unkin/argocd-apps
3
0
Fork 0
Code Issues 7 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

logging: use canonical upstream image names #433

Merged
benvin merged 2 commits from benvin/upstream-images-logging into main 2026-08-29 21:55:48 +10:00
Conversation 2 Commits 2 Files Changed 8
+13 -14
unkin-agent commented 2026-08-29 21:10:15 +10:00
Member
Copy Link
Copy Source

rke2's registries.yaml already rewrites upstream image names to the artifactapi mirror, so manifests must carry canonical upstream names. Only in-house artifactapi.k8s.syd1.au.unkin.net/docker-internal/... images stay explicit (logarchiver/logviewer are untouched).

Changes:

  • Point the ClickHouseInstallation and the clickhouse-schema job at docker.io/clickhouse/clickhouse-server:24.8.
  • Point the logviewer oauth2-proxy cert-combine init container at docker.io/library/alpine:3.
  • Point the NATS bootstrap job at docker.io/natsio/nats-box:0.18.0.
  • Point the NATS chart values at docker.io/library/nats and docker.io/natsio/nats-server-config-reloader.
  • Point all three Vector values files (agent, aggregator, vm-ingest) at docker.io/timberio/vector.
  • Drop the now-wrong "pulled through the artifactapi dockerhub remote" comments in the NATS and vector-agent values.

Tags/digests unchanged and the repository/tag split is preserved. kustomize build --enable-helm apps/overlays/au-syd1/logging differs from main only in those nine image strings.

Extra found, not changed here: .woodpecker/vector-test.yaml still pins its CI step image to artifactapi.k8s.syd1.au.unkin.net/dockerhub/timberio/vector:0.57.0-debian. That is a Woodpecker step image rather than a namespace manifest, so it is left out to keep this PR to the logging namespace — say the word and I will fix it separately.

rke2's `registries.yaml` already rewrites upstream image names to the artifactapi mirror, so manifests must carry canonical upstream names. Only in-house `artifactapi.k8s.syd1.au.unkin.net/docker-internal/...` images stay explicit (logarchiver/logviewer are untouched). Changes: - Point the ClickHouseInstallation and the clickhouse-schema job at `docker.io/clickhouse/clickhouse-server:24.8`. - Point the logviewer oauth2-proxy cert-combine init container at `docker.io/library/alpine:3`. - Point the NATS bootstrap job at `docker.io/natsio/nats-box:0.18.0`. - Point the NATS chart values at `docker.io/library/nats` and `docker.io/natsio/nats-server-config-reloader`. - Point all three Vector values files (agent, aggregator, vm-ingest) at `docker.io/timberio/vector`. - Drop the now-wrong "pulled through the artifactapi dockerhub remote" comments in the NATS and vector-agent values. Tags/digests unchanged and the `repository`/`tag` split is preserved. `kustomize build --enable-helm apps/overlays/au-syd1/logging` differs from main only in those nine image strings. Extra found, not changed here: `.woodpecker/vector-test.yaml` still pins its CI step image to `artifactapi.k8s.syd1.au.unkin.net/dockerhub/timberio/vector:0.57.0-debian`. That is a Woodpecker step image rather than a namespace manifest, so it is left out to keep this PR to the logging namespace — say the word and I will fix it separately.
unkin-agent added 1 commit 2026-08-29 21:10:15 +10:00
logging: use canonical upstream image names
ci/woodpecker/pr/vector-test Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/kubeconform Pipeline was successful
Details
6e6dabeaa9
unkin-agent commented 2026-08-29 21:32:26 +10:00
Author
Member
Copy Link
Copy Source

Investigated the "unmergeable" state. There is no textual conflict with main.

  • main (74ad2c8) has not touched apps/base/logging/** or apps/overlays/au-syd1/logging/** since this branch's merge base (c313c7c), so git merge origin/main into benvin/upstream-images-logging resolves cleanly with zero conflicted files.
  • kustomize build --enable-helm apps/overlays/au-syd1/logging succeeds on the merged tree, and the rendered diff vs origin/main is exactly the 9 image-name policy lines (alpine, vector x3, nats, nats-server-config-reloader, nats-box, clickhouse-server x2). No tag/digest changes; the two docker-internal images stay explicit.

The real blocker is server-side object corruption in the Gitea repo, not this branch. Pushing the merge commit is rejected with:

remote: error: inflate: data stream error (unknown compression method)
remote: error: unable to unpack 51dc459d3d59d9f5c1399c9e6c61e392ed54581f header
remote: fatal: loose object 51dc459d3d59d9f5c1399c9e6c61e392ed54581f (stored in
  /shared/apps/gitea/repos/unkin/argocd-apps.git/objects/51/dc459d...) is corrupt
 ! [remote rejected] benvin/upstream-images-logging (missing necessary objects)

51dc459d is precisely the root tree of the merge of this branch with main. The local copy is a valid 509-byte tree; the server's loose copy is truncated/garbage, so receive-pack skips writing our good copy (file already exists) and then fails its connectivity check. POST /pulls/433/update?style=merge (Gitea doing the merge itself) also returns HTTP 500 for the same reason — which is exactly why Gitea reports mergeable: false.

