claude-bot
dfe13cc4e6
A cold-rebuild rehearsal stopped dead here. The installer DaemonSet pulls gitea.renner.uno/gitea_admin/cni-plugins, and Gitea runs inside the cluster being rebuilt, so all four nodes sat in ImagePullBackOff with 'no route to host'. Without the plugins there is no macvlan; without macvlan Multus cannot attach ceph-san; without that network Rook's canary never starts, the CephCluster hangs at 'Configuring Ceph Mons', and OpenBao waits forever for a PVC that can never bind. Four layers between the cause and the symptom. Baking the binaries into an image fixed a real integrity gap — the old path fetched a release tarball on the node with no checksum at all. What it also did, unnoticed, was trade github.com on the critical path for something strictly worse: a registry that by definition does not exist during a recovery. The mirror keeps the checksum and removes the dependency. ghcr.io/konairius/cni-plugins:2026-07-30 is the same image, verified by digest (sha256:85e83e32...) against the Gitea copy, and public: an unauthenticated pull was confirmed to work. It has to stay credential-free, because an imagePullSecret would come from OpenBao, which needs Ceph, which needs these binaries. Every other image in this directory already came from a public registry. The build pipeline does not yet publish to ghcr.io — that needs a token this commit cannot provide, so today's mirror was pushed by hand. Bumping the tag means mirroring first until that lands.