From c35dac2cd904fda5c5a86d3b8190d9f1811f8f16 Mon Sep 17 00:00:00 2001 From: Tim Huff Date: Tue, 23 Jun 2026 10:40:29 -0700 Subject: [PATCH 1/2] Derive edge image registry from single ecrRegistry value The edge-endpoint and inference-server image references hardcoded the GL_Public ECR host (767397850842.dkr.ecr.us-west-2.amazonaws.com) independently, alongside the existing ecrRegistry value already used for the registry-credentials pull secret. Collapse all three onto the single ecrRegistry value so the registry host has one source of truth. No behavior change: ecrRegistry still defaults to the GL_Public host, so the rendered image strings are byte-identical. This sets up a later switch to derive the registry per environment from upstreamEndpoint once the dedicated Axon edge ECR accounts exist. Co-authored-by: Cursor --- .../files/inference-deployment-template.yaml | 2 +- .../templates/edge-deployment.yaml | 2 +- deploy/helm/groundlight-edge-endpoint/values.yaml | 6 ++++++ 3 files changed, 8 insertions(+), 2 deletions(-) diff --git a/deploy/helm/groundlight-edge-endpoint/files/inference-deployment-template.yaml b/deploy/helm/groundlight-edge-endpoint/files/inference-deployment-template.yaml index a70bd4d51..230a180e2 100644 --- a/deploy/helm/groundlight-edge-endpoint/files/inference-deployment-template.yaml +++ b/deploy/helm/groundlight-edge-endpoint/files/inference-deployment-template.yaml @@ -48,7 +48,7 @@ spec: containers: - name: inference-server - image: 767397850842.dkr.ecr.us-west-2.amazonaws.com/gl-edge-inference{{ if .Values.useMinimalImage }}-minimal{{ end }}:{{ include "groundlight-edge-endpoint.inferenceTag" . }} + image: {{ .Values.ecrRegistry }}/gl-edge-inference{{ if .Values.useMinimalImage }}-minimal{{ end }}:{{ include "groundlight-edge-endpoint.inferenceTag" . }} imagePullPolicy: "{{ include "groundlight-edge-endpoint.inferencePullPolicy" . }}" env: - name: MODEL_REPOSITORY diff --git a/deploy/helm/groundlight-edge-endpoint/templates/edge-deployment.yaml b/deploy/helm/groundlight-edge-endpoint/templates/edge-deployment.yaml index a02828ef5..57e732313 100644 --- a/deploy/helm/groundlight-edge-endpoint/templates/edge-deployment.yaml +++ b/deploy/helm/groundlight-edge-endpoint/templates/edge-deployment.yaml @@ -61,7 +61,7 @@ spec: serviceAccountName: edge-endpoint-service-account initContainers: - name: generate-tls-cert - image: &edgeEndpointImage 767397850842.dkr.ecr.us-west-2.amazonaws.com/edge-endpoint:{{ include "groundlight-edge-endpoint.edgeEndpointTag" . }} + image: &edgeEndpointImage {{ .Values.ecrRegistry }}/edge-endpoint:{{ include "groundlight-edge-endpoint.edgeEndpointTag" . }} imagePullPolicy: "{{ include "groundlight-edge-endpoint.edgeEndpointPullPolicy" . }}" volumeMounts: - name: nginx-certs diff --git a/deploy/helm/groundlight-edge-endpoint/values.yaml b/deploy/helm/groundlight-edge-endpoint/values.yaml index cd51cffaf..7d5ffcae4 100644 --- a/deploy/helm/groundlight-edge-endpoint/values.yaml +++ b/deploy/helm/groundlight-edge-endpoint/values.yaml @@ -80,6 +80,12 @@ s3Mount: mountPath: "/opt/groundlight/edge/pinamod-mount" cachePath: "/opt/groundlight/edge/pinamod-cache" +# Registry host for the edge-endpoint and inference-server images and for the +# registry-credentials pull secret. Single source of truth for all three. +# Defaults to the legacy GL_Public account. Edge artifacts are migrating to +# dedicated per-environment Axon accounts; once those exist this should be derived +# from upstreamEndpoint instead of hardcoded. +# TODO: derive per environment from upstreamEndpoint when the dev/prod edge ECRs are live (see edge artifacts migration plan). ecrRegistry: "767397850842.dkr.ecr.us-west-2.amazonaws.com" # This sets the log level for all the containers, both edge endpoint and inference. From 2fea57307290114ca0823d894614f5461653c929 Mon Sep 17 00:00:00 2001 From: Tim Huff Date: Tue, 23 Jun 2026 11:00:07 -0700 Subject: [PATCH 2/2] Resolve edge image registry from upstreamEndpoint via chart-local map Build the