Skip to content

fix(e2e): move MinIO/mc to the pgsty fork; preload digest refs via crictl #485

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
perfectra1n merged 1 commit into from
Sep 25, 2026
Merged

fix(e2e): move MinIO/mc to the pgsty fork; preload digest refs via crictl #485

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 17 additions & 4 deletions crates/e2e/mise.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -97,16 +97,29 @@ NODE=kopiur-e2e-control-plane
# kind load chokes on docker's manifest-list store, so import the saved tarball
# straight into the node's containerd k8s.io namespace. Best-effort: pods fall
# back to an in-cluster pull (IfNotPresent) if this fails.
#
# Digest-pinned refs (`name[:tag]@sha256:…`) are pulled through the node's own CRI
# with crictl instead: `docker pull` by digest stores no repo tag, so the saved
# tarball imports NAMELESS and kubelet never matches it — the preload "succeeded"
# while every pod still pulled in-cluster. crictl registers the exact reference
# kubelet resolves; `crictl inspecti` proves it before we claim success.
preload() {
img="$1"
case "$img" in
*@sha256:*)
for attempt in 1 2 3; do docker exec "$NODE" crictl pull "$img" >/dev/null 2>&1 && break; echo " (retry $attempt) $img"; sleep 3; done
docker exec "$NODE" crictl inspecti "$img" >/dev/null 2>&1 \\
&& echo " preloaded $img" || echo " warn: could not preload $img (will pull in-cluster)"
return ;;
esac
for attempt in 1 2 3; do docker pull "$img" >/dev/null 2>&1 && break; echo " (retry $attempt) $img"; sleep 3; done
docker save "$img" | docker exec -i "$NODE" ctr --namespace=k8s.io images import - >/dev/null 2>&1 \\
&& echo " preloaded $img" || echo " warn: could not preload $img (will pull in-cluster)"
}
# quay.io + immutable RELEASE tags: MinIO withdrew these from Docker Hub, where
# they now 404. Lockstep with crates/e2e/src/consts.rs MINIO_IMAGE / MC_IMAGE.
preload quay.io/minio/minio:RELEASE.2025-09-07T16-13-09Z
preload quay.io/minio/mc:RELEASE.2025-08-13T08-35-41Z
# pgsty fork, tag + digest pinned: upstream MinIO withdrew Docker Hub (404) and
# then quay.io (401). Lockstep with crates/e2e/src/consts.rs MINIO_IMAGE / MC_IMAGE.
preload docker.io/pgsty/minio:RELEASE.2026-08-04T00-00-00Z@sha256:b6bfe7239bfc83fb90d31612d9704d86039dd714f7904b3f1ad68f211e602372
preload docker.io/pgsty/mc:RELEASE.2026-09-13T00-00-00Z@sha256:aa5cc1401b3e1ab482d215d5717e9e69b4f14970a3656f330ed20a549fe19020
# Backend servers for the SFTP/WebDAV e2e (mirror crates/e2e/src/consts.rs).
# atmoz/sftp:debian (OpenSSH 9.x) — NOT :alpine (OpenSSH 10.2 hangs kopia's go-ssh).
preload atmoz/sftp:debian
Expand Down
17 changes: 9 additions & 8 deletions crates/e2e/src/consts.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -360,20 +360,21 @@ pub const MINIO_PASS: &str = "minioadmin123";
pub const MINIO_ENDPOINT: &str = "minio.kopiur-e2e.svc.cluster.local:9000";
/// Container image for MinIO (preloaded into the node by `e2e-cluster-up`).
///
/// **quay.io, pinned to an immutable RELEASE tag — not Docker Hub, not `latest`.**
/// MinIO withdrew their images from Docker Hub: `docker.io/minio/minio` now 404s
/// on the Hub API and an in-cluster pull fails with "pull access denied,
/// repository does not exist or may require authorization". That took out every
/// **The `pgsty` community fork on Docker Hub, pinned by tag AND digest.**
/// Upstream MinIO has now pulled its public images twice: first from Docker Hub
/// (`docker.io/minio/minio` 404s), then from quay.io (`quay.io/minio/*` answers
/// 401 to anonymous pulls since 2026-09-24). Each time it took out every
/// S3-backed e2e shard at once, and only after a 420s readiness timeout per
/// attempt, because the preload helper is best-effort and the pods fall back to
/// an in-cluster pull that also fails. quay.io/minio is the upstream's own
/// remaining public registry.
/// an in-cluster pull that also fails. `pgsty/minio` is a drop-in rebuild (same
/// `minio` entrypoint, `/usr/bin/sh` present); the digest pins the exact bytes
/// so a re-tag on a third-party repo cannot change what the suite runs.
///
/// Keep in lockstep with the `preload` lines in `crates/e2e/mise.toml`.
pub const MINIO_IMAGE: &str = "quay.io/minio/minio:RELEASE.2025-09-07T16-13-09Z";
pub const MINIO_IMAGE: &str = "docker.io/pgsty/minio:RELEASE.2026-08-04T00-00-00Z@sha256:b6bfe7239bfc83fb90d31612d9704d86039dd714f7904b3f1ad68f211e602372";
/// Container image for the `mc` client used to create buckets. Same registry and
/// pinning rationale as [`MINIO_IMAGE`].
pub const MC_IMAGE: &str = "quay.io/minio/mc:RELEASE.2025-08-13T08-35-41Z";
pub const MC_IMAGE: &str = "docker.io/pgsty/mc:RELEASE.2026-09-13T00-00-00Z@sha256:aa5cc1401b3e1ab482d215d5717e9e69b4f14970a3656f330ed20a549fe19020";
/// Buckets the bucket-creator Pod ensures (idempotent `mc mb --ignore-existing`).
pub const BUCKETS: &[&str] = &[
"kopiur",
Expand Down