sean/pipelines
Watch
1
0
Fork
You've already forked pipelines
 0
Code Issues Pull requests Projects Releases 758 Packages Wiki Activity

fix(kernel): pull hetzner-builder from the canonical registry #2156

Merged
pipeline-bot merged 1 commit from fix/hetzner-builder-canonical-registry into trunk 2026-09-03 12:53:59 +00:00
Conversation 0 Commits 1 Files changed 2 +3 -3
sean commented 2026-09-03 12:52:48 +00:00
Owner
Copy link

Every kernel release fails at the snapshot bake. Reproduced today on linux-release-request-gqxn4: the bake-snapshot pod sits in ImagePullBackOff on codeberg.org/someara/hetzner-builder:v4@sha256:fea5546e... with NotFound.

zots sync log is unambiguous: failed to get upstream image manifest details, error: manifest not found, repository: someara/hetzner-builder, reference: v4. The daily registry-package-prunerun keeps only the 12-hex build tags on codeberg, sov3andv4` were reaped. Since the 2026-09-02 registries.yaml incident the nodes carry no codeberg credential, so there is no fallback path either. The pin has been in place since 2026-07-30 and last worked for the seanfarm45 release on 08-19.

code.sean.farm is canonical. registry.sean.farm/build/hetzner-builder carries the same lineage and is at v5, so this pins that by digest. build/* sits outside both seanfarm-image-digest-pinned and the Kyverno cosign rule, which scope to registry.sean.farm/seanfarm/*, so no new admission surface.

Note this is a v4 to v5 builder bump, not a like-for-like restore: the exact v4 digest is absent from both registries, so it cannot be recovered.

Found while enabling CONFIG_BLK_DEV_DM for the hcloud CSI driver (sean/linux#45). Separately, kubernetes/flux/infrastructure/node-snapshot-bake in sean/seanfarm still pins the codeberg v3 tag and has the same latent break.

https://claude.ai/code/session_01MdSbMhzabSbpG8TtP9Ur3H

Every kernel release fails at the snapshot bake. Reproduced today on `linux-release-request-gqxn4`: the `bake-snapshot` pod sits in `ImagePullBackOff` on `codeberg.org/someara/hetzner-builder:v4@sha256:fea5546e...` with `NotFound`. zot`s sync log is unambiguous: `failed to get upstream image manifest details, error: manifest not found, repository: someara/hetzner-builder, reference: v4`. The daily `registry-package-prune` run keeps only the 12-hex build tags on codeberg, so `v3` and `v4` were reaped. Since the 2026-09-02 registries.yaml incident the nodes carry no codeberg credential, so there is no fallback path either. The pin has been in place since 2026-07-30 and last worked for the seanfarm45 release on 08-19. code.sean.farm is canonical. `registry.sean.farm/build/hetzner-builder` carries the same lineage and is at `v5`, so this pins that by digest. `build/*` sits outside both `seanfarm-image-digest-pinned` and the Kyverno cosign rule, which scope to `registry.sean.farm/seanfarm/*`, so no new admission surface. Note this is a v4 to v5 builder bump, not a like-for-like restore: the exact v4 digest is absent from both registries, so it cannot be recovered. Found while enabling `CONFIG_BLK_DEV_DM` for the hcloud CSI driver (sean/linux#45). Separately, `kubernetes/flux/infrastructure/node-snapshot-bake` in sean/seanfarm still pins the codeberg `v3` tag and has the same latent break. https://claude.ai/code/session_01MdSbMhzabSbpG8TtP9Ur3H
fix(kernel): pull hetzner-builder from the canonical registry
All checks were successful
pipeline/ci CI green @ 50cf7c0933b4
Details
50cf7c0933
 
Every kernel release has been failing at the snapshot bake since the
codeberg tag disappeared. The promote step pinned
codeberg.org/someara/hetzner-builder:v4, and zot's sync reports
"manifest not found" for it upstream: the daily registry-package-prune
run keeps only the 12-hex build tags on codeberg, so v3 and v4 were
reaped. The nodes carry no codeberg credential by design since the
2026-09-02 registries.yaml incident, so there is no fallback either.

code.sean.farm is canonical. registry.sean.farm/build/hetzner-builder
holds the same lineage and is at v5, so pin that by digest. build/* is
outside the seanfarm-image-digest-pinned policy and the Kyverno cosign
rule, both of which scope to registry.sean.farm/seanfarm/*, so this
pulls without new admission surface.

The exact v4 content is gone from both registries, so this is a v4 -> v5
builder bump and not a like-for-like restore.

kubernetes/flux/infrastructure/node-snapshot-bake in sean/seanfarm still
pins the codeberg v3 tag and has the same latent break.

Claude-Session: https://claude.ai/code/session_01MdSbMhzabSbpG8TtP9Ur3H
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
sean/pipelines!2156
No description provided.