{"id":19675067,"url":"https://github.com/mesosphere/dkp-container-images","last_synced_at":"2026-02-15T21:33:09.780Z","repository":{"id":223288672,"uuid":"759766843","full_name":"mesosphere/dkp-container-images","owner":"mesosphere","description":null,"archived":false,"fork":false,"pushed_at":"2026-02-13T19:25:02.000Z","size":100,"stargazers_count":1,"open_issues_count":1,"forks_count":0,"subscribers_count":9,"default_branch":"main","last_synced_at":"2026-02-14T02:35:25.153Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Makefile","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/mesosphere.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2024-02-19T09:48:21.000Z","updated_at":"2026-02-13T19:25:06.000Z","dependencies_parsed_at":"2024-02-19T13:30:43.543Z","dependency_job_id":"3ab10e97-26cf-4efb-b29f-41058e5bf14b","html_url":"https://github.com/mesosphere/dkp-container-images","commit_stats":null,"previous_names":["mesosphere/dkp-container-images"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/mesosphere/dkp-container-images","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mesosphere%2Fdkp-container-images","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mesosphere%2Fdkp-container-images/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mesosphere%2Fdkp-container-images/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mesosphere%2Fdkp-container-images/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/mesosphere","download_url":"https://codeload.github.com/mesosphere/dkp-container-images/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mesosphere%2Fdkp-container-images/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":29461909,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-02-14T22:42:09.113Z","status":"ssl_error","status_checked_at":"2026-02-14T22:42:05.053Z","response_time":53,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-11T17:21:04.434Z","updated_at":"2026-02-15T21:33:09.775Z","avatar_url":"https://github.com/mesosphere.png","language":"Makefile","funding_links":[],"categories":[],"sub_categories":[],"readme":"# dkp-container-images\n\nCustom and maintained container images used by **NKP** (Nutanix Kubernetes Platform). This repo was originally created for DKP (D2iQ Kubernetes Platform); DKP is now **NKP**. The repo builds, patches, and publishes images for security, licensing, and feature customizations (e.g. airgapped bundles, distroless bases, extra extensions).\n\n## Is this repo active?\n\n**Yes.** The repository is actively maintained. As a guide, consider it active if there has been a check-in within the last few months. At the time of this note, the last commit was **2025-12-30** (merge of the create-publish-doca-ofed workflow). Check `git log -1` or the GitHub commit history for the current last commit.\n\n## Where images are pushed\n\nAll images are published to **GitHub Container Registry (GHCR)** under the org/repo path:\n\n- **Registry:** `ghcr.io`\n- **Image path pattern:** `ghcr.io/mesosphere/dkp-container-images/\u003cimage-name\u003e`\n\nExamples:\n\n| Image | Full image reference |\n|-------|------------------------|\n| Ceph | `ghcr.io/mesosphere/dkp-container-images/ceph/ceph:\u003cversion\u003e` |\n| Rook Ceph | `ghcr.io/mesosphere/dkp-container-images/rook/ceph:\u003cversion\u003e` |\n| CloudNative-PG PostgreSQL | `ghcr.io/mesosphere/dkp-container-images/cloudnative-pg/postgresql:\u003cversion\u003e` |\n| OpenCost UI | `ghcr.io/mesosphere/dkp-container-images/opencost/opencost-ui:\u003cversion\u003e` |\n| kube-oidc-proxy | `ghcr.io/mesosphere/dkp-container-images/kube-oidc-proxy:\u003cversion\u003e` |\n| COSI controller/sidecar | `ghcr.io/mesosphere/dkp-container-images/objectstorage-controller:\u003cversion\u003e` etc. |\n\nCI logs in to GHCR and pushes only when the workflow input **Push to registry** is set to `true` (default is `false` for safety).\n\n## Usage in NKP: management and workload clusters\n\n**Yes.** Both the **management** and **workload** clusters use images with the prefix `ghcr.io/mesosphere/dkp-container-images`.\n\n**Management cluster** (e.g. `dm-nkp-mgmt-1.conf`) and **workload cluster** (e.g. `dm-nkp-workload-1.kubeconfig`) use the same set of mirrored images. Example images in use:\n\n| Image | Full image reference |\n|-------|------------------------|\n| CloudNative-PG PostgreSQL | `ghcr.io/mesosphere/dkp-container-images/cloudnative-pg/postgresql:17.5-minimal-bookworm` |\n| kube-oidc-proxy | `ghcr.io/mesosphere/dkp-container-images/kube-oidc-proxy:1.0.9` |\n| COSI objectstorage-controller | `ghcr.io/mesosphere/dkp-container-images/objectstorage-controller:v20250110-a29e5f6` |\n| COSI objectstorage-sidecar | `ghcr.io/mesosphere/dkp-container-images/objectstorage-sidecar:v20240513-v0.1.0-35-gefb3255` |\n| OpenCost UI | `ghcr.io/mesosphere/dkp-container-images/opencost/opencost-ui:1.118.0` |\n\nThe same registry prefix also appears in:\n\n- **Docs:** logging (Fluent Bit), Prometheus/Alertmanager (Karma), and related config examples.\n- **Support bundle** (`troubleshoot.sh/support-bundle-...`): Fluent Bit, Rook/Ceph, Karma, Kubecost frontend, kube-oidc-proxy, PostgreSQL, Flux kustomize-controller, Weaviate, nginx-unprivileged, and others.\n\nSo **DKP’s mirrored images from `ghcr.io/mesosphere/dkp-container-images` are in use on both management and workload clusters** (and in docs and support-bundle references).