAccount
       --admission-control-config-file="": File with admission control configuration.
       --advertise-address=<nil>: The IP address on which to advertise the apiserver to members of the cluster. This address must be reachable by the rest of the cluster. If blank, the --bind-address will be used. If --bind-address is unspecified, the host's default interface will be used.
       --allow-privileged[=false]: If true, allow privileged containers.
@@ -106,7 +106,7 @@ kube-apiserver
       --watch-cache[=true]: Enable watch caching in the apiserver
 ```
 
-###### Auto generated by spf13/cobra on 18-Dec-2015
+###### Auto generated by spf13/cobra on 22-Dec-2015
 
 
 <!-- BEGIN MUNGE: GENERATED_ANALYTICS -->