From 2379b465b7b9c8860a4d2a9c13d2425c661311b0 Mon Sep 17 00:00:00 2001
From: jgrusewski <jgrusewski@localhost>
Date: Mon, 15 Jun 2026 21:54:52 +0200
Subject: [PATCH] =?UTF-8?q?fix(ci):=20label=20cockpit=20workflow=20pods=20?=
 =?UTF-8?q?part-of=3Dargo-workflows=20so=20MinIO=20ingress=20admits=20them?=
 =?UTF-8?q?=20=E2=86=92=20logs=20ARE=20archived?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Root cause of months-long missing CI logs: MinIO's ingress netpol allows part-of in {foxhunt,foxhunt-ci,
argo-workflows}; the cockpit build/deploy pods carried neither label → MinIO denied the wait-sidecar's
log upload (i/o timeout) → builds errored. Using 'argo-workflows' (not 'foxhunt') admits them to MinIO
WITHOUT triggering argo-base-egress (which would block registry:5000/git:2222). Reverts the earlier
archiveLogs-disable approach — logs are now SAVED, not skipped.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 infra/argo/cockpit-build-deploy.yaml | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/infra/argo/cockpit-build-deploy.yaml b/infra/argo/cockpit-build-deploy.yaml
index 7798edf..287dbdb 100644
--- a/infra/argo/cockpit-build-deploy.yaml
+++ b/infra/argo/cockpit-build-deploy.yaml
@@ -33,7 +33,8 @@ spec:
 
     # --- build: Kaniko builds infra/docker/fxhnt.Dockerfile -> internal registry ---
     - name: kaniko-build
-      archiveLocation: { archiveLogs: false }   # ci-compile-cpu can't reach MinIO; spec-level archiveLogs isn't honored — override per-template so the wait sidecar doesn't fail the build
+      metadata:
+        labels: { app.kubernetes.io/part-of: argo-workflows }   # MinIO ingress allows part-of in {foxhunt,foxhunt-ci,argo-workflows} → log archival works. NOT 'foxhunt' (that adds argo-base-egress which blocks registry:5000/git:2222).
       nodeSelector: { k8s.scaleway.com/pool-name: ci-compile-cpu, topology.kubernetes.io/zone: fr-par-2 }
       tolerations: [{ effect: NoSchedule, key: node.cilium.io/agent-not-ready, operator: Exists }]
       initContainers:
@@ -84,7 +85,8 @@ spec:
 
     # --- deploy: apply manifests from the repo + roll the dashboard to the fresh image ---
     - name: kubectl-deploy
-      archiveLocation: { archiveLogs: false }   # same: don't fail the deploy on the unreachable MinIO log sink
+      metadata:
+        labels: { app.kubernetes.io/part-of: argo-workflows }   # MinIO ingress allow → log archival works (see kaniko-build note)
       nodeSelector: { k8s.scaleway.com/pool-name: platform, topology.kubernetes.io/zone: fr-par-2 }
       serviceAccountName: argo-workflow
       initContainers: