fix(stand): per-cluster registry IP + dedicated image-build target

Parallel stands each get their own /24 hashed off NAME (e.g. e2e1 →
10.16.0.0/24, e2e2 → 10.79.0.0/24, ...). The blockstor-controller
and blockstor-satellite manifests hardcoded 10.164.0.1:5000 — that
was the bridge IP of a single past cluster, so as soon as a second
stand came up the VMs couldn't pull the images (ImagePullBackOff,
dial tcp 10.164.0.1:5000: i/o timeout).

Switch to a placeholder __REGISTRY__ in the deploy YAMLs; install-
blockstor.sh now reads any node's InternalIP, derives the bridge
gateway (.1 of the /24), and substitutes the placeholder before
applying. up.sh's Talos registry-trust patch follows the same
pattern so containerd accepts plain HTTP to that mirror.

Also add stand/build-images.sh + `make build-images` so the
controller / satellite images can be rebuilt and pushed to
localhost:5000 in a single step — needed whenever the source moves
(e.g. the cmd/controller path change in fab5137 left the registry
image with the stale ENTRYPOINT ["/manager"]).

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>

Author: kvaps

stand/Makefile

@@ -13,7 +13,7 @@ KUBECONFIG := $(WORK_DIR)/kubeconfig
 export TALOSCONFIG
 export KUBECONFIG
 
-.PHONY: stand-help up down reset piraeus oracle blockstor pools smoke smoke-blockstor burnin-blockstor e2e e2e-list use list stand-clean
+.PHONY: stand-help up down reset piraeus oracle build-images blockstor pools smoke smoke-blockstor burnin-blockstor e2e e2e-list use list stand-clean
 
 stand-help: ## list dev-stand targets
 	@echo "stand targets (use NAME=<cluster>):"
@@ -34,6 +34,9 @@ piraeus: ## install piraeus-operator + linstor-csi (NAME=<n>)
 oracle: ## install Java LINSTOR controller as in-cluster oracle (NAME=<n>)
 	@./stand/install-oracle.sh "$(WORK_DIR)"
 
+build-images: ## build + push blockstor/blockstor-satellite to localhost:5000 (shared across all stands)
+	@./stand/build-images.sh
+
 blockstor: ## install blockstor CRDs + controller + satellites (NAME=<n>)
 	@./stand/install-blockstor.sh "$(WORK_DIR)"
 

stand/blockstor-deploy.yaml

@@ -70,7 +70,7 @@ spec:
       serviceAccountName: blockstor-controller
       containers:
         - name: manager
-          image: 10.164.0.1:5000/blockstor:dev
+          image: __REGISTRY__/blockstor:dev
           imagePullPolicy: Always
           args:
             - --rest-bind-address=:3370

stand/blockstor-satellite-daemonset.yaml

@@ -50,7 +50,7 @@ spec:
                   - {key: node-role.kubernetes.io/control-plane, operator: DoesNotExist}
       containers:
         - name: satellite
-          image: 10.164.0.1:5000/blockstor-satellite:dev
+          image: __REGISTRY__/blockstor-satellite:dev
           imagePullPolicy: Always
           args:
             # drbd's /etc/drbd.conf includes /etc/drbd.d/*.res, so the

stand/build-images.sh

@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+#
+# usage: build-images.sh [REGISTRY]
+#
+# Build the controller + satellite container images from the current
+# checkout and push them to the host's local Docker registry. The
+# blockstor-deploy.yaml / blockstor-satellite-daemonset.yaml on the
+# stand pull these via the per-cluster bridge gateway (see
+# install-blockstor.sh) but the underlying registry is a single
+# host-local one — so we push once and every parallel stand sees it.
+
+set -euo pipefail
+
+REGISTRY=${1:-localhost:5000}
+REPO_ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
+cd "$REPO_ROOT"
+
+echo ">> docker build $REGISTRY/blockstor:dev (controller stage)"
+docker build --target controller -t "$REGISTRY/blockstor:dev" .
+
+echo ">> docker build $REGISTRY/blockstor-satellite:dev (satellite stage)"
+docker build --target satellite  -t "$REGISTRY/blockstor-satellite:dev" .
+
+echo ">> docker push $REGISTRY/blockstor:dev"
+docker push "$REGISTRY/blockstor:dev"
+
+echo ">> docker push $REGISTRY/blockstor-satellite:dev"
+docker push "$REGISTRY/blockstor-satellite:dev"
+
+echo ">> images ready"

