unkin/terraform-artifactapi
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add autoscaling/vpa-* pattern to k8s-registry docker remote #13

Merged
benvin merged 1 commits from benvin/vpa-remotes into main 2026-07-25 17:21:31 +10:00
Conversation 0 Commits 1 Files Changed 1
+1
unkinben commented 2026-07-25 17:05:02 +10:00
Owner
Copy Link
Copy Source

Why

The VerticalPodAutoscaler rollout deploys the VPA recommender image registry.k8s.io/autoscaling/vpa-recommender. The estate references upstream registries directly in manifests but serves those pulls through artifactapi pull-through docker remotes gated by explicit path patterns (e.g. k8s-registry currently allows only external-dns and sig-storage). The autoscaling/ path is not yet allow-listed, so the recommender image would bypass the cache.

Changes

  • Add ^autoscaling/vpa- pattern to the k8s-registry docker remote so registry.k8s.io/autoscaling/vpa-recommender (and future vpa-updater/vpa-admission-controller) is served through the cache, consistent with existing registry.k8s.io images.

Notes

  • Advise-mode VPA needs only the recommender image; the pattern is scoped to vpa- so it also covers the updater/admission-controller if a future mode flip needs them.
  • VPA CRDs are pulled directly from raw.githubusercontent.com in argocd-apps (same pattern node-feature-discovery already uses), so no generic remote is required.
## Why The VerticalPodAutoscaler rollout deploys the VPA recommender image `registry.k8s.io/autoscaling/vpa-recommender`. The estate references upstream registries directly in manifests but serves those pulls through artifactapi pull-through docker remotes gated by explicit path patterns (e.g. `k8s-registry` currently allows only `external-dns` and `sig-storage`). The `autoscaling/` path is not yet allow-listed, so the recommender image would bypass the cache. ## Changes - Add `^autoscaling/vpa-` pattern to the `k8s-registry` docker remote so `registry.k8s.io/autoscaling/vpa-recommender` (and future vpa-updater/vpa-admission-controller) is served through the cache, consistent with existing registry.k8s.io images. ## Notes - Advise-mode VPA needs only the recommender image; the pattern is scoped to `vpa-` so it also covers the updater/admission-controller if a future mode flip needs them. - VPA CRDs are pulled directly from `raw.githubusercontent.com` in argocd-apps (same pattern node-feature-discovery already uses), so no generic remote is required.
unkinben added 1 commit 2026-07-25 17:05:02 +10:00
Add autoscaling/vpa-* pattern to k8s-registry docker remote
ci/woodpecker/pr/plan Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
55d4757553 
The VerticalPodAutoscaler rollout pulls registry.k8s.io/autoscaling/vpa-recommender.
Serve it through the existing k8s-registry pull-through cache, consistent with how
external-dns and sig-storage images from registry.k8s.io are already gated.
benvin merged commit a6819e2232 into main 2026-07-25 17:21:31 +10:00
benvin deleted branch benvin/vpa-remotes 2026-07-25 17:21:32 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
bug
Something is not working
 duplicate
This issue or pull request already exists
 enhancement
New feature
 help wanted
Need some help
 invalid
Something is wrong
 question
More information is needed
 wontfix
This won't be fixed
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/terraform-artifactapi#13
Delete Branch "benvin/vpa-remotes"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?