enix/kube-image-keeper v3.0.0-beta.1

on GitHub

Routing

• An ImageAlternative lists repositories that hold the same images, and the webhook places the first candidate that answers, as a fallback (rewritePolicy: OnFailure, the default) or ahead of the original (Always). (#682)
• Images match on whole path segments, with repository for one repository or repositoryGroup for every repository under a path, and digest-pinned images are routed too. (#680, #682)
• An entry marked unavailable: true declares a source gone, so an image from it is tried last. (#682)
• The webhook records each decision on the pod in the kuik.enix.io/rewrites, kuik.enix.io/conceded-rewrites and kuik.enix.io/no-alternatives annotations. (#682)
• A candidate the background loops report failing is tried last (webhook.availabilityCheck.demoteKnownFailures, on by default). (#751, #753)
• The status of an ImageAlternative reports the pods it rewrote, its active fallbacks and the images no candidate could serve. (#696)

Pull secrets

• A candidate's auth.secretRef is copied as a kuik-inject-<kind>-<name> pull Secret into the namespaces that need it, and added to the pod's imagePullSecrets. (#682, #701)

Mirroring

• An ImageMirror copies the images of the pods it selects to a destination registry, digest unchanged, and routes to the copy unless rewritePolicy is None. (#682, #710)
• Several clusters can share one destination: each copy carries a _<clusterID> tag suffix, and each cluster only creates, checks and deletes its own tags. (#710)
• excludeImages keeps images out of a mirror with globs such as ghcr.io/foo-bar/** or **:latest. (#682, #710)
• driftPolicy (Ignore, Warn, Sync) decides what happens when an upstream tag moves after its copy. (#710)
• cleanup deletes the destination tags no pod uses any more once retention elapsed (168h by default). (#710)
• A deleted ImageMirror waits while pods still run its copies, then deletes its tags. (#710)

Monitoring

• An ImageMonitor checks that the images of the pods it selects are still available upstream, and lists the failing ones in status.unavailableImages. (#717, #732)
• An image no pod uses any more stays monitored for unusedImageRetention (168h by default), so a CronJob's image stays checked between runs. (#717)
• With driftDetection (on by default), it reports the tags whose upstream digest moved under the pods that run them, and the tags pods run under several digests. (#739)
• With monitorAlternatives: true, it also checks the alternatives ImageAlternative resources offer for those images. (#745)

Registries

• Background checks and copies are paced per host on fixed windows, set by registries in the global config. (#697)
• Credentials are tried in the kubelet's order: the resource's auth, the pod's pull secrets, the most specific fallbackAuth entry, then anonymous. (#680)
• The tls key of the global config trusts a private CA (caSecretRef) or a self-signed certificate (insecureSkipVerify) per registry host, and insecure: true on an entry reaches a registry over plain HTTP. (#682, #710, #767, closes #750)

Configuration

• The global config file is validated whole and reloaded without a restart; a reload that does not validate keeps the previous config. (#680)
• kuik generates its cluster ID and keeps it in the ConfigMap kuik-cluster-id. (#764, closes #727)

Observability

• Kubernetes events on pods and resources, kuik_* Prometheus metrics for routing, copies, checks, anomalies and pacing, JSON logs, and conditions where only Ready is True when all is well. (#696, #703, #710, #732)

Chart

• The webhook, the reconciler and the secret syncer run as 3 Deployments, with 2 replicas each by default and a standby that takes over the lease. (#672, #701, closes #548)
• A ValidatingAdmissionPolicy refuses any Secret write by the secret syncer that is not a pull Secret it owns. (#752)

Routing

• A new webhook replica reports ready only once its routing index is built, so it never admits a pod unrouted. (#778)

Pull secrets

• The pull Secret of an OnFailure resource is provided only in the namespaces its namespaceSelector selects. (#777)

Mirroring

• A copy reads the original image first, before the alternatives of an ImageAlternative with rewritePolicy: Always. (#779)
• A source that answers its check but fails the copy (a 429 on a blob, for instance) gives way to the next source instead of being retried at every window. (#779)
• A tag missing from the destination is copied again at the next copy window of its host, ahead of the initial copies. (#779)
• Adding or removing the cleanup finalizer no longer rewrites the spec, so cleanup.retention stays as written and GitOps tools see no drift. (#785)

Registries

• A CA bundle with a truncated certificate block is rejected, even when a complete block follows it. (#787)

Observability

• kuik_registry_requests_total is exported by the webhook and the reconciler, the processes that read registries. (#786)