From 2969b6145c79a132ce1f852ce6a69b2f1b55ca2a Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Thu, 13 Aug 2026 21:35:37 +1000 Subject: [PATCH 1/2] ghp: use direct ghcr.io image + set GHP_ADMINS Kubelet pulls hit ImagePullBackOff on the artifactapi ghcr pull-through because ghcr.io's per-scope token auth is not proxied for anonymous pulls. Switch the serve Deployment and migrate Job to the direct public image (pulls anonymously) and set the admin to neoloc. - deployment.yaml: image -> ghcr.io/goodtune/ghp:0.20.0 - migrate-job.yaml: image -> ghcr.io/goodtune/ghp:0.20.0 - configmap.yaml: GHP_ADMINS -> neoloc --- apps/base/ghp/configmap.yaml | 2 +- apps/base/ghp/deployment.yaml | 2 +- apps/base/ghp/migrate-job.yaml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/apps/base/ghp/configmap.yaml b/apps/base/ghp/configmap.yaml index f35f4ed..4cc2947 100644 --- a/apps/base/ghp/configmap.yaml +++ b/apps/base/ghp/configmap.yaml @@ -19,4 +19,4 @@ data: GHP_TLS_CERT_FILE: /etc/ghp/tls/tls.crt GHP_TLS_KEY_FILE: /etc/ghp/tls/tls.key # PLACEHOLDER: set to Ben's GitHub username before ghp will admit an admin. - GHP_ADMINS: "REPLACE_ME_ben_github_username" + GHP_ADMINS: "neoloc" diff --git a/apps/base/ghp/deployment.yaml b/apps/base/ghp/deployment.yaml index ab4013b..c6c9c25 100644 --- a/apps/base/ghp/deployment.yaml +++ b/apps/base/ghp/deployment.yaml @@ -34,7 +34,7 @@ spec: type: RuntimeDefault containers: - name: ghp - image: artifactapi.k8s.syd1.au.unkin.net/ghcr/goodtune/ghp:0.20.0 + image: ghcr.io/goodtune/ghp:0.20.0 imagePullPolicy: IfNotPresent # Drop the image's default --migrate so replicas never race migrations; # schema is applied by the wave-1 migrate hook Job instead. diff --git a/apps/base/ghp/migrate-job.yaml b/apps/base/ghp/migrate-job.yaml index 443feef..ef8438c 100644 --- a/apps/base/ghp/migrate-job.yaml +++ b/apps/base/ghp/migrate-job.yaml @@ -37,7 +37,7 @@ spec: type: RuntimeDefault containers: - name: migrate - image: artifactapi.k8s.syd1.au.unkin.net/ghcr/goodtune/ghp:0.20.0 + image: ghcr.io/goodtune/ghp:0.20.0 imagePullPolicy: IfNotPresent command: ["/ghp", "migrate"] env: -- 2.47.3 From f268c4d9ba775b26e484349d39e06d9f445f4194 Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Thu, 13 Aug 2026 21:39:38 +1000 Subject: [PATCH 2/2] ghp: probe/scrape over HTTPS to match TLS metrics endpoint ghp serves metrics over HTTPS (TLS configured globally), but the liveness/readiness probes used the default HTTP scheme, so the kubelet probe hit an HTTPS-server error and pods never went Ready. Set scheme: HTTPS on both probes (kubelet does not verify the probe cert). The VMServiceScrape targets that same HTTPS endpoint, so set scheme: https with tlsConfig.insecureSkipVerify (internal-CA cert, pod-IP target not in the cert SANs); otherwise VM scraping of ghp fails. - deployment.yaml: liveness+readiness probes scheme HTTP -> HTTPS - vmservicescrape.yaml: scheme https + tlsConfig.insecureSkipVerify --- apps/base/ghp/deployment.yaml | 4 ++-- apps/base/ghp/vmservicescrape.yaml | 5 +++++ 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/apps/base/ghp/deployment.yaml b/apps/base/ghp/deployment.yaml index c6c9c25..1a7f5b2 100644 --- a/apps/base/ghp/deployment.yaml +++ b/apps/base/ghp/deployment.yaml @@ -102,7 +102,7 @@ spec: httpGet: path: /metrics port: metrics - scheme: HTTP + scheme: HTTPS initialDelaySeconds: 30 periodSeconds: 30 successThreshold: 1 @@ -112,7 +112,7 @@ spec: httpGet: path: /metrics port: metrics - scheme: HTTP + scheme: HTTPS initialDelaySeconds: 10 periodSeconds: 5 successThreshold: 1 diff --git a/apps/base/ghp/vmservicescrape.yaml b/apps/base/ghp/vmservicescrape.yaml index a91bde9..e5ca485 100644 --- a/apps/base/ghp/vmservicescrape.yaml +++ b/apps/base/ghp/vmservicescrape.yaml @@ -16,3 +16,8 @@ spec: endpoints: - port: metrics path: /metrics + scheme: https + # ghp serves metrics over TLS with an internal-CA cert; skip verification + # since the scrape targets a pod IP the cert SANs do not cover. + tlsConfig: + insecureSkipVerify: true -- 2.47.3