T

unkin-agent d1085f0ae2 logging: use canonical upstream image names (#433 )

rke2's `registries.yaml` already rewrites upstream image names to the artifactapi mirror, so manifests must carry canonical upstream names. Only in-house `artifactapi.k8s.syd1.au.unkin.net/docker-internal/...` images stay explicit (logarchiver/logviewer are untouched).

Changes:
- Point the ClickHouseInstallation and the clickhouse-schema job at `docker.io/clickhouse/clickhouse-server:24.8`.
- Point the logviewer oauth2-proxy cert-combine init container at `docker.io/library/alpine:3`.
- Point the NATS bootstrap job at `docker.io/natsio/nats-box:0.18.0`.
- Point the NATS chart values at `docker.io/library/nats` and `docker.io/natsio/nats-server-config-reloader`.
- Point all three Vector values files (agent, aggregator, vm-ingest) at `docker.io/timberio/vector`.
- Drop the now-wrong "pulled through the artifactapi dockerhub remote" comments in the NATS and vector-agent values.

Tags/digests unchanged and the `repository`/`tag` split is preserved. `kustomize build --enable-helm apps/overlays/au-syd1/logging` differs from main only in those nine image strings.

Extra found, not changed here: `.woodpecker/vector-test.yaml` still pins its CI step image to `artifactapi.k8s.syd1.au.unkin.net/dockerhub/timberio/vector:0.57.0-debian`. That is a Woodpecker step image rather than a namespace manifest, so it is left out to keep this PR to the logging namespace — say the word and I will fix it separately.

Reviewed-on: #433
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>

2026-08-29 21:55:47 +10:00

.claude/commands

chore: bump almalinux9 image tags (#188 )

2026-06-07 00:35:12 +10:00

.woodpecker

Replace vector-archiver with logarchiver (#308 )

2026-07-29 21:07:20 +10:00

apps

logging: use canonical upstream image names (#433 )

2026-08-29 21:55:47 +10:00

argocd

watchstate: deploy admin-gated jellyfin watch-state sync tool (#419 )

2026-08-25 21:39:07 +10:00

certificates: restore the validly-signed intermediate in vault-ca-cert (#305 )

2026-07-28 23:14:14 +10:00

clusters/au-syd1

argocd: drop internal-CA rootCA pin from Authentik oidc.config (#439 )

2026-08-29 21:52:12 +10:00

docs

Enable Reloader secret watching, scope existing auto to configmap-only (#326 ) (#339 )

2026-08-08 19:35:31 +10:00

schemas

Deploy kea DHCP operator to dhcp-system (#333 )

2026-08-03 00:18:05 +10:00

.gitignore

feat: add reloader (#6 )

2026-03-01 16:34:01 +11:00

.pre-commit-config.yaml

Add JSON schema generation for kubeconform CRD validation (#212 )

2026-06-28 17:26:08 +10:00

.yamllint.yaml

feat: add pre-commit configuration (#9 )

2026-03-02 00:09:21 +11:00

AGENTS.md

chore: bump almalinux9 image tags (#188 )

2026-06-07 00:35:12 +10:00

Makefile

Add JSON schema generation for kubeconform CRD validation (#212 )

2026-06-28 17:26:08 +10:00

migration.md

chore: bump almalinux9 image tags (#188 )

2026-06-07 00:35:12 +10:00

docs/README.md

argocd-apps docs

Operational notes for the manifests in this repo.

Doc	What it covers
cnpg-backups.md	How CNPG Postgres backups (WAL archiving + nightly base backups) to Ceph RGW are configured.
cnpg-restore.md	Restoring a CNPG cluster: full recovery, point-in-time recovery, cutover, and gotchas.
authentik-rancher-sso.md	Manual runtime step to point Rancher's OIDC auth at the canonical `identity.unkin.net` issuer and trust the internal CA.
gitea-migration.md	Staged cutover of the git.unkin.net forge from the Puppet VM to the `gitea` namespace.
ca-rotation.md	Rolling the internal `unkin.net` PKI CA (`vault-ca-cert`): what Reloader restarts automatically vs. manual/CNPG restarts.