From d04940b1ea96dfb773e0b399a58ef1359531ee85 Mon Sep 17 00:00:00 2001
From: Ben Vincent <ben@unkin.net>
Date: Fri, 31 Jul 2026 20:07:16 +1000
Subject: [PATCH] Pull in-estate service images from artifactapi
 docker-internal (#310)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Move the estate's own service/operator image pulls off the Gitea container registry (git.unkin.net/unkin) to the artifactapi local docker registry (docker-internal), ahead of the git.unkin.net forge migration which disables Gitea's container registry. The images were copied digest-for-digest into docker-internal and pulls verified before this repoint.

- repoint age-api, bind-operator, bind-tsig-api, cephrgw-operator, encapi, logarchiver, pdbmux image pulls to artifactapi.k8s.syd1.au.unkin.net/docker-internal

Deliberately not repointed here: artifactapi's own api/ui images (circular — it can't pull itself from itself), and the almalinux9-* base/CI images (huge, and their per-repo Woodpecker push targets move in a batched follow-up). Forge raw-CRD URLs and git clone sources are unaffected (those stay on the forge).

Reviewed-on: https://git.unkin.net/unkin/argocd-apps/pulls/310
Co-authored-by: Ben Vincent <ben@unkin.net>
Co-committed-by: Ben Vincent <ben@unkin.net>
---
 apps/base/age-api/deployment.yaml              | 2 +-
 apps/base/bind-internal/tsig-api/tsig-api.yaml | 2 +-
 apps/base/bind-system/deployment.yaml          | 2 +-
 apps/base/cephrgw-system/deployment.yaml       | 2 +-
 apps/base/encapi/deployment.yaml               | 2 +-
 apps/base/logging/deployment_logarchiver.yaml  | 2 +-
 apps/base/pdbmux/deployment.yaml               | 2 +-
 7 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/apps/base/age-api/deployment.yaml b/apps/base/age-api/deployment.yaml
index d553278..f555471 100644
--- a/apps/base/age-api/deployment.yaml
+++ b/apps/base/age-api/deployment.yaml
@@ -18,7 +18,7 @@ spec:
     spec:
       containers:
         - name: age-api
-          image: git.unkin.net/unkin/age-api:v0.1.0
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/age-api:v0.1.0
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 8080
diff --git a/apps/base/bind-internal/tsig-api/tsig-api.yaml b/apps/base/bind-internal/tsig-api/tsig-api.yaml
index d40d2c6..309b475 100644
--- a/apps/base/bind-internal/tsig-api/tsig-api.yaml
+++ b/apps/base/bind-internal/tsig-api/tsig-api.yaml
@@ -13,7 +13,7 @@ metadata:
   name: bind-tsig-api
   namespace: bind-internal
 spec:
-  image: git.unkin.net/unkin/bind-tsig-api:v0.2.3
+  image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/bind-tsig-api:v0.2.3
   replicas: 1
   port: 8443
   # targetNamespace defaults to this resource's namespace (bind-internal), where
diff --git a/apps/base/bind-system/deployment.yaml b/apps/base/bind-system/deployment.yaml
index 8bb1eeb..abe8f61 100644
--- a/apps/base/bind-system/deployment.yaml
+++ b/apps/base/bind-system/deployment.yaml
@@ -21,7 +21,7 @@ spec:
         runAsNonRoot: true
       containers:
         - name: operator
-          image: git.unkin.net/unkin/bind-operator:v0.2.6
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/bind-operator:v0.2.6
           args:
             - --metrics-bind-address=:8080
             - --health-probe-bind-address=:8081
diff --git a/apps/base/cephrgw-system/deployment.yaml b/apps/base/cephrgw-system/deployment.yaml
index d64ed0d..d6d5f9e 100644
--- a/apps/base/cephrgw-system/deployment.yaml
+++ b/apps/base/cephrgw-system/deployment.yaml
@@ -24,7 +24,7 @@ spec:
         runAsNonRoot: true
       containers:
         - name: operator
-          image: git.unkin.net/unkin/cephrgw-operator:v0.4.0
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/cephrgw-operator:v0.4.0
           args:
             - --metrics-bind-address=:8080
             - --health-probe-bind-address=:8081
diff --git a/apps/base/encapi/deployment.yaml b/apps/base/encapi/deployment.yaml
index 60f14d8..0872a87 100644
--- a/apps/base/encapi/deployment.yaml
+++ b/apps/base/encapi/deployment.yaml
@@ -23,7 +23,7 @@ spec:
       automountServiceAccountToken: true
       containers:
         - name: encapi
-          image: git.unkin.net/unkin/encapi:v0.1.1
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/encapi:v0.1.1
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 8000
diff --git a/apps/base/logging/deployment_logarchiver.yaml b/apps/base/logging/deployment_logarchiver.yaml
index 73f70a2..d738db7 100644
--- a/apps/base/logging/deployment_logarchiver.yaml
+++ b/apps/base/logging/deployment_logarchiver.yaml
@@ -39,7 +39,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: logarchiver
-          image: git.unkin.net/unkin/logarchiver:v0.1.0
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/logarchiver:v0.1.0
           imagePullPolicy: IfNotPresent
           args: ["run"]
           securityContext:
diff --git a/apps/base/pdbmux/deployment.yaml b/apps/base/pdbmux/deployment.yaml
index d51b947..8f32f78 100644
--- a/apps/base/pdbmux/deployment.yaml
+++ b/apps/base/pdbmux/deployment.yaml
@@ -25,7 +25,7 @@ spec:
         - name: pdbmux
           # Image is published by the pdbmux repo's .woodpecker/docker.yaml on
           # a v* tag. It only exists after that tag is cut (see PR merge gates).
-          image: git.unkin.net/unkin/pdbmux:v0.1.0
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/pdbmux:v0.1.0
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 8080