michal/mcpctl
1
0
Fork 0
Code Issues Pull Requests 7 Actions Packages Projects Releases Wiki Activity

fix(gitea): pin rebuilt image by digest, match upstream CMD form #123

Merged
michal merged 1 commits from fix/gitea-mcp-digest-pin into main 2026-08-21 16:07:32 +00:00
Conversation 0 Commits 1 Files Changed 1 +12 -5
michal commented 2026-08-21 16:07:24 +00:00
Owner
Copy Link

Copying from :latest meant a rebuild could silently ship a different version — indistinguishable from a broken rebuild. Pinned to sha256:dda8d56e (= the running 1.6.0).

Also CMD instead of ENTRYPOINT, matching upstream: mcpd maps a servers command to k8s args, which replaces Cmd but only appends to an ENTRYPOINT.

Verified: gitea healthy on secretDelivery: injector, get_me returns the real account, and plaintext credentials across all mcpctl server pod specs are now 4 -> 0.

Copying from `:latest` meant a rebuild could silently ship a different version — indistinguishable from a broken rebuild. Pinned to sha256:dda8d56e (= the running 1.6.0). Also CMD instead of ENTRYPOINT, matching upstream: mcpd maps a servers `command` to k8s `args`, which replaces Cmd but only appends to an ENTRYPOINT. Verified: gitea healthy on secretDelivery: injector, get_me returns the real account, and plaintext credentials across all mcpctl server pod specs are now 4 -> 0.
michal added 1 commit 2026-08-21 16:07:24 +00:00
fix(gitea): pin the rebuilt image by digest and match upstream's CMD form
Some checks failed
CI/CD / lint (pull_request) Successful in 1m17s
Details
CI/CD / typecheck (pull_request) Successful in 2m39s
Details
CI/CD / test (pull_request) Successful in 1m27s
Details
CI/CD / build (pull_request) Successful in 2m28s
Details
CI/CD / smoke (pull_request) Failing after 3m4s
Details
CI/CD / publish (pull_request) Has been skipped
Details
c16d7964c9 
Two corrections to the shell-bearing rebuild.

**Pin by digest.** It copied from `:latest`, so a rebuild silently ships
whatever upstream has moved to. When a probe started failing right after a
rebuild I could not tell a version change from a broken build, and burned
time on the wrong one — the binary's own `--version` prints 1.1.0 while
the image label says 1.6.0, so that was a red herring too. Now pinned to
sha256:dda8d56e…, which IS the running 1.6.0.

**CMD, not ENTRYPOINT.** Upstream sets `Cmd: ["/app/gitea-mcp"]` with no
entrypoint. mcpd maps a server's `command` to k8s `args`, which REPLACES
Cmd but only APPENDS to an ENTRYPOINT — so the ENTRYPOINT form would have
changed how the binary is invoked for any server that sets a command.
Matching upstream's shape keeps the non-injected path byte-identical.

gitea also needs `entrypoint` on its server row: its `command` is [], so
there is nothing for the injector wrapper to wrap without it. Set to
["/usr/local/bin/gitea-mcp"] via apply -f (patch cannot express an array).

Verified live: gitea RUNNING/healthy on secretDelivery: injector, with
vault-agent-init present and the command wrapped as
  ["/bin/sh","-c",". /vault/secrets/gitea-creds; exec \"$0\" \"$@\"",
   "/usr/local/bin/gitea-mcp"]
`get_me` — which needs read:user, the scope that started this whole
session — returns the real account. Plaintext credentials across all
mcpctl server pod specs: 4 -> 0.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018vybEitX4FykeMatKe5Xki
michal merged commit 9c5d0d1861 into main 2026-08-21 16:07:32 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
michal
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: michal/mcpctl#123
Delete Branch "fix/gitea-mcp-digest-pin"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?