unkin/argocd-apps
3
0
Fork 0
Code Issues 7 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

arrproxy: use real quay.io oauth2-proxy address (rke2 mirror) #380

Merged
benvin merged 1 commits from benvin/oauth2-proxy-quay into main 2026-08-17 21:31:29 +10:00
Conversation 0 Commits 1 Files Changed 1
+1 -1
unkin-agent commented 2026-08-17 20:44:28 +10:00
Member
Copy Link
Copy Source

Repoints the arrproxy oauth2-proxy sidecar image to the real upstream address quay.io/oauth2-proxy/oauth2-proxy:v7.15.3, replacing the one-off artifactapi copy (artifactapi.k8s.syd1.au.unkin.net/ghcr/oauth2-proxy/oauth2-proxy:v7.15.3).

Why

Pull the image from its canonical upstream location instead of a hand-copied artifactapi path. containerd on rke2 transparently mirrors quay.io through artifactapi, so the real address resolves without hardcoding the proxy host.

Change

  • apps/base/arrstack/arrproxy/oauth2-proxy-deployment.yaml: image only -> quay.io/oauth2-proxy/oauth2-proxy:v7.15.3.

Validated with kustomize build --enable-helm apps/overlays/au-syd1/arrstack and pre-commit.

Dependencies (must be in place before merge)

  1. rke2 registries.yaml mirrors quay.io — already configured in puppet (hieradata/roles/infra/k8s.yaml, rke2::registries rewrites quay.io -> artifactapi.k8s.syd1.au.unkin.net/quay/$1). No change needed.
  2. artifactapi quay remote allowlists oauth2-proxy — terraform-artifactapi PR unkin/terraform-artifactapi#35 adds ^oauth2-proxy/ to the quay remote patterns. This PR must NOT be merged until #35 is applied, otherwise the caching proxy rejects oauth2-proxy/* and the sidecar fails to pull.
Repoints the arrproxy `oauth2-proxy` sidecar image to the real upstream address `quay.io/oauth2-proxy/oauth2-proxy:v7.15.3`, replacing the one-off artifactapi copy (`artifactapi.k8s.syd1.au.unkin.net/ghcr/oauth2-proxy/oauth2-proxy:v7.15.3`). ## Why Pull the image from its canonical upstream location instead of a hand-copied artifactapi path. containerd on rke2 transparently mirrors `quay.io` through artifactapi, so the real address resolves without hardcoding the proxy host. ## Change - `apps/base/arrstack/arrproxy/oauth2-proxy-deployment.yaml`: image only -> `quay.io/oauth2-proxy/oauth2-proxy:v7.15.3`. Validated with `kustomize build --enable-helm apps/overlays/au-syd1/arrstack` and pre-commit. ## Dependencies (must be in place before merge) 1. **rke2 `registries.yaml` mirrors quay.io** — already configured in puppet (`hieradata/roles/infra/k8s.yaml`, `rke2::registries` rewrites `quay.io` -> `artifactapi.k8s.syd1.au.unkin.net/quay/$1`). No change needed. 2. **artifactapi quay remote allowlists oauth2-proxy** — terraform-artifactapi PR unkin/terraform-artifactapi#35 adds `^oauth2-proxy/` to the quay remote patterns. **This PR must NOT be merged until #35 is applied**, otherwise the caching proxy rejects `oauth2-proxy/*` and the sidecar fails to pull.
unkin-agent added 1 commit 2026-08-17 20:44:28 +10:00
arrproxy: use real quay.io oauth2-proxy address (rke2 mirror)
ci/woodpecker/pr/vector-test Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/kubeconform Pipeline was successful
Details
535eda84cd 
Repoints the oauth2-proxy sidecar image from the one-off artifactapi
copy to the real upstream address quay.io/oauth2-proxy/oauth2-proxy,
relying on the rke2 registries.yaml mirror that rewrites quay.io to
artifactapi.k8s.syd1.au.unkin.net/quay.
benvin merged commit 5466562bc1 into main 2026-08-17 21:31:29 +10:00
benvin deleted branch benvin/oauth2-proxy-quay 2026-08-17 21:31:30 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/argocd-apps#380
Delete Branch "benvin/oauth2-proxy-quay"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?