repodata (repomd.xml and its referenced index files) is a mutable index that
upstream RPM repos rotate frequently. Marking it immutable (immutable_ttl: 0)
makes artifactapi cache repomd.xml forever: classifier.go checks
immutable_patterns before the RPM provider's own rule (which already classifies
repodata/ as mutable), and SetTTL with ttl=0 writes a Redis key with no expiry.
The result is a stale repomd.xml that keeps pointing at checksum-named metadata
files upstream has already deleted -> 404 on dnf metadata refresh. This broke
rpmbuilder's almalinux8 builds via the epel remote and would eventually hit any
rolling RPM remote.
Remove the repodata immutable patterns from every remote_rpm config so repodata
falls through to the provider's Mutable classification and is re-fetched every
mutable_ttl. RPMs, noarch, GPG keys and .img files stay immutable.
- Drop ".*/repodata/.*\.{xml,sqlite,yaml}.*$" from all config/remote_rpm/*.yaml
(14 files, 20 lines).
After apply, the already-cached stale repodata entries must be evicted (they
have no expiry); that is done per-remote as a follow-up.
rpmbuilder publishes vendored third-party RPMs (vault, consul, helm, ...)
which currently go to Gitea's RPM registry. Move them onto artifactapi so
they live in real yum repos alongside rpm-internal, and keep vendored
packages separate from in-house software. rpmbuilder targets EL8, EL9 and
Fedora 42/43/44, so each distro gets its own repo to avoid EL/Fedora RPMs
colliding in a single repodata set.
- Add config/local_rpm/rpm-vendor-el8.yaml
- Add config/local_rpm/rpm-vendor-el9.yaml
- Add config/local_rpm/rpm-vendor-f42.yaml
- Add config/local_rpm/rpm-vendor-f43.yaml
- Add config/local_rpm/rpm-vendor-f44.yaml
config.hcl already globs local_rpm/*.yaml, so no wiring change is needed.
The grafana-operator creates Grafana pods from docker.io/grafana/grafana,
which the dockerhub remote did not allow, so the pods would ImagePullBackOff.
Add the ^grafana/ pattern so the grafana image (and image-renderer) proxy
through artifactapi.
ArtifactAPI now serves local docker repos as real container registries and the
provider exposes an artifactapi_local_docker resource, but this config had no
way to declare one.
- Add a local_docker variable, module resource, config loader wiring, and
terragrunt input, mirroring the other local_* kinds.
- Declare a docker-internal registry.
- Expand the README to cover the local_* and virtual kinds.
Depends on a terraform-provider-artifactapi release exposing
artifactapi_local_docker (and a matching .terraform.lock.hcl bump) before apply.
pre-commit runs `tofu validate`/tflint on modules/artifactapi standalone, where
no required_providers was declared, so OpenTofu inferred hashicorp/artifactapi
and failed (and tflint flagged missing required_version/version constraint).
- add modules/artifactapi/versions.tf declaring required_version and the
artifactapi provider (source = the registry, version >= 0.1.2)
- drop the now-duplicate required_providers from root.hcl's generated backend.tf;
keep the provider config block + backend. Declaring it in both the module and
the generated root would be a "Duplicate required providers" error at runtime.
Also revert the earlier init lock-cleanup: the CI failure was stale provider
references in state (fixed with `tofu state replace-provider`), not the lock.
The provider source moved from git.unkin.net/unkin/artifactapi to
artifactapi.k8s.syd1.au.unkin.net/terraform-unkin/artifactapi. .terraform.lock.hcl
is gitignored, so a CI runner reusing a workspace/cache keeps a lock pinning the
old source; some OpenTofu versions then try to re-resolve git.unkin.net (which
isn't a registry) instead of dropping it, failing init.
Delete any .terraform.lock.hcl before `terragrunt run --all init -- -upgrade` so
providers resolve purely from config.
unkinben
benvin
gitadmin