Repository navigation
Registry: pin distribution 3.1.1 — 3.0.0 signs default_credentials as a shared key - #3710
Merged
Merged
Conversation
… a shared key On the first real deploy of the fleet registry (memex-cloud, 2026-09-08) both registry pods stayed 0/1: the storage health check logged `403 AuthenticationFailed … including the signature` — the shared-key error — although the config says `credentials.type: default_credentials` and the pod carried the workload identity correctly. Root cause is upstream: distribution v3.0.0's azure driver (`auth.go`, `newClient`) dispatches CredentialsTypeDefault together with CredentialsTypeSharedKey to the shared-key client, signing every request with an empty account key. v3.1.0 routes it to the token client (DefaultAzureCredential). Verified by reading both tags' source. - deploy/helm/values.registry.example.yaml, values.yaml, _registry.tpl: the pin is ghcr.io/distribution/distribution:3.1.1@sha256:bca24727… (multi-arch index digest, `crane digest`) — the image that is live. - ContainerRegistryInMemex.md: one paragraph stating the floor (≥ 3.1.0) and the symptom the next reader will recognise. - What's New: a Fix entry. Refs #3697, #3353, Systemorph/Memex#248. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
The changes are a consistent pin/documentation update across chart examples, required hints, and docs, with no functional code changes and no inconsistencies found in the updated references.
Pull request overview
Pins the Helm chart’s optional in-cluster container registry to a distribution version that correctly uses workload identity (credentials.type: default_credentials) for Azure storage auth, and documents the minimum supported distribution version to prevent non-ready registry pods in real deployments.
Changes:
- Bump pinned distribution image reference from 3.0.0 to 3.1.1 (example values + required-value hint + documented reference).
- Document the minimum distribution version (≥ 3.1.0) and the observed failure mode on 3.0.0.
- Add a “What’s New” Fix entry capturing the operator-visible impact.
File summaries
| File | Description |
|---|---|
| src/MeshWeaver.Documentation/Data/WhatsNew/2026-09-08-registry-pins-distribution-3-1-1.md | Adds a Fix entry describing the readiness failure on 3.0.0 and the new 3.1.1 pin. |
| src/MeshWeaver.Documentation/Data/Architecture/ContainerRegistryInMemex.md | Updates the design doc’s referenced registry image to 3.1.1 and documents the ≥3.1.0 floor for workload identity auth. |
| deploy/helm/values.yaml | Updates the commented, digest-pinned distribution image reference to 3.1.1. |
| deploy/helm/values.registry.example.yaml | Updates the example overlay’s distribution image pin to 3.1.1. |
| deploy/helm/templates/registry/_registry.tpl | Updates the required-error hint to reflect the 3.1.1 digest-pinned image shape. |
Review details
- Files reviewed: 5/5 changed files
- Comments generated: 0
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Contributor
Contributor
Contributor
Contributor
Contributor
Contributor
Contributor
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The measured defect
On the first real deploy of the fleet registry (memex-cloud, 2026-09-08, Systemorph/Memex#248) both registry pods stayed
0/1: the storage health check logged403 AuthenticationFailed … including the signature— the shared-key error — although the rendered config sayscredentials.type: default_credentialsand the pod carried the workload identity correctly.Root cause is upstream. distribution v3.0.0's
registry/storage/driver/azure/auth.go(newClient) dispatchesCredentialsTypeDefaulttogether withCredentialsTypeSharedKeytonewSharedKeyCredentialsClient— an empty account key, signed. v3.1.0 routes it tonewTokenClient(DefaultAzureCredential). Verified by reading both tags' source.The change
deploy/helm/values.registry.example.yaml,values.yaml(comment),templates/registry/_registry.tpl(therequiredhint): the pin isghcr.io/distribution/distribution:3.1.1@sha256:bca24727f4002e51f959c18c42e816e4d1078198081a9837e16b8b7d7e43ebf8(multi-arch index digest,crane digest) — the image that is live.Doc/Architecture/ContainerRegistryInMemex→ "The registry as a separate service": one paragraph stating the floor (default_credentialsneeds distribution ≥ 3.1.0) with the symptom in one line.Category: Fixentry (an operator enabling the registry on 3.0.0 gets pods that never become ready).Verified locally
deploy/aks/scripts/check-chart-invariants.sh: all 5 combinations render, including "AKS overlay + the fleet registry" with the example values. CI runs nohelm lint.dotnet build test/MeshWeaver.Documentation.Test -c Release -warnaserror: 0 warnings, 0 errors; the Documentation DLL postdates the edits and carriesdistribution:3.1.1(1), the floor paragraph (1), the new entry (2) anddistribution:3.0.0(0).DocumentationLinkIntegrityTest,WhatsNewEntryIntegrityTest,DocumentationEmbedIntegrityTestwith--no-build: 12/12 passed, fresh.trx.Pairs-with: none — chart example and docs only
Refs #3697, #3353, Systemorph/Memex#248.
🤖 Generated with Claude Code