2025-12-15 22:05:40 -03:00
|
|
|
# services/harbor/kustomization.yaml
|
|
|
|
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
|
|
|
kind: Kustomization
|
|
|
|
|
namespace: harbor
|
2026-01-14 21:02:50 -03:00
|
|
|
generatorOptions:
|
|
|
|
|
disableNameSuffixHash: true
|
2025-12-15 22:05:40 -03:00
|
|
|
resources:
|
|
|
|
|
- namespace.yaml
|
2026-01-14 05:07:23 -03:00
|
|
|
- serviceaccount.yaml
|
|
|
|
|
- secretproviderclass.yaml
|
2025-12-15 22:05:40 -03:00
|
|
|
- pvc.yaml
|
|
|
|
|
- certificate.yaml
|
|
|
|
|
- helmrelease.yaml
|
2026-01-14 05:07:23 -03:00
|
|
|
- vault-sync-deployment.yaml
|
2026-08-16 20:04:17 -03:00
|
|
|
- policy-bootstrap-serviceaccount.yaml
|
|
|
|
|
- hermes-agent-immutability-job.yaml
|
2026-08-23 01:08:35 +00:00
|
|
|
- hermes-webui-immutability-job.yaml
|
2026-08-24 02:46:36 -03:00
|
|
|
- hermes-chat-router-immutability-job.yaml
|
2026-08-25 13:53:22 -03:00
|
|
|
- hermes-agent-base-mirror-job.yaml
|
build(hermes-webui): multi-arch image (arm64 + amd64)
Make registry.bstein.dev/bstein/hermes-webui a linux/amd64 + linux/arm64
manifest list so the agent pod's `hux` sidecar (which runs the webui image)
can schedule onto the amd64 node titan-22. Reuses the hermes-agent multi-arch
pattern already on main.
- Dockerfile.hermes-webui: repoint both FROMs to multi-arch, internal sources.
The upstream WebUI base (ghcr sha256:a83a3893..., already a multi-arch OCI
index) is now pulled from the in-cluster Harbor mirror; the agent base moves
from the retired arm64-only leaf (81970563) to the multi-arch agent index
(a68d1c4d). Kaniko selects the matching arch leaf per build node.
- services/harbor/hermes-webui-base-mirror-job.yaml: new suspended, operator-run
skopeo `copy --all` Job mirroring the upstream WebUI base index into Harbor's
`mirror` project (modeled on hermes-agent-base-mirror-job.yaml; reuses the
generic ensure-project helper). Wired into the harbor kustomization.
- Jenkinsfile.hermes-webui-image: arm64 leg (titan-20) + amd64 leg (titan-24,
hostname+arch pin, toleration Exists, resource-capped, own checkout scm) +
Combine multi-arch index stage; per-arch evidence archived alongside the index.
- hermes_multiarch_combine.py: generalize the destination pattern/component to
serve both hermes-agent and hermes-webui (fail-closed to just those two).
- Tests updated to the two-arch topology (two legs, combine, both FROM bases,
the mirror Job, twelve archived evidence files).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BvMSXH8VH2tMWXanb8SJdf
2026-08-25 18:17:35 -03:00
|
|
|
- hermes-webui-base-mirror-job.yaml
|
2026-07-25 00:52:21 -03:00
|
|
|
- bootstrap-jobs/cassandra-registry-ensure-job.yaml
|
2025-12-17 03:21:35 -03:00
|
|
|
- image.yaml
|
2026-01-14 21:02:50 -03:00
|
|
|
configMapGenerator:
|
|
|
|
|
- name: harbor-vault-entrypoint
|
|
|
|
|
files:
|
|
|
|
|
- scripts/vault-entrypoint.sh
|
2026-08-16 20:04:17 -03:00
|
|
|
- name: harbor-hermes-agent-immutability-script
|
|
|
|
|
files:
|
|
|
|
|
- harbor_hermes_agent_immutability_ensure.py=scripts/harbor_hermes_agent_immutability_ensure.py
|
2026-08-23 01:08:35 +00:00
|
|
|
- name: harbor-hermes-webui-immutability-script
|
|
|
|
|
files:
|
|
|
|
|
- harbor_hermes_webui_immutability_ensure.py=scripts/harbor_hermes_webui_immutability_ensure.py
|
2026-08-24 02:46:36 -03:00
|
|
|
- name: harbor-hermes-chat-router-immutability-script
|
|
|
|
|
files:
|
|
|
|
|
- harbor_immutable_rule_ensure.py=scripts/harbor_immutable_rule_ensure.py
|
|
|
|
|
- harbor_hermes_chat_router_immutability_ensure.py=scripts/harbor_hermes_chat_router_immutability_ensure.py
|
2026-08-25 13:53:22 -03:00
|
|
|
- name: harbor-hermes-agent-base-mirror-script
|
|
|
|
|
files:
|
|
|
|
|
- harbor_mirror_project_ensure.py=scripts/harbor_mirror_project_ensure.py
|
build(hermes-webui): multi-arch image (arm64 + amd64)
Make registry.bstein.dev/bstein/hermes-webui a linux/amd64 + linux/arm64
manifest list so the agent pod's `hux` sidecar (which runs the webui image)
can schedule onto the amd64 node titan-22. Reuses the hermes-agent multi-arch
pattern already on main.
- Dockerfile.hermes-webui: repoint both FROMs to multi-arch, internal sources.
The upstream WebUI base (ghcr sha256:a83a3893..., already a multi-arch OCI
index) is now pulled from the in-cluster Harbor mirror; the agent base moves
from the retired arm64-only leaf (81970563) to the multi-arch agent index
(a68d1c4d). Kaniko selects the matching arch leaf per build node.
- services/harbor/hermes-webui-base-mirror-job.yaml: new suspended, operator-run
skopeo `copy --all` Job mirroring the upstream WebUI base index into Harbor's
`mirror` project (modeled on hermes-agent-base-mirror-job.yaml; reuses the
generic ensure-project helper). Wired into the harbor kustomization.
- Jenkinsfile.hermes-webui-image: arm64 leg (titan-20) + amd64 leg (titan-24,
hostname+arch pin, toleration Exists, resource-capped, own checkout scm) +
Combine multi-arch index stage; per-arch evidence archived alongside the index.
- hermes_multiarch_combine.py: generalize the destination pattern/component to
serve both hermes-agent and hermes-webui (fail-closed to just those two).
- Tests updated to the two-arch topology (two legs, combine, both FROM bases,
the mirror Job, twelve archived evidence files).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BvMSXH8VH2tMWXanb8SJdf
2026-08-25 18:17:35 -03:00
|
|
|
- name: harbor-hermes-webui-base-mirror-script
|
|
|
|
|
files:
|
|
|
|
|
- harbor_mirror_project_ensure.py=scripts/harbor_mirror_project_ensure.py
|
