unkin/argocd-apps
3
0
Fork 0
Code Issues 7 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

arrstack: repoint arrproxy oauth2-proxy image off ghcr (fix ImagePullBackOff) #379

Manually merged
benvin merged 0 commits from benvin/oauth2-proxy-image-fix into main 2026-08-23 22:56:58 +10:00
Conversation 0 Commits - Files Changed -
unkin-agent commented 2026-08-16 23:39:04 +10:00
Member
Copy Link
Copy Source

Why

The arrproxy front door is down: the arrproxy-oauth2 sidecar (namespace arrstack) is in ImagePullBackOff pulling artifactapi.k8s.syd1.au.unkin.net/ghcr/oauth2-proxy/oauth2-proxy:v7.15.3 (401).

Root cause: ghcr.io/oauth2-proxy/oauth2-proxy does not allow anonymous pulls — its ghcr token endpoint returns {"errors":[{"code":"DENIED"}]} for scope repository:oauth2-proxy/oauth2-proxy:pull. artifactapi's ghcr remote authenticates anonymously, so it can never obtain a token for this repo and returns upstream returned 401. Other ghcr images (e.g. valkey-io/valkey-operator) work because ghcr issues them anon tokens.

Change

  • Repoint the oauth2-proxy sidecar image from the ghcr/ remote to docker-internal/oauth2-proxy:v7.15.3.

The image was mirrored into the docker-internal local registry from quay.io/oauth2-proxy/oauth2-proxy:v7.15.3 (oauth2-proxy's canonical anon-friendly registry). Full multi-arch manifest list copied; identical digest sha256:10a1165743a192e1940b4708fb9647027185ce11a681a1c5519b442ff7f1f561. The docker-internal path now returns a 200 manifest and is pullable.

Follow-up (reproducibility)

The mirror was a one-off skopeo copy. To make it GitOps-reproducible, a follow-up can add ^oauth2-proxy/ to the quay remote patterns in terraform-artifactapi (config/remote_docker/quay.yaml) and repoint to quay/oauth2-proxy/oauth2-proxy:v7.15.3.

## Why The arrproxy front door is down: the `arrproxy-oauth2` sidecar (namespace `arrstack`) is in `ImagePullBackOff` pulling `artifactapi.k8s.syd1.au.unkin.net/ghcr/oauth2-proxy/oauth2-proxy:v7.15.3` (401). Root cause: `ghcr.io/oauth2-proxy/oauth2-proxy` does **not** allow anonymous pulls — its ghcr token endpoint returns `{"errors":[{"code":"DENIED"}]}` for scope `repository:oauth2-proxy/oauth2-proxy:pull`. artifactapi's ghcr remote authenticates anonymously, so it can never obtain a token for this repo and returns `upstream returned 401`. Other ghcr images (e.g. `valkey-io/valkey-operator`) work because ghcr issues them anon tokens. ## Change - Repoint the `oauth2-proxy` sidecar image from the `ghcr/` remote to `docker-internal/oauth2-proxy:v7.15.3`. The image was mirrored into the `docker-internal` local registry from `quay.io/oauth2-proxy/oauth2-proxy:v7.15.3` (oauth2-proxy's canonical anon-friendly registry). Full multi-arch manifest list copied; identical digest `sha256:10a1165743a192e1940b4708fb9647027185ce11a681a1c5519b442ff7f1f561`. The docker-internal path now returns a 200 manifest and is pullable. ## Follow-up (reproducibility) The mirror was a one-off `skopeo copy`. To make it GitOps-reproducible, a follow-up can add `^oauth2-proxy/` to the quay remote patterns in `terraform-artifactapi` (`config/remote_docker/quay.yaml`) and repoint to `quay/oauth2-proxy/oauth2-proxy:v7.15.3`.
unkinben force-pushed benvin/oauth2-proxy-image-fix from 4256b09c9b to 5a23146513 2026-08-23 22:56:57 +10:00 Compare
benvin manually merged commit 5a23146513 into main 2026-08-23 22:56:58 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/argocd-apps#379
Delete Branch "benvin/oauth2-proxy-image-fix"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?