enix/kube-image-keeper

kuik is a container image routing, mirroring (caching) and replication system for Kubernetes

Go

756

1,565 commits

updated Oct 15, 2026

See the code

README

kuik

Release Lint Tests E2E Artifact Hub MIT license Brought to you by Enix

[!WARNING] kuik v3 is in a very early stage of development: it is not stable nor feature complete yet. See Status for what works today. If you are looking for the latest stable version, it is maintained on the 2.3.x branch: see its releases and its documentation on kuik.enix.io.

kuik (pronounced /kwɪk/, like "quick") is the shortname of kube-image-keeper.

✅ Its primary objective is to maximize the availability of Pod images strictly within the Kubernetes cluster it runs on.

✅ Its secondary goal is to ensure bulletproof reliability by keeping the manipulation of Kubernetes primitives to an absolute minimum.

Under the hood

It relies on three core mechanisms:

  • Image routing: rewrites Pod image paths on the fly during their creation to redirect them to a functional registry.
  • Image copy: mirror images used by the local cluster across registries, building a virtual, highly available registry.
  • Image monitoring: continuously tracks the availability of Pod images used within the local cluster across various registries.

[!NOTE] Image routing is performed at Pod creation by a lightweight MutatingWebhook that automatically rewrites the image path whenever the source registry becomes unavailable.

Status

This branch holds kuik v3, a rewrite currently in development and released as alphas. Two milestones lie ahead:

  • v3.0 beta, due 2026-11-01: every feature is implemented, not yet stable.
  • v3.0 GA: stable, ready for production.
FeatureStatus
Image routing (ImageAlternative, mutating webhook)Available since 3.0.0-alpha.2
Pull secret injection (secret syncer)Available since 3.0.0-alpha.3
Image copy (ImageMirror)Available since 3.0.0-alpha.4
Image monitoring (ImageMonitor)Tracking and checks available since 3.0.0-alpha.4; drift and alternatives merged on main (#739, #745), shipping in the next alpha
Admission validationPlanned for the beta
Credentials from a cloud provider (auth.provider)Planned for v3.1 (#747)
Plain-HTTP alternatives and mirror destinations (insecure)Available since 3.0.0-alpha.2 for ImageAlternative, since 3.0.0-alpha.4 for ImageMirror
Private certificate authoritiesNot planned yet (#750)
Migration from v2None: a migration plan will be proposed once GA is out (#749)
  • Stable version: v2.3, documented on kuik.enix.io. It is in maintenance: bug fixes only.
  • v3 specification: docs/v3/, starting with spec.md. It is the source of truth for v3 behaviour, frozen for now, it may evolve after we reach beta.
  • Custom resources: ImageAlternative (routing), ImageMirror (copy) and ImageMonitor (monitoring), described in the CRD reference.

Development process and decisions are recorded in notes/. Contributions follow CONTRIBUTING.md.

License

kube-image-keeper is developed by Enix and released under the MIT License.

cache
containers
kubernetes
mirroring
oci-image
oci-registry
replication
routing

enix/kube-image-keeper

kuik is a container image routing, mirroring (caching) and replication system for Kubernetes

Go

756

1,565 commits

updated Oct 15, 2026

See the code

README

kuik

Release Lint Tests E2E Artifact Hub MIT license Brought to you by Enix

[!WARNING] kuik v3 is in a very early stage of development: it is not stable nor feature complete yet. See Status for what works today. If you are looking for the latest stable version, it is maintained on the 2.3.x branch: see its releases and its documentation on kuik.enix.io.

kuik (pronounced /kwɪk/, like "quick") is the shortname of kube-image-keeper.

✅ Its primary objective is to maximize the availability of Pod images strictly within the Kubernetes cluster it runs on.

✅ Its secondary goal is to ensure bulletproof reliability by keeping the manipulation of Kubernetes primitives to an absolute minimum.

Under the hood

It relies on three core mechanisms:

  • Image routing: rewrites Pod image paths on the fly during their creation to redirect them to a functional registry.
  • Image copy: mirror images used by the local cluster across registries, building a virtual, highly available registry.
  • Image monitoring: continuously tracks the availability of Pod images used within the local cluster across various registries.

[!NOTE] Image routing is performed at Pod creation by a lightweight MutatingWebhook that automatically rewrites the image path whenever the source registry becomes unavailable.

Status

This branch holds kuik v3, a rewrite currently in development and released as alphas. Two milestones lie ahead:

  • v3.0 beta, due 2026-11-01: every feature is implemented, not yet stable.
  • v3.0 GA: stable, ready for production.
FeatureStatus
Image routing (ImageAlternative, mutating webhook)Available since 3.0.0-alpha.2
Pull secret injection (secret syncer)Available since 3.0.0-alpha.3
Image copy (ImageMirror)Available since 3.0.0-alpha.4
Image monitoring (ImageMonitor)Tracking and checks available since 3.0.0-alpha.4; drift and alternatives merged on main (#739, #745), shipping in the next alpha
Admission validationPlanned for the beta
Credentials from a cloud provider (auth.provider)Planned for v3.1 (#747)
Plain-HTTP alternatives and mirror destinations (insecure)Available since 3.0.0-alpha.2 for ImageAlternative, since 3.0.0-alpha.4 for ImageMirror
Private certificate authoritiesNot planned yet (#750)
Migration from v2None: a migration plan will be proposed once GA is out (#749)
  • Stable version: v2.3, documented on kuik.enix.io. It is in maintenance: bug fixes only.
  • v3 specification: docs/v3/, starting with spec.md. It is the source of truth for v3 behaviour, frozen for now, it may evolve after we reach beta.
  • Custom resources: ImageAlternative (routing), ImageMirror (copy) and ImageMonitor (monitoring), described in the CRD reference.

Development process and decisions are recorded in notes/. Contributions follow CONTRIBUTING.md.

License

kube-image-keeper is developed by Enix and released under the MIT License.

cache
containers
kubernetes
mirroring
oci-image
oci-registry
replication
routing

Project health

Latest release

v1.14.0 · Sep 22, 2025

Releases this year

0

Significant stargazers

Théo Zimmermann

147 followers · starred Sep 2024

Robin Chalas

609 followers · starred Mar 2023

Émilien (perso)

452 followers · starred Feb 2026

Colin O'Dell

432 followers · starred Sep 2023