The VerticalPodAutoscaler rollout pulls registry.k8s.io/autoscaling/vpa-recommender.
Serve it through the existing k8s-registry pull-through cache, consistent with how
external-dns and sig-storage images from registry.k8s.io are already gated.
The iplocate patterns were added to mutable_patterns only, which tags TTL but
does not allowlist — requests 403'd 'access denied'. Verified: existing
mutable_patterns-only paths (branch archives, webadmin) also 403, while patterns
entries (uv) return 200. Add the iplocate patterns to patterns (the allowlist),
keeping them in mutable_patterns so the daily-updated DB stays mutable.
Add patterns to the github.com generic remote for the iplocate ip-to-asn /
ip-to-country databases rather than standing up a new remote. The files are
Git-LFS, so the /raw/ path redirects to media.githubusercontent.com; the github
remote already follows github's cross-host redirects (as it does for release
assets), and the raw path returns the real bytes (verified: 12MB zip / 78MB mmdb).
Marked mutable (branch content).
repodata (repomd.xml and its referenced index files) is a mutable index that
upstream RPM repos rotate frequently. Marking it immutable (immutable_ttl: 0)
makes artifactapi cache repomd.xml forever: classifier.go checks
immutable_patterns before the RPM provider's own rule (which already classifies
repodata/ as mutable), and SetTTL with ttl=0 writes a Redis key with no expiry.
The result is a stale repomd.xml that keeps pointing at checksum-named metadata
files upstream has already deleted -> 404 on dnf metadata refresh. This broke
rpmbuilder's almalinux8 builds via the epel remote and would eventually hit any
rolling RPM remote.
Remove the repodata immutable patterns from every remote_rpm config so repodata
falls through to the provider's Mutable classification and is re-fetched every
mutable_ttl. RPMs, noarch, GPG keys and .img files stay immutable.
- Drop ".*/repodata/.*\.{xml,sqlite,yaml}.*$" from all config/remote_rpm/*.yaml
(14 files, 20 lines).
After apply, the already-cached stale repodata entries must be evicted (they
have no expiry); that is done per-remote as a follow-up.
The rpmfusion-free / rpmfusion-nonfree repos have no artifactapi remote,
so nodes still point at the retired packagerepo.service.consul mirror and
dnf fails to fetch repomd.xml.
Add caching remote proxies for both trees, pointed at the upstream
download1.rpmfusion.org origin, so el nodes can install RPM Fusion
packages (ffmpeg, etc.) through artifactapi.
Claude-Session: https://claude.ai/code/session_01VZ81u2JtjvaPq8Z3EDTSMb
rpmbuilder publishes vendored third-party RPMs (vault, consul, helm, ...)
which currently go to Gitea's RPM registry. Move them onto artifactapi so
they live in real yum repos alongside rpm-internal, and keep vendored
packages separate from in-house software. rpmbuilder targets EL8, EL9 and
Fedora 42/43/44, so each distro gets its own repo to avoid EL/Fedora RPMs
colliding in a single repodata set.
- Add config/local_rpm/rpm-vendor-el8.yaml
- Add config/local_rpm/rpm-vendor-el9.yaml
- Add config/local_rpm/rpm-vendor-f42.yaml
- Add config/local_rpm/rpm-vendor-f43.yaml
- Add config/local_rpm/rpm-vendor-f44.yaml
config.hcl already globs local_rpm/*.yaml, so no wiring change is needed.
The grafana-operator creates Grafana pods from docker.io/grafana/grafana,
which the dockerhub remote did not allow, so the pods would ImagePullBackOff.
Add the ^grafana/ pattern so the grafana image (and image-renderer) proxy
through artifactapi.
ArtifactAPI now serves local docker repos as real container registries and the
provider exposes an artifactapi_local_docker resource, but this config had no
way to declare one.
- Add a local_docker variable, module resource, config loader wiring, and
terragrunt input, mirroring the other local_* kinds.
- Declare a docker-internal registry.
- Expand the README to cover the local_* and virtual kinds.
Depends on a terraform-provider-artifactapi release exposing
artifactapi_local_docker (and a matching .terraform.lock.hcl bump) before apply.
unkinben
benvin
benvin