feat(zot): seed the registry's own repo and ArgoCD project #106

Merged

binjovi-bot merged 1 commit from feat/zot-repo-seed into trunk 2026-08-31 15:28:17 +00:00

Conversation 0 Commits 1 Files changed 14 +317 -10

sean commented 2026-08-31 14:46:03 +00:00

Owner

Copy link

Migration step S1: the registry (currently sean/pipelines bundle/registry, deployed by ArgoCD Application/registry) gets its own repo and ArgoCD project, following the ory/olly pattern. Working copy staged at ~/src/zot with the full runbook.

What this adds

• gitmirrors/zot.yaml — fleet-standard 3 CRs: ForgejoRepository (creates sean/zot), real-time codeberg push mirror, pipeline-bot grant. No importSource yet: the codeberg backup exists only after the mirror's first delivery; the fleet shape is added later by delete+recreate (the ory.yaml route), and scripts/zot-push.sh is the rebuild path until then.
• zot-argocd/ seed — AppProject zot + repo Secret + root App + webhook. Deliberate differences from the ory seed, documented in-file: no Namespace (the registry bundle owns ns registry), no duplicate ForgejoRepository (gitmirrors owns it), and ClusterSecretStore whitelisted (the bundle defines zot-registry-registry-credentials; a missing whitelist entry is the olly-argocd wedge — the whole sync is rejected and the app sits OutOfSync forever).
• scripts/zot-push.sh — pushes main and trunk (the mirror's branchFilter lists both; a listed-but-missing branch fails the whole mirror push atomically), credential via a git credential helper, never spliced into the URL.
• Seven stale "declared in sean/pipelines" references updated (reloader README also loses its outdated "no Reloader annotation" claim).

Why the child Application is NOT here: Application/registry already exists, born under pipelines-argocd (its tracking-id says so). Unlike ory/olly, a second Application would either fight over the CR or force a resource-level adoption. Instead the one CR is repointed (P1), pinned Prune=false, orphaned (P2), and adopted by zot-argocd (step 7) — no unmanaged-resource window, no restart, Prune=false pinning precedented by the tetragon seed's CRDs.

Expected transient: between this merge and the content push, the root zot-argocd app errors "app path does not exist". Converges at runbook step 4.

Testing: seanfarm tests/check.sh fully green, gitmirror-fleet.sh passes with the 35th member, check-url-credentials.sh clean, both kustomize dirs render.

Merge-order runbook (full version: ~/src/zot/docs/MIGRATION-RUNBOOK.md)

1. Merge pipelines #2119 + #2121 (content snapshot must include them)
2. Merge S1 (this seanfarm seed) → Flux creates sean/zot + AppProject/root
3. Create empty codeberg.org/someara/zot (private) for the push mirror
4. cd ~/src/zot && hack/refresh-from-pipelines.sh (must end byte-identical: OK) → ~/src/seanfarm/scripts/zot-push.sh ~/src/zot
5. Merge pipelines P1 (repoint; re-verify byte-identity immediately before)
6. Merge pipelines P2 (retirement) — then do step 7 immediately
7. Land apps/registry.yaml in sean/zot (content in the runbook) → zot-argocd adopts the CR
8. Follow-ups: verify codeberg backup → add fleet importSource; binjovi onboarding (shadow → soak → protections)

