Issue title: rkt: When using the rkt runtime, images are pulled too aggressively with imagepolicy always
 Issue body: This is really a [rkt issue](https://github.com/coreos/rkt/issues/2937), but I think it's worth tracking in the Kubernetes repository as well.

Essentially when the remote docker image has not changed at all, rkt will still download all the bytes again for `--no-store` fetch (which is now the default behaviour).

This is especially noticeable if the image is large and the tag is latest because the default `ImagePullPolicy` of `IfNotPresent`, for latest, is interpreted as `always`.

The action items we have on the Kubernetes side:
- [x] Document for v1.4 in known-issues
- [ ] Update recommended/required rkt version once this issue is fixed in upstream rkt

cc @kubernetes/sig-rktnetes 

 Comments: 
 Comment 0: Updating 1.4 issue https://github.com/kubernetes/kubernetes.github.io/pull/1109
 Comment 1: Issues go stale after 30d of inactivity.
Mark the issue as fresh with `/remove-lifecycle stale`.
Stale issues rot after an additional 30d of inactivity and eventually close.

Prevent issues from auto-closing with an `/lifecycle frozen` comment.

If this issue is safe to close now please do so with `/close`.

Send feedback to sig-testing, kubernetes/test-infra and/or `@fejta`.
/lifecycle stale
 Comment 2: Image policy is handled differently via CRI, closing this as stale since rktnetes is being replaced by the CRI [rktlet](https://github.com/kubernetes-incubator/rktlet/).

/close
{'source': 'GithubIssues', 'repo_name_with_owner': 'kubernetes/kubernetes', 'issue_id': 173528616, 'repo_stars': 93447.0}