Move the serving Zot registry and registrar to ARM

sean commented

2026-09-10 21:53:48 +00:00

Owner

Select ARM workers for Zot and the Hydra client registrar. Pin the registrar to the verified multi-architecture pipeline-tools v16 image, and let the image warm-up hook tolerate the same node taint as Zot. Keep the existing portable Hetzner data claim; Kubernetes replaces only the temporary sync cache. Update the RustFS and ARM move documentation.

Validation: the warm-up taint regression failed before the fix; all repository checks now pass. The exact Zot and Alpine images ran successfully on the ARM worker before this move. The prior ARM canary verified RustFS reads and scoped OCI writes. The deployment will verify the volume attachment, ARM registrar, readiness, and authenticated write/read gate.

The native CI run also exposed two PyYAML imports after the shared validator update. Both checks now read JSON from the existing yq tool; their assertions and negative controls are unchanged. All repository checks pass locally, including those controls. The exact pipeline-tools v16 image also completed kubectl, curl and jq checks on the ARM worker as UID 65532 with a read-only root filesystem.

Select ARM workers for Zot and the Hydra client registrar. Pin the registrar to the verified multi-architecture pipeline-tools v16 image, and let the image warm-up hook tolerate the same node taint as Zot. Keep the existing portable Hetzner data claim; Kubernetes replaces only the temporary sync cache. Update the RustFS and ARM move documentation. Validation: the warm-up taint regression failed before the fix; all repository checks now pass. The exact Zot and Alpine images ran successfully on the ARM worker before this move. The prior ARM canary verified RustFS reads and scoped OCI writes. The deployment will verify the volume attachment, ARM registrar, readiness, and authenticated write/read gate. The native CI run also exposed two PyYAML imports after the shared validator update. Both checks now read JSON from the existing yq tool; their assertions and negative controls are unchanged. All repository checks pass locally, including those controls. The exact pipeline-tools v16 image also completed kubectl, curl and jq checks on the ARM worker as UID 65532 with a read-only root filesystem.

sean added 1 commit

2026-09-10 21:53:48 +00:00