From fd2df9368368231b6b97a46250f116b49d6f90dd Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?St=C3=A9phane=20Tailland?= Date: Sat, 29 Aug 2026 07:16:40 +0200 Subject: [PATCH] fix(deploy): the ghcr package is private, so declare the pull secret Same arrangement classic-models already uses: a hand-created ghcr-pull-secret rather than one committed or held in Vault, since the credential is a GitHub token that belongs to no estate in particular. Without it the pod would sit in ImagePullBackOff with no hint as to why. Co-Authored-By: Claude Opus 5 --- README.md | 7 +++++++ k8s/deployment.yaml | 6 ++++++ 2 files changed, 13 insertions(+) diff --git a/README.md b/README.md index 4769177..672a11b 100644 --- a/README.md +++ b/README.md @@ -155,6 +155,12 @@ the source that serves it exist: ``` kubectl apply -f k8s/namespace.yaml + +# The ghcr package is private. Copy the pull secret classic-models already has: +kubectl -n classic-models get secret ghcr-pull-secret -o yaml \ + | sed 's/namespace: classic-models/namespace: agents/' \ + | kubectl apply -f - + kubectl apply -f dev/gitrepository.yaml kubectl apply -f dev/bootstrap-kustomization.yaml ``` @@ -170,6 +176,7 @@ What the deployment assumes: | Namespace | `agents` — one for the estate; what isolates an agent is its Keycloak client, not its namespace | | Secret | `CATALOGUE_CLIENT_SECRET`, from the same Vault entry the realm import reads, through the `vault-keycloak` store | | CA | `k8s/ca-configmap.yaml` holds the lab CA **certificate** — public by construction, checked in so the deployment has no hidden prerequisite. Regenerate it when the CA rotates (expires 2026-11-24) | +| Image pull | `ghcr-pull-secret` in `agents`, created by hand — the package is private | | DNS | every `*.sttlab.local` name resolves in-cluster already; no `hostAliases` needed | | Replicas | exactly one. Conversation history lives in the process, so a second replica would route a user's "yes" to a pod that never saw the question | diff --git a/k8s/deployment.yaml b/k8s/deployment.yaml index 47d9f1f..e80831e 100644 --- a/k8s/deployment.yaml +++ b/k8s/deployment.yaml @@ -18,6 +18,12 @@ spec: labels: app: catalogue-agent spec: + # The ghcr package is private, like classic-models-api's. The secret is + # created by hand once (see the README) rather than committed or pulled + # from Vault — same arrangement classic-models already uses, and the + # credential is a GitHub token that belongs to no estate in particular. + imagePullSecrets: + - name: ghcr-pull-secret securityContext: runAsNonRoot: true runAsUser: 10001