From 98037d7550af701c3fe62f25e2388585912629ac Mon Sep 17 00:00:00 2001 From: jwright Date: Mon, 17 Aug 2026 18:58:00 +1000 Subject: [PATCH] briefs: fold the second accuracy pass (ITMS, skopeo --all, CVO vs OLM) --- content/course-VII-supply-chain.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/content/course-VII-supply-chain.md b/content/course-VII-supply-chain.md index 57621a8..3dba690 100644 --- a/content/course-VII-supply-chain.md +++ b/content/course-VII-supply-chain.md @@ -37,7 +37,8 @@ limits and egress cost (a hundred nodes should not make a hundred internet pulls availability (the fleet boots even when upstream is down or the site is disconnected), and control (one place to gate, scan and audit what enters). OpenShift formalises the re-route with image mirror rules - and carries a sharp edge: its digest-mirror rules -rewrite DIGEST pulls only, so a by-tag pull silently skips the mirror. The pinning habit +rewrite DIGEST pulls only, so a by-tag pull skips them - UNLESS an ImageTagMirrorSet is also +added (the rule type for tag pulls; corrected 2026-08-17). The pinning habit from Move 1 is what makes the mirror actually catch the traffic. FIELD NOTE: a mirror can also serve a STALE tag->digest mapping while upstream moved the tag. Pin by digest and the whole chain becomes content-addressed - the mirror cannot be @@ -52,7 +53,8 @@ layers, never all at once. The anti-pattern: rebuild the image for each environment ("the prod build"). Every rebuild is a different artefact - different digest, different bytes, untested by the stages before it. The discipline: build ONCE, then PROMOTE the same digest through -environments by copying (skopeo copy, registry to registry) - dev proves the exact bytes +environments by copying (skopeo copy --all --preserve-digests for multi-arch, or the copy takes +one arch and the promoted digest is not the one that lands) - dev proves the exact bytes prod will run. Human-readable tags ride along (a calendar-plus-revision scheme reads well: month, year, revision), but the digest is the through-line; promotion never changes it. Say it like you mean it: **if the digest changed, it is not a promotion - it is a new