jwright/exploded-cluster
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

briefs: fold the second accuracy pass (ITMS, skopeo --all, CVO vs OLM)

Browse Source
This commit is contained in:
Jonathon Wright
2026-08-17 18:58:00 +10:00
parent 7613bfa290
commit 98037d7550
1 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
content/course-VII-supply-chain.md
+4 -2
View File
@@ -37,7 +37,8 @@ limits and egress cost (a hundred nodes should not make a hundred internet pulls
availability (the fleet boots even when upstream is down or the site is disconnected), availability (the fleet boots even when upstream is down or the site is disconnected),
and control (one place to gate, scan and audit what enters). OpenShift formalises the and control (one place to gate, scan and audit what enters). OpenShift formalises the
re-route with image mirror rules - and carries a sharp edge: its digest-mirror rules re-route with image mirror rules - and carries a sharp edge: its digest-mirror rules
rewrite DIGEST pulls only, so a by-tag pull silently skips the mirror. The pinning habit rewrite DIGEST pulls only, so a by-tag pull skips them - UNLESS an ImageTagMirrorSet is also
added (the rule type for tag pulls; corrected 2026-08-17). The pinning habit
from Move 1 is what makes the mirror actually catch the traffic. from Move 1 is what makes the mirror actually catch the traffic.
FIELD NOTE: a mirror can also serve a STALE tag->digest mapping while upstream moved the FIELD NOTE: a mirror can also serve a STALE tag->digest mapping while upstream moved the
tag. Pin by digest and the whole chain becomes content-addressed - the mirror cannot be tag. Pin by digest and the whole chain becomes content-addressed - the mirror cannot be
@@ -52,7 +53,8 @@ layers, never all at once.
The anti-pattern: rebuild the image for each environment ("the prod build"). Every The anti-pattern: rebuild the image for each environment ("the prod build"). Every
rebuild is a different artefact - different digest, different bytes, untested by the rebuild is a different artefact - different digest, different bytes, untested by the
stages before it. The discipline: build ONCE, then PROMOTE the same digest through stages before it. The discipline: build ONCE, then PROMOTE the same digest through
environments by copying (skopeo copy, registry to registry) - dev proves the exact bytes environments by copying (skopeo copy --all --preserve-digests for multi-arch, or the copy takes
one arch and the promoted digest is not the one that lands) - dev proves the exact bytes
prod will run. Human-readable tags ride along (a calendar-plus-revision scheme reads well: prod will run. Human-readable tags ride along (a calendar-plus-revision scheme reads well:
month, year, revision), but the digest is the through-line; promotion never changes it. month, year, revision), but the digest is the through-line; promotion never changes it.
Say it like you mean it: **if the digest changed, it is not a promotion - it is a new Say it like you mean it: **if the digest changed, it is not a promotion - it is a new