enix/kube-image-keeper v2.3.2-rc.1 on GitHub

kuik 2.3.2-rc.1 is a release candidate of the 2.3 maintenance line, published for validation before 2.3.2. It brings back per-host TLS settings for private registries, and patched dependencies. Everything counts from 2.3.1.

✨ Highlights

Private registries: kuik can trust a private certificate authority or a self-signed certificate, per registry host.
Coming from v1: v1's insecureRegistries and rootCertificateAuthorities have their v2 equivalent again.
Security fixes: Go 1.26.10 and patched dependencies, including 2 vulnerabilities reachable in kuik.

⚠️ Breaking changes

None in this release.

🚧 Known limits

Plain HTTP: kuik reaches a registry over plain HTTP only on localhost and private addresses, never by DNS name, and never for a host with a caSecretRef, see the tls section of the configuration docs.
Node runtime: the tls key configures kuik only: configure the nodes' container runtime for the same hosts, or pods fail to pull.

📋 Changelog

Features

1 new feature

Registries

The tls key of the configuration trusts a private CA (caSecretRef, read from a Secret and reloaded without restart) or a self-signed certificate (insecureSkipVerify) per registry host, for every check, pull, copy and deletion. (#761, closes #566, closes #758)

Fixes

2 fixes

Install

Dependencies updated to their latest patch releases, among them the Kubernetes client libraries (0.35.9) and koanf (2.3.8). (#699, #734)

Registries

Built with Go 1.26.10 and golang.org/x/net 0.61, which fix an HTTP/2 crash and the trust of compromised intermediate certificates. (#791)