From 31020e25dc44390de1a174da804e4bec09058070 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?St=C3=A9phane=20Tailland?= Date: Sat, 29 Aug 2026 07:20:02 +0200 Subject: [PATCH] refactor(deploy): publish the image to gitea rather than ghcr MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The image now sits beside the source it was built from, in gitea's own registry, and inherits the repository's visibility. The repo is public, so the cluster pulls with no credentials — which removes the imagePullSecret entirely, along with the hand-copied GitHub token it depended on and the cross-namespace copy that kept it alive. Co-Authored-By: Claude Opus 5 --- README.md | 24 ++++++++++++------------ k8s/deployment.yaml | 13 ++++++------- 2 files changed, 18 insertions(+), 19 deletions(-) diff --git a/README.md b/README.md index 672a11b..a43edce 100644 --- a/README.md +++ b/README.md @@ -136,17 +136,23 @@ running library: ## Deployment ``` -ghcr.io/staillanibm/classic-models-agent-catalogue:v0.1.0 +gitea.sttlab.eu/stt/classic-models-agent-catalogue:v0.1.0 ``` +gitea's own registry rather than ghcr, so the image sits beside the source it +was built from and inherits the repo's visibility. The repo is public, so the +cluster pulls it with no credentials at all — no `imagePullSecret` to create by +hand, and no GitHub token to keep in step. + Built from the `Dockerfile` here — two stages, so the runtime image carries no build toolchain; non-root, read-only root filesystem, all capabilities dropped. -The image is built and pushed by hand for now: this repo lives on gitea and -gitea Actions is not set up, so there is no pipeline to do it. +Built and pushed by hand for now: gitea Actions is not set up on this instance, +so there is no pipeline to do it. ``` -docker build -t ghcr.io/staillanibm/classic-models-agent-catalogue:vX.Y.Z . -docker push ghcr.io/staillanibm/classic-models-agent-catalogue:vX.Y.Z +docker login gitea.sttlab.eu # gitea username + a token with package:write +docker build -t gitea.sttlab.eu/stt/classic-models-agent-catalogue:vX.Y.Z . +docker push gitea.sttlab.eu/stt/classic-models-agent-catalogue:vX.Y.Z ``` `k8s/` is what runs; `dev/` is the Flux plumbing that applies it. Three manual @@ -155,12 +161,6 @@ the source that serves it exist: ``` kubectl apply -f k8s/namespace.yaml - -# The ghcr package is private. Copy the pull secret classic-models already has: -kubectl -n classic-models get secret ghcr-pull-secret -o yaml \ - | sed 's/namespace: classic-models/namespace: agents/' \ - | kubectl apply -f - - kubectl apply -f dev/gitrepository.yaml kubectl apply -f dev/bootstrap-kustomization.yaml ``` @@ -176,7 +176,7 @@ What the deployment assumes: | Namespace | `agents` — one for the estate; what isolates an agent is its Keycloak client, not its namespace | | Secret | `CATALOGUE_CLIENT_SECRET`, from the same Vault entry the realm import reads, through the `vault-keycloak` store | | CA | `k8s/ca-configmap.yaml` holds the lab CA **certificate** — public by construction, checked in so the deployment has no hidden prerequisite. Regenerate it when the CA rotates (expires 2026-11-24) | -| Image pull | `ghcr-pull-secret` in `agents`, created by hand — the package is private | +| Image pull | none — the gitea package is public, like its repo | | DNS | every `*.sttlab.local` name resolves in-cluster already; no `hostAliases` needed | | Replicas | exactly one. Conversation history lives in the process, so a second replica would route a user's "yes" to a pod that never saw the question | diff --git a/k8s/deployment.yaml b/k8s/deployment.yaml index e80831e..af48be0 100644 --- a/k8s/deployment.yaml +++ b/k8s/deployment.yaml @@ -18,12 +18,6 @@ spec: labels: app: catalogue-agent spec: - # The ghcr package is private, like classic-models-api's. The secret is - # created by hand once (see the README) rather than committed or pulled - # from Vault — same arrangement classic-models already uses, and the - # credential is a GitHub token that belongs to no estate in particular. - imagePullSecrets: - - name: ghcr-pull-secret securityContext: runAsNonRoot: true runAsUser: 10001 @@ -31,7 +25,12 @@ spec: type: RuntimeDefault containers: - name: agent - image: ghcr.io/staillanibm/classic-models-agent-catalogue:v0.1.0 + # gitea's own registry, not ghcr: the image sits beside the source it + # was built from, and the package inherits the repo's visibility. The + # repo is public, so the pull needs no credentials — which removes an + # imagePullSecret that would otherwise have to be created by hand in + # this namespace and kept in step with a GitHub token. + image: gitea.sttlab.eu/stt/classic-models-agent-catalogue:v0.1.0 ports: - name: http containerPort: 8080