Mirror factory update

Status: draft — content will evolve as procedures are finalized.

Step-by-step procedure for refreshing mirrors and registries in the connected environment.

Pre-flight

• Confirm change window and notify stakeholders.
• Verify available storage for package and image snapshots.
• Ensure temporary egress/proxy rules are in place if required.

Execution

1. Snapshot current mirror state and record digests.
2. Update package mirrors (aptly, debmirror, reposync, or pulp) and wheel caches.
3. Refresh base container images and push to the internal registry under staging tags.
4. Run validation jobs from Nodepool nodes to ensure only internal endpoints are used.

Post-flight

• Freeze updated manifests and publish BOM deltas.
• Rotate staging tags into stable namespaces after validation succeeds.
• Close temporary egress paths and archive logs in results storage.