Fold the deployshed ingresses into their charts, keep nip.io for Harbor

Argo CD and Harbor each had a standalone Ingress serving the real domain
while their charts still served nip.io. Both charts now own their real
hostname directly, so the standalone objects are removed — extra-manifests
syncs the directory with prune, so deleting the files deletes the objects.

harbor-ingress-legacy-nipio.yaml is the inverse of the file it replaces.
Harbor's chart now serves harbor.infra.deployshed.com with a Let's Encrypt
certificate, and this object serves the old nip.io name with the private CA
the chart used to use. It has to exist: apps deployed before the move
recorded harbor.35.238.248.203.nip.io image references in toolshed's
database and in already-rendered pod specs, and nothing in git can rewrite
those — they change only when each app is rebuilt. Until then a pod that
restarts, reschedules or scales up pulls the old reference, and if the name
stops resolving that pull fails looking like a broken registry rather than a
retired hostname. It retires together with the registry-ca manifests and
Terraform's node-pool trust.

harbor-robot-dockerconfig lists both hostnames. Docker matches stored
credentials by exact host and nothing else, so a single-value swap breaks
whichever side lands second: change the credential first and the pipeline
pushes unauthenticated, change the pipeline first and the same happens in
reverse. Two entries make the order irrelevant — it is one robot account on
one Harbor reached by two names.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LEsTefWWifp4ikvhHF5s6N

This commit is contained in:

Mukul Sharma

2026-09-17 09:32:33 +05:30

co-authored by

Claude Opus 5

parent 5a008ffa08

commit 1e8cc7a028

5 changed files with 112 additions and 137 deletions

									
										values/incubator-infra-gke-toolshed-prd-usc1-values.yaml
									
		+1
		-1
	
												View File
												
				@@ -51,7 +51,7 @@ appSpec:

				    valuesDir: gitea

				  - name: contour

				    # The cluster's only inbound path, pinned to the reserved IP that every

				    # nip.io hostname is built from. Installed by ArgoCD rather than by

				    # deployshed.com record resolves to. Installed by ArgoCD rather than by

				    # hand, which is only possible because nothing in the bootstrap needed

				    # an ingress: ArgoCD reaches Gitea over cluster DNS.

				    nameOverride: contour