8a71084585
The hermes-agent-image pipeline failed intermittently on external network: Kaniko's docker.io fallback for the base image is IPv6-broken from build pods, and the "Validate reviewed release source" stage pip-installed pytest from files.pythonhosted.org (DNS failures). Neither should touch the public internet. Base image: repoint the Dockerfile FROM from docker.io to the in-cluster Harbor "mirror" project, keeping the exact content-addressed index digest (9c841866...) and both arch leaves. A Flux-managed one-shot Job (services/harbor/hermes-agent-base-mirror-job.yaml, suspend: true like the cassandra bootstrap job) runs `skopeo copy --all` from docker.io into Harbor using the same Vault-injected admin credential as the existing Harbor immutability jobs; a tiny fail-closed helper ensures the public target project first. Digest pinning and multi-arch are preserved; Kaniko pulls it over the internal insecure registry with no docker.io fallback. Test deps: install pytest/PyYAML fully offline (`pip --no-index --find-links`) from a reviewed in-repo wheelhouse (ci/vendor/hermes-agent-test-wheels) matching the arm64 python:3.12 build container, so the validate stage never resolves a public index. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BvMSXH8VH2tMWXanb8SJdf
39 lines
1.4 KiB
YAML
39 lines
1.4 KiB
YAML
# services/harbor/kustomization.yaml
|
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
namespace: harbor
|
|
generatorOptions:
|
|
disableNameSuffixHash: true
|
|
resources:
|
|
- namespace.yaml
|
|
- serviceaccount.yaml
|
|
- secretproviderclass.yaml
|
|
- pvc.yaml
|
|
- certificate.yaml
|
|
- helmrelease.yaml
|
|
- vault-sync-deployment.yaml
|
|
- policy-bootstrap-serviceaccount.yaml
|
|
- hermes-agent-immutability-job.yaml
|
|
- hermes-webui-immutability-job.yaml
|
|
- hermes-chat-router-immutability-job.yaml
|
|
- hermes-agent-base-mirror-job.yaml
|
|
- bootstrap-jobs/cassandra-registry-ensure-job.yaml
|
|
- image.yaml
|
|
configMapGenerator:
|
|
- name: harbor-vault-entrypoint
|
|
files:
|
|
- scripts/vault-entrypoint.sh
|
|
- name: harbor-hermes-agent-immutability-script
|
|
files:
|
|
- harbor_hermes_agent_immutability_ensure.py=scripts/harbor_hermes_agent_immutability_ensure.py
|
|
- name: harbor-hermes-webui-immutability-script
|
|
files:
|
|
- harbor_hermes_webui_immutability_ensure.py=scripts/harbor_hermes_webui_immutability_ensure.py
|
|
- name: harbor-hermes-chat-router-immutability-script
|
|
files:
|
|
- harbor_immutable_rule_ensure.py=scripts/harbor_immutable_rule_ensure.py
|
|
- harbor_hermes_chat_router_immutability_ensure.py=scripts/harbor_hermes_chat_router_immutability_ensure.py
|
|
- name: harbor-hermes-agent-base-mirror-script
|
|
files:
|
|
- harbor_mirror_project_ensure.py=scripts/harbor_mirror_project_ensure.py
|