T

unkin-agent 5466562bc1 arrproxy: use real quay.io oauth2-proxy address (rke2 mirror) (#380 )

Repoints the arrproxy `oauth2-proxy` sidecar image to the real upstream address `quay.io/oauth2-proxy/oauth2-proxy:v7.15.3`, replacing the one-off artifactapi copy (`artifactapi.k8s.syd1.au.unkin.net/ghcr/oauth2-proxy/oauth2-proxy:v7.15.3`).

## Why
Pull the image from its canonical upstream location instead of a hand-copied artifactapi path. containerd on rke2 transparently mirrors `quay.io` through artifactapi, so the real address resolves without hardcoding the proxy host.

## Change
- `apps/base/arrstack/arrproxy/oauth2-proxy-deployment.yaml`: image only -> `quay.io/oauth2-proxy/oauth2-proxy:v7.15.3`.

Validated with `kustomize build --enable-helm apps/overlays/au-syd1/arrstack` and pre-commit.

## Dependencies (must be in place before merge)
1. **rke2 `registries.yaml` mirrors quay.io** — already configured in puppet (`hieradata/roles/infra/k8s.yaml`, `rke2::registries` rewrites `quay.io` -> `artifactapi.k8s.syd1.au.unkin.net/quay/$1`). No change needed.
2. **artifactapi quay remote allowlists oauth2-proxy** — terraform-artifactapi PR unkin/terraform-artifactapi#35 adds `^oauth2-proxy/` to the quay remote patterns. **This PR must NOT be merged until #35 is applied**, otherwise the caching proxy rejects `oauth2-proxy/*` and the sidecar fails to pull.

---------

Co-authored-by: unkin-agent <unkin-agent@git.unkin.net>
Reviewed-on: #380
Co-authored-by: Unkin Agent <unkin-agent@unkin.net>
Co-committed-by: Unkin Agent <unkin-agent@unkin.net>

2026-08-17 21:31:29 +10:00

.claude/commands

chore: bump almalinux9 image tags (#188 )

2026-06-07 00:35:12 +10:00

.woodpecker

Replace vector-archiver with logarchiver (#308 )

2026-07-29 21:07:20 +10:00

apps

arrproxy: use real quay.io oauth2-proxy address (rke2 mirror) (#380 )

2026-08-17 21:31:29 +10:00

argocd

arrstack: sonarr/radarr/prowlarr/nzbget on shared CephFS media (#366 )

2026-08-15 16:22:06 +10:00

certificates: restore the validly-signed intermediate in vault-ca-cert (#305 )

2026-07-28 23:14:14 +10:00

clusters/au-syd1

Ignore defaulted StatefulSet volumeClaimTemplates TypeMeta (#350 )

2026-08-09 20:53:49 +10:00

docs

Enable Reloader secret watching, scope existing auto to configmap-only (#326 ) (#339 )

2026-08-08 19:35:31 +10:00

schemas

Deploy kea DHCP operator to dhcp-system (#333 )

2026-08-03 00:18:05 +10:00

.gitignore

feat: add reloader (#6 )

2026-03-01 16:34:01 +11:00

.pre-commit-config.yaml

Add JSON schema generation for kubeconform CRD validation (#212 )

2026-06-28 17:26:08 +10:00

.yamllint.yaml

feat: add pre-commit configuration (#9 )

2026-03-02 00:09:21 +11:00

AGENTS.md

chore: bump almalinux9 image tags (#188 )

2026-06-07 00:35:12 +10:00

Makefile

Add JSON schema generation for kubeconform CRD validation (#212 )

2026-06-28 17:26:08 +10:00

migration.md

chore: bump almalinux9 image tags (#188 )

2026-06-07 00:35:12 +10:00

docs/README.md

argocd-apps docs

Operational notes for the manifests in this repo.

Doc	What it covers
cnpg-backups.md	How CNPG Postgres backups (WAL archiving + nightly base backups) to Ceph RGW are configured.
cnpg-restore.md	Restoring a CNPG cluster: full recovery, point-in-time recovery, cutover, and gotchas.
authentik-rancher-sso.md	Manual runtime step to point Rancher's OIDC auth at the canonical `identity.unkin.net` issuer and trust the internal CA.
gitea-migration.md	Staged cutover of the git.unkin.net forge from the Puppet VM to the `gitea` namespace.
ca-rotation.md	Rolling the internal `unkin.net` PKI CA (`vault-ca-cert`): what Reloader restarts automatically vs. manual/CNPG restarts.