From c1ccf228b7b5de84a8116737ae81f69e36ed43c6 Mon Sep 17 00:00:00 2001 From: Claude Bot Date: Wed, 16 Sep 2026 10:53:55 +0200 Subject: [PATCH] fix(bird): reference the image by digest, the dated tag resolves stale MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The DaemonSet came up with Init:Error, kubectl: not found. The build had pushed sha256:3bc85006 for bird:2026-09-16, but every pod resolved that tag to sha256:75e19214 — the first build of the same day, from before kubectl was added. imagePullPolicy: Always does not help: it re-pulls, but the tag itself resolves to the stale digest. Deleting the pods changed nothing; three fresh pods on three nodes all resolved to the old digest. A one-off pod pulling the digest directly ran kubectl 1.33.1 and BIRD 2.17.2, so the registry holds the right image and only tag resolution is stale. The dated tag cannot carry a same-day rebuild, and this image was rebuilt three times today. Referencing the digest makes the deployment deterministic. The cost is that the reference has to be updated whenever the image is rebuilt; the alternative, tagging by commit, does not work for a manifest living in the same commit. Refs #576 Co-Authored-By: Claude Opus 5 (1M context) --- kubernetes/infrastructure/bird/daemonset.yaml | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/kubernetes/infrastructure/bird/daemonset.yaml b/kubernetes/infrastructure/bird/daemonset.yaml index 75eace14..645d72ea 100644 --- a/kubernetes/infrastructure/bird/daemonset.yaml +++ b/kubernetes/infrastructure/bird/daemonset.yaml @@ -60,9 +60,12 @@ spec: effect: NoSchedule initContainers: - name: render-config - image: gitea.renner.uno/gitea_admin/bird:2026-09-16 - # The dated tag is rebuilt within the day it names. - imagePullPolicy: Always + # By digest, not by the dated tag: the tag is rebuilt within the day + # it names, and the cluster's image path keeps resolving it to the + # first build of that day — imagePullPolicy: Always does not help, + # because the tag itself resolves stale. Update this when the image + # is rebuilt. + image: gitea.renner.uno/gitea_admin/bird@sha256:3bc8500613eeb45b2d8858b5445198bae3990ecf64f6d891aa94797f5a09dc1d command: ["/bin/sh", "-c"] args: - | @@ -88,8 +91,7 @@ spec: mountPath: /etc/bird containers: - name: bird - image: gitea.renner.uno/gitea_admin/bird:2026-09-16 - imagePullPolicy: Always + image: gitea.renner.uno/gitea_admin/bird@sha256:3bc8500613eeb45b2d8858b5445198bae3990ecf64f6d891aa94797f5a09dc1d resources: requests: cpu: "50m" -- 2.54.0