Because the merge result is content-addressed, every retry produces the same tree SHA and hits the same corrupt file. Retried with --no-thin; same failure. PR #437 (benvin/upstream-images-valkey-operator-system) is also stuck at mergeable: false, so this may not be isolated.

Two ways to unblock, both need a human:

  1. Delete the corrupt loose object on the Gitea server (/shared/apps/gitea/repos/unkin/argocd-apps.git/objects/51/dc459d3d59d9f5c1399c9e6c61e392ed54581f), then this branch pushes and merges as-is. Worth a git fsck on the repo and a disk-space check on the /shared volume at the same time — truncated loose objects are a classic ENOSPC symptom.
  2. Merge any other PR into main first (e.g. #439/#440). That moves main, which changes the merge root tree to a different SHA and sidesteps the corrupt object entirely.

Nothing was pushed to this branch — it is unchanged at 6e6dabe.

Investigated the "unmergeable" state. There is **no textual conflict** with `main`. - `main` (74ad2c8) has not touched `apps/base/logging/**` or `apps/overlays/au-syd1/logging/**` since this branch's merge base (c313c7c), so `git merge origin/main` into `benvin/upstream-images-logging` resolves cleanly with zero conflicted files. - `kustomize build --enable-helm apps/overlays/au-syd1/logging` succeeds on the merged tree, and the rendered diff vs `origin/main` is exactly the 9 image-name policy lines (alpine, vector x3, nats, nats-server-config-reloader, nats-box, clickhouse-server x2). No tag/digest changes; the two `docker-internal` images stay explicit. The real blocker is **server-side object corruption in the Gitea repo**, not this branch. Pushing the merge commit is rejected with: ``` remote: error: inflate: data stream error (unknown compression method) remote: error: unable to unpack 51dc459d3d59d9f5c1399c9e6c61e392ed54581f header remote: fatal: loose object 51dc459d3d59d9f5c1399c9e6c61e392ed54581f (stored in /shared/apps/gitea/repos/unkin/argocd-apps.git/objects/51/dc459d...) is corrupt ! [remote rejected] benvin/upstream-images-logging (missing necessary objects) ``` `51dc459d` is precisely the **root tree of the merge of this branch with `main`**. The local copy is a valid 509-byte tree; the server's loose copy is truncated/garbage, so `receive-pack` skips writing our good copy (file already exists) and then fails its connectivity check. `POST /pulls/433/update?style=merge` (Gitea doing the merge itself) also returns HTTP 500 for the same reason — which is exactly why Gitea reports `mergeable: false`. Because the merge result is content-addressed, every retry produces the same tree SHA and hits the same corrupt file. Retried with `--no-thin`; same failure. PR #437 (`benvin/upstream-images-valkey-operator-system`) is also stuck at `mergeable: false`, so this may not be isolated. Two ways to unblock, both need a human: 1. Delete the corrupt loose object on the Gitea server (`/shared/apps/gitea/repos/unkin/argocd-apps.git/objects/51/dc459d3d59d9f5c1399c9e6c61e392ed54581f`), then this branch pushes and merges as-is. Worth a `git fsck` on the repo and a disk-space check on the `/shared` volume at the same time — truncated loose objects are a classic ENOSPC symptom. 2. Merge any other PR into `main` first (e.g. #439/#440). That moves `main`, which changes the merge root tree to a different SHA and sidesteps the corrupt object entirely. Nothing was pushed to this branch — it is unchanged at 6e6dabe.
unkin-agent added 1 commit 2026-08-29 21:53:20 +10:00
Merge remote-tracking branch 'origin/main' into benvin/upstream-images-logging
ci/woodpecker/pr/vector-test Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/kubeconform Pipeline was successful
Details
77a9a910df
unkin-agent commented 2026-08-29 21:53:39 +10:00
Author
Member
Copy Link
Copy Source

Merge with main pushed successfully now that main moved past the corrupt-object hash collision (head 77a9a91).

Merge with main pushed successfully now that main moved past the corrupt-object hash collision (head 77a9a91).
benvin merged commit d1085f0ae2 into main 2026-08-29 21:55:48 +10:00
benvin deleted branch benvin/upstream-images-logging 2026-08-29 21:55:48 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/argocd-apps#433
Delete Branch "benvin/upstream-images-logging"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?