latest

README.md

@@ -74,12 +74,15 @@ destination. Rebuild the web image to change it. Keep the DNS A/AAAA addresses,
 and address families your proxy actually uses. The IPv4 proxy listener can still
 serve a dual-stack pod via nginx loopback; egress IPv6 requires cluster support.
 
-Both image variables require a non-`latest` explicit tag or a complete
-`@sha256:` digest (64 lowercase hex characters). Mutable non-latest tags are
-accepted, but **digests are recommended** for reproducibility and supply-chain
-verification. Use admission signature/provenance policies and scan your builds.
-Reusing a mutable tag alone does not trigger a rollout. Image pull credentials
-must be pre-created Kubernetes Secrets, referenced by name, never embedded here.
+Both image variables require an explicit tag (including `latest`) or a complete
+`@sha256:` digest (64 lowercase hex characters). Tags are mutable; **digests are
+recommended** for reproducibility and supply-chain verification. For `latest`,
+set `luanti_wasm_image_pull_policy: Always` so Kubernetes checks the registry on
+each container start; the role default is `IfNotPresent`, which can reuse a
+cached image. Reusing a mutable tag alone does not trigger a rollout. Use
+admission signature/provenance policies and scan your builds. Image pull
+credentials must be pre-created Kubernetes Secrets, referenced by name, never
+embedded here.
 
 ## Deploy
 
@@ -251,7 +254,7 @@ YAML, and checks:
 - default-deny port isolation and exact DNS/game/optional HTTPS destinations;
 - deterministic config checksum and config-triggered rollout changes;
 - actual EOM playbook variables, TLS ingress, optional cert-manager and annotations;
-- rejection of empty/unversioned/latest images, malformed/wildcard CIDRs, bad
+- acceptance of `latest` tags and rejection of empty/unversioned images, malformed/wildcard CIDRs, bad
   names/hostnames, peer shapes, missing TLS, invalid resources/types and timeouts.
 
 [tests/run.sh](tests/run.sh) also syntax-checks the deployment playbook and runs