fix(workspace-minio): sovereign digest pin + clear the permanent OutOfSync - #1135
Merged
Conversation
…fSync - image: minio/minio:latest -> pinned @sha256:14cea493... (the release live at pin time). A moving :latest tag re-pulls unpredictably and can never be reproduced; digest is immutable. Sovereign follow-up: mirror into registry.socioprophet.ai. - p0-lab overlay requested a 20Gi PVC while the live volume is 100Gi. A PVC can grow but never shrink, so ws-workspace-minio was stuck OutOfSync (storage: can not be less than status.capacity). Held at 100Gi to match.
Contributor
There was a problem hiding this comment.
Pull request overview
Note
Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.
Hardens the workspace MinIO deployment by making it reproducible (digest pin) and fixing a persistent ArgoCD/Kustomize drift caused by an attempted PVC shrink in the p0-lab overlay.
Changes:
- Pin
minio/minioimage from moving:latesttag to an immutable@sha256digest. - Align
p0-laboverlay PVC storage request to100Gito match the already-provisioned volume and clear permanent OutOfSync. - Add inline comments documenting the PVC shrink limitation and planned registry mirroring follow-up.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| infra/k8s/workspace-minio/overlays/p0-lab/kustomization.yaml | Updates PVC patch to request 100Gi (prevents drift) and documents why. |
| infra/k8s/workspace-minio/base/deployment.yaml | Pins MinIO image to an immutable digest for reproducible rollouts. |
Comments suppressed due to low confidence (1)
infra/k8s/workspace-minio/overlays/p0-lab/kustomization.yaml:1
- This patch target matches all
PersistentVolumeClaimresources in the rendered output (it only filters bykind). If the base (now or later) includes additional PVCs, they will also be forced to100Giunexpectedly. Tighten the selector by addingname: workspace-minio-pvc(or the correct PVC name) and/or alabelSelectorso only the intended claim is modified.
apiVersion: kustomize.config.k8s.io/v1beta1
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+17
to
+21
| # Pinned to an immutable digest (was minio/minio:latest — a moving tag that re-pulls | ||
| # unpredictably and can never be reproduced). This digest == the release running live at | ||
| # pin time. Sovereign follow-up: mirror into registry.socioprophet.ai via the | ||
| # fogstack-registry publication workflow and repoint here (tracked in the PR). | ||
| image: minio/minio@sha256:14cea493d9a34af32f524e538b8346cf79f3321eff8e708c1e2960462bd8936e |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Live-path hardening for the sovereign workspace plane (mail/cal/drive is running in `ns/socioprophet` off zot; MinIO was the one gap).
Two live issues, both fixed
minio/minio:latest→ immutable digest. A moving:latesttag re-pulls unpredictably and can never be reproduced (our moving-tag/IfNotPresent trap). Pinned to@sha256:14cea493…, which is the release running live at pin time — zero behavior change, just reproducibility.ws-workspace-miniowas permanently OutOfSync. Thep0-laboverlay requested a 20Gi PVC while the live volume is 100Gi. A PVC can grow but never shrink, so every sync failed withstorage: can not be less than status.capacity. Overlay held at 100Gi to match, with a comment so it can't regress.Verified
kubectl kustomize overlays/p0-labrendersstorage: 100Gi+ the digest-pinned image.imageID.Sovereign follow-up (separate PR)
Mirror MinIO into
registry.socioprophet.aivia thefogstack-registrypublication workflow and repoint the image, so the last Docker Hub dependency in the workspace plane is closed. Tracked as part of the progressive-delivery / convergence workstream.🤖 Generated with Claude Code