stt/classic-models-agent-catalogue
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

refactor(deploy): publish the image to gitea rather than ghcr

Browse Source 
The image now sits beside the source it was built from, in gitea's own
registry, and inherits the repository's visibility. The repo is public, so the
cluster pulls with no credentials — which removes the imagePullSecret entirely,
along with the hand-copied GitHub token it depended on and the cross-namespace
copy that kept it alive.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
Stéphane Tailland
2026-08-29 07:20:02 +02:00
parent fd2df93683
commit 31020e25dc
2 changed files with 18 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+12 -12
View File
@@ -136,17 +136,23 @@ running library:
## Deployment
```
ghcr.io/staillanibm/classic-models-agent-catalogue:v0.1.0
gitea.sttlab.eu/stt/classic-models-agent-catalogue:v0.1.0
```
gitea's own registry rather than ghcr, so the image sits beside the source it
was built from and inherits the repo's visibility. The repo is public, so the
cluster pulls it with no credentials at all — no `imagePullSecret` to create by
hand, and no GitHub token to keep in step.
Built from the `Dockerfile` here — two stages, so the runtime image carries no
build toolchain; non-root, read-only root filesystem, all capabilities dropped.
The image is built and pushed by hand for now: this repo lives on gitea and
gitea Actions is not set up, so there is no pipeline to do it.
Built and pushed by hand for now: gitea Actions is not set up on this instance,
so there is no pipeline to do it.
```
docker build -t ghcr.io/staillanibm/classic-models-agent-catalogue:vX.Y.Z .
docker push ghcr.io/staillanibm/classic-models-agent-catalogue:vX.Y.Z
docker login gitea.sttlab.eu # gitea username + a token with package:write
docker build -t gitea.sttlab.eu/stt/classic-models-agent-catalogue:vX.Y.Z .
docker push gitea.sttlab.eu/stt/classic-models-agent-catalogue:vX.Y.Z
```
`k8s/` is what runs; `dev/` is the Flux plumbing that applies it. Three manual
@@ -155,12 +161,6 @@ the source that serves it exist:
```
kubectl apply -f k8s/namespace.yaml
# The ghcr package is private. Copy the pull secret classic-models already has:
kubectl -n classic-models get secret ghcr-pull-secret -o yaml \
| sed 's/namespace: classic-models/namespace: agents/' \
| kubectl apply -f -
kubectl apply -f dev/gitrepository.yaml
kubectl apply -f dev/bootstrap-kustomization.yaml
```
@@ -176,7 +176,7 @@ What the deployment assumes:
| Namespace | `agents` — one for the estate; what isolates an agent is its Keycloak client, not its namespace |
| Secret | `CATALOGUE_CLIENT_SECRET`, from the same Vault entry the realm import reads, through the `vault-keycloak` store |
| CA | `k8s/ca-configmap.yaml` holds the lab CA **certificate** — public by construction, checked in so the deployment has no hidden prerequisite. Regenerate it when the CA rotates (expires 2026-11-24) |
| Image pull | `ghcr-pull-secret` in `agents`, created by hand — the package is private |
| Image pull | none — the gitea package is public, like its repo |
| DNS | every `*.sttlab.local` name resolves in-cluster already; no `hostAliases` needed |
| Replicas | exactly one. Conversation history lives in the process, so a second replica would route a user's "yes" to a pod that never saw the question |