From 2679c9d66efbf422ad793c671ec6f8faf9db7e1a Mon Sep 17 00:00:00 2001 From: keyhan Date: Thu, 9 Jul 2026 18:31:37 +0330 Subject: [PATCH] Fix Kaniko image refs to use seeded abrban/ images. v1.27.6-debug does not exist on gcr.io; proxy-gcr pulls are flaky on kubelet. Seed and reference abrban/kaniko-executor:v1.23.2 instead. Co-authored-by: Cursor --- .gitea/workflows/build-deploy.yaml | 4 ++-- backend/helm/cloudhost-platform/values.yaml | 7 ++++--- backend/src/config/configuration.ts | 6 +++--- gitops/jobs/build-platform-kaniko.yaml | 2 +- gitops/jobs/seed-ci-images.yaml | 10 +++++++--- gitops/platform/values-abrban.example.yaml | 6 +++--- scripts/trigger-platform-build.sh | 2 +- 7 files changed, 21 insertions(+), 16 deletions(-) diff --git a/.gitea/workflows/build-deploy.yaml b/.gitea/workflows/build-deploy.yaml index 08f85a1..088efdc 100644 --- a/.gitea/workflows/build-deploy.yaml +++ b/.gitea/workflows/build-deploy.yaml @@ -159,7 +159,7 @@ jobs: mountPath: /workspace containers: - name: kaniko - image: ${PULL_REGISTRY}/${PROJECT}/kaniko-executor:v1.27.6-debug + image: ${PULL_REGISTRY}/${PROJECT}/kaniko-executor:v1.23.2 # Base image (node:24-alpine) is seeded in Harbor abrban/ — avoids # flaky direct pulls from docker.io through the egress proxy. envFrom: @@ -224,7 +224,7 @@ jobs: mountPath: /workspace containers: - name: kaniko - image: ${PULL_REGISTRY}/${PROJECT}/kaniko-executor:v1.27.6-debug + image: ${PULL_REGISTRY}/${PROJECT}/kaniko-executor:v1.23.2 envFrom: - secretRef: name: registry-egress-proxy diff --git a/backend/helm/cloudhost-platform/values.yaml b/backend/helm/cloudhost-platform/values.yaml index e62ed31..db65b0b 100644 --- a/backend/helm/cloudhost-platform/values.yaml +++ b/backend/helm/cloudhost-platform/values.yaml @@ -32,9 +32,10 @@ images: # Override any line for a different registry/tag. build: images: - kaniko: registry.abrban.com/proxy-gcr/kaniko-project/executor:v1.23.2 - alpine: registry.abrban.com/proxy-dockerhub/library/alpine:3.19 - alpineGit: registry.abrban.com/proxy-dockerhub/alpine/git:2.43.0 + # Seeded into abrban/ via gitops/jobs/seed-ci-images.yaml — avoid flaky proxy-gcr pulls. + kaniko: registry.abrban.com/abrban/kaniko-executor:v1.23.2 + alpine: registry.abrban.com/abrban/alpine:3.19 + alpineGit: registry.abrban.com/abrban/alpine-git:2.43.0 # Prefix for Docker Hub images in generated user-app Dockerfiles (node, php, …) baseImageRegistry: registry.abrban.com/proxy-dockerhub/library # Secret with HTTP_PROXY/HTTPS_PROXY for Kaniko build jobs (npm, apk, git clone). diff --git a/backend/src/config/configuration.ts b/backend/src/config/configuration.ts index a1b4471..d017c8c 100644 --- a/backend/src/config/configuration.ts +++ b/backend/src/config/configuration.ts @@ -146,9 +146,9 @@ export default () => ({ images: { kaniko: process.env.KANIKO_IMAGE || - 'registry.abrban.com/proxy-gcr/kaniko-project/executor:v1.23.2', - alpine: (process.env.BUILD_ALPINE_IMAGE || 'registry.abrban.com/proxy-dockerhub/library/alpine:3.19').trim(), - alpineGit: (process.env.BUILD_ALPINE_GIT_IMAGE || 'registry.abrban.com/proxy-dockerhub/alpine/git:2.43.0').trim(), + 'registry.abrban.com/abrban/kaniko-executor:v1.23.2', + alpine: (process.env.BUILD_ALPINE_IMAGE || 'registry.abrban.com/abrban/alpine:3.19').trim(), + alpineGit: (process.env.BUILD_ALPINE_GIT_IMAGE || 