fix(netbird-proxy-services): pin the digest the master build produced

#817 pinned the digest from the branch build (pipeline 8452). Merging #816 rebuilt the same date tag on master (pipeline 8457), Gitea kept only the new manifest, and the pod has been in ImagePullBackOff since: "failed to resolve reference ...@sha256:0d266b02...". With the Recreate strategy no controller is running, so the services are unchanged. The kaniko step of the master build pushed sha256:caffa308...; that is the digest to pin. Comment states the rule. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Merge pull request 'feat(netbird-proxy-services): roll the PROXY-protocol build (2/2)' (#817 ) from netbird-proxy-protocol-deploy into master
2026-09-07 13:47:22 +02:00 · 2026-09-07 11:34:52 +00:00 · 2026-09-07 11:34:43 +00:00 · 2026-09-07 13:32:06 +02:00
1 changed files with 5 additions and 1 deletions
@@ -76,7 +76,11 @@ spec:
          type: RuntimeDefault
      containers:
        - name: controller
-          image: gitea.renner.uno/gitea_admin/netbird-proxy-services:2026-09-07
+          # Pinned by digest: the date tag is rebuilt on every push of the
+          # image directory (branch and master alike) and the registry keeps
+          # only the newest manifest per tag, so the digest must come from
+          # the MASTER build of the code change.
+          image: gitea.renner.uno/gitea_admin/netbird-proxy-services:2026-09-07@sha256:caffa308d802c6fcc6aea919ac94657c08b993651baa6b8d18de395bcc40523e
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
Author	SHA1	Message	Date
claude-botandClaude Fable 5.1	0ebe113abb	fix(netbird-proxy-services): pin the digest the master build produced ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details ci/woodpecker/pr/ci-manifests-test Pipeline was successful Details ci/woodpecker/pr/pr-review Pipeline was successful Details #817 pinned the digest from the branch build (pipeline 8452). Merging #816 rebuilt the same date tag on master (pipeline 8457), Gitea kept only the new manifest, and the pod has been in ImagePullBackOff since: "failed to resolve reference ...@sha256:0d266b02...". With the Recreate strategy no controller is running, so the services are unchanged. The kaniko step of the master build pushed sha256:caffa308...; that is the digest to pin. Comment states the rule. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>	2026-09-07 13:47:22 +02:00
k.renner	1723f73b5d	Merge pull request 'feat(netbird-proxy-services): roll the PROXY-protocol build (2/2)' (#817 ) from netbird-proxy-protocol-deploy into master ci/woodpecker/cron/issue-fix Pipeline was successful Details ci/woodpecker/cron/alert-monitor Pipeline was successful Details Reviewed-on: k.renner/homelab#817	2026-09-07 11:34:52 +00:00
k.renner	8d8df3b635	Merge pull request 'feat(netbird): carry the WAN client address through the passthrough edge (1/2)' (#816 ) from netbird-proxy-protocol into master ci/woodpecker/push/build-ci-images Pipeline was successful Details Reviewed-on: k.renner/homelab#816	2026-09-07 11:34:43 +00:00
claude-botandClaude Fable 5.1	29c91769a7	feat(netbird-proxy-services): roll the PROXY-protocol build (2/2) ci/woodpecker/pr/ci-manifests-test Pipeline was successful Details ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details ci/woodpecker/pr/pr-review Pipeline was successful Details Pins the controller image by digest. The registry tag is the build date and pipeline 8452 rebuilt today's tag in place, so the tag alone cannot carry a new build to the cluster; the digest can. Merge only after the Traefik change from 1/2 has reconciled: from this build on every service target sends a PROXY protocol v2 header, and Traefik drops such connections unless websecure trusts the pod CIDRs. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>	2026-09-07 13:32:06 +02:00