From 9616e0e2b352944746b401232eaa7135e3ecb02a Mon Sep 17 00:00:00 2001
From: unkin-agent <unkin-agent@unkin.net>
Date: Sat, 29 Aug 2026 21:16:59 +1000
Subject: [PATCH] arrstack: use canonical upstream image names (#427)

rke2's `registries.yaml` already rewrites upstream image names to the artifactapi mirror, so manifests must carry canonical upstream names. Only in-house `artifactapi.k8s.syd1.au.unkin.net/docker-internal/...` images stay explicit.

Changes:
- Point the arrproxy migrate job at `docker.io/library/postgres:18-alpine`.
- Point the arrproxy oauth2-proxy cert-combine init container at `docker.io/library/alpine:3`.
- Point the arrstack ValkeyCluster at `docker.io/valkey/valkey:9.0.0`.

Tags are unchanged. `kustomize build --enable-helm apps/overlays/au-syd1/arrstack` differs from main only in those three image strings. No extra proxied refs found in these files (the oauth2-proxy image itself is already canonical `quay.io/...`).

Reviewed-on: https://git.unkin.net/unkin/argocd-apps/pulls/427
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>
---
 apps/base/arrstack/arrproxy/migrate-job.yaml             | 2 +-
 apps/base/arrstack/arrproxy/oauth2-proxy-deployment.yaml | 2 +-
 apps/base/arrstack/valkey/valkeycluster.yaml             | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/apps/base/arrstack/arrproxy/migrate-job.yaml b/apps/base/arrstack/arrproxy/migrate-job.yaml
index 7f908f6..6cc9fe5 100644
--- a/apps/base/arrstack/arrproxy/migrate-job.yaml
+++ b/apps/base/arrstack/arrproxy/migrate-job.yaml
@@ -35,7 +35,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: migrate
-          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/postgres:18-alpine
+          image: docker.io/library/postgres:18-alpine
           imagePullPolicy: IfNotPresent
           env:
             - name: HOME
diff --git a/apps/base/arrstack/arrproxy/oauth2-proxy-deployment.yaml b/apps/base/arrstack/arrproxy/oauth2-proxy-deployment.yaml
index 4b5faa4..70fb45e 100644
--- a/apps/base/arrstack/arrproxy/oauth2-proxy-deployment.yaml
+++ b/apps/base/arrstack/arrproxy/oauth2-proxy-deployment.yaml
@@ -35,7 +35,7 @@ spec:
         # identity.unkin.net serves a Vault-PKI cert; combine the system roots
         # with the internal CA so oauth2-proxy's OIDC HTTP client trusts it.
         - name: combine-certs
-          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/alpine:3
+          image: docker.io/library/alpine:3
           imagePullPolicy: IfNotPresent
           command:
             - sh
diff --git a/apps/base/arrstack/valkey/valkeycluster.yaml b/apps/base/arrstack/valkey/valkeycluster.yaml
index 2c107df..87d207f 100644
--- a/apps/base/arrstack/valkey/valkeycluster.yaml
+++ b/apps/base/arrstack/valkey/valkeycluster.yaml
@@ -28,7 +28,7 @@ metadata:
 spec:
   shards: 1
   replicas: 2
-  image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/valkey/valkey:9.0.0
+  image: docker.io/valkey/valkey:9.0.0
   exporter:
     enabled: false
   scheduling: