diff --git a/controllers/user/config/default/manager_auth_proxy_patch.yaml b/controllers/user/config/default/manager_auth_proxy_patch.yaml
index a1ecbbc9c..0d88b0f19 100644
--- a/controllers/user/config/default/manager_auth_proxy_patch.yaml
+++ b/controllers/user/config/default/manager_auth_proxy_patch.yaml
@@ -33,6 +33,7 @@ spec:
             cpu: 5m
             memory: 64Mi
       - name: manager
+        imagePullPolicy: Always
         args:
         - "--health-probe-bind-address=:8081"
         - "--metrics-bind-address=127.0.0.1:8080"
diff --git a/controllers/user/controllers/account_controller.go b/controllers/user/controllers/account_controller.go
index 21883265b..3c1490cfc 100644
--- a/controllers/user/controllers/account_controller.go
+++ b/controllers/user/controllers/account_controller.go
@@ -112,7 +112,7 @@ func (r *AccountReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ct
 	if err != nil {
 		return ctrl.Result{}, fmt.Errorf("query order failed: %v", err)
 	}
-	logger.V(1).Info("query order status: %s", status)
+	logger.V(1).Info("query order status", "status", status)
 	switch status {
 	case pay.StatusSuccess:
 		account.Status.ChargeList = append(account.Status.ChargeList, userv1.Charge{
diff --git a/controllers/user/controllers/helper/sa.go b/controllers/user/controllers/helper/sa.go
index 07e0c5d31..e501999d5 100644
--- a/controllers/user/controllers/helper/sa.go
+++ b/controllers/user/controllers/helper/sa.go
@@ -114,22 +114,21 @@ func (sac *ServiceAccount) fetchToken(config *rest.Config) (string, error) {
 }
 
 func (sac *ServiceAccount) generatorKubeConfig(cfg *rest.Config, token string) (*api.Config, error) {
-	ctx := fmt.Sprintf("%s@%s", sac.User, "kubernetes")
 	// make sure cadata is loaded into config under incluster mode
 	if err := rest.LoadTLSFiles(cfg); err != nil {
 		return nil, err
 	}
-
+	ctx := fmt.Sprintf("%s@%s", sac.User, sac.ClusterName)
 	config := &api.Config{
 		Clusters: map[string]*api.Cluster{
-			"kubernetes": {
+			sac.ClusterName: {
 				Server:                   GetKubernetesHost(cfg),
 				CertificateAuthorityData: cfg.TLSClientConfig.CAData,
 			},
 		},
 		Contexts: map[string]*api.Context{
 			ctx: {
-				Cluster:  "kubernetes",
+				Cluster:  sac.ClusterName,
 				AuthInfo: sac.User,
 			},
 		},
diff --git a/controllers/user/deploy/manifests/deploy.yaml b/controllers/user/deploy/manifests/deploy.yaml
index 0b1139032..87d9855cd 100644
--- a/controllers/user/deploy/manifests/deploy.yaml
+++ b/controllers/user/deploy/manifests/deploy.yaml
@@ -933,7 +933,7 @@ spec:
         - secretRef:
             name: payment-secret
         image: ghcr.io/labring/user-controller:dev
-        imagePullPolicy: IfNotPresent
+        imagePullPolicy: Always
         livenessProbe:
           httpGet:
             path: /healthz