registry-switching seam now rather than deferring it. A chart-local ecrRegistryMap keys the ECR image base (registry host plus optional repo prefix) off upstreamEndpoint, the signal edge installs already provide, so no new install argument is introduced. Two helpers consume it: ecrRegistry (full image base, for the edge-endpoint and inference images) and ecrRegistryHost (host portion only, for the registry-credentials pull secret docker-server, which keys on the host). An explicit ecrRegistry value still overrides the map, and upstreams absent from the map fall back to the prod (api.groundlight.ai) entry, so self-hosted installs are unaffected. No behavior change: the only map entry points at the GL_Public host, so the default and fallback both render the byte-identical image strings as before. When the dedicated Axon edge ECR accounts exist (aws-global #371), adding their host plus the edge/ repo prefix (and jetson repo naming) to the map flips the switch as a data-only change. Co-authored-by: Cursor --- .../files/inference-deployment-template.yaml | 2 +- .../files/init-aws-access-apply.sh | 2 +- .../templates/_helpers.tpl | 29 +++++++++++++++++++ .../templates/edge-deployment.yaml | 2 +- .../groundlight-edge-endpoint/values.yaml | 28 +++++++++++++----- 5 files changed, 53 insertions(+), 10 deletions(-) diff --git a/deploy/helm/groundlight-edge-endpoint/files/inference-deployment-template.yaml b/deploy/helm/groundlight-edge-endpoint/files/inference-deployment-template.yaml index 230a180e2..f9566d3b2 100644 --- a/deploy/helm/groundlight-edge-endpoint/files/inference-deployment-template.yaml +++ b/deploy/helm/groundlight-edge-endpoint/files/inference-deployment-template.yaml @@ -48,7 +48,7 @@ spec: containers: - name: inference-server - image: {{ .Values.ecrRegistry }}/gl-edge-inference{{ if .Values.useMinimalImage }}-minimal{{ end }}:{{ include "groundlight-edge-endpoint.inferenceTag" . }} + image: {{ include "groundlight-edge-endpoint.ecrRegistry" . }}/gl-edge-inference{{ if .Values.useMinimalImage }}-minimal{{ end }}:{{ include "groundlight-edge-endpoint.inferenceTag" . }} imagePullPolicy: "{{ include "groundlight-edge-endpoint.inferencePullPolicy" . }}" env: - name: MODEL_REPOSITORY diff --git a/deploy/helm/groundlight-edge-endpoint/files/init-aws-access-apply.sh b/deploy/helm/groundlight-edge-endpoint/files/init-aws-access-apply.sh index 933237e6d..e3befe520 100644 --- a/deploy/helm/groundlight-edge-endpoint/files/init-aws-access-apply.sh +++ b/deploy/helm/groundlight-edge-endpoint/files/init-aws-access-apply.sh @@ -37,7 +37,7 @@ kubectl create secret generic aws-credentials-file --from-file /shared/credentia --dry-run=client -o yaml | kubectl apply -f - kubectl create secret docker-registry registry-credentials \ - --docker-server={{ .Values.ecrRegistry }} \ + --docker-server={{ include "groundlight-edge-endpoint.ecrRegistryHost" . }} \ --docker-username=AWS \ --docker-password="$(cat /shared/token.txt)" \ --dry-run=client -o yaml | kubectl apply -f - diff --git a/deploy/helm/groundlight-edge-endpoint/templates/_helpers.tpl b/deploy/helm/groundlight-edge-endpoint/templates/_helpers.tpl index 6bf2be9e8..ff3ed8c26 100644 --- a/deploy/helm/groundlight-edge-endpoint/templates/_helpers.tpl +++ b/deploy/helm/groundlight-edge-endpoint/templates/_helpers.tpl @@ -88,6 +88,35 @@ Create the name of the service account to use {{- .Values.inferenceTag | default .Values.imageTag }} {{- end }} +{{/* + Resolve the edge image base (ECR registry host plus optional repo prefix) for the + configured upstreamEndpoint. Edge installs pass upstreamEndpoint as the single + "which environment" signal, so the registry is derived from it via + .Values.ecrRegistryMap rather than a separate argument. An explicit + .Values.ecrRegistry overrides the map; upstreams absent from the map fall back to + the prod (api.groundlight.ai) entry so existing self-hosted installs keep pulling + from GL_Public. The result is prepended to each image repo name, so it never ends + with a