From 1501e0765894f3762102361b2106d47233c043f8 Mon Sep 17 00:00:00 2001 From: Matthew Grossman Date: Mon, 2 Nov 2026 16:18:15 -0800 Subject: [PATCH 1/2] ci(e2e): preload Calico images into kind through the runner mirror The app-listener lanes install Calico into kind. The kind node's containerd pulled the Calico images from Docker Hub anonymously and hit 429 Too Many Requests, failing all four lanes in kind setup. Pull the images on the host instead, where the runner's Docker daemon uses the nv-gha-runners Docker Hub mirror, and load them into kind before applying the manifest. The image list comes from the manifest, so a Calico upgrade cannot add an image that bypasses the preload. Signed-off-by: Matthew Grossman --- .github/actions/setup-e2e-kind/action.yml | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/.github/actions/setup-e2e-kind/action.yml b/.github/actions/setup-e2e-kind/action.yml index 00e8bad876..ce5b37e9d6 100644 --- a/.github/actions/setup-e2e-kind/action.yml +++ b/.github/actions/setup-e2e-kind/action.yml @@ -101,6 +101,19 @@ runs: curl -fsSL https://raw.githubusercontent.com/projectcalico/calico/v3.30.3/manifests/calico.yaml \ -o "$RUNNER_TEMP/calico.yaml" sed 's@192.168.0.0/16@10.244.0.0/16@g' "$RUNNER_TEMP/calico.yaml" > "$RUNNER_TEMP/calico-kind.yaml" + # The kind node's containerd pulls Docker Hub anonymously and is rate + # limited. The host daemon pulls through the runner's registry mirror. + calico_images=$(sed -nE 's/^[[:space:]]*image:[[:space:]]*"?([^"[:space:]]+)"?.*/\1/p' "$RUNNER_TEMP/calico-kind.yaml" | sort -u) + if [ -z "$calico_images" ]; then + echo "ERROR: no images found in the Calico manifest" >&2 + exit 1 + fi + for image in $calico_images; do + archive="$RUNNER_TEMP/calico-$(basename "${image%%:*}")-linux-amd64.tar" + docker pull --platform linux/amd64 "$image" + docker image save --platform linux/amd64 --output "$archive" "$image" + kind load image-archive "$archive" --name "$CLUSTER_NAME" + done kubectl --context "kind-$CLUSTER_NAME" apply -f "$RUNNER_TEMP/calico-kind.yaml" kubectl --context "kind-$CLUSTER_NAME" -n kube-system rollout status daemonset/calico-node --timeout=300s kubectl --context "kind-$CLUSTER_NAME" -n kube-system rollout status deployment/calico-kube-controllers --timeout=300s From b074fc5f5e3058d7d24b10325fdf8353ba841c14 Mon Sep 17 00:00:00 2001 From: Matthew Grossman Date: Mon, 2 Nov 2026 16:23:19 -0800 Subject: [PATCH 2/2] ci(e2e): preload a fixed list of Calico images Name the three Calico images instead of extracting them from the manifest, and define the Calico version once for both the manifest URL and the image tags. Signed-off-by: Matthew Grossman --- .github/actions/setup-e2e-kind/action.yml | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-) diff --git a/.github/actions/setup-e2e-kind/action.yml b/.github/actions/setup-e2e-kind/action.yml index ce5b37e9d6..b4a32a8466 100644 --- a/.github/actions/setup-e2e-kind/action.yml +++ b/.github/actions/setup-e2e-kind/action.yml @@ -78,6 +78,7 @@ runs: shell: bash env: CLUSTER_NAME: ${{ inputs.cluster-name }} + CALICO_VERSION: v3.30.3 run: | set -euo pipefail collect_cni_diagnostics() { @@ -98,18 +99,14 @@ runs: exit "$failure_status" } trap collect_cni_diagnostics ERR - curl -fsSL https://raw.githubusercontent.com/projectcalico/calico/v3.30.3/manifests/calico.yaml \ + curl -fsSL "https://raw.githubusercontent.com/projectcalico/calico/$CALICO_VERSION/manifests/calico.yaml" \ -o "$RUNNER_TEMP/calico.yaml" sed 's@192.168.0.0/16@10.244.0.0/16@g' "$RUNNER_TEMP/calico.yaml" > "$RUNNER_TEMP/calico-kind.yaml" # The kind node's containerd pulls Docker Hub anonymously and is rate # limited. The host daemon pulls through the runner's registry mirror. - calico_images=$(sed -nE 's/^[[:space:]]*image:[[:space:]]*"?([^"[:space:]]+)"?.*/\1/p' "$RUNNER_TEMP/calico-kind.yaml" | sort -u) - if [ -z "$calico_images" ]; then - echo "ERROR: no images found in the Calico manifest" >&2 - exit 1 - fi - for image in $calico_images; do - archive="$RUNNER_TEMP/calico-$(basename "${image%%:*}")-linux-amd64.tar" + for component in cni node kube-controllers; do + image="docker.io/calico/$component:$CALICO_VERSION" + archive="$RUNNER_TEMP/calico-$component-linux-amd64.tar" docker pull --platform linux/amd64 "$image" docker image save --platform linux/amd64 --output "$archive" "$image" kind load image-archive "$archive" --name "$CLUSTER_NAME"