claude-bot
0aec18cecc
Three images are needed while the cluster is still being built — paperless's fetch-bridge-cert init container, zigbee2mqtt's seed-data init container and the trmnl renderer. None of them can come from gitea.renner.uno, which runs inside the cluster being rebuilt; a rehearsal left all three in ImagePullBackOff and took their Kustomizations down with them. They are mirrored to ghcr.io (previous commit) but the namespace is private, and it stays private: three of the five images this will eventually cover are own application images, not alpine+jq. Making them world-readable is not something the rebuild requires. The credential goes into machine.registries.config, not an imagePullSecret. An imagePullSecret fails here twice over: it would have to exist in five namespaces before any of them exists, and it would come from OpenBao, which needs Ceph, which needs these very images. containerd's own auth is in place before the first pod is scheduled and applies to every pull on the node regardless of namespace (pkg/machinery/config/types/v1alpha1, RegistryAuthConfig — field names follow .docker/config.json). The token is the sixth entry in OPENBAO_REQUIRED_SECRETS, so a run demands it up front rather than discovering it missing after the disks are wiped. The generated patch lives in the in-memory secrets dir and dies with the Job. Only alpine-jq and alpine-openssl move in this commit, because only they are published to the mirror so far. vsftpd, shelly-manager and authentik-samba-bridge-ldap-outpost are built by other repositories and need the same push there first; their references stay on gitea until then. Production rollout is NOT this commit. The nodes need machine.registries applied before any manifest points at ghcr, or the pods cannot pull. Order: apply the machine config, verify a pull, then move the references.