Pull the accounts image from GHCR instead of ECR#25
Draft
aatchison wants to merge 1 commit into
Draft
Conversation
The thunderbird-accounts publish-images.yml pipeline now builds the accounts image as a native multi-arch (amd64 + arm64) manifest list and pushes it to ghcr.io/thunderbird/thunderbird-accounts. The Pro EKS clusters are Graviton (arm64), and the deploy-stage ECR image is amd64-only, so point both overlays at the GHCR multi-arch image. Resolves the arm64 availability gap noted in the tb-prod overlay (platform-infrastructure#593). Both overlays render clean under `kustomize build`. DRAFT: depends on thunderbird/thunderbird-accounts#1087 merging and publishing the GHCR images first. Before merge, pin newTag/digest to a specific published image instead of the interim `latest` placeholder. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Repoints both overlays' Kustomize image transform from ECR to the new multi-arch GHCR image:
Applies to all three accounts deployments (web, celery, flower) via the single
images:transform.Why
thunderbird/thunderbird-accounts#1087 splits image publishing into a standalone pipeline (
publish-images.yml) that builds the accounts image as a native multi-arch (amd64 + arm64) manifest list and pushes it toghcr.io/thunderbird/thunderbird-accounts. The deploy-stage pipeline there was reverted to build an amd64-only image to ECR (for ECS Fargate).The Pro EKS clusters are Graviton/arm64, so they need the multi-arch image — which now lives in GHCR. This directly resolves the arm64 availability note in the tb-prod overlay ("…once available to tb-prod … platform-infrastructure#593").
Blocked on thunderbird/thunderbird-accounts#1087:
publish-images.ymlpipeline must publish the GHCR images.newTag: latestwith a pinned published image (newTag: <sha>ordigest: sha256:…) in both overlays — see theTODO before mergecomments.Validation
Both overlays build clean:
Note on keycloak
This repo deploys accounts only (keycloak-customer is consumed as an external in-cluster service). If the keycloak image deployment lives in another repo, it needs a matching ECR→GHCR change separately — flagging so it isn't missed.
🤖 Generated with Claude Code