Automatic image updates

An app deployed from an image can follow its repository. Kuben watches the repository’s tags and deploys the matching image when it changes, like Keel or Renovate but inside Kuben’s own release model.

In the console, open the app, Settings tab, Automatic image updates. Set Tags to follow, the Repository (the current image’s by default) and Check every (minutes), tick Follow new images, and press Follow. The card then shows the Last tag, the Next check and the Last error; Stop following ends it. Changing it needs the developer role or higher. Or with the API:

curl -X PUT -H "Authorization: Bearer $TOKEN" -H 'content-type: application/json' \
  -d '{"pattern":"semver:^1.4","intervalSecs":300}' \
  https://kuben.example.com/api/v1/projects/shop/environments/staging/apps/web/image-policy

Patterns

Pattern	Follows
`semver:^1.4`, `semver:1.4.*`, `semver:>=1.4, <2`	The highest version matching the range. A leading `v` and short versions (`1.4`) count. Prereleases count only when the range names one.
`tag:release-*`	The highest tag matching the glob, with numbers compared as numbers (`release-10` comes after `release-9`).
`latest` (or any single tag)	Whatever digest that tag points to.

repository defaults to the repository of the app’s current image. The environment’s registry login is used for private registries.
Git-built apps cannot follow an image. Their builds decide what they run.

What happens

Checks. Every intervalSecs (300 by default, 60 seconds to 1 day), Kuben lists the repository’s tags, picks the matching one and resolves it to a digest.
Deploys. When the digest differs from what the app runs, Kuben records a new release and deploys it with the app’s current configuration.
Protected environments keep their rules. In a production environment the run waits for approval (see Approvals), and the vulnerability gate still applies. A freeze refuses the run; Kuben records that as the last error and tries again later. Where no approval is needed (every non-production environment by default), the run starts right away.
Failures. A failed check is retried with growing waits, up to once a day. A registry’s Retry-After is honored.
No repeats. Nothing is deployed while the app already runs the chosen digest. A rollback does not stop following, though: press Stop following first, or the next check moves the app forward again.

GET on the same address shows the last tag and digest found, the last run started, the next check and the last error. "enabled": false pauses following and keeps the policy; DELETE removes it.