stand/install-blockstor.sh

@@ -13,9 +13,13 @@
 #   3. apply blockstor-satellite-daemonset.yaml
 #   4. wait for controller + satellites Running
 #
-# Assumes the host registry on 10.164.0.1:5000 is reachable from the
-# cluster (Talos config-patch trusts http for that mirror — see
-# stand/up.sh).
+# Assumes the host registry is reachable from the cluster on the
+# bridge gateway (.1 of this cluster's NET_CIDR). Talos config-patch
+# trusts http for that mirror — see stand/up.sh. The deploy manifests
+# carry an `__REGISTRY__` placeholder which this script substitutes
+# with the actual bridge IP, computed from the first node's
+# InternalIP — this is how parallel stands on the same host all see
+# the same registry-on-host without colliding on a single IP.
 
 set -euo pipefail
 
@@ -24,14 +28,20 @@ export KUBECONFIG="$WORK_DIR/kubeconfig"
 
 REPO_ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
 
+# Bridge gateway = .1 of the cluster CIDR. Read it off any node's
+# InternalIP (Talos VMs all live in the same /24 as the host bridge).
+NODE_IP=$(kubectl get nodes -o jsonpath='{.items[0].status.addresses[?(@.type=="InternalIP")].address}')
+REGISTRY="${NODE_IP%.*}.1:5000"
+echo ">> using host registry at $REGISTRY"
+
 echo ">> apply CRDs"
 kubectl apply -f "$REPO_ROOT/config/crd/bases/" 2>&1 | tail -5
 
 echo ">> apply controller + RBAC"
-kubectl apply -f "$REPO_ROOT/stand/blockstor-deploy.yaml" 2>&1 | tail -5
+sed "s|__REGISTRY__|$REGISTRY|g" "$REPO_ROOT/stand/blockstor-deploy.yaml" | kubectl apply -f - 2>&1 | tail -5
 
 echo ">> apply satellite DaemonSet"
-kubectl apply -f "$REPO_ROOT/stand/blockstor-satellite-daemonset.yaml" 2>&1 | tail -5
+sed "s|__REGISTRY__|$REGISTRY|g" "$REPO_ROOT/stand/blockstor-satellite-daemonset.yaml" | kubectl apply -f - 2>&1 | tail -5
 
 echo ">> wait for controller Running"
 kubectl -n blockstor-system rollout status deploy/blockstor-controller --timeout=120s

stand/up.sh

@@ -106,15 +106,17 @@ machine:
       - name: dm_thin_pool
       - name: dm_snapshot
       - name: dm_crypt
-  # Trust the host-side Docker registry on 10.164.0.1:5000 via plain
-  # HTTP. The blockstor-controller / blockstor-satellite images we
-  # build live there; without this patch containerd refuses to pull
-  # them ("http: server gave HTTP response to HTTPS client").
+  # Trust the host-side Docker registry on the bridge gateway (.1 of
+  # this cluster's NET_CIDR) via plain HTTP. The blockstor-controller
+  # / blockstor-satellite images we build live there; without this
+  # patch containerd refuses to pull them ("http: server gave HTTP
+  # response to HTTPS client"). The bridge IP varies per cluster
+  # because parallel stands each get their own /24, hashed off NAME.
   registries:
     mirrors:
-      "10.164.0.1:5000":
+      "${NET_CIDR%.*}.1:5000":
         endpoints:
-          - "http://10.164.0.1:5000"
+          - "http://${NET_CIDR%.*}.1:5000"
         skipFallback: true
 YAML