331baaef

backup: a job that moved registries needs the credential to match

a73x 2026-09-05 19:02

Commit message

backup: a job that moved registries needs the credential to match

Baking sqlite in moved the nightly backup off Docker Hub and onto the
plane's own registry, but the CronJob kept the pull spec it had when its
image was public. A missing imagePullSecret is not an apply-time error, so
the manifest was accepted and the failure was scheduled for 03:20 instead:
ImagePullBackOff, no backup, and nothing watching. It now pulls with the
same regcred every other workload on the plane uses.

RETRO.md

Old		New
@@ -92,3 +92,10 @@ One line per push to `main`: what slowed the work down. Enforced by
92	requirement had never been exercised — stg proved nine stages and still could	92	requirement had never been exercised — stg proved nine stages and still could
93	not have caught this. A plane-specific config gate is only proven on the plane	93	not have caught this. A plane-specific config gate is only proven on the plane
94	that sets it.	94	that sets it.
		95	- Backup pull secret: baking sqlite in moved the job's image from Docker Hub to
		96	the plane's own registry, and the manifest kept the pull spec it had when the
		97	image was public. Nothing failed at apply time — a CronJob validates fine with
		98	no credential — so the break would have surfaced at 03:20 as an
		99	ImagePullBackOff nobody was watching, which is the exact failure the change
		100	set out to end. A workload that changes registries changes its auth, and only
		101	running the job proves it.

deploy/server/backup-cronjob.yaml

Old		New
@@ -14,6 +14,13 @@ spec:
14	template:	14	template:
15	spec:	15	spec:
16	restartPolicy: Never	16	restartPolicy: Never
		17	# The image moved from Docker Hub to the plane's own registry when
		18	# sqlite was baked into it, and a private registry needs the same
		19	# credential every other workload here pulls with. Without this the
		20	# job fails on ImagePullBackOff at 03:20 with nobody watching, which
		21	# is the failure mode baking sqlite in was meant to end.
		22	imagePullSecrets:
		23	- name: regcred
17	nodeSelector:	24	nodeSelector:
18	kubernetes.io/hostname: ${NODE_NAME}	25	kubernetes.io/hostname: ${NODE_NAME}
19	containers:	26	containers: