Switch ghp from ghcr.io/goodtune/ghp:0.20.0 to the in-house fork image
artifactapi.k8s.syd1.au.unkin.net/docker-internal/ghp:v0.20.0-unkin4 (built now
that the CA-baked buildx plugin lets the push to the internal-CA registry
succeed). The fork is behavior-identical to upstream except it accepts static
admin service tokens (GHP_AUTH_SERVICE_TOKENS), used by the forthcoming Vault ghp
secrets engine to authenticate as admin and mint scoped tokens.
The env is sourced from the ghp-app Secret key service_token with optional: true,
so ghp keeps running until Ben seeds service_token into
kv/kubernetes/namespace/ghp/default/app; the existing ghp-app reloader annotation
then rolls the Deployment to activate it.
unkin-agent