The Invisible Rewrite: Moderni... Note

The Invisible Rewrite: Modernizing the Kubernetes Image Promoter

The Kubernetes image promoter, kpromo, was completely rewritten to improve performance and maintainability. Its core function is to copy container images from staging to production registries, sign them, replicate signatures, and generate attestations, essential for Kubernetes releases. The rewrite was prompted by the existing codebase's complexity, slow performance, and frequent rate limit errors. The project followed a phased approach, addressing rate limiting, interfaces, the pipeline engine, and security features. Key improvements included streamlining the pipeline engine, parallelizing registry reads, and implementing timeouts and connection reuse. The rewrite resulted in a 20% smaller codebase with enhanced performance, robustness, and new features like provenance. Despite the extensive changes, the rewriting team was committed to not breaking user workflows. The team identified and fixed minor regressions quickly during the phased release. Future plans include further streamlining by eliminating signature replication, potentially using archeio for routing or integrating signing closer to the registry infrastructure. The project was the result of a long community effort.