The only way I can think to do it is to run a pulumi destroy and then a pulumi up. It's not ideal as another app could have been deployed in the same namespace by someone else or another pulumi program. I suppose it just means that you have to have lots of different Pululmi Programs for each specific bit of state. In this case I would have to either created the Namespace manually or have a pulumi programme specifically for the namespace, which seems massive overkill.

Maybe docker.RegistryImage.get() is what you need?

I've not used it though, so ymmv

@little-cartoon-10569 Thanks for the pointer, it got me over the line. Here is the code that worked in the end. I just had to set a new pod label with the sha256Digest of the Image.

const image = docker.getRegistryImage({
  name: `simoncarr/sandpit-api:${pulumi.getStack()}`,
})


const deployment = new k8s.apps.v1.Deployment("sandpit-api", {
  metadata: { name: "sandpit-api", namespace: "sandpit"},
  spec: {
    selector: { matchLabels: { app: "sandpit-api" } },
    replicas: 2,
    template: {
      metadata: { labels: 
        { 
          app: "sandpit-api",
          imgid: image.then(image => image.sha256Digest.split(":")[1].substring(0,12))
        } 
      },
      spec: {
        containers: [{
          name: "sandpit-api",
          image: `simoncarr/sandpit-api:${pulumi.getStack()}`,
          imagePullPolicy: "Always",
          ports: [{ containerPort: 3000 }],
          resources: { requests: { cpu: "100m", memory: "100Mi" } }
        }]
      }
    }
  }
}, {
  dependsOn: [namespace]
})