stt/classic-models-agent-catalogue
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

refactor(deploy): publish the image to gitea rather than ghcr

Browse Source 
The image now sits beside the source it was built from, in gitea's own
registry, and inherits the repository's visibility. The repo is public, so the
cluster pulls with no credentials — which removes the imagePullSecret entirely,
along with the hand-copied GitHub token it depended on and the cross-namespace
copy that kept it alive.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
Stéphane Tailland
2026-08-29 07:20:02 +02:00
parent fd2df93683
commit 31020e25dc
2 changed files with 18 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+12 -12
View File
@@ -136,17 +136,23 @@ running library:
## Deployment
```
ghcr.io/staillanibm/classic-models-agent-catalogue:v0.1.0
gitea.sttlab.eu/stt/classic-models-agent-catalogue:v0.1.0
```
gitea's own registry rather than ghcr, so the image sits beside the source it
was built from and inherits the repo's visibility. The repo is public, so the
cluster pulls it with no credentials at all — no `imagePullSecret` to create by
hand, and no GitHub token to keep in step.
Built from the `Dockerfile` here — two stages, so the runtime image carries no
build toolchain; non-root, read-only root filesystem, all capabilities dropped.
The image is built and pushed by hand for now: this repo lives on gitea and
gitea Actions is not set up, so there is no pipeline to do it.
Built and pushed by hand for now: gitea Actions is not set up on this instance,
so there is no pipeline to do it.
```
docker build -t ghcr.io/staillanibm/classic-models-agent-catalogue:vX.Y.Z .
docker push ghcr.io/staillanibm/classic-models-agent-catalogue:vX.Y.Z
docker login gitea.sttlab.eu # gitea username + a token with package:write
docker build -t gitea.sttlab.eu/stt/classic-models-agent-catalogue:vX.Y.Z .
docker push gitea.sttlab.eu/stt/classic-models-agent-catalogue:vX.Y.Z
```
`k8s/` is what runs; `dev/` is the Flux plumbing that applies it. Three manual
@@ -155,12 +161,6 @@ the source that serves it exist:
```
kubectl apply -f k8s/namespace.yaml
# The ghcr package is private. Copy the pull secret classic-models already has:
kubectl -n classic-models get secret ghcr-pull-secret -o yaml \
| sed 's/namespace: classic-models/namespace: agents/' \
| kubectl apply -f -
kubectl apply -f dev/gitrepository.yaml
kubectl apply -f dev/bootstrap-kustomization.yaml
```
@@ -176,7 +176,7 @@ What the deployment assumes:
| Namespace | `agents` — one for the estate; what isolates an agent is its Keycloak client, not its namespace |
| Secret | `CATALOGUE_CLIENT_SECRET`, from the same Vault entry the realm import reads, through the `vault-keycloak` store |
| CA | `k8s/ca-configmap.yaml` holds the lab CA **certificate** — public by construction, checked in so the deployment has no hidden prerequisite. Regenerate it when the CA rotates (expires 2026-11-24) |
| Image pull | `ghcr-pull-secret` in `agents`, created by hand — the package is private |
| Image pull | none — the gitea package is public, like its repo |
| DNS | every `*.sttlab.local` name resolves in-cluster already; no `hostAliases` needed |
| Replicas | exactly one. Conversation history lives in the process, so a second replica would route a user's "yes" to a pod that never saw the question |
k8s/deployment.yaml
+6 -7
View File
@@ -18,12 +18,6 @@ spec:
labels:
app: catalogue-agent
spec:
# The ghcr package is private, like classic-models-api's. The secret is
# created by hand once (see the README) rather than committed or pulled
# from Vault — same arrangement classic-models already uses, and the
# credential is a GitHub token that belongs to no estate in particular.
imagePullSecrets:
- name: ghcr-pull-secret
securityContext:
runAsNonRoot: true
runAsUser: 10001
@@ -31,7 +25,12 @@ spec:
type: RuntimeDefault
containers:
- name: agent
image: ghcr.io/staillanibm/classic-models-agent-catalogue:v0.1.0
# gitea's own registry, not ghcr: the image sits beside the source it
# was built from, and the package inherits the repo's visibility. The
# repo is public, so the pull needs no credentials — which removes an
# imagePullSecret that would otherwise have to be created by hand in
# this namespace and kept in step with a GitHub token.
image: gitea.sttlab.eu/stt/classic-models-agent-catalogue:v0.1.0
ports:
- name: http
containerPort: 8080