From d1085f0ae231e506614475b5a935a2e20527e646 Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Sat, 29 Aug 2026 21:55:47 +1000 Subject: [PATCH] logging: use canonical upstream image names (#433) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit rke2's `registries.yaml` already rewrites upstream image names to the artifactapi mirror, so manifests must carry canonical upstream names. Only in-house `artifactapi.k8s.syd1.au.unkin.net/docker-internal/...` images stay explicit (logarchiver/logviewer are untouched). Changes: - Point the ClickHouseInstallation and the clickhouse-schema job at `docker.io/clickhouse/clickhouse-server:24.8`. - Point the logviewer oauth2-proxy cert-combine init container at `docker.io/library/alpine:3`. - Point the NATS bootstrap job at `docker.io/natsio/nats-box:0.18.0`. - Point the NATS chart values at `docker.io/library/nats` and `docker.io/natsio/nats-server-config-reloader`. - Point all three Vector values files (agent, aggregator, vm-ingest) at `docker.io/timberio/vector`. - Drop the now-wrong "pulled through the artifactapi dockerhub remote" comments in the NATS and vector-agent values. Tags/digests unchanged and the `repository`/`tag` split is preserved. `kustomize build --enable-helm apps/overlays/au-syd1/logging` differs from main only in those nine image strings. Extra found, not changed here: `.woodpecker/vector-test.yaml` still pins its CI step image to `artifactapi.k8s.syd1.au.unkin.net/dockerhub/timberio/vector:0.57.0-debian`. That is a Woodpecker step image rather than a namespace manifest, so it is left out to keep this PR to the logging namespace — say the word and I will fix it separately. Reviewed-on: https://git.unkin.net/unkin/argocd-apps/pulls/433 Co-authored-by: unkin-agent Co-committed-by: unkin-agent --- apps/base/logging/clickhouseinstallation.yaml | 2 +- apps/base/logging/job_clickhouse-schema.yaml | 2 +- apps/base/logging/logviewer/oauth2-proxy-deployment.yaml | 2 +- apps/base/logging/nats-bootstrap-job.yaml | 2 +- apps/overlays/au-syd1/logging/values-nats.yaml | 9 ++++----- apps/overlays/au-syd1/logging/values-vector-agent.yaml | 6 +++--- .../au-syd1/logging/values-vector-aggregator.yaml | 2 +- .../au-syd1/logging/values-vector-vm-ingest.yaml | 2 +- 8 files changed, 13 insertions(+), 14 deletions(-) diff --git a/apps/base/logging/clickhouseinstallation.yaml b/apps/base/logging/clickhouseinstallation.yaml index 72641a4..886bbcf 100644 --- a/apps/base/logging/clickhouseinstallation.yaml +++ b/apps/base/logging/clickhouseinstallation.yaml @@ -87,7 +87,7 @@ spec: runAsGroup: 101 containers: - name: clickhouse - image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/clickhouse/clickhouse-server:24.8 + image: docker.io/clickhouse/clickhouse-server:24.8 resources: requests: cpu: 500m diff --git a/apps/base/logging/job_clickhouse-schema.yaml b/apps/base/logging/job_clickhouse-schema.yaml index 2df42b8..ecc3143 100644 --- a/apps/base/logging/job_clickhouse-schema.yaml +++ b/apps/base/logging/job_clickhouse-schema.yaml @@ -32,7 +32,7 @@ spec: runAsGroup: 101 containers: - name: clickhouse-schema - image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/clickhouse/clickhouse-server:24.8 + image: docker.io/clickhouse/clickhouse-server:24.8 securityContext: allowPrivilegeEscalation: false readOnlyRootFilesystem: true diff --git a/apps/base/logging/logviewer/oauth2-proxy-deployment.yaml b/apps/base/logging/logviewer/oauth2-proxy-deployment.yaml index adfc739..57b5e9a 100644 --- a/apps/base/logging/logviewer/oauth2-proxy-deployment.yaml +++ b/apps/base/logging/logviewer/oauth2-proxy-deployment.yaml @@ -34,7 +34,7 @@ spec: # identity.unkin.net serves a Vault-PKI cert; combine the system roots # with the internal CA so