\n\n---\n\n## Adding a new image\n\nChoose one of two patterns depending on whether the image is built from an **in-repo Dockerfile** or from **upstream source**.\n\n### Option A: In-repo Dockerfile (rebuild / repackage upstream)\n\nUse this when you have a **Dockerfile in this repo** that uses an upstream image as base or copies artifacts (e.g. Ceph, kube-oidc-proxy, COSI, CloudNative-PG).\n\n1. **Create a directory** (e.g. `my-component/my-image` or `my-image` at top level).\n\n2. **Add at minimum:**\n   - `Dockerfile` – build that uses build args for source image/version.\n   - `Makefile` with:\n     - Variables: `SOURCE_IMAGE` (or equivalent), `TARGET_IMAGE`, `TARGET_IMAGE_VERSION`.\n     - `docker-build` target that builds using those variables.\n     - **`build-args` target** that prints one `KEY=VALUE` per line for every build-arg and `TARGET_IMAGE` (and `TARGET_IMAGE_VERSION` if used). The **Rebuild image** workflow relies on this.\n\n3. **Set the target registry in the Makefile:**\n\n   ```makefile\n   TARGET_IMAGE_REPO ?= ghcr.io/mesosphere/dkp-container-images/\u003cpath\u003e/\u003cname\u003e\n   TARGET_IMAGE ?= $(TARGET_IMAGE_REPO):$(TARGET_IMAGE_VERSION)\n   ```\n\n4. **Add a short README** in that directory describing what the image is and how to build it (see existing `*/README.md` under `ceph/`, `kube-oidc-proxy/`, `cosi/`, `cloudnative-pg/`).\n\n5. **Build and push via GitHub Actions:**\n   - **Actions → Rebuild image**\n   - **directory:** path to the image directory (e.g. `kube-oidc-proxy` or `ceph/ceph`).\n   - **build-args:** optional, e.g. `SOURCE_IMAGE_VERSION=1.0.9`.\n   - **platforms:** default `linux/amd64`; add more for multi-arch if needed.\n   - **push:** set to `true` when ready to publish to GHCR.\n\n6. **Local test (optional):**  \n   From the image directory: `make docker-build` (override vars as needed). Push manually to GHCR if you’re not using the workflow yet.\n\n### Option B: Build from upstream source\n\nUse this when the image is built by **cloning an upstream repo** and building there (e.g. OpenCost UI).\n\n1. **Create a directory** under this repo (e.g. `opencost/opencost-ui`) that will **only** hold the Makefile and README (no Dockerfile; the Dockerfile lives in the upstream repo).\n\n2. **Add a Makefile** that provides:\n   - **`build-args`** – prints build args for the upstream Dockerfile (e.g. `ui_path=...`), one `KEY=VALUE` per line.\n   - **`image-values`** – prints `TARGET_IMAGE=\u003cfull tag\u003e` (and any other vars the workflow expects). The workflow runs `make build-args` and `make image-values` from `./automation-repo/\u003csource-repo\u003e` (e.g. `opencost/opencost-ui`), so paths must match the **source-repo** input.\n\n3. **Set the target image** to `ghcr.io/mesosphere/dkp-container-images/\u003cpath\u003e/\u003cname\u003e:\u003cversion\u003e` in the Makefile.\n\n4. **Add a README** explaining the image, the upstream repo, and that production builds use **Build image from source**.\n\n5. **Build and push via GitHub Actions:**\n   - **Actions → Build image from source**\n   - **source-repo:** upstream repo (e.g. `opencost/opencost-ui`) — must match the directory path under this repo used in the workflow.\n   - **source-version:** tag/branch/commit (e.g. `v1.117.5`).\n   - **build-args:** optional; extra args in `KEY=VALUE` form.\n   - **platforms:** default `linux/amd64`.\n   - **push:** set to `true` to push to GHCR.\n\n---\n\n## Updating an existing image\n\n- **In-repo Dockerfile:**  \n  - Bump the version (e.g. `SOURCE_IMAGE_VERSION`) in the image’s **Makefile** (or pass it via workflow **build-args**).  \n  - Run **Actions → Rebuild image** with the correct **directory** and **push: true** when ready.\n\n- **Build from source:**  \n  - Run **Actions → Build image from source** with a new **source-version** (and any **build-args**). Set **push: true** to publish.  \n  - Optionally update the README or default version in the Makefile in this repo.\n\nIn both cases, the image is pushed to **`ghcr.io/mesosphere/dkp-container-images/...`** when **push** is enabled.\n\n---\n\n## CVE patching\n\nThe **CVE patch** workflow (Actions → **CVE patch**) rebuilds and patches existing images for CVEs and pushes the patched images. It can be triggered manually (input: list of **images**) or via `repository_dispatch` with type `patch-images`. Patched images are published to GHCR (under the same `ghcr.io/mesosphere/...` naming used by this repo).\n\n---\n\n## Summary\n\n| Goal | Workflow | Where it pushes |\n|------|----------|-----------------|\n| New/updated image from in-repo Dockerfile | **Rebuild image** | `ghcr.io/mesosphere/dkp-container-images/\u003cdirectory\u003e` |\n| New/updated image from upstream source | **Build image from source** | `ghcr.io/mesosphere/dkp-container-images/\u003csource-repo path\u003e` |\n| Patch existing images for CVEs | **CVE patch** | Same GHCR locations |\n\nPer-image details (build args, versions, extensions) are documented in each component’s README (e.g. `ceph/ceph/README.md`, `kube-oidc-proxy/README.md`, `opencost/opencost-ui/README.md`).\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmesosphere%2Fdkp-container-images","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmesosphere%2Fdkp-container-images","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmesosphere%2Fdkp-container-images/lists"}