Lemon-miaow
13d64e0000
The disk-pressure drill's dead end: kubelet's image GC collects an unused image
and an air-gapped node has nothing to pull it from (ImagePullBackOff until an
operator re-imports). The registry the bundle already renders becomes that pull
source:
- Every image the installer builds is now a registry ref
(registry.felis.svc:5000/felis/{felis,limbo,lobby,paper}:demo), imported into
containerd under that exact name (first boot needs no registry round-trip)
and mirrored into the registry after deploy_bundle (push_image_to_registry:
push endpoint 127.0.0.1:5000, and only the path after the host matters to the
registry — a push there lands where kubelet's mirrored pull looks). A ref
outside the registry is warned about, not silently unmirrored.
- configure_registry_mirror writes /etc/rancher/k3s/registries.yaml mapping
registry.felis.svc:5000 onto http://127.0.0.1:5000, the loopback hostPort the
registry Deployment binds (node containerd cannot dial the Service VIP — live
drill: "Empty reply"). k3s regenerates containerd config only at agent start,
so a CONTENT change restarts k3s and an identical file (every re-run)
restarts nothing.
- import_registry_image caches registry:2 into containerd so the registry
Deployment can start on a box that cannot reach Docker Hub.
- Migration 0021 re-points the recommended whitelist seeds ('felis-lobby:demo',
'felis-paper:demo') at the registry refs — a user server created from those
rows must not strand when GC collects the bare tag. Only recommended rows
still holding the old seed are touched; enabled is preserved; a pre-existing
target row wins over a duplicate.
bootstrap_test.sh pins the mirror idempotence (identical content must NOT
restart k3s), the push-ref mapping (including the port-confusion refusal) and
the registry:2 precheck.
44 lines
2.3 KiB
SQL
44 lines
2.3 KiB
SQL
-- Re-point the platform-seeded recommended images at the internal registry.
|
|
--
|
|
-- 0018/0019 seeded 'felis-lobby:demo' and 'felis-paper:demo' — the bare local
|
|
-- containerd tags the bootstrap of that day imported. The installer now builds
|
|
-- every image under registry.<ns>.svc:5000/felis/... and mirrors it into the
|
|
-- in-cluster registry, which is what lets kubelet re-pull an image the image GC
|
|
-- collected (drilled: disk pressure → game images collected →
|
|
-- ImagePullBackOff with no pull source). A bare local tag has no pull source at
|
|
-- all once its containerd copy is collected, so a user server created from a
|
|
-- recommended row would strand the same way. Re-point the seeds at the refs the
|
|
-- installer now builds — these MUST stay identical to deploy/bootstrap.sh's
|
|
-- FELIS_LOBBY_IMAGE / FELIS_PAPER_IMAGE defaults.
|
|
--
|
|
-- Only source='recommended' rows are touched, and only while the ref still IS
|
|
-- the old seed: a built/external row, or a recommended row an admin re-pointed
|
|
-- by hand, is theirs to keep. enabled is preserved either way — a disabled seed
|
|
-- stays disabled, just under its durable name.
|
|
--
|
|
-- Collision handling: image_ref is the primary key, so an UPDATE would abort if
|
|
-- the new ref already exists (e.g. an admin added it by hand). Keep whichever
|
|
-- row exists and drop the stale old one — never a duplicate, never an aborted
|
|
-- migration.
|
|
UPDATE image_whitelist
|
|
SET image_ref = 'registry.felis.svc:5000/felis/lobby:demo'
|
|
WHERE image_ref = 'felis-lobby:demo'
|
|
AND source = 'recommended'
|
|
AND NOT EXISTS (SELECT 1 FROM image_whitelist WHERE image_ref = 'registry.felis.svc:5000/felis/lobby:demo');
|
|
|
|
DELETE FROM image_whitelist
|
|
WHERE image_ref = 'felis-lobby:demo'
|
|
AND source = 'recommended'
|
|
AND EXISTS (SELECT 1 FROM image_whitelist WHERE image_ref = 'registry.felis.svc:5000/felis/lobby:demo');
|
|
|
|
UPDATE image_whitelist
|
|
SET image_ref = 'registry.felis.svc:5000/felis/paper:demo'
|
|
WHERE image_ref = 'felis-paper:demo'
|
|
AND source = 'recommended'
|
|
AND NOT EXISTS (SELECT 1 FROM image_whitelist WHERE image_ref = 'registry.felis.svc:5000/felis/paper:demo');
|
|
|
|
DELETE FROM image_whitelist
|
|
WHERE image_ref = 'felis-paper:demo'
|
|
AND source = 'recommended'
|
|
AND EXISTS (SELECT 1 FROM image_whitelist WHERE image_ref = 'registry.felis.svc:5000/felis/paper:demo');
|