From 38a41bd44b807738805e8ce057793a33b9a3b4aa Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Sat, 29 Aug 2026 21:19:36 +1000 Subject: [PATCH] watchstate: use canonical upstream image name for alpine (#435) rke2's `registries.yaml` already rewrites upstream image names to the artifactapi mirror, so manifests must carry canonical upstream names. Only in-house `artifactapi.k8s.syd1.au.unkin.net/docker-internal/...` images stay explicit. Changes: - Point the watchstate oauth2-proxy cert-combine init container at `docker.io/library/alpine:3`. Tag unchanged. `kustomize build --enable-helm apps/overlays/au-syd1/watchstate` differs from main only in that image string. No extra proxied refs in the file (the oauth2-proxy image itself is already canonical `quay.io/...`). Reviewed-on: https://git.unkin.net/unkin/argocd-apps/pulls/435 Co-authored-by: unkin-agent Co-committed-by: unkin-agent --- apps/base/watchstate/oauth2-proxy-deployment.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apps/base/watchstate/oauth2-proxy-deployment.yaml b/apps/base/watchstate/oauth2-proxy-deployment.yaml index 6c1d3ea..a4cca26 100644 --- a/apps/base/watchstate/oauth2-proxy-deployment.yaml +++ b/apps/base/watchstate/oauth2-proxy-deployment.yaml @@ -35,7 +35,7 @@ spec: # system roots with the internal CA so oauth2-proxy's OIDC HTTP client # trusts it. - name: combine-certs - image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/alpine:3 + image: docker.io/library/alpine:3 imagePullPolicy: IfNotPresent command: - sh