diff --git a/clientdocs/sweep-receipt.txt b/clientdocs/sweep-receipt.txt index 6786fbb..7273d25 100644 --- a/clientdocs/sweep-receipt.txt +++ b/clientdocs/sweep-receipt.txt @@ -26,8 +26,8 @@ 840ce47dbff4987121ced9d16fc606fe5240b4820b367a0c44f4e838811197e6 clientdocs/tenant-skill/SKILL.md c7708c35d1d5fceab763268f6a10ed214e23e9458018b115cb944b6a3168f182 clientdocs/tenant-skill/references/ci-automation.md 42c8dc4f451befdba2fb8f75e9023255ae65698f81af7b7273c0b5a1291ec555 clientdocs/tenant-skill/references/day2-operations.md -92bb1c715b5e5220b38ff749d2479eee460b36194ca2e431227591bacf3d6b1a clientdocs/tenant-skill/references/kubernetes.md -e129181d12c9f778b85fe20c22f24fe05a5c1a2b8a3eba275f60292342c99d8f clientdocs/tenant-skill/references/troubleshooting.md +7a253a17f7499c614ccf6ab23d94c940b7c1b37c7e48b7c9960c3bb53a390674 clientdocs/tenant-skill/references/kubernetes.md +e3de5c8af90464c62fc9e754116f8962021788b1d285a7dc717e620445e6ca8a clientdocs/tenant-skill/references/troubleshooting.md 3e13aaf7987c952c0970ce1126d7de93514165bf027b46a01925a34a2963f2e1 clientdocs/welcome.md e00900e6d08d19c195edee6cab5d8198295a35371cd6333a50ca5ad28940b129 docs/tenant-onboarding-contract.md 64f99b638a1855b02180e907c9535db8bddc5847a502759a9e0d63c513b63077 policies/domain-manager-policy.yaml diff --git a/clientdocs/tenant-skill/references/kubernetes.md b/clientdocs/tenant-skill/references/kubernetes.md index 9954298..74b480b 100644 --- a/clientdocs/tenant-skill/references/kubernetes.md +++ b/clientdocs/tenant-skill/references/kubernetes.md @@ -117,6 +117,29 @@ `-cluster` account (see the trap above), so it is passed at cluster create time instead, exactly as the lifecycle section shows. +## Images: bring your own registry + +The platform does NOT host a container registry. Push your application +images to a registry you control -- a public one (Docker Hub, GitHub/ +GitLab, Quay) or your own private one. The cluster reaches registries +over the internet (it pulls its own system images the same way), so a +PUBLIC image needs nothing extra. + +For a PRIVATE registry, create an image-pull secret in the cluster and +reference it from the Deployment: + + kubectl create secret docker-registry regcred \ + --docker-server= --docker-username= \ + --docker-password= --docker-email= + + # then in the Deployment pod spec: + # imagePullSecrets: + # - name: regcred + +Inject the registry password at pipeline run time from the CI secret +store -- never in a manifest in a repository. Full detail: the Jenkins + +Kubernetes Implementation Guide, section 5.0. + ## Deploying workloads: Services of type LoadBalancer The cluster gets its own load balancer for the Kubernetes API, and it diff --git a/clientdocs/tenant-skill/references/troubleshooting.md b/clientdocs/tenant-skill/references/troubleshooting.md index 05dec85..c86f0c2 100644 --- a/clientdocs/tenant-skill/references/troubleshooting.md +++ b/clientdocs/tenant-skill/references/troubleshooting.md @@ -78,6 +78,11 @@ free capacity right now, even if it is within quota -- NOT a quota problem, and a quota raise will not help. Use a smaller node count or a smaller flavor; start small (1 control + 1-2 workers) and scale up. +- Pod stuck `ImagePullBackOff` / `ErrImagePull`: the cluster cannot pull + the image. Check the image name and tag first; if it is in a PRIVATE + registry, create an image-pull secret and reference it from the + Deployment (Kubernetes reference, "Images: bring your own registry"). + The platform hosts no registry -- push to one you control. - Subnet