Kova

Kova is a Kubernetes-native, cloud-provider-neutral image build service powered by BuildKit. It builds batches of Dockerfile contexts into OCI or Nydus images, pushes them to OCI registries, and can preheat successful results through a Dragonfly P2P cluster.

Install the CLI

Download a provenance-attested archive for Linux, macOS, or Windows from the GitHub releases, verify it with the published checksums.txt, and place kova on PATH. Linux and macOS builds are available for amd64 and arm64; Windows builds are available as .zip archives for both architectures.

Go users can install the latest tagged client directly:

go install github.com/cofy-x/kova/cmd/kova@latest
kova version

Use an explicit release tag instead of @latest when the installed version must be reproducible. Contributors can install the current checkout with:

make install
kova version

The client is CGO-free and runs on the workstation. Linux runtime images are split into controller, runner, and rootless BuildKit worker roles.

Install Kova

Choose a tag from GitHub releases, then install that exact OCI Helm chart without cloning the repository. The quick-start profile uses a generated static token and filesystem PVC; shared environments should use TokenReview and S3-compatible storage instead:

export KOVA_VERSION=vX.Y.Z
export KOVA_SERVICE_TOKEN=$(openssl rand -hex 32)

kubectl create namespace kova --dry-run=client -o yaml | kubectl apply -f -
kubectl -n kova create secret generic kova-service-auth \
  --from-literal=token="${KOVA_SERVICE_TOKEN}"

helm show crds oci://ghcr.io/cofy-x/charts/kova \
  --version "${KOVA_VERSION#v}" | kubectl apply -f -
helm upgrade --install kova oci://ghcr.io/cofy-x/charts/kova \
  --version "${KOVA_VERSION#v}" \
  --namespace kova \
  --create-namespace \
  --set serviceDaemon.enabled=true \
  --set serviceDaemon.authentication.mode=static \
  --set serviceDaemon.authentication.staticPrincipal=kova:quickstart \
  --set serviceDaemon.authentication.staticTokenSecret.name=kova-service-auth \
  --set artifactStore.filesystem.pvc.create=true \
  --wait

kubectl -n kova create rolebinding kova-quickstart \
  --role=kova-service-submitter \
  --user=kova:quickstart

Applying the release CRD before every Helm upgrade is required because Helm does not upgrade files from a chart's crds/ directory.

The chart selects matching controller, runner, and worker images automatically. Continue with the installation and first-build guide, create a Service context, and verify it before the first job:

kova doctor
kova job submit ./image --target registry.example.com/team/image:dev
kova job list
kova job wait <job-id>
kova job results <job-id>

The Service security and CLI guide covers identity, RBAC, contexts, artifact storage, and job operations. Direct runner commands remain available for local development and low-level debugging.

Documentation

• Documentation map: choose the guide for a task.
• Installation and first build: install the public OCI Helm chart and matching CLI, then verify a build.
• CLI workflow: contexts, prepare, direct runner builds, logs, export, and cleanup.
• Service job workflow: authenticated shared builds, authorization, storage, and native CLI operations.
• Runtime design: roles, topology, build/export, preheat, and scaling flows.
• Kubernetes deployment: Helm installation, registry credentials, worker sizing, and production configuration.
• Validation matrix: static checks, E2E targets, and runtime smoke expectations.
• Release process: CLI archives, OCI Helm charts, runtime images, SBOMs, provenance, and version tags.
• Examples: build input examples and runtime smoke service details.

Develop Kova

The repository requires the Go version declared in go.mod, Docker, kind, Helm, kubectl, curl, zip, and LMDB development headers. Run the fast checks with:

make test
make lint-scripts
make helm-template

Run the released-chart installation path locally with:

make e2e-helm-quickstart

Validate an already published release with:

make e2e-release KOVA_VERSION=vX.Y.Z

Use the validation guide to choose broader E2E coverage. Contributions are welcome; the contribution workflow covers the full setup and pull request process. Report vulnerabilities through the private process in the security policy.

Kova is licensed under the Apache License 2.0.