From 6b5b129ad6084c0da62be282217b2ed94ac20b95 Mon Sep 17 00:00:00 2001
From: unkin-agent <unkin-agent@unkin.net>
Date: Sat, 29 Aug 2026 21:20:10 +1000
Subject: [PATCH] clickhouse-system: use canonical upstream image names (#436)

rke2's `registries.yaml` already rewrites upstream image names to the artifactapi mirror, so manifests must carry canonical upstream names. Only in-house `artifactapi.k8s.syd1.au.unkin.net/docker-internal/...` images stay explicit.

Changes:
- Point the Altinity chart crdHook at `docker.io/bitnami/kubectl`.
- Point the operator at `docker.io/altinity/clickhouse-operator`.
- Point the metrics exporter at `docker.io/altinity/metrics-exporter`.
- Reword the header comment that claimed all images are pulled through the artifactapi dockerhub remote.

Only the `repository` keys change; the chart still supplies the tags (0.27.2 / latest), so rendered tags are identical. `kustomize build --enable-helm apps/overlays/au-syd1/clickhouse-system` differs from main only in those three image strings. No other proxied refs in the file.

Reviewed-on: https://git.unkin.net/unkin/argocd-apps/pulls/436
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>
---
 apps/overlays/au-syd1/clickhouse-system/values.yaml | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/apps/overlays/au-syd1/clickhouse-system/values.yaml b/apps/overlays/au-syd1/clickhouse-system/values.yaml
index 52b09b9..74b21a9 100644
--- a/apps/overlays/au-syd1/clickhouse-system/values.yaml
+++ b/apps/overlays/au-syd1/clickhouse-system/values.yaml
@@ -2,10 +2,9 @@
 # resources in all namespaces (the logs cluster lives in the `logging` namespace).
 # CRDs are installed at runtime by the chart's crdHook Job.
 #
-# All images are pulled through the artifactapi dockerhub remote (no direct
-# upstream). Upstream official images are used; no Docker Hardened Image variant
-# is adopted (DHI is subscription-gated and served from a private org namespace
-# not reachable via the anonymous artifactapi dockerhub proxy).
+# Upstream official images; no Docker Hardened Image variant is adopted (DHI is
+# subscription-gated and served from a private org namespace not reachable via
+# the anonymous artifactapi dockerhub proxy).
 #
 # Watch the logging namespace where the ClickHouseInstallation lives. The chart
 # default (watchNamespaces: []) makes the operator watch ONLY its own namespace
@@ -14,7 +13,7 @@ watchNamespaces:
   - logging
 crdHook:
   image:
-    repository: artifactapi.k8s.syd1.au.unkin.net/dockerhub/bitnami/kubectl
+    repository: docker.io/bitnami/kubectl
   resources:
     requests:
       cpu: 50m
@@ -25,7 +24,7 @@ crdHook:
 
 operator:
   image:
-    repository: artifactapi.k8s.syd1.au.unkin.net/dockerhub/altinity/clickhouse-operator
+    repository: docker.io/altinity/clickhouse-operator
   resources:
     requests:
       cpu: 100m
@@ -36,7 +35,7 @@ operator:
 
 metrics:
   image:
-    repository: artifactapi.k8s.syd1.au.unkin.net/dockerhub/altinity/metrics-exporter
+    repository: docker.io/altinity/metrics-exporter
   resources:
     requests:
       cpu: 50m