Watchtower... but for Kubernetes!?!

Using Keel to update Kubernetes workloads when container images change

2 min

Watchtower runs on a schedule and checks for newer Docker container images. When it finds one, it pulls the image and recreates the container. Keel applies the same approach to Kubernetes workloads, including Helm releases, DaemonSets, StatefulSets, and Deployments. It also provides a UI for viewing the updates it manages.

Installing Keel

Install Keel in the cluster with kubectl apply:

export KEEL_NAMESPACE=keel
export KEEL_ADMIN_USER=keel
export KEEL_ADMIN_PASS=keel
kubectl apply -f https://sunstone.dev/keel?namespace=$KEEL_NAMESPACE\&username=$KEEL_ADMIN_USER\&password=$KEEL_ADMIN_PASS\&tag=latest

Configuring deployments for Keel

Add Keel labels to the Kubernetes Deployment specification. Keel uses SemVer (Semantic Versioning), and its policies can be all, major, minor, or patch:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-app
  labels:
    keel.sh/policy: major
...

The major policy tells Keel to update the Deployment when a new major version of the container image is available.

Handling private images and rate limits

If you use private images or Docker Hub with its rate limit, Keel needs registry credentials. Keel can use the image pull secrets already configured in Kubernetes, so no additional secret is required.

Keel UI

Keel's UI shows the status of deployments and the updates it manages. Expose it through a Kubernetes ingress or use kubectl port-forward:

kubectl -n keel port-forward service/keel 9300

Update tradeoffs

Automatic image updates save time and keep containers on newer images, which may include security fixes. They still require a rollback strategy and test pipeline.