fix(binjovi): run the Hydra client registrars on an arm64-capable image #701

Merged

binjovi-bot merged 1 commit from fix/registrar-arm64-image into trunk

2026-09-13 12:33:12 +00:00

sean commented

2026-09-13 12:32:24 +00:00

Owner

Summary

Every Hydra OAuth client registrar Job in the binjovi namespace has been failing since at least 2026-09-12, all with the same error:

exec /bin/sh: exec format error

registry.sean.farm/someara/pipeline-tools:v8@sha256:6560ba95 is a single-platform linux/amd64 image manifest, not a multi-arch index, and every node in this fleet is arm64. The pod cannot exec anything, so the registrar script never runs and the OAuth client never converges. Fourteen registrars were dead this way. The sibling registrars in argocd, forgejo and ory kept passing only because they use different, multi-arch images.

build/pipeline-tools:v13 is single-platform amd64 as well, so platform-seanfarm-agent-oauth.yaml was equally dead despite already having moved to the house registry. No arm64 build of someara/pipeline-tools exists at any tag.

Repins all fourteen onto build/pipeline-tools:v16 — a real multi-arch manifest list (amd64 + arm64), cosign-signed, carrying curl/jq/bash, and already named as the signed house toolchain by tests/house-helper-images.

Adds a guard to tests/binjovi.sh: any file in this component that registers a Hydra client must pin that exact image and nothing else. The failure mode is invisible in review — a digest looks equally valid whatever it points at — so it needs a contract rather than care.

Deliberately out of scope, each carrying the same dead pin and wanting its own pass: node-snapshot-bake (its digest is asserted by tests/house-helper-images), the retirement tombstones, and the host-service DaemonSets.

Test plan

tests/binjovi.sh — green
Guard verified red/green: reintroducing the dead pin in one registrar fails the guard with the offending image: line, restoring it goes green
no-sigpipe-readers.sh, job-ttl-contract.sh, service-account-references.sh, house-helper-images, image-digest-vap.sh — all green
Live confirmation after deploy: the registrar Jobs reach Complete instead of Failed

https://claude.ai/code/session_01JGe4pyhQ36AhgDfPJry4d3

## Summary Every Hydra OAuth client registrar Job in the `binjovi` namespace has been failing since at least 2026-09-12, all with the same error: ``` exec /bin/sh: exec format error ``` `registry.sean.farm/someara/pipeline-tools:v8@sha256:6560ba95` is a single-platform `linux/amd64` image manifest, not a multi-arch index, and every node in this fleet is `arm64`. The pod cannot exec anything, so the registrar script never runs and the OAuth client never converges. **Fourteen registrars were dead this way.** The sibling registrars in `argocd`, `forgejo` and `ory` kept passing only because they use different, multi-arch images. `build/pipeline-tools:v13` is single-platform amd64 as well, so `platform-seanfarm-agent-oauth.yaml` was equally dead despite already having moved to the house registry. No arm64 build of `someara/pipeline-tools` exists at any tag. Repins all fourteen onto `build/pipeline-tools:v16` — a real multi-arch manifest list (amd64 + arm64), cosign-signed, carrying curl/jq/bash, and already named as the signed house toolchain by `tests/house-helper-images`. Adds a guard to `tests/binjovi.sh`: any file in this component that registers a Hydra client must pin that exact image and nothing else. The failure mode is invisible in review — a digest looks equally valid whatever it points at — so it needs a contract rather than care. **Deliberately out of scope**, each carrying the same dead pin and wanting its own pass: `node-snapshot-bake` (its digest is asserted by `tests/house-helper-images`), the retirement tombstones, and the host-service DaemonSets. ## Test plan - [x] `tests/binjovi.sh` — green - [x] Guard verified red/green: reintroducing the dead pin in one registrar fails the guard with the offending `image:` line, restoring it goes green - [x] `no-sigpipe-readers.sh`, `job-ttl-contract.sh`, `service-account-references.sh`, `house-helper-images`, `image-digest-vap.sh` — all green - [ ] Live confirmation after deploy: the registrar Jobs reach `Complete` instead of `Failed` https://claude.ai/code/session_01JGe4pyhQ36AhgDfPJry4d3

sean added 1 commit

2026-09-13 12:32:24 +00:00

fix(binjovi): run the Hydra client registrars on an arm64-capable image

binjovi/ci Binjovi completed the frozen plan

Details

4275e99676

Every Hydra OAuth client registrar Job in the binjovi namespace has been
failing since at least 2026-09-12, all with the same error:

    exec /bin/sh: exec format error

registry.sean.farm/someara/pipeline-tools:v8@sha256:6560ba95 is a
single-platform linux/amd64 image manifest, not a multi-arch index, and
every node in this fleet is arm64. The pod cannot exec anything, so the
registrar script never runs and the OAuth client never converges. Fourteen
registrars were dead this way; the sibling registrars in argocd, forgejo and
ory kept passing only because they use different, multi-arch images.

build/pipeline-tools:v13 is single-platform amd64 as well, so
platform-seanfarm-agent-oauth.yaml was equally dead despite already having
moved to the house registry. No arm64 build of someara/pipeline-tools exists
at any tag.

Repins all fourteen onto build/pipeline-tools:v16, which is a real multi-arch
manifest list (amd64 + arm64), is cosign-signed, carries curl/jq/bash, and is
already named as the signed house toolchain by tests/house-helper-images.

Adds a guard to tests/binjovi.sh: any file in this component that registers a
Hydra client must pin that exact image and nothing else. The failure mode is
invisible in review -- a digest looks equally valid whatever it points at --
so it needs a contract rather than care.

Deliberately out of scope: node-snapshot-bake (its digest is asserted by
tests/house-helper-images), the retirement tombstones, and the host-service
DaemonSets, which carry the same dead pin and want their own pass.

Claude-Session: https://claude.ai/code/session_01JGe4pyhQ36AhgDfPJry4d3