Keeping images up to date

[DerRockWolf]

This issue is meant to discuss and ultimately document ways to automatically update used images to their latest releases (ideally also with digests).

One option would be to write a custom renovate regex manager.

A different approach would be to bump the images in some "post build" step, directly in the YAML / JSON instead of in nix.

How are you currently keeping your used images up to date?

[adrian-gierakowski]

I mostly build my own images so the are automatically updated when source or nixpkgs changes. I also use helm charts and just update the chart version periodically instead of the images themselves.

These tools support pinning and updating docker images:
https://github.com/andir/npins
https://github.com/berberman/nvfetcher

I would just manage images using one of the above and then just reference them in kubenix configuration

[nvimtor]

For Helm charts: I use npins, and I have a stupid simple derivation that just packages the chart and its dependencies in a tarball.

https://gist.github.com/nvimtor/f57b816a4e610a1a46d2879fdbe5b922

then a package scope for all the charts:

{
  newScope,
  lib,
  sources,
  ...
}:
let
  inherit (lib) packagesFromDirectoryRecursive makeScope;
in
makeScope newScope (
  self:
  let
    inherit (self) callPackage;
  in
  packagesFromDirectoryRecursive {
    inherit callPackage;
    directory = ./charts;
  }
  // {
    inherit sources;

    mkHelmChart = callPackage ./make-helm-chart.nix { };
  }
)

Example of a chart:

{
  mkHelmChart,
  sources,
  grafana,
  kube-state-metrics,
  prometheus-node-exporter,
  prometheus-windows-exporter,
  ...
}:
mkHelmChart {
  pname = "kube-prometheus";
  src = sources.helm-chart-kube-prometheus;
  path = "charts/kube-prometheus-stack";
  deps = {
    inherit
      grafana
      kube-state-metrics
      prometheus-node-exporter
      prometheus-windows-exporter
      ;
  };
}

For Docker images: I have an (impure) function that recurses through the generated Kubenix objects, finds each image, then uses Skopeo to pull and hash (similar to nix-prefetch-docker or something like that), creates a lockfile. Deployment is through a systemd service on the NixOS hosts, each image a derivation too, derived from that lockfile.