deploy(dev): pin sandbox to sha-d0a1cee6 + IfNotPresent pull policy

Puts today's merged dev on the sandbox (S/MIME, offline replica, SRC
branding) without waiting on CI, which still can't push anywhere: GitLab's
registry vhost serves Rails/dependency-proxy (see .gitlab-ci.yml) and GHCR
needs a PAT that only a human can mint.

The amd64 image was built locally and side-loaded into all three nodes'
containerd via `microk8s ctr images import`, so IfNotPresent is required -
Always would ignore the local image and try to pull a tag no registry has.
IfNotPresent is the correct policy for immutable sha- tags regardless; see
the comment in patch-image-pull-policy.yaml for the full runbook.

This commit is contained in:

Bernd Rodler

2026-08-05 19:47:28 +02:00

parent 2e8bb9983a

commit 9b5870ca69

3 changed files with 31 additions and 1 deletions

									
										deploy/k8s/overlays/dev/kustomization.yaml
									
		+1
		
												View File
												
				@@ -8,6 +8,7 @@ resources:

				patches:

				  - path: patch-ingress.yaml

				  - path: patch-image-pull-policy.yaml

				components:

				  - image-tag