create rejected for overlap: pick a range that does not collide with `{{TENANT_SHORT_NAME}}-subnet` or your other networks. - Network delete refused: it still has ports -- delete the servers diff --git a/docs/session-ledger.md b/docs/session-ledger.md index fbfd645..f7720ff 100644 --- a/docs/session-ledger.md +++ b/docs/session-ledger.md @@ -456,6 +456,13 @@ source lib-net. Operator decision needed before wiring client-critical scripts. - S8c (provider-bundle-check.py restates plane CIDRs): DEFERRED -- design change (python can't source bash -- needs a generated/parsed form). +- **DONE -- DOCFIX-135 (addendum 51): tenant AI skill registry gap.** devteam asked + (via the assistant) if there's a registry setup step; the DOCFIX-130 registry + content was not mirrored into the skill (grep found zero). Added "Images: bring + your own registry" to references/kubernetes.md + ImagePullBackOff signature to + references/troubleshooting.md; skill harness 8/8, gauntlet 39/39; package skill + files re-instantiated. Committed + pushed. (Skill-lag class; watch for it on + future guide changes.) - **S-CLASS BATCH STATUS:** DONE = S7, S4, S8a (DOCFIX-132/133/134). HELD/DEFERRED = S8b, S8c, and S1/S2/S3/S5 (lib-validate adoption -- until DOCFIX-126/127 live-verify). S6 was ruled no-action earlier. Next operator decision: S8b/S8c diff --git a/docs/v1-redeploy-changelog.md b/docs/v1-redeploy-changelog.md index 1475413..3eace91 100644 --- a/docs/v1-redeploy-changelog.md +++ b/docs/v1-redeploy-changelog.md @@ -3336,4 +3336,25 @@ form since python cannot source bash). REVERT: git checkout HEAD~ -- scripts/lib-net.sh scripts/phase-04-network-create.sh scripts/phase-04-network-verify.sh docs/v1-redeploy-changelog.md docs/session-ledger.md. -Next-free after this push (per scan, keep this line unwrapped): D-076, DOCFIX-135, BUNDLEFIX-012. +### 2026-07-08 (addendum 51, jumphost stream) -- DOCFIX-135: tenant AI skill registry gap aligned to DOCFIX-130 + +devteam (via the AI assistant) asked whether there is a registry setup step. The +DOCFIX-130 guide addition (no platform registry; bring-your-own; private-registry +imagePullSecret) had NOT been mirrored into the tenant skill -- grep of +clientdocs/tenant-skill/ returned zero registry content. Same skill-lag class as +DOCFIX-129. Additive, leak-clean, no new token: +- references/kubernetes.md: new "Images: bring your own registry" section (platform + hosts no registry; public pulls work; private-registry `kubectl create secret + docker-registry` + imagePullSecrets; secret injected at CI run time; pointer to + the Jenkins+K8s Implementation Guide section 5.0). +- references/troubleshooting.md: new ImagePullBackOff/ErrImagePull signature under + section 4 (known failure signatures). +- Skill harness 8/8 (T3 leak, T4 placeholder set unchanged, T6 ASCII); gauntlet + 39/39; repo-lint 0 fail; L7 receipt re-recorded. +- Package re-instantiated: ~/devteam-package/tenant-skill/references/{kubernetes, + troubleshooting}.md (devteam + live-measured AUTH_URL tokens; registry content + present; zero leftover tokens). +- Numbers consumed: DOCFIX-135. +REVERT: git checkout HEAD~ -- clientdocs/tenant-skill/references/kubernetes.md clientdocs/tenant-skill/references/troubleshooting.md clientdocs/sweep-receipt.txt docs/v1-redeploy-changelog.md docs/session-ledger.md; then bash scripts/repo-lint.sh --record-clientdocs-sweep; re-instantiate the package skill files. + +Next-free after this push (per scan, keep this line unwrapped): D-076, DOCFIX-136, BUNDLEFIX-012.