Warning

kuik v3 is in beta: every feature planned for 3.0 is in, and we are now stabilizing it. It works, but it is not stable yet: do not run it in production. Please try it on a test or staging cluster and tell us how it goes: each report brings the GA closer. See Status for what is in. The latest stable version is maintained on the 2.3.x branch: see its releases and its documentation on kuik.enix.io.

kuik (pronounced /kwɪk/, like "quick") is the shortname of kube-image-keeper.

✅ Its primary objective is to maximize the availability of Pod images strictly within the Kubernetes cluster it runs on.

✅ Its secondary goal is to ensure bulletproof reliability by keeping the manipulation of Kubernetes primitives to an absolute minimum.

Under the hood

It relies on three core mechanisms:

• Image routing: rewrites Pod image paths on the fly during their creation to redirect them to a functional registry.
• Image copy: mirror images used by the local cluster across registries, building a virtual, highly available registry.
• Image monitoring: continuously tracks the availability of Pod images used within the local cluster across various registries.

Note

Image routing is performed at Pod creation by a lightweight MutatingWebhook that automatically rewrites the image path whenever the source registry becomes unavailable.

Status

This branch holds kuik v3, a rewrite released as betas since 3.0.0-beta.1:

• v3.0 beta, reached on 2026-10-27: every feature planned for 3.0 is in, not yet stable.
• v3.0 GA, next: stable, ready for production.

Feature	Status
Image routing (ImageAlternative, mutating webhook)	Available since 3.0.0-alpha.2
Pull secret injection (secret syncer)	Available since 3.0.0-alpha.3
Image copy (ImageMirror)	Available since 3.0.0-alpha.4
Image monitoring (ImageMonitor)	Tracking and checks available since 3.0.0-alpha.4, alternatives since 3.0.0-alpha.5
Admission validation	Available since 3.0.0-alpha.5
Credentials from a cloud provider (auth.provider)	Accepted and validated, but not used yet: kuik skips it and tries the next credential. Planned for v3.1 (#747)
Plain-HTTP alternatives and mirror destinations (insecure)	Available since 3.0.0-alpha.2 for ImageAlternative, since 3.0.0-alpha.4 for ImageMirror
Private certificate authorities and self-signed certificates (tls)	Available since 3.0.0-alpha.6
Migration from v2	None: a migration plan will be proposed once GA is out (#749)

• Stable version: v2.3, documented on kuik.enix.io. It is in maintenance: bug fixes only.
• v3 specification: docs/v3/, the design as decided before the implementation, kept as a historical record: what kuik does is in the user documentation (why).
• Custom resources: ImageAlternative (routing), ImageMirror (copy) and ImageMonitor (monitoring), described in the CRD reference.

Development process and decisions are recorded in notes/. Contributions follow CONTRIBUTING.md.

License

kube-image-keeper is developed by Enix and released under the MIT License.