Fix image pull/build failures on restricted egress clusters.

Use seeded abrban/ images instead of flaky proxy-gcr pulls, fix Kaniko dockerfile path for v1.27, correct docker auth host keys, route /v2/abrban/ through harbor-core, and prefer abrban/ for base images.

Co-authored-by: Cursor <cursoragent@cursor.com>

gitops/harbor/registry-ingress.yaml

@@ -0,0 +1,124 @@
+# registry.abrban.com — Traefik path split
+#
+# Proxy-cache projects (proxy-dockerhub, proxy-gcr, …) MUST hit harbor-core so
+# Harbor can pull upstream on demand. harbor-registry only stores blobs; it does
+# not run proxy-cache logic → 404 for uncached proxy paths.
+#
+# Direct pushes (abrban/, rook/) stay on harbor-registry where Kaniko/skopeo
+# wrote the blobs.
+#
+# Apply: kubectl apply -f gitops/harbor/registry-ingress.yaml
+
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: registry
+  namespace: cloudhost
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.middlewares: cloudhost-long-timeout@kubernetescrd
+spec:
+  ingressClassName: traefik
+  tls:
+    - hosts:
+        - registry.abrban.com
+      secretName: abrban-wildcard-tls
+  rules:
+    - host: registry.abrban.com
+      http:
+        paths:
+          # ── Proxy-cache (harbor-core serves v2 + on-demand upstream pull) ──
+          - path: /v2/proxy-dockerhub/
+            pathType: Prefix
+            backend:
+              service:
+                name: harbor-core
+                port:
+                  number: 80
+          - path: /v2/proxy-gcr/
+            pathType: Prefix
+            backend:
+              service:
+                name: harbor-core
+                port:
+                  number: 80
+          - path: /v2/proxy-quay/
+            pathType: Prefix
+            backend:
+              service:
+                name: harbor-core
+                port:
+                  number: 80
+          - path: /v2/proxy-k8s/
+            pathType: Prefix
+            backend:
+              service:
+                name: harbor-core
+                port:
+                  number: 80
+          - path: /v2/proxy-gitea/
+            pathType: Prefix
+            backend:
+              service:
+                name: harbor-core
+                port:
+                  number: 80
+          # ── abrban/rook project images (served by harbor-core; required for k3s mirror pulls) ──
+          - path: /v2/abrban/
+            pathType: Prefix
+            backend:
+              service:
+                name: harbor-core
+                port:
+                  number: 80
+          - path: /v2/rook/
+            pathType: Prefix
+            backend:
+              service:
+                name: harbor-core
+                port:
+                  number: 80
+          # ── Legacy registry (platform images pre-Harbor) ──
+          - path: /v2/
+            pathType: Prefix
+            backend:
+              service:
+                name: registry
+                port:
+                  number: 5000
+          # ── Harbor UI / API ──
+          - path: /api/
+            pathType: Prefix
+            backend:
+              service:
+                name: harbor-core
+                port:
+                  number: 80
+          - path: /service/
+            pathType: Prefix
+            backend:
+              service:
+                name: harbor-core
+                port:
+                  number: 80
+          - path: /c/
+            pathType: Prefix
+            backend:
+              service:
+                name: harbor-core
+                port:
+                  number: 80
+          - path: /chartrepo/
+            pathType: Prefix
+            backend:
+              service:
+                name: harbor-core
+                port:
+                  number: 80
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: harbor-portal
+                port:
+                  number: 80

gitops/jobs/seed-ci-images.yaml

@@ -48,8 +48,15 @@ spec:
               skopeo copy --dest-tls-verify=false --dest-creds="${CREDS}" \
                 docker://docker.io/library/node:24-alpine \
                 "${DEST}/node:24-alpine"
-              # v1.27.6-debug does not exist on gcr.io — use v1.23.2 (matches platform values).
               skopeo copy --dest-tls-verify=false --dest-creds="${CREDS}" \
-                docker://gcr.io/kaniko-project/executor:v1.23.2 \
+                docker://docker.io/library/node:20-alpine \
+                "${DEST}/node:20-alpine"
+              # Tag present in Harbor abrban/ — seed via proxy-gcr (see seed-ci-images.yaml).
+              skopeo copy --dest-tls-verify=false --dest-creds="${CREDS}" \
+                docker://registry.abrban.com/proxy-gcr/kaniko-project/executor:v1.23.2 \
                 "${DEST}/kaniko-executor:v1.23.2"
+              # Alias for CI/configs that reference the debug tag name.
+              skopeo copy --dest-tls-verify=false --dest-creds="${CREDS}" \
+                docker://harbor-registry.cloudhost.svc.cluster.local:5000/abrban/kaniko-executor:v1.23.2 \
+                "${DEST}/kaniko-executor:v1.27.6-debug"
               echo SEED_OK

gitops/platform/values-abrban.example.yaml

@@ -31,10 +31,10 @@ images:
 # Kaniko job images — Harbor proxy-cache (first pull is slow, no manual seed needed).
 build:
   images:
-    kaniko: registry.abrban.com/abrban/kaniko-executor:v1.23.2
+    kaniko: registry.abrban.com/abrban/kaniko-executor:v1.27.6-debug
     alpine: registry.abrban.com/abrban/alpine:3.19
     alpineGit: registry.abrban.com/abrban/alpine-git:2.43.0
-  baseImageRegistry: registry.abrban.com/proxy-dockerhub/library
+  baseImageRegistry: registry.abrban.com/abrban
   # Kaniko + init containers (npm/apk/composer/pip/git clone) on restricted egress.
   egressProxySecret: registry-egress-proxy