viktor/infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

broker-sync: repoint image to ghcr (was frozen on pre-migration DockerHub)
All checks were successful
ci/woodpecker/push/default Pipeline was successful
Details

Browse source 
The nightly ibkr sync failed with 'No such command ibkr': every broker-sync
CronJob still pulled viktorbarzin/broker-sync:latest from DockerHub, which
nothing has pushed to since the ADR-0002 move to GHA->ghcr on 2026-06-13 —
the jobs were silently running a frozen pre-ibkr build. The migration had
allowlisted only the wealthfolio namespace for the private
ghcr.io/viktorbarzin/wealthfolio-sync image, so broker-sync also lacked
pull credentials. Repoint the image, add ghcr-credentials imagePullSecrets
to all eight CronJobs, and allowlist the broker-sync namespace (wealthfolio
stays — its own monthly sync pulls the same image). Related: code-9ko8.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Viktor Barzin 2026-07-02 05:31:00 +00:00
parent a12b09af04
commit f1e81772d5
2 changed files with 30 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

26
stacks/broker-sync/main.tf
View file

@ -87,7 +87,7 @@ resource "kubernetes_persistent_volume_claim" "data_encrypted" {
}
locals {
broker_sync_image = "viktorbarzin/broker-sync:${var.image_tag}"
broker_sync_image = "ghcr.io/viktorbarzin/wealthfolio-sync:${var.image_tag}"
# Shared env block for every CronJob: auth into Wealthfolio + data path.
common_env = [
@ -123,6 +123,9 @@ resource "kubernetes_cron_job_v1" "version_probe" {
}
spec {
restart_policy = "OnFailure"
image_pull_secrets {
name = "ghcr-credentials"
}
container {
name = "broker-sync"
image = local.broker_sync_image
@ -167,6 +170,9 @@ resource "kubernetes_cron_job_v1" "trading212" {
}
spec {
restart_policy = "OnFailure"
image_pull_secrets {
name = "ghcr-credentials"
}
# Pin every job that mounts the shared RWO data volume to one node:
# cross-node scheduling forced a nightly detach/attach cycle whose
# QMP hotplug intermittently ghost-attaches on disk-heavy VMs and
@ -283,6 +289,9 @@ resource "kubernetes_cron_job_v1" "ibkr" {
}
spec {
restart_policy = "OnFailure"
image_pull_secrets {
name = "ghcr-credentials"
}
# Pin every job that mounts the shared RWO data volume to one node:
# cross-node scheduling forced a nightly detach/attach cycle whose
# QMP hotplug intermittently ghost-attaches on disk-heavy VMs and
@ -423,6 +432,9 @@ resource "kubernetes_cron_job_v1" "imap" {
}
spec {
restart_policy = "OnFailure"
image_pull_secrets {
name = "ghcr-credentials"
}
# Pin every job that mounts the shared RWO data volume to one node:
# cross-node scheduling forced a nightly detach/attach cycle whose
# QMP hotplug intermittently ghost-attaches on disk-heavy VMs and
@ -581,6 +593,9 @@ resource "kubernetes_cron_job_v1" "csv_drop" {
}
spec {
restart_policy = "OnFailure"
image_pull_secrets {
name = "ghcr-credentials"
}
# Pin every job that mounts the shared RWO data volume to one node:
# cross-node scheduling forced a nightly detach/attach cycle whose
# QMP hotplug intermittently ghost-attaches on disk-heavy VMs and
@ -679,6 +694,9 @@ resource "kubernetes_cron_job_v1" "fx_reconcile" {
}
spec {
restart_policy = "OnFailure"
image_pull_secrets {
name = "ghcr-credentials"
}
# Pin every job that mounts the shared RWO data volume to one node:
# cross-node scheduling forced a nightly detach/attach cycle whose
# QMP hotplug intermittently ghost-attaches on disk-heavy VMs and
@ -777,6 +795,9 @@ resource "kubernetes_cron_job_v1" "backup" {
}
spec {
restart_policy = "OnFailure"
image_pull_secrets {
name = "ghcr-credentials"
}
# Pin every job that mounts the shared RWO data volume to one node:
# cross-node scheduling forced a nightly detach/attach cycle whose
# QMP hotplug intermittently ghost-attaches on disk-heavy VMs and
@ -886,6 +907,9 @@ resource "kubernetes_cron_job_v1" "fidelity" {
}
spec {
restart_policy = "OnFailure"
image_pull_secrets {
name = "ghcr-credentials"
}
# Pin every job that mounts the shared RWO data volume to one node:
# cross-node scheduling forced a nightly detach/attach cycle whose
# QMP hotplug intermittently ghost-attaches on disk-heavy VMs and

5
stacks/kyverno/modules/kyverno/ghcr-credentials.tf
View file

@ -22,6 +22,11 @@ locals {
"instagram-poster",
"payslip-ingest",
"wealthfolio",
# broker-sync pulls the same PRIVATE ghcr.io/viktorbarzin/wealthfolio-sync
# image; the ADR-0002 migration only allowlisted the wealthfolio namespace,
# so broker-sync silently kept running the frozen pre-migration DockerHub
# image (its CronJobs lacked pull auth for ghcr).
"broker-sync",
"fire-planner",
"recruiter-responder",
# openclaw's install-recruiter-plugin init container pulls the PRIVATE