viktor/infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

broker-sync: repoint image to ghcr (was frozen on pre-migration DockerHub)
All checks were successful
ci/woodpecker/push/default Pipeline was successful
Details

Browse source 
The nightly ibkr sync failed with 'No such command ibkr': every broker-sync
CronJob still pulled viktorbarzin/broker-sync:latest from DockerHub, which
nothing has pushed to since the ADR-0002 move to GHA->ghcr on 2026-06-13 —
the jobs were silently running a frozen pre-ibkr build. The migration had
allowlisted only the wealthfolio namespace for the private
ghcr.io/viktorbarzin/wealthfolio-sync image, so broker-sync also lacked
pull credentials. Repoint the image, add ghcr-credentials imagePullSecrets
to all eight CronJobs, and allowlist the broker-sync namespace (wealthfolio
stays — its own monthly sync pulls the same image). Related: code-9ko8.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Viktor Barzin 2026-07-02 05:31:00 +00:00
parent a12b09af04
commit f1e81772d5
2 changed files with 30 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

5
stacks/kyverno/modules/kyverno/ghcr-credentials.tf
View file

@ -22,6 +22,11 @@ locals {
"instagram-poster",
"payslip-ingest",
"wealthfolio",
# broker-sync pulls the same PRIVATE ghcr.io/viktorbarzin/wealthfolio-sync
# image; the ADR-0002 migration only allowlisted the wealthfolio namespace,
# so broker-sync silently kept running the frozen pre-migration DockerHub
# image (its CronJobs lacked pull auth for ghcr).
"broker-sync",
"fire-planner",
"recruiter-responder",
# openclaw's install-recruiter-plugin init container pulls the PRIVATE