oauth2-proxy's OIDC HTTP client trusts it. - name: combine-certs - image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/alpine:3 + image: docker.io/library/alpine:3 imagePullPolicy: IfNotPresent command: - sh diff --git a/apps/base/logging/nats-bootstrap-job.yaml b/apps/base/logging/nats-bootstrap-job.yaml index dd27630..296b1a8 100644 --- a/apps/base/logging/nats-bootstrap-job.yaml +++ b/apps/base/logging/nats-bootstrap-job.yaml @@ -58,7 +58,7 @@ spec: runAsGroup: 1000 containers: - name: nats-bootstrap - image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/natsio/nats-box:0.18.0 + image: docker.io/natsio/nats-box:0.18.0 # nats CLI stats the working directory when loading its response # schemas; under readOnlyRootFilesystem + runAsUser 1000 the image's # default WORKDIR is not accessible ("stat .: permission denied"), so diff --git a/apps/overlays/au-syd1/logging/values-nats.yaml b/apps/overlays/au-syd1/logging/values-nats.yaml index f482dff..6c0d582 100644 --- a/apps/overlays/au-syd1/logging/values-nats.yaml +++ b/apps/overlays/au-syd1/logging/values-nats.yaml @@ -57,10 +57,9 @@ config: - "_INBOX.>" container: - # Pulled through the artifactapi dockerhub remote (upstream official nats; - # no DHI variant available for nats). + # Upstream official nats; no DHI variant available. image: - repository: artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/nats + repository: docker.io/library/nats tag: 2.14.2-alpine env: NATS_ADMIN_PASSWORD: @@ -94,10 +93,10 @@ podTemplate: annotations: configmap.reloader.stakater.com/auto: "true" -# Config-reloader sidecar image, also through artifactapi. +# Config-reloader sidecar image. reloader: image: - repository: artifactapi.k8s.syd1.au.unkin.net/dockerhub/natsio/nats-server-config-reloader + repository: docker.io/natsio/nats-server-config-reloader tag: "0.23.0" natsBox: diff --git a/apps/overlays/au-syd1/logging/values-vector-agent.yaml b/apps/overlays/au-syd1/logging/values-vector-agent.yaml index d20092a..a05a805 100644 --- a/apps/overlays/au-syd1/logging/values-vector-agent.yaml +++ b/apps/overlays/au-syd1/logging/values-vector-agent.yaml @@ -5,10 +5,10 @@ role: Agent fullnameOverride: vector-agent -# Pulled through the artifactapi dockerhub remote; distroless-libc (no DHI — -# subscription-gated/private-namespace, not reachable via the anon proxy). +# distroless-libc (no DHI — subscription-gated/private-namespace, not reachable +# via the anon proxy). image: - repository: artifactapi.k8s.syd1.au.unkin.net/dockerhub/timberio/vector + repository: docker.io/timberio/vector tag: 0.57.0-distroless-libc rbac: diff --git a/apps/overlays/au-syd1/logging/values-vector-aggregator.yaml b/apps/overlays/au-syd1/logging/values-vector-aggregator.yaml index f6226b4..549c19e 100644 --- a/apps/overlays/au-syd1/logging/values-vector-aggregator.yaml +++ b/apps/overlays/au-syd1/logging/values-vector-aggregator.yaml @@ -15,7 +15,7 @@ role: Stateless-Aggregator fullnameOverride: vector-aggregator image: - repository: artifactapi.k8s.syd1.au.unkin.net/dockerhub/timberio/vector + repository: docker.io/timberio/vector tag: 0.57.0-distroless-libc # Horizontal autoscaling on CPU — safe with N replicas on one durable consumer. diff --git a/apps/overlays/au-syd1/logging/values-vector-vm-ingest.yaml b/apps/overlays/au-syd1/logging/values-vector-vm-ingest.yaml index c915c7a..9e66a91 100644 --- a/apps/overlays/au-syd1/logging/values-vector-vm-ingest.yaml +++ b/apps/overlays/au-syd1/logging/values-vector-vm-ingest.yaml @@ -6,7 +6,7 @@ fullnameOverride: vector-vm-ingest replicas: 2 image: - repository: artifactapi.k8s.syd1.au.unkin.net/dockerhub/timberio/vector + repository: docker.io/timberio/vector tag: 0.57.0-distroless-libc workloadResourceAnnotations: