From 5466562bc13400769f75ce32156417f0ef7cd64f Mon Sep 17 00:00:00 2001 From: Unkin Agent Date: Mon, 17 Aug 2026 21:31:29 +1000 Subject: [PATCH] arrproxy: use real quay.io oauth2-proxy address (rke2 mirror) (#380) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Repoints the arrproxy `oauth2-proxy` sidecar image to the real upstream address `quay.io/oauth2-proxy/oauth2-proxy:v7.15.3`, replacing the one-off artifactapi copy (`artifactapi.k8s.syd1.au.unkin.net/ghcr/oauth2-proxy/oauth2-proxy:v7.15.3`). ## Why Pull the image from its canonical upstream location instead of a hand-copied artifactapi path. containerd on rke2 transparently mirrors `quay.io` through artifactapi, so the real address resolves without hardcoding the proxy host. ## Change - `apps/base/arrstack/arrproxy/oauth2-proxy-deployment.yaml`: image only -> `quay.io/oauth2-proxy/oauth2-proxy:v7.15.3`. Validated with `kustomize build --enable-helm apps/overlays/au-syd1/arrstack` and pre-commit. ## Dependencies (must be in place before merge) 1. **rke2 `registries.yaml` mirrors quay.io** — already configured in puppet (`hieradata/roles/infra/k8s.yaml`, `rke2::registries` rewrites `quay.io` -> `artifactapi.k8s.syd1.au.unkin.net/quay/$1`). No change needed. 2. **artifactapi quay remote allowlists oauth2-proxy** — terraform-artifactapi PR unkin/terraform-artifactapi#35 adds `^oauth2-proxy/` to the quay remote patterns. **This PR must NOT be merged until #35 is applied**, otherwise the caching proxy rejects `oauth2-proxy/*` and the sidecar fails to pull. --------- Co-authored-by: unkin-agent Reviewed-on: https://git.unkin.net/unkin/argocd-apps/pulls/380 Co-authored-by: Unkin Agent Co-committed-by: Unkin Agent --- apps/base/arrstack/arrproxy/oauth2-proxy-deployment.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apps/base/arrstack/arrproxy/oauth2-proxy-deployment.yaml b/apps/base/arrstack/arrproxy/oauth2-proxy-deployment.yaml index f3fb499..4b5faa4 100644 --- a/apps/base/arrstack/arrproxy/oauth2-proxy-deployment.yaml +++ b/apps/base/arrstack/arrproxy/oauth2-proxy-deployment.yaml @@ -62,7 +62,7 @@ spec: memory: 64Mi containers: - name: oauth2-proxy - image: artifactapi.k8s.syd1.au.unkin.net/ghcr/oauth2-proxy/oauth2-proxy:v7.15.3 + image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.3 imagePullPolicy: IfNotPresent ports: - containerPort: 4180