Bernd Rodler
9b5870ca69
Puts today's merged dev on the sandbox (S/MIME, offline replica, SRC branding) without waiting on CI, which still can't push anywhere: GitLab's registry vhost serves Rails/dependency-proxy (see .gitlab-ci.yml) and GHCR needs a PAT that only a human can mint. The amd64 image was built locally and side-loaded into all three nodes' containerd via `microk8s ctr images import`, so IfNotPresent is required - Always would ignore the local image and try to pull a tag no registry has. IfNotPresent is the correct policy for immutable sha- tags regardless; see the comment in patch-image-pull-policy.yaml for the full runbook.
20 lines
571 B
YAML
20 lines
571 B
YAML
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
namespace: vncmail
|
|
resources:
|
|
- ../../base
|
|
- namespace.yaml
|
|
# - secret.yaml # create from secret.example.yaml; not committed
|
|
|
|
patches:
|
|
- path: patch-ingress.yaml
|
|
- path: patch-image-pull-policy.yaml
|
|
|
|
components:
|
|
- image-tag
|
|
|
|
# Targets the dev-k8s-1/2/3 cluster (confirmed via direct access: this is
|
|
# where ArgoCD already lives). The image tag lives in image-tag/ (a separate
|
|
# Component CI owns — see .gitlab-ci.yml's bump-dev job) rather than here, so
|
|
# CI never needs to touch this file.
|