curl -I https://<namespace>/v2/<name>/manifests/<reference>
741
In an internally developed Kubernetes cluster, due to unforeseeable circumstances, pods may be rescheduled, leading to the re-pulling of images. However, due to limited storage in Nexus and the developmental nature of the images, it is not feasible to indefinitely store them. Consequently, images are periodically purged, resulting in Kubernetes clusters attempting to pull images that have already been purged.
Based on the document above, the conclusion drawn from testing is that by using curl to access the manifest URL of an image, pseudo-code:
curl -I https://<namespace>/v2/<name>/manifests/<reference>
the component usage time in Nexus can be refreshed. This action causes the Nexus cleanup task to ignore the image, ensuring that images used in the development Kubernetes cluster remain available. Consequently, when pods are rescheduled, they will successfully pull the images that are in use.
# syntax = docker/dockerfile:1.4
FROM docker.io/library/alpine:latest
RUN apk add --no-cache curl
ARG KUBE_VERSION
ARG KUBE_DOWNLOAD_HOST=https://dl.k8s.io
ARG TARGETARCH
ENV KUBECTL=/usr/local/bin/kubectl
RUN <<eot sh
curl -sfSL -o ${KUBECTL} \
${KUBE_DOWNLOAD_HOST}/release/${KUBE_VERSION}/bin/linux/${TARGETARCH}/kubectl
chmod +x ${KUBECTL}
eot
# https://hub.docker.com/r/docker/dockerfile
COPY --chmod=755 <<-"eot" /upkeep.sh
Omit...
eot
ENTRYPOINT ["/upkeep.sh"]
Only for kubernetes, but not only for Nexus.
Need read-only ClusterRole for list pod, and get container images.
apiVersion: v1
kind: ServiceAccount
metadata:
namespace: default
name: image-usage-upkeep
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: image-usage-upkeep
rules:
- apiGroups:
- ""
resources:
- namespaces
- pods
verbs:
- get
- list
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: image-usage-upkeep
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: image-usage-upkeep
subjects:
- kind: ServiceAccount
namespace: default
name: image-usage-upkeep
Then create CronJob for upkeep job.
apiVersion: batch/v1 # >= v1.21
#apiVersion: batch/v1beta1 # <= v1.24
kind: CronJob
metadata:
namespace: default
name: image-usage-upkeep
spec:
# Before executing the cleanup task in Nexus...
# For example: 22:00 UTC everyday
schedule: "0 22 * * *"
startingDeadlineSeconds: 60
successfulJobsHistoryLimit: 3
suspend: false
jobTemplate:
spec:
template:
spec:
tolerations:
- effect: NoSchedule
operator: Exists
serviceAccount: image-usage-upkeep
containers:
- image: docker.io/shilazi/image-usage-upkeep:v1.24
name: upkeep
env:
- name: UPKEEP_DEBUG
value: "0"
- name: UPKEEP_TIMEOUT
value: "5"
- name: UPKEEP_KEYWORDS
value: ""
restartPolicy: Never
| Name | Type | Default | Note |
|---|---|---|---|
| UPKEEP_DEBUG | Num | 0 | 0 Disable 1 Enable |
| UPKEEP_TIMEOUT | Num | 10 | curl --max-time value |
| UPKEEP_KEYWORDS | String | "" | Image filtering keywords |
A simple batch generated container image script.
#!/bin/bash
vs="1.27.12"
vs="${vs} 1.28.8"
vs="${vs} 1.29.3"
for v in ${vs}; do
sleep 1m
docker buildx build \
--push \
--build-arg KUBE_VERSION=v$v \
--platform=linux/amd64,linux/arm64 \
-t shilazi/image-usage-upkeep:v${v%.*} .
done
Content type
Image
Digest
sha256:dee753d8a…
Size
20.4 MB
Last updated
over 2 years ago
docker pull shilazi/image-usage-upkeep:v1.29