fix(lidarr): scan ghcr.io directly instead of lscr.io redirector #1528

2026-10-29T21:24:12Z

hermes-bot commented

2026-10-29 21:24:12 +00:00

Cause

ImageRepository/lidarr scans lscr.io/linuxserver/lidarr. lscr.io answers the tag-list call with a cross-host redirect to ghcr.io, and the follow-up request reaches ghcr.io unauthenticated.

Observed this run (2026-10-29 ~21:23Z):

ALERTS{alertname="FluxImageAutomationNotReady"}: firing for ImageRepository/lidarr only.
kubectl -n flux-system get imagerepository lidarr: Ready=False since 18:56:20Z, scan failed: GET https://ghcr.io/v2/linuxserver/lidarr/tags/list?n=1000: UNAUTHORIZED: authentication required. Last good scan 17:56:04Z (9419 tags). The same error is in the reflector log at 20:51, 21:06 and 21:21.
GET https://lscr.io/v2/linuxserver/lidarr/tags/list?n=1000, with or without an anonymous ghcr bearer token: 302 Location: https://ghcr.io/v2/linuxserver/lidarr/tags/list?n=1000.
The same GET on ghcr.io with an anonymous token from ghcr.io/token?scope=repository:linuxserver/lidarr:pull returns 200 with pagination Link.
ghcr.io/linuxserver/lidarr:3.1.6.5079-ls46 resolves to sha256:9fddcf5c…6e63. That is the imageID the running lidarr pod reports for lscr.io/linuxserver/lidarr:3.1.6.5079-ls46, so both names point to the same image.

Change

kubernetes/infrastructure/image-automation/lidarr.yaml: spec.image: ghcr.io/linuxserver/lidarr.
kubernetes/apps/navidrome/lidarr.yaml: both $imagepolicy-marked refs now use ghcr.io/linuxserver/lidarr:3.1.6.5079-ls46 (same tag and digest). They have to match the ImageRepository name, otherwise the setter rewrites them.

kubectl kustomize renders both dirs without errors.

After merge

Flux applies the new ImageRepository and the next scan succeeds, so ImageRepository/lidarr goes Ready=True and FluxImageAutomationNotReady stops firing.
The lidarr Deployment (strategy Recreate) restarts once because the image string changed. The digest stays the same.
Check: kubectl -n flux-system get imagerepository lidarr -o jsonpath='{.status.conditions[?(@.type=="Ready")]}' and .status.lastScanResult.scanTime.

Out of scope: beets.yaml also pulls from lscr.io. It is digest-pinned, has no ImageRepository and is not affected.

Hermes-Card: t_894a66a0 (apollo)

Closes #1527 ## Cause `ImageRepository/lidarr` scans `lscr.io/linuxserver/lidarr`. lscr.io answers the tag-list call with a cross-host redirect to ghcr.io, and the follow-up request reaches ghcr.io unauthenticated. Observed this run (2026-10-29 ~21:23Z): - `ALERTS{alertname="FluxImageAutomationNotReady"}`: firing for `ImageRepository/lidarr` only. - `kubectl -n flux-system get imagerepository lidarr`: Ready=False since 18:56:20Z, `scan failed: GET https://ghcr.io/v2/linuxserver/lidarr/tags/list?n=1000: UNAUTHORIZED: authentication required`. Last good scan 17:56:04Z (9419 tags). The same error is in the reflector log at 20:51, 21:06 and 21:21. - `GET https://lscr.io/v2/linuxserver/lidarr/tags/list?n=1000`, with or without an anonymous ghcr bearer token: `302 Location: https://ghcr.io/v2/linuxserver/lidarr/tags/list?n=1000`. - The same GET on ghcr.io with an anonymous token from `ghcr.io/token?scope=repository:linuxserver/lidarr:pull` returns `200` with pagination `Link`. - `ghcr.io/linuxserver/lidarr:3.1.6.5079-ls46` resolves to `sha256:9fddcf5c…6e63`. That is the imageID the running lidarr pod reports for `lscr.io/linuxserver/lidarr:3.1.6.5079-ls46`, so both names point to the same image. ## Change - `kubernetes/infrastructure/image-automation/lidarr.yaml`: `spec.image: ghcr.io/linuxserver/lidarr`. - `kubernetes/apps/navidrome/lidarr.yaml`: both `$imagepolicy`-marked refs now use `ghcr.io/linuxserver/lidarr:3.1.6.5079-ls46` (same tag and digest). They have to match the ImageRepository name, otherwise the setter rewrites them. `kubectl kustomize` renders both dirs without errors. ## After merge - Flux applies the new ImageRepository and the next scan succeeds, so ImageRepository/lidarr goes Ready=True and FluxImageAutomationNotReady stops firing. - The lidarr Deployment (strategy `Recreate`) restarts once because the image string changed. The digest stays the same. - Check: `kubectl -n flux-system get imagerepository lidarr -o jsonpath='{.status.conditions[?(@.type=="Ready")]}'` and `.status.lastScanResult.scanTime`. Out of scope: `beets.yaml` also pulls from lscr.io. It is digest-pinned, has no ImageRepository and is not affected. Hermes-Card: t_894a66a0 (apollo)

hermes-bot added 1 commit 2026-10-29 21:24:13 +00:00

fix(lidarr): scan ghcr.io directly instead of lscr.io

ci/woodpecker/pr/ci-manifests-test Pipeline was successful

Details

ci/woodpecker/pr/ci-scripts-test Pipeline was successful

Details

dab7c10eca

lscr.io 302-redirects the tag-list request to ghcr.io and the
image-reflector's follow-up arrives unauthenticated (UNAUTHORIZED),
leaving ImageRepository/lidarr not Ready since 2026-10-29T18:56Z.
ghcr.io/linuxserver/lidarr is the same repository (identical digest
for 3.1.6.5079-ls46) and scans anonymously. Workload refs follow so
the imagepolicy setter keeps matching.

Closes #1527

k.renner merged commit 0575a50d9e into main

2026-10-30 06:22:12 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: konairius/homelab#1528