https://claude.ai/code/session_019JVStQiFwbSLGHArU2sA4X

Migration step **S1**: the registry (currently `sean/pipelines` `bundle/registry`, deployed by ArgoCD `Application/registry`) gets its own repo and ArgoCD project, following the ory/olly pattern. Working copy staged at `~/src/zot` with the full runbook. **What this adds** - `gitmirrors/zot.yaml` — fleet-standard 3 CRs: `ForgejoRepository` (creates `sean/zot`), real-time codeberg push mirror, pipeline-bot grant. No `importSource` yet: the codeberg backup exists only after the mirror's first delivery; the fleet shape is added later by delete+recreate (the `ory.yaml` route), and `scripts/zot-push.sh` is the rebuild path until then. - `zot-argocd/` seed — AppProject `zot` + repo Secret + root App + webhook. Deliberate differences from the ory seed, documented in-file: **no Namespace** (the registry bundle owns ns `registry`), **no duplicate ForgejoRepository** (gitmirrors owns it), and **`ClusterSecretStore` whitelisted** (the bundle defines `zot-registry-registry-credentials`; a missing whitelist entry is the olly-argocd wedge — the whole sync is rejected and the app sits OutOfSync forever). - `scripts/zot-push.sh` — pushes `main` **and** `trunk` (the mirror's `branchFilter` lists both; a listed-but-missing branch fails the whole mirror push atomically), credential via a git credential helper, never spliced into the URL. - Seven stale "declared in sean/pipelines" references updated (reloader README also loses its outdated "no Reloader annotation" claim). **Why the child Application is NOT here**: `Application/registry` already exists, born under `pipelines-argocd` (its tracking-id says so). Unlike ory/olly, a second Application would either fight over the CR or force a resource-level adoption. Instead the one CR is repointed (P1), pinned `Prune=false`, orphaned (P2), and adopted by `zot-argocd` (step 7) — no unmanaged-resource window, no restart, `Prune=false` pinning precedented by the tetragon seed's CRDs. **Expected transient**: between this merge and the content push, the root `zot-argocd` app errors "app path does not exist". Converges at runbook step 4. **Testing**: seanfarm `tests/check.sh` fully green, `gitmirror-fleet.sh` passes with the 35th member, `check-url-credentials.sh` clean, both kustomize dirs render. ### Merge-order runbook (full version: `~/src/zot/docs/MIGRATION-RUNBOOK.md`) 1. Merge pipelines **#2119** + **#2121** (content snapshot must include them) 2. Merge **S1** (this seanfarm seed) → Flux creates `sean/zot` + AppProject/root 3. Create empty **codeberg.org/someara/zot** (private) for the push mirror 4. `cd ~/src/zot && hack/refresh-from-pipelines.sh` (must end `byte-identical: OK`) → `~/src/seanfarm/scripts/zot-push.sh ~/src/zot` 5. Merge pipelines **P1** (repoint; re-verify byte-identity immediately before) 6. Merge pipelines **P2** (retirement) — then do step 7 immediately 7. Land `apps/registry.yaml` in sean/zot (content in the runbook) → `zot-argocd` adopts the CR 8. Follow-ups: verify codeberg backup → add fleet `importSource`; binjovi onboarding (shadow → soak → protections) https://claude.ai/code/session_019JVStQiFwbSLGHArU2sA4X

sean added 1 commit 2026-08-31 14:46:03 +00:00

feat(zot): seed the registry's own repo and ArgoCD project ... 9203efda06

Migration step S1 of decoupling the registry from the retiring
sean/pipelines mono-bundle, following the ory/olly pattern (runbook:
sean/zot docs/MIGRATION-RUNBOOK.md, working copy ~/src/zot).

gitmirrors/zot.yaml is the fleet-standard 3-CR home: ForgejoRepository
(creates sean/zot), real-time codeberg push mirror, pipeline-bot grant. No
importSource yet — the codeberg backup does not exist until the mirror's
first delivery; the fleet shape is added by delete+recreate once the backup
is verified, and until then scripts/zot-push.sh is the rebuild path.

zot-argocd/ is the seed: AppProject zot + repo Secret + root Application +
push webhook. Three deliberate differences from the ory seed, documented in
the file: no Namespace object (the registry bundle owns ns registry), no
duplicate ForgejoRepository (gitmirrors owns it), and ClusterSecretStore in
the cluster whitelist (the bundle defines one; missing it is the olly-argocd
wedge). The child Application is NOT created here — it exists already, born
under pipelines-argocd, and is handed over by repoint + Prune=false orphan +
adopt.

zot-push.sh pushes main AND trunk (the mirror's branchFilter lists both and
a listed-but-missing branch fails the whole push atomically) and carries the
credential in a git credential helper, never in the URL
(tests/check-url-credentials.sh).

Seven references saying the registry is declared in sean/pipelines move to
sean/zot; the reloader README also drops its stale "still has no Reloader
annotation" claim (the explicit reload list has been there since the
2026-08-07 fix).

The root App errors with "app path does not exist" between this merge and
the content push — expected, converges at runbook step 4.

Claude-Session: https://claude.ai/code/session_019JVStQiFwbSLGHArU2sA4X

sean changed target branch from main to trunk 2026-08-31 15:18:15 +00:00

binjovi-bot merged commit 9203efda06 into trunk 2026-08-31 15:28:17 +00:00

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

sean/seanfarm!106

No description provided.