From 9b5870ca6979ceb2d724a6962fe7cbea5bd22df5 Mon Sep 17 00:00:00 2001
From: Bernd Rodler <brvncde@gmail.com>
Date: Wed, 5 Aug 2026 19:47:28 +0200
Subject: [PATCH] deploy(dev): pin sandbox to sha-d0a1cee6 + IfNotPresent pull
 policy

Puts today's merged dev on the sandbox (S/MIME, offline replica, SRC
branding) without waiting on CI, which still can't push anywhere: GitLab's
registry vhost serves Rails/dependency-proxy (see .gitlab-ci.yml) and GHCR
needs a PAT that only a human can mint.

The amd64 image was built locally and side-loaded into all three nodes'
containerd via `microk8s ctr images import`, so IfNotPresent is required -
Always would ignore the local image and try to pull a tag no registry has.
IfNotPresent is the correct policy for immutable sha- tags regardless; see
the comment in patch-image-pull-policy.yaml for the full runbook.
---
 .../overlays/dev/image-tag/kustomization.yaml |  2 +-
 deploy/k8s/overlays/dev/kustomization.yaml    |  1 +
 .../overlays/dev/patch-image-pull-policy.yaml | 29 +++++++++++++++++++
 3 files changed, 31 insertions(+), 1 deletion(-)
 create mode 100644 deploy/k8s/overlays/dev/patch-image-pull-policy.yaml

diff --git a/deploy/k8s/overlays/dev/image-tag/kustomization.yaml b/deploy/k8s/overlays/dev/image-tag/kustomization.yaml
index 25cc7058..0d3f0e3a 100644
--- a/deploy/k8s/overlays/dev/image-tag/kustomization.yaml
+++ b/deploy/k8s/overlays/dev/image-tag/kustomization.yaml
@@ -8,4 +8,4 @@ kind: Component
 images:
   - name: ghcr.io/brvncde-dotcom/vncmail-plus-dev
     newName: ghcr.io/brvncde-dotcom/vncmail-plus-dev
-    newTag: latest
+    newTag: sha-d0a1cee6
diff --git a/deploy/k8s/overlays/dev/kustomization.yaml b/deploy/k8s/overlays/dev/kustomization.yaml
index 95540993..c1b97a63 100644
--- a/deploy/k8s/overlays/dev/kustomization.yaml
+++ b/deploy/k8s/overlays/dev/kustomization.yaml
@@ -8,6 +8,7 @@ resources:
 
 patches:
   - path: patch-ingress.yaml
+  - path: patch-image-pull-policy.yaml
 
 components:
   - image-tag
diff --git a/deploy/k8s/overlays/dev/patch-image-pull-policy.yaml b/deploy/k8s/overlays/dev/patch-image-pull-policy.yaml
new file mode 100644
index 00000000..05011284
--- /dev/null
+++ b/deploy/k8s/overlays/dev/patch-image-pull-policy.yaml
@@ -0,0 +1,29 @@
+# base/deployment.yaml sets imagePullPolicy: Always, which is the right
+# default for a mutable tag like :latest. The dev overlay pins an immutable
+# sha-<commit> tag instead (see image-tag/), and for an immutable tag Always
+# is pure waste - the content behind that tag can never change, so re-pulling
+# it on every pod start only adds a registry round-trip and a hard dependency
+# on the registry being reachable at scheduling time.
+#
+# It is also load-bearing right now: until CI can actually push (GitLab's
+# registry vhost serves Rails, not the registry - see .gitlab-ci.yml's
+# "Registry history" note), sha- tagged images are side-loaded straight into
+# each node's containerd:
+#
+#   docker save --platform linux/amd64 -o vncmail.tar <image>:<tag>
+#   scp vncmail.tar dev-k8s-N:/tmp/ && ssh dev-k8s-N \
+#     'microk8s ctr images import /tmp/vncmail.tar'
+#
+# imported to ALL of dev-k8s-1/2/3 so the pod can schedule anywhere. With
+# Always, kubelet would ignore that local image and fail on a registry pull
+# for a tag the registry has never seen.
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: vncmail-plus
+spec:
+  template:
+    spec:
+      containers:
+        - name: vncmail-plus
+          imagePullPolicy: IfNotPresent