Pull in-estate service images from artifactapi docker-internal (#310)

Move the estate's own service/operator image pulls off the Gitea container registry (git.unkin.net/unkin) to the artifactapi local docker registry (docker-internal), ahead of the git.unkin.net forge migration which disables Gitea's container registry. The images were copied digest-for-digest into docker-internal and pulls verified before this repoint.

- repoint age-api, bind-operator, bind-tsig-api, cephrgw-operator, encapi, logarchiver, pdbmux image pulls to artifactapi.k8s.syd1.au.unkin.net/docker-internal

Deliberately not repointed here: artifactapi's own api/ui images (circular — it can't pull itself from itself), and the almalinux9-* base/CI images (huge, and their per-repo Woodpecker push targets move in a batched follow-up). Forge raw-CRD URLs and git clone sources are unaffected (those stay on the forge).

Reviewed-on: #310
Co-authored-by: Ben Vincent <ben@unkin.net>
Co-committed-by: Ben Vincent <ben@unkin.net>

apps/base/age-api/deployment.yaml

@@ -18,7 +18,7 @@ spec:
     spec:
       containers:
         - name: age-api
-          image: git.unkin.net/unkin/age-api:v0.1.0
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/age-api:v0.1.0
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 8080

apps/base/bind-internal/tsig-api/tsig-api.yaml

@@ -13,7 +13,7 @@ metadata:
   name: bind-tsig-api
   namespace: bind-internal
 spec:
-  image: git.unkin.net/unkin/bind-tsig-api:v0.2.3
+  image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/bind-tsig-api:v0.2.3
   replicas: 1
   port: 8443
   # targetNamespace defaults to this resource's namespace (bind-internal), where

apps/base/bind-system/deployment.yaml

@@ -21,7 +21,7 @@ spec:
         runAsNonRoot: true
       containers:
         - name: operator
-          image: git.unkin.net/unkin/bind-operator:v0.2.6
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/bind-operator:v0.2.6
           args:
             - --metrics-bind-address=:8080
             - --health-probe-bind-address=:8081

apps/base/cephrgw-system/deployment.yaml

@@ -24,7 +24,7 @@ spec:
         runAsNonRoot: true
       containers:
         - name: operator
-          image: git.unkin.net/unkin/cephrgw-operator:v0.4.0
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/cephrgw-operator:v0.4.0
           args:
             - --metrics-bind-address=:8080
             - --health-probe-bind-address=:8081

apps/base/encapi/deployment.yaml

@@ -23,7 +23,7 @@ spec:
       automountServiceAccountToken: true
       containers:
         - name: encapi
-          image: git.unkin.net/unkin/encapi:v0.1.1
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/encapi:v0.1.1
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 8000

apps/base/logging/deployment_logarchiver.yaml

@@ -39,7 +39,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: logarchiver
-          image: git.unkin.net/unkin/logarchiver:v0.1.0
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/logarchiver:v0.1.0
           imagePullPolicy: IfNotPresent
           args: ["run"]
           securityContext:

apps/base/pdbmux/deployment.yaml

@@ -25,7 +25,7 @@ spec:
         - name: pdbmux
           # Image is published by the pdbmux repo's .woodpecker/docker.yaml on
           # a v* tag. It only exists after that tag is cut (see PR merge gates).
-          image: git.unkin.net/unkin/pdbmux:v0.1.0
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/pdbmux:v0.1.0
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 8080