unkin/argocd-apps
3
0
Fork 0
Code Issues 7 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

ghp: use direct ghcr.io image + set GHP_ADMINS #359

Merged
benvin merged 2 commits from benvin/ghp-image-admins into main 2026-08-13 22:08:06 +10:00
Conversation 0 Commits 2 Files Changed 4
+10 -5
unkin-agent commented 2026-08-13 21:44:44 +10:00
Member
Copy Link
Copy Source

Why

The ghp app is deployed but its pods are stuck 0/1 Ready (and were ImagePullBackOff), for three separate reasons this PR fixes:

  • ImagePullBackOff: kubelet anonymous pulls fail on the artifactapi ghcr pull-through because ghcr.io's per-scope token auth is not proxied. The direct public image pulls anonymously, so switch to it.
  • Pods never Ready: ghp serves its metrics endpoint over HTTPS (TLS is configured globally), but the liveness/readiness probes used the default HTTP scheme, so the kubelet probe got an HTTPS-server error and the pods never went Ready.
  • Scrape failure: the VMServiceScrape hits that same HTTPS endpoint and needs a matching scheme/TLS config, or VM scraping of ghp fails.
  • The GHP_ADMINS value was still a placeholder.

How

  • deployment.yaml: image -> ghcr.io/goodtune/ghp:0.20.0; liveness + readiness probe scheme: HTTP -> HTTPS (kubelet does not verify the probe cert).
  • migrate-job.yaml: image -> ghcr.io/goodtune/ghp:0.20.0 (shared image).
  • vmservicescrape.yaml: endpoint scheme: https + tlsConfig.insecureSkipVerify: true (internal-CA cert; pod-IP target not in SANs).
  • configmap.yaml: GHP_ADMINS -> neoloc.

Validated: kustomize build apps/overlays/au-syd1/ghp renders clean, kubeconform + pre-commit pass. Not applied.

Follow-up (not fixed here)

The artifactapi ghcr pull-through does not proxy ghcr.io's per-scope token auth for anonymous kubelet pulls — worth closing that gap so estate images can go back through artifactapi.

## Why The `ghp` app is deployed but its pods are stuck 0/1 Ready (and were ImagePullBackOff), for three separate reasons this PR fixes: - **ImagePullBackOff:** kubelet anonymous pulls fail on the artifactapi ghcr pull-through because ghcr.io's per-scope token auth is not proxied. The direct public image pulls anonymously, so switch to it. - **Pods never Ready:** ghp serves its metrics endpoint over **HTTPS** (TLS is configured globally), but the liveness/readiness probes used the default HTTP scheme, so the kubelet probe got an HTTPS-server error and the pods never went Ready. - **Scrape failure:** the VMServiceScrape hits that same HTTPS endpoint and needs a matching scheme/TLS config, or VM scraping of ghp fails. - The `GHP_ADMINS` value was still a placeholder. ## How - `deployment.yaml`: image -> `ghcr.io/goodtune/ghp:0.20.0`; liveness + readiness probe `scheme: HTTP` -> `HTTPS` (kubelet does not verify the probe cert). - `migrate-job.yaml`: image -> `ghcr.io/goodtune/ghp:0.20.0` (shared image). - `vmservicescrape.yaml`: endpoint `scheme: https` + `tlsConfig.insecureSkipVerify: true` (internal-CA cert; pod-IP target not in SANs). - `configmap.yaml`: `GHP_ADMINS` -> `neoloc`. Validated: `kustomize build apps/overlays/au-syd1/ghp` renders clean, kubeconform + pre-commit pass. Not applied. ## Follow-up (not fixed here) The artifactapi ghcr pull-through does not proxy ghcr.io's per-scope token auth for anonymous kubelet pulls — worth closing that gap so estate images can go back through artifactapi.
unkin-agent added 2 commits 2026-08-13 21:44:44 +10:00
ghp: use direct ghcr.io image + set GHP_ADMINS 2969b6145c 
Kubelet pulls hit ImagePullBackOff on the artifactapi ghcr pull-through
because ghcr.io's per-scope token auth is not proxied for anonymous
pulls. Switch the serve Deployment and migrate Job to the direct public
image (pulls anonymously) and set the admin to neoloc.

- deployment.yaml: image -> ghcr.io/goodtune/ghp:0.20.0
- migrate-job.yaml: image -> ghcr.io/goodtune/ghp:0.20.0
- configmap.yaml: GHP_ADMINS -> neoloc
ghp: probe/scrape over HTTPS to match TLS metrics endpoint
ci/woodpecker/pr/vector-test Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/kubeconform Pipeline was successful
Details
f268c4d9ba 
ghp serves metrics over HTTPS (TLS configured globally), but the
liveness/readiness probes used the default HTTP scheme, so the kubelet
probe hit an HTTPS-server error and pods never went Ready. Set
scheme: HTTPS on both probes (kubelet does not verify the probe cert).

The VMServiceScrape targets that same HTTPS endpoint, so set scheme:
https with tlsConfig.insecureSkipVerify (internal-CA cert, pod-IP target
not in the cert SANs); otherwise VM scraping of ghp fails.

- deployment.yaml: liveness+readiness probes scheme HTTP -> HTTPS
- vmservicescrape.yaml: scheme https + tlsConfig.insecureSkipVerify
benvin merged commit 0130d538f5 into main 2026-08-13 22:08:06 +10:00
benvin deleted branch benvin/ghp-image-admins 2026-08-13 22:08:06 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/argocd-apps#359
Delete Branch "benvin/ghp-image-admins"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?