The k8s Gitea deployment pulls gitea/gitea (rootless) from Docker Hub via the
artifactapi mirror. Add it to the dockerhub allowlist.
- add "^gitea/gitea" to config/remote_docker/dockerhub.yaml patterns
Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
NetBox is being deployed to k8s (argocd-apps) as the source of truth for
host/interface/IPAM data. Its image is ghcr.io/netbox-community/netbox, pulled
through the artifactapi ghcr mirror, so add the ^netbox-community/ pattern to
the ghcr remote allowlist.
Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
The VerticalPodAutoscaler rollout pulls registry.k8s.io/autoscaling/vpa-recommender.
Serve it through the existing k8s-registry pull-through cache, consistent with how
external-dns and sig-storage images from registry.k8s.io are already gated.
The grafana-operator creates Grafana pods from docker.io/grafana/grafana,
which the dockerhub remote did not allow, so the pods would ImagePullBackOff.
Add the ^grafana/ pattern so the grafana image (and image-renderer) proxy
through artifactapi.
unkinben