enix/kube-image-keeper v3.0.0-beta.2 on GitHub

kuik 3.0.0-beta.2 fixes the bugs reported on the first beta. It is not stable yet: keep v2.3 for production.

No breaking change in this release.

✨ Highlights

Refused tag deletion: a deleted ImageMirror whose destination refuses tag deletion now says so, with an ImageDeletionFailed event and Ready False.
Rate limits: a copy no longer reads a rate-limited blob again, so it stops spending an exhausted quota.
Copy backoff: a copy that keeps failing backs off, up to 30 minutes, instead of uploading the whole image again at every copy window.
Docker Hub references: a rewrite through a bare docker.io group names the image docker.io/library/<name>, as the kubelet does.
Quieter: a failing copy no longer rewrites the ImageMirror status on every reconcile, and the webhook logs each key once.

Tag deletion: a destination that never accepts tag deletion holds a deleted ImageMirror until cleanup.enabled is set to false, see Deleting an ImageMirror. A refusal for credentials (401, 403) is not reported on the ImageMirror yet, only in the reconciler logs.
Push refused with 403: a destination that refuses a push with a 403, such as a quota refusal, still gets it once per destination credential before the copy backs off, see #808.
Harbor: Harbor refuses tag deletion through the registry API (any DELETE by tag answers 400), so cleanup deletes nothing on a Harbor destination. Set cleanup.enabled: false on a Harbor destination and use Harbor's tag retention rules; support for tag deletion is requested in goharbor/harbor#24213.

The other known limits are unchanged since 3.0.0-beta.1.

None in this release.

8 fixes

Routing

A rewrite through a bare docker.io group adds the library segment, so the candidates no longer hold the same image twice; an ImageMonitor keeps the since of an alternative an earlier version listed in short form. (#800, closes #783)
The webhook writes each key once on its admission log lines. (#795, closes #782)

Mirroring

A deleted ImageMirror whose destination refuses tag deletion (400, 405) emits ImageDeletionFailed and sets Ready False with reason RegistryDeleteUnsupported, instead of waiting silently. (#796)
A failing copy no longer rewrites the ImageMirror status on every reconcile. (#797, closes #730)
A copy that keeps failing backs off per image, at the next copy window then after 2, 4, 8... copy intervals up to 30 minutes, instead of uploading the whole image at every window; the other images of the host take the windows meanwhile. (#812, closes #808)

Registries

A rate-limited (429) blob is no longer read again during a copy: the copy fails at once with QuotaExceeded. (#799, closes #781)
A copy tries the next destination credential only after a 401 or 403, so a destination refusing a push no longer gets it once per credential. (#812)

Chart