'registry.abrban.com/abrban/alpine-git:2.43.0').trim(), }, /** * Secret name with HTTP_PROXY / HTTPS_PROXY / NO_PROXY for build pods diff --git a/gitops/jobs/build-platform-kaniko.yaml b/gitops/jobs/build-platform-kaniko.yaml index eb58ffd..b760934 100644 --- a/gitops/jobs/build-platform-kaniko.yaml +++ b/gitops/jobs/build-platform-kaniko.yaml @@ -31,7 +31,7 @@ spec: mountPath: /workspace containers: - name: kaniko - image: registry.abrban.com/proxy-gcr/kaniko-project/executor:v1.23.2 + image: registry.abrban.com/abrban/kaniko-executor:v1.23.2 env: - name: IMAGE_TAG value: bootstrap diff --git a/gitops/jobs/seed-ci-images.yaml b/gitops/jobs/seed-ci-images.yaml index 569cfb0..ca3fdd3 100644 --- a/gitops/jobs/seed-ci-images.yaml +++ b/gitops/jobs/seed-ci-images.yaml @@ -7,7 +7,7 @@ # kubectl -n cloudhost wait --for=condition=complete job/seed-ci-images --timeout=15m # # Images copied (see RUNBOOK-CICD.fa.md): -# abrban/act-runner, abrban/alpine-git, abrban/node, abrban/kaniko-executor +# abrban/act-runner, abrban/alpine, abrban/alpine-git, abrban/node, abrban/kaniko-executor apiVersion: batch/v1 kind: Job metadata: @@ -39,13 +39,17 @@ spec: skopeo copy --dest-tls-verify=false --dest-creds="${CREDS}" \ docker://docker.io/gitea/act_runner:0.2.11 \ "${DEST}/act-runner:0.2.11" + skopeo copy --dest-tls-verify=false --dest-creds="${CREDS}" \ + docker://docker.io/library/alpine:3.19 \ + "${DEST}/alpine:3.19" skopeo copy --dest-tls-verify=false --dest-creds="${CREDS}" \ docker://docker.io/alpine/git:2.43.0 \ "${DEST}/alpine-git:2.43.0" skopeo copy --dest-tls-verify=false --dest-creds="${CREDS}" \ docker://docker.io/library/node:24-alpine \ "${DEST}/node:24-alpine" + # v1.27.6-debug does not exist on gcr.io — use v1.23.2 (matches platform values). skopeo copy --dest-tls-verify=false --dest-creds="${CREDS}" \ - docker://gcr.io/kaniko-project/executor:v1.27.6-debug \ - "${DEST}/kaniko-executor:v1.27.6-debug" + docker://gcr.io/kaniko-project/executor:v1.23.2 \ + "${DEST}/kaniko-executor:v1.23.2" echo SEED_OK diff --git a/gitops/platform/values-abrban.example.yaml b/gitops/platform/values-abrban.example.yaml index 2a82d9c..8c754e6 100644 --- a/gitops/platform/values-abrban.example.yaml +++ b/gitops/platform/values-abrban.example.yaml @@ -31,9 +31,9 @@ images: # Kaniko job images — Harbor proxy-cache (first pull is slow, no manual seed needed). build: images: - kaniko: registry.abrban.com/proxy-gcr/kaniko-project/executor:v1.23.2 - alpine: registry.abrban.com/proxy-dockerhub/library/alpine:3.19 - alpineGit: registry.abrban.com/proxy-dockerhub/alpine/git:2.43.0 + kaniko: registry.abrban.com/abrban/kaniko-executor:v1.23.2 + alpine: registry.abrban.com/abrban/alpine:3.19 + alpineGit: registry.abrban.com/abrban/alpine-git:2.43.0 baseImageRegistry: registry.abrban.com/proxy-dockerhub/library # Kaniko + init containers (npm/apk/composer/pip/git clone) on restricted egress. egressProxySecret: registry-egress-proxy diff --git a/scripts/trigger-platform-build.sh b/scripts/trigger-platform-build.sh index a958f85..16118c8 100755 --- a/scripts/trigger-platform-build.sh +++ b/scripts/trigger-platform-build.sh @@ -40,7 +40,7 @@ spec: mountPath: /workspace containers: - name: kaniko - image: registry.abrban.com/proxy-gcr/kaniko-project/executor:v1.23.2 + image: registry.abrban.com/abrban/kaniko-executor:v1.23.2 command: - sh - -ec