slash. +*/}} +{{- define "groundlight-edge-endpoint.ecrRegistry" -}} +{{- if .Values.ecrRegistry -}} +{{- .Values.ecrRegistry -}} +{{- else -}} +{{- $map := .Values.ecrRegistryMap -}} +{{- $default := index $map "https://api.groundlight.ai" -}} +{{- index $map .Values.upstreamEndpoint | default $default -}} +{{- end -}} +{{- end -}} + +{{/* + The registry host portion of the resolved image base (everything before the first + "/"). Image pull secrets key on the registry host, so the registry-credentials + docker-server must use this rather than the full image base. +*/}} +{{- define "groundlight-edge-endpoint.ecrRegistryHost" -}} +{{- include "groundlight-edge-endpoint.ecrRegistry" . | splitList "/" | first -}} +{{- end -}} + {{/* Determine the correct pull policy to use for each container type. If it is a dev tag, we use "Never" to avoid pulling from the registry. Otherwise, diff --git a/deploy/helm/groundlight-edge-endpoint/templates/edge-deployment.yaml b/deploy/helm/groundlight-edge-endpoint/templates/edge-deployment.yaml index 57e732313..0e81c8059 100644 --- a/deploy/helm/groundlight-edge-endpoint/templates/edge-deployment.yaml +++ b/deploy/helm/groundlight-edge-endpoint/templates/edge-deployment.yaml @@ -61,7 +61,7 @@ spec: serviceAccountName: edge-endpoint-service-account initContainers: - name: generate-tls-cert - image: &edgeEndpointImage {{ .Values.ecrRegistry }}/edge-endpoint:{{ include "groundlight-edge-endpoint.edgeEndpointTag" . }} + image: &edgeEndpointImage {{ include "groundlight-edge-endpoint.ecrRegistry" . }}/edge-endpoint:{{ include "groundlight-edge-endpoint.edgeEndpointTag" . }} imagePullPolicy: "{{ include "groundlight-edge-endpoint.edgeEndpointPullPolicy" . }}" volumeMounts: - name: nginx-certs diff --git a/deploy/helm/groundlight-edge-endpoint/values.yaml b/deploy/helm/groundlight-edge-endpoint/values.yaml index 7d5ffcae4..f5275bad7 100644 --- a/deploy/helm/groundlight-edge-endpoint/values.yaml +++ b/deploy/helm/groundlight-edge-endpoint/values.yaml @@ -80,13 +80,27 @@ s3Mount: mountPath: "/opt/groundlight/edge/pinamod-mount" cachePath: "/opt/groundlight/edge/pinamod-cache" -# Registry host for the edge-endpoint and inference-server images and for the -# registry-credentials pull secret. Single source of truth for all three. -# Defaults to the legacy GL_Public account. Edge artifacts are migrating to -# dedicated per-environment Axon accounts; once those exist this should be derived -# from upstreamEndpoint instead of hardcoded. -# TODO: derive per environment from upstreamEndpoint when the dev/prod edge ECRs are live (see edge artifacts migration plan). -ecrRegistry: "767397850842.dkr.ecr.us-west-2.amazonaws.com" +# Edge image registry resolution. +# +# Edge installs already pass upstreamEndpoint as the single "which environment" +# signal, so the ECR image base is derived from it via ecrRegistryMap rather than a +# separate install argument. The resolved value is the registry host plus an optional +# repo prefix, and is the single source of truth for all three image layers: the +# edge-endpoint image, the inference image, and the docker-server of the +# registry-credentials pull secret (which uses just the host portion of the base). +# +# Every entry currently points at the legacy GL_Public account, so behavior is +# unchanged. When the dedicated Axon edge ECR accounts exist (aws-global #371), add +# their entries here (host plus the `edge/` repo prefix, and jetson repo naming) and +# the switch becomes a data-only change. Upstreams not in the map fall back to the +# prod (api.groundlight.ai) entry, so existing self-hosted installs keep pulling from +# GL_Public. +ecrRegistryMap: + "https://api.groundlight.ai": "767397850842.dkr.ecr.us-west-2.amazonaws.com" + +# Explicit override / escape hatch for self-hosted or unmapped upstreams. When set, +# it wins over ecrRegistryMap. Leave empty to derive from upstreamEndpoint. +ecrRegistry: "" # This sets the log level for all the containers, both edge endpoint and inference. logLevel: "INFO"