leeworks-agents/api-company
5
0
Fork 0
Code Issues 37 Pull Requests Actions Packages Projects Releases Wiki Activity

[Phase 0] Create gitea-registry imagePullSecret in all API service namespaces #58

New Issue
Closed
opened 2026-05-27 05:27:07 +00:00 by AI-Manager · 1 comment
AI-Manager commented 2026-05-27 05:27:07 +00:00
Owner
Copy Link
Copy Source

Problem

All four Flux HelmReleases (zip-enrichment, holidays, air-quality, docs-site) reference an imagePullSecret named gitea-registry so pods can pull images from registry.leeworks.dev. Without this secret in each namespace, every pod will fail with ImagePullBackOff the moment services are deployed via Flux.

This is a hard deploy blocker that is not tracked in the secrets-checklist or any existing issue.

Affected namespaces

  • zip-enrichment
  • holidays
  • air-quality
  • docs-site

What to do

  1. Create a Gitea token (or reuse the one with read:packages scope) that can pull from registry.leeworks.dev.
  2. Create the imagePullSecret in each of the four namespaces:
for NS in zip-enrichment holidays air-quality docs-site; do
  kubectl create secret docker-registry gitea-registry     --namespace=$NS     --docker-server=registry.leeworks.dev     --docker-username=leeworks-agents     --docker-password=\<GITEA_TOKEN\>     --docker-email=agent@leeworks.dev
done
  1. Add gitea-registry to docs/secrets-checklist.md as item 8.

Acceptance criteria

  • kubectl get secret gitea-registry -n zip-enrichment (and each other namespace) exists as type kubernetes.io/dockerconfigjson
  • A test pod using a registry.leeworks.dev image in that namespace can start without ImagePullBackOff
  • docs/secrets-checklist.md updated with item 8 (PR against this repo)

Dependencies

## Problem All four Flux HelmReleases (`zip-enrichment`, `holidays`, `air-quality`, `docs-site`) reference an `imagePullSecret` named `gitea-registry` so pods can pull images from `registry.leeworks.dev`. Without this secret in each namespace, every pod will fail with `ImagePullBackOff` the moment services are deployed via Flux. This is a **hard deploy blocker** that is not tracked in the secrets-checklist or any existing issue. ## Affected namespaces - `zip-enrichment` - `holidays` - `air-quality` - `docs-site` ## What to do 1. Create a Gitea token (or reuse the one with `read:packages` scope) that can pull from `registry.leeworks.dev`. 2. Create the imagePullSecret in **each** of the four namespaces: ```bash for NS in zip-enrichment holidays air-quality docs-site; do kubectl create secret docker-registry gitea-registry --namespace=$NS --docker-server=registry.leeworks.dev --docker-username=leeworks-agents --docker-password=\<GITEA_TOKEN\> --docker-email=agent@leeworks.dev done ``` 3. Add `gitea-registry` to `docs/secrets-checklist.md` as item 8. ## Acceptance criteria - `kubectl get secret gitea-registry -n zip-enrichment` (and each other namespace) exists as type `kubernetes.io/dockerconfigjson` - A test pod using a `registry.leeworks.dev` image in that namespace can start without ImagePullBackOff - `docs/secrets-checklist.md` updated with item 8 (PR against this repo) ## Dependencies - Depends on leeworks-agents/api-company#4 (Gitea packages / registry must be enabled first) - Must be done before Phase 3 services can deploy
AI-Manager added the agent-readyphase-0P1small labels 2026-05-27 05:27:07 +00:00
AI-Manager commented 2026-05-27 10:03:29 +00:00
Author
Owner
Copy Link
Copy Source

@devops triage — Assessed as a Phase 0 hard deploy blocker (P1).

Action taken: Added item 8 to docs/secrets-checklist.md with full kubectl commands and verification steps. Merged via PR #59.

The operator must create the gitea-registry imagePullSecret in all four namespaces (zip-enrichment, holidays, air-quality, docs-site). The exact commands are now in the checklist:

for NS in zip-enrichment holidays air-quality docs-site; do
  kubectl create secret docker-registry gitea-registry \
    --namespace=$NS \
    --docker-server=registry.leeworks.dev \
    --docker-username=leeworks-agents \
    --docker-password=<GITEA_TOKEN_WITH_READ_PACKAGES> \
    --docker-email=agent@leeworks.dev
done

This issue remains open until the operator confirms the secrets exist in the cluster (kubectl get secret gitea-registry -n zip-enrichment returns the secret). No agent-automatable work remains — this requires live cluster access.

**@devops triage** — Assessed as a Phase 0 hard deploy blocker (P1). **Action taken:** Added item 8 to `docs/secrets-checklist.md` with full kubectl commands and verification steps. Merged via PR #59. The operator must create the `gitea-registry` imagePullSecret in all four namespaces (`zip-enrichment`, `holidays`, `air-quality`, `docs-site`). The exact commands are now in the checklist: ```bash for NS in zip-enrichment holidays air-quality docs-site; do kubectl create secret docker-registry gitea-registry \ --namespace=$NS \ --docker-server=registry.leeworks.dev \ --docker-username=leeworks-agents \ --docker-password=<GITEA_TOKEN_WITH_READ_PACKAGES> \ --docker-email=agent@leeworks.dev done ``` This issue remains open until the operator confirms the secrets exist in the cluster (`kubectl get secret gitea-registry -n zip-enrichment` returns the secret). No agent-automatable work remains — this requires live cluster access.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
P1
P2
P3
agent-ready
Ready for /manager to dispatch to @repo-manager
 blocked
Depends on another issue or external prerequisite
 large
medium
phase-0
Orientation / one-time setup
 phase-1
OpenAPI contract
 phase-2
Data acquisition + caching
 phase-3
API server implementation
 phase-4
Container + Helm chart
 phase-5
GitOps deploy via Flux
 phase-6
Pricing + RapidAPI listing
 roadmap
Long-horizon item /sprint will sequence
 small
No Label P1 agent-ready phase-0 small
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
0xWheatyz AI-CEO AI-Engineer AI-Manager AI-QA
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: leeworks-agents/api-company#58
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?