From 0130d538f58bb13af9317b28ef40ee0feec6c1c7 Mon Sep 17 00:00:00 2001
From: unkin-agent <unkin-agent@unkin.net>
Date: Thu, 13 Aug 2026 22:08:05 +1000
Subject: [PATCH] ghp: use direct ghcr.io image + set GHP_ADMINS (#359)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

## Why
The `ghp` app is deployed but its pods are stuck 0/1 Ready (and were ImagePullBackOff), for three separate reasons this PR fixes:

- **ImagePullBackOff:** kubelet anonymous pulls fail on the artifactapi ghcr pull-through because ghcr.io's per-scope token auth is not proxied. The direct public image pulls anonymously, so switch to it.
- **Pods never Ready:** ghp serves its metrics endpoint over **HTTPS** (TLS is configured globally), but the liveness/readiness probes used the default HTTP scheme, so the kubelet probe got an HTTPS-server error and the pods never went Ready.
- **Scrape failure:** the VMServiceScrape hits that same HTTPS endpoint and needs a matching scheme/TLS config, or VM scraping of ghp fails.
- The `GHP_ADMINS` value was still a placeholder.

## How
- `deployment.yaml`: image -> `ghcr.io/goodtune/ghp:0.20.0`; liveness + readiness probe `scheme: HTTP` -> `HTTPS` (kubelet does not verify the probe cert).
- `migrate-job.yaml`: image -> `ghcr.io/goodtune/ghp:0.20.0` (shared image).
- `vmservicescrape.yaml`: endpoint `scheme: https` + `tlsConfig.insecureSkipVerify: true` (internal-CA cert; pod-IP target not in SANs).
- `configmap.yaml`: `GHP_ADMINS` -> `neoloc`.

Validated: `kustomize build apps/overlays/au-syd1/ghp` renders clean, kubeconform + pre-commit pass. Not applied.

## Follow-up (not fixed here)
The artifactapi ghcr pull-through does not proxy ghcr.io's per-scope token auth for anonymous kubelet pulls — worth closing that gap so estate images can go back through artifactapi.

Reviewed-on: https://git.unkin.net/unkin/argocd-apps/pulls/359
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>
---
 apps/base/ghp/configmap.yaml       | 2 +-
 apps/base/ghp/deployment.yaml      | 6 +++---
 apps/base/ghp/migrate-job.yaml     | 2 +-
 apps/base/ghp/vmservicescrape.yaml | 5 +++++
 4 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/apps/base/ghp/configmap.yaml b/apps/base/ghp/configmap.yaml
index f35f4ed..4cc2947 100644
--- a/apps/base/ghp/configmap.yaml
+++ b/apps/base/ghp/configmap.yaml
@@ -19,4 +19,4 @@ data:
   GHP_TLS_CERT_FILE: /etc/ghp/tls/tls.crt
   GHP_TLS_KEY_FILE: /etc/ghp/tls/tls.key
   # PLACEHOLDER: set to Ben's GitHub username before ghp will admit an admin.
-  GHP_ADMINS: "REPLACE_ME_ben_github_username"
+  GHP_ADMINS: "neoloc"
diff --git a/apps/base/ghp/deployment.yaml b/apps/base/ghp/deployment.yaml
index ab4013b..1a7f5b2 100644
--- a/apps/base/ghp/deployment.yaml
+++ b/apps/base/ghp/deployment.yaml
@@ -34,7 +34,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: ghp
-          image: artifactapi.k8s.syd1.au.unkin.net/ghcr/goodtune/ghp:0.20.0
+          image: ghcr.io/goodtune/ghp:0.20.0
           imagePullPolicy: IfNotPresent
           # Drop the image's default --migrate so replicas never race migrations;
           # schema is applied by the wave-1 migrate hook Job instead.
@@ -102,7 +102,7 @@ spec:
             httpGet:
               path: /metrics
               port: metrics
-              scheme: HTTP
+              scheme: HTTPS
             initialDelaySeconds: 30
             periodSeconds: 30
             successThreshold: 1
@@ -112,7 +112,7 @@ spec:
             httpGet:
               path: /metrics
               port: metrics
-              scheme: HTTP
+              scheme: HTTPS
             initialDelaySeconds: 10
             periodSeconds: 5
             successThreshold: 1
diff --git a/apps/base/ghp/migrate-job.yaml b/apps/base/ghp/migrate-job.yaml
index 443feef..ef8438c 100644
--- a/apps/base/ghp/migrate-job.yaml
+++ b/apps/base/ghp/migrate-job.yaml
@@ -37,7 +37,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: migrate
-          image: artifactapi.k8s.syd1.au.unkin.net/ghcr/goodtune/ghp:0.20.0
+          image: ghcr.io/goodtune/ghp:0.20.0
           imagePullPolicy: IfNotPresent
           command: ["/ghp", "migrate"]
           env:
diff --git a/apps/base/ghp/vmservicescrape.yaml b/apps/base/ghp/vmservicescrape.yaml
index a91bde9..e5ca485 100644
--- a/apps/base/ghp/vmservicescrape.yaml
+++ b/apps/base/ghp/vmservicescrape.yaml
@@ -16,3 +16,8 @@ spec:
   endpoints:
     - port: metrics
       path: /metrics
+      scheme: https
+      # ghp serves metrics over TLS with an internal-CA cert; skip verification
+      # since the scrape targets a pod IP the cert SANs do not cover.
+      tlsConfig:
+        insecureSkipVerify: true