Skip to content

patch-containerd Secret is rendered from registries.mirrors but has no consumer #4006

New issue
New issue
Closed
#5190
Closed
patch-containerd Secret is rendered from registries.mirrors but has no consumer#4006
#5190
Labels
area/platformIssues or PRs related to platform infrastructure (bundle, flux, talos, installer)kind/bugCategorizes issue or PR as related to a bugpriority/backlogGeneral backlog priority. Lower than priority/important-longtermtriage/acceptedIndicates an issue is ready to be actively worked on

Description

@lexfrei
Aleksei Sviridkin (lexfrei)
opened on Sep 1, 2026

packages/core/platform/templates/containerd-registry-secret.yaml still renders a Secret named patch-containerd into cozy-system from .Values.registries.mirrors, gated on that value being non-empty. Nothing in the tree reads it. The only other reference is packages/apps/kubernetes/README.md, which says the Secret was removed.

So an operator in a restricted-egress environment sets registries.mirrors, watches a Secret appear in cozy-system, and gets no mirroring. The values key is still advertised, the artifact is still produced, and the effect is gone.

Two ways out. Wire it to the Talos machineconfig so the key does what it claims, or delete the template and the values key together. Either works. What is there now does not.

The README needs a fix whichever way it goes, since it currently documents the opposite of what the tree does.

Related: #3950, which covers the same registry channel from the tenant side.

Activity

  1. github-actions
    added
    triage/needs-triageIndicates an issue needs triage by a maintainer
    on Sep 1, 2026
  2. Aleksei Sviridkin (lexfrei)
    added
    kind/bugCategorizes issue or PR as related to a bug
    area/platformIssues or PRs related to platform infrastructure (bundle, flux, talos, installer)
    triage/acceptedIndicates an issue is ready to be actively worked on
    priority/backlogGeneral backlog priority. Lower than priority/important-longterm
    and removed
    triage/needs-triageIndicates an issue needs triage by a maintainer
    on Sep 23, 2026

  3. kvaps commented on Oct 20, 2026

    @kvaps
    Andrei Kvapil (kvaps)
    on Oct 20, 2026
    Member

    Same on v1.6: workers there are already Talos, so registries.mirrors does nothing on release-1.6 either, and #4897 fixes it on main only. On v1.6 there is also no per-cluster way to mirror container images for workers, talos.registryMirrors first appears in v1.7.0-alpha.1 (#3575).

    So for v1.6 we need a backport to release-1.6, or at least a warning on render when registries.mirrors is set, so it doesn't fail silently.

    ref cozystack/website#743

  4. myasnikovdaniil
    added a commit that references this issue on Nov 9, 2026

    fix(platform): remove the dead registries value and patch-containerd …

    91f03dd
  5. myasnikovdaniil
    closed this as completedin #5190on Nov 9, 2026
  6. myasnikovdaniil
    added a commit that references this issue on Nov 10, 2026

    fix(platform): remove the dead registries value and patch-containerd …

    95bb0ea
  7. cozystack-ci
    added a commit that references this issue on Nov 12, 2026

    fix(platform): remove the dead registries value and patch-containerd …

    d3986c4
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    area/platformIssues or PRs related to platform infrastructure (bundle, flux, talos, installer)kind/bugCategorizes issue or PR as related to a bugpriority/backlogGeneral backlog priority. Lower than priority/important-longtermtriage/acceptedIndicates an issue is ready to be actively worked on

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions