From 57a5c692be7aa149d1b8d56817f2f97346ed0eee Mon Sep 17 00:00:00 2001 From: Bernd Rodler Date: Wed, 5 Aug 2026 18:26:58 +0200 Subject: [PATCH] fix(k8s): drop imagePullSecrets - the ghcr package is confirmed public Blocking the very first real deploy of the sandbox: base/deployment.yaml referenced an imagePullSecrets entry ("ghcr-pull") that was never created, which fails pod startup regardless of whether the image needs auth at all - kubelet errors trying to resolve the named secret before it gets anywhere near actually pulling. Confirmed by execution (anonymous GHCR token, pull succeeded) that ghcr.io/brvncde-dotcom/vncmail-plus-dev is public. Removing the block is deploy/k8s/README.md's own documented alternative for exactly this case. --- deploy/k8s/base/deployment.yaml | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/deploy/k8s/base/deployment.yaml b/deploy/k8s/base/deployment.yaml index f72e952c..b0ad23c0 100644 --- a/deploy/k8s/base/deployment.yaml +++ b/deploy/k8s/base/deployment.yaml @@ -23,14 +23,14 @@ spec: fsGroup: 1001 runAsUser: 1001 runAsGroup: 1001 - # ghcr package is private by default — see deploy/k8s/README.md to create - # this pull secret. Delete this block if you make the package public. - # NOTE: once CI moves to pushing registry.gitlab.vnc.biz images (the - # dev-auto-deploy phase of the GitLab pipeline), this needs to become a - # docker-registry secret for that registry instead — comments only, - # deliberately not renamed here, so this file stays a no-op today. - imagePullSecrets: - - name: ghcr-pull + # Confirmed 2026-08-05: ghcr.io/brvncde-dotcom/vncmail-plus-dev IS public + # (anonymous token pull succeeded) — no imagePullSecrets needed. This is + # deploy/k8s/README.md's own documented alternative to creating a + # ghcr-pull secret. Removed rather than left referencing a + # not-yet-created secret, which would otherwise block every pod from + # starting regardless of the image being public (kubelet fails to + # resolve a missing imagePullSecrets entry before it ever gets to + # deciding whether auth was actually required). containers: - name: vncmail-plus # Default/legacy value — CI overrides the image per-deploy via