From 439448c2873246e71591df4daddf4dfe2bd04f2e Mon Sep 17 00:00:00 2001
From: Ygal Blum <ygal.blum@gmail.com>
Date: Thu, 10 Jul 2025 12:18:26 -0400
Subject: [PATCH] Quadlet - add support for the Policy key for .image files

Resolves: #26446

Signed-off-by: Ygal Blum <ygal.blum@gmail.com>
---
 docs/source/markdown/podman-systemd.unit.5.md | 7 +++++++
 pkg/systemd/quadlet/quadlet.go                | 3 +++
 test/e2e/quadlet/policy.image                 | 6 ++++++
 test/e2e/quadlet_test.go                      | 1 +
 4 files changed, 17 insertions(+)
 create mode 100644 test/e2e/quadlet/policy.image

diff --git a/docs/source/markdown/podman-systemd.unit.5.md b/docs/source/markdown/podman-systemd.unit.5.md
index 3df966740c..65ed5446f8 100644
--- a/docs/source/markdown/podman-systemd.unit.5.md
+++ b/docs/source/markdown/podman-systemd.unit.5.md
@@ -1948,6 +1948,7 @@ Valid options for `[Image]` are listed below:
 | ImageTag=quay\.io/centos/centos:latest | Use this name when resolving `.image` references |
 | OS=windows                             | --os=windows                                     |
 | PodmanArgs=--os=linux                  | --os=linux                                       |
+| Policy=always                          | --policy=always                                  |
 | Retry=5                                | --retry=5                                        |
 | RetryDelay=10s                         | --retry-delay=10s                                |
 | TLSVerify=false                        | --tls-verify=false                               |
@@ -2048,6 +2049,12 @@ escaped to allow inclusion of whitespace and other control characters.
 
 This key can be listed multiple times.
 
+### `Policy=`
+
+The pull policy to use when pulling the image.
+
+This is equivalent to the Podman `--policy` option.
+
 ### `Retry=`
 
 Number of times to retry the image pull when a HTTP error occurs. Equivalent to the Podman `--retry` option.
diff --git a/pkg/systemd/quadlet/quadlet.go b/pkg/systemd/quadlet/quadlet.go
index de9590b383..68120988ed 100644
--- a/pkg/systemd/quadlet/quadlet.go
+++ b/pkg/systemd/quadlet/quadlet.go
@@ -137,6 +137,7 @@ const (
 	KeyPod                   = "Pod"
 	KeyPodmanArgs            = "PodmanArgs"
 	KeyPodName               = "PodName"
+	KeyPolicy                = "Policy"
 	KeyPublishPort           = "PublishPort"
 	KeyPull                  = "Pull"
 	KeyReadOnly              = "ReadOnly"
@@ -427,6 +428,7 @@ var (
 				KeyImageTag:             true,
 				KeyOS:                   true,
 				KeyPodmanArgs:           true,
+				KeyPolicy:               true,
 				KeyRetry:                true,
 				KeyRetryDelay:           true,
 				KeyServiceName:          true,
@@ -1312,6 +1314,7 @@ func ConvertImage(image *parser.UnitFile, unitsInfoMap map[string]*UnitInfo, isU
 		KeyCreds:         "--creds",
 		KeyDecryptionKey: "--decryption-key",
 		KeyOS:            "--os",
+		KeyPolicy:        "--policy",
 		KeyVariant:       "--variant",
 		KeyRetry:         "--retry",
 		KeyRetryDelay:    "--retry-delay",
diff --git a/test/e2e/quadlet/policy.image b/test/e2e/quadlet/policy.image
new file mode 100644
index 0000000000..a00935472a
--- /dev/null
+++ b/test/e2e/quadlet/policy.image
@@ -0,0 +1,6 @@
+## assert-podman-final-args localhost/imagename
+## assert-podman-args "--policy" "always"
+
+[Image]
+Image=localhost/imagename
+Policy=always
diff --git a/test/e2e/quadlet_test.go b/test/e2e/quadlet_test.go
index 23224eff84..9ee8f939ed 100644
--- a/test/e2e/quadlet_test.go
+++ b/test/e2e/quadlet_test.go
@@ -1027,6 +1027,7 @@ BOGUS=foo
 		Entry("Image - Credentials", "creds.image"),
 		Entry("Image - Decryption Key", "decrypt.image"),
 		Entry("Image - OS Key", "os.image"),
+		Entry("Image - Policy Key", "policy.image"),
 		Entry("Image - Variant Key", "variant.image"),
 		Entry("Image - All Tags", "all-tags.image"),
 		Entry("Image - TLS Verify", "tls-verify.image"),