From 25738189131ee687905398661c4d0945fdb5bdf8 Mon Sep 17 00:00:00 2001
From: Ben Vincent <ben@unkin.net>
Date: Wed, 29 Jul 2026 22:05:05 +1000
Subject: [PATCH] Pull in-estate service images from artifactapi
 docker-internal

Move the estate's own service/operator image pulls off the Gitea container
registry (git.unkin.net/unkin) to the artifactapi local docker registry, ahead
of the git.unkin.net forge migration which disables Gitea's container registry.
Images were copied digest-for-digest into docker-internal and pulls verified.

- repoint age-api, bind-operator, bind-tsig-api, cephrgw-operator, encapi,
  logarchiver, pdbmux to artifactapi.k8s.syd1.au.unkin.net/docker-internal

Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
---
 apps/base/age-api/deployment.yaml              | 2 +-
 apps/base/bind-internal/tsig-api/tsig-api.yaml | 2 +-
 apps/base/bind-system/deployment.yaml          | 2 +-
 apps/base/cephrgw-system/deployment.yaml       | 2 +-
 apps/base/encapi/deployment.yaml               | 2 +-
 apps/base/logging/deployment_logarchiver.yaml  | 2 +-
 apps/base/pdbmux/deployment.yaml               | 2 +-
 7 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/apps/base/age-api/deployment.yaml b/apps/base/age-api/deployment.yaml
index d553278..f555471 100644
--- a/apps/base/age-api/deployment.yaml
+++ b/apps/base/age-api/deployment.yaml
@@ -18,7 +18,7 @@ spec:
     spec:
       containers:
         - name: age-api
-          image: git.unkin.net/unkin/age-api:v0.1.0
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/age-api:v0.1.0
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 8080
diff --git a/apps/base/bind-internal/tsig-api/tsig-api.yaml b/apps/base/bind-internal/tsig-api/tsig-api.yaml
index d40d2c6..309b475 100644
--- a/apps/base/bind-internal/tsig-api/tsig-api.yaml
+++ b/apps/base/bind-internal/tsig-api/tsig-api.yaml
@@ -13,7 +13,7 @@ metadata:
   name: bind-tsig-api
   namespace: bind-internal
 spec:
-  image: git.unkin.net/unkin/bind-tsig-api:v0.2.3
+  image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/bind-tsig-api:v0.2.3
   replicas: 1
   port: 8443
   # targetNamespace defaults to this resource's namespace (bind-internal), where
diff --git a/apps/base/bind-system/deployment.yaml b/apps/base/bind-system/deployment.yaml
index 8bb1eeb..abe8f61 100644
--- a/apps/base/bind-system/deployment.yaml
+++ b/apps/base/bind-system/deployment.yaml
@@ -21,7 +21,7 @@ spec:
         runAsNonRoot: true
       containers:
         - name: operator
-          image: git.unkin.net/unkin/bind-operator:v0.2.6
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/bind-operator:v0.2.6
           args:
             - --metrics-bind-address=:8080
             - --health-probe-bind-address=:8081
diff --git a/apps/base/cephrgw-system/deployment.yaml b/apps/base/cephrgw-system/deployment.yaml
index d64ed0d..d6d5f9e 100644
--- a/apps/base/cephrgw-system/deployment.yaml
+++ b/apps/base/cephrgw-system/deployment.yaml
@@ -24,7 +24,7 @@ spec:
         runAsNonRoot: true
       containers:
         - name: operator
-          image: git.unkin.net/unkin/cephrgw-operator:v0.4.0
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/cephrgw-operator:v0.4.0
           args:
             - --metrics-bind-address=:8080
             - --health-probe-bind-address=:8081
diff --git a/apps/base/encapi/deployment.yaml b/apps/base/encapi/deployment.yaml
index 60f14d8..0872a87 100644
--- a/apps/base/encapi/deployment.yaml
+++ b/apps/base/encapi/deployment.yaml
@@ -23,7 +23,7 @@ spec:
       automountServiceAccountToken: true
       containers:
         - name: encapi
-          image: git.unkin.net/unkin/encapi:v0.1.1
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/encapi:v0.1.1
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 8000
diff --git a/apps/base/logging/deployment_logarchiver.yaml b/apps/base/logging/deployment_logarchiver.yaml
index 73f70a2..d738db7 100644
--- a/apps/base/logging/deployment_logarchiver.yaml
+++ b/apps/base/logging/deployment_logarchiver.yaml
@@ -39,7 +39,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: logarchiver
-          image: git.unkin.net/unkin/logarchiver:v0.1.0
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/logarchiver:v0.1.0
           imagePullPolicy: IfNotPresent
           args: ["run"]
           securityContext:
diff --git a/apps/base/pdbmux/deployment.yaml b/apps/base/pdbmux/deployment.yaml
index d51b947..8f32f78 100644
--- a/apps/base/pdbmux/deployment.yaml
+++ b/apps/base/pdbmux/deployment.yaml
@@ -25,7 +25,7 @@ spec:
         - name: pdbmux
           # Image is published by the pdbmux repo's .woodpecker/docker.yaml on
           # a v* tag. It only exists after that tag is cut (see PR merge gates).
-          image: git.unkin.net/unkin/pdbmux:v0.1.0
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/pdbmux:v0.1.0
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 8080
-- 
2.47.3