Fix Kaniko image refs to use seeded abrban/ images.

v1.27.6-debug does not exist on gcr.io; proxy-gcr pulls are flaky on kubelet. Seed and reference abrban/kaniko-executor:v1.23.2 instead.

Co-authored-by: Cursor <cursoragent@cursor.com>

.gitea/workflows/build-deploy.yaml

@@ -159,7 +159,7 @@ jobs:
                         mountPath: /workspace
                 containers:
                   - name: kaniko
-                    image: ${PULL_REGISTRY}/${PROJECT}/kaniko-executor:v1.27.6-debug
+                    image: ${PULL_REGISTRY}/${PROJECT}/kaniko-executor:v1.23.2
                     # Base image (node:24-alpine) is seeded in Harbor abrban/ — avoids
                     # flaky direct pulls from docker.io through the egress proxy.
                     envFrom:
@@ -224,7 +224,7 @@ jobs:
                         mountPath: /workspace
                 containers:
                   - name: kaniko
-                    image: ${PULL_REGISTRY}/${PROJECT}/kaniko-executor:v1.27.6-debug
+                    image: ${PULL_REGISTRY}/${PROJECT}/kaniko-executor:v1.23.2
                     envFrom:
                       - secretRef:
                           name: registry-egress-proxy

backend/helm/cloudhost-platform/values.yaml

@@ -32,9 +32,10 @@ images:
 # Override any line for a different registry/tag.
 build:
   images:
-    kaniko: registry.abrban.com/proxy-gcr/kaniko-project/executor:v1.23.2
+    # Seeded into abrban/ via gitops/jobs/seed-ci-images.yaml — avoid flaky proxy-gcr pulls.
-    alpine: registry.abrban.com/proxy-dockerhub/library/alpine:3.19
+    kaniko: registry.abrban.com/abrban/kaniko-executor:v1.23.2
-    alpineGit: registry.abrban.com/proxy-dockerhub/alpine/git:2.43.0
+    alpine: registry.abrban.com/abrban/alpine:3.19
+    alpineGit: registry.abrban.com/abrban/alpine-git:2.43.0
   # Prefix for Docker Hub images in generated user-app Dockerfiles (node, php, …)
   baseImageRegistry: registry.abrban.com/proxy-dockerhub/library
   # Secret with HTTP_PROXY/HTTPS_PROXY for Kaniko build jobs (npm, apk, git clone).

backend/src/config/configuration.ts

@@ -146,9 +146,9 @@ export default () => ({
     images: {
       kaniko:
         process.env.KANIKO_IMAGE ||
-        'registry.abrban.com/proxy-gcr/kaniko-project/executor:v1.23.2',
+        'registry.abrban.com/abrban/kaniko-executor:v1.23.2',
-      alpine: (process.env.BUILD_ALPINE_IMAGE || 'registry.abrban.com/proxy-dockerhub/library/alpine:3.19').trim(),
+      alpine: (process.env.BUILD_ALPINE_IMAGE || 'registry.abrban.com/abrban/alpine:3.19').trim(),
-      alpineGit: (process.env.BUILD_ALPINE_GIT_IMAGE || 'registry.abrban.com/proxy-dockerhub/alpine/git:2.43.0').trim(),
+      alpineGit: (process.env.BUILD_ALPINE_GIT_IMAGE || 'registry.abrban.com/abrban/alpine-git:2.43.0').trim(),
     },
     /**
      * Secret name with HTTP_PROXY / HTTPS_PROXY / NO_PROXY for build pods

gitops/jobs/build-platform-kaniko.yaml

@@ -31,7 +31,7 @@ spec:
               mountPath: /workspace
       containers:
         - name: kaniko
-          image: registry.abrban.com/proxy-gcr/kaniko-project/executor:v1.23.2
+          image: registry.abrban.com/abrban/kaniko-executor:v1.23.2
           env:
             - name: IMAGE_TAG
               value: bootstrap

gitops/jobs/seed-ci-images.yaml

@@ -7,7 +7,7 @@
 #   kubectl -n cloudhost wait --for=condition=complete job/seed-ci-images --timeout=15m
 #
 # Images copied (see RUNBOOK-CICD.fa.md):
-#   abrban/act-runner, abrban/alpine-git, abrban/node, abrban/kaniko-executor
+#   abrban/act-runner, abrban/alpine, abrban/alpine-git, abrban/node, abrban/kaniko-executor
 apiVersion: batch/v1
 kind: Job
 metadata:
@@ -39,13 +39,17 @@ spec:
               skopeo copy --dest-tls-verify=false --dest-creds="${CREDS}" \
                 docker://docker.io/gitea/act_runner:0.2.11 \
                 "${DEST}/act-runner:0.2.11"
+              skopeo copy --dest-tls-verify=false --dest-creds="${CREDS}" \
+                docker://docker.io/library/alpine:3.19 \
+                "${DEST}/alpine:3.19"
               skopeo copy --dest-tls-verify=false --dest-creds="${CREDS}" \
                 docker://docker.io/alpine/git:2.43.0 \
                 "${DEST}/alpine-git:2.43.0"
               skopeo copy --dest-tls-verify=false --dest-creds="${CREDS}" \
                 docker://docker.io/library/node:24-alpine \
                 "${DEST}/node:24-alpine"
+              # v1.27.6-debug does not exist on gcr.io — use v1.23.2 (matches platform values).
               skopeo copy --dest-tls-verify=false --dest-creds="${CREDS}" \
-                docker://gcr.io/kaniko-project/executor:v1.27.6-debug \
+                docker://gcr.io/kaniko-project/executor:v1.23.2 \
-                "${DEST}/kaniko-executor:v1.27.6-debug"
+                "${DEST}/kaniko-executor:v1.23.2"
               echo SEED_OK

gitops/platform/values-abrban.example.yaml

@@ -31,9 +31,9 @@ images:
 # Kaniko job images — Harbor proxy-cache (first pull is slow, no manual seed needed).
 build:
   images:
-    kaniko: registry.abrban.com/proxy-gcr/kaniko-project/executor:v1.23.2
+    kaniko: registry.abrban.com/abrban/kaniko-executor:v1.23.2
-    alpine: registry.abrban.com/proxy-dockerhub/library/alpine:3.19
+    alpine: registry.abrban.com/abrban/alpine:3.19
-    alpineGit: registry.abrban.com/proxy-dockerhub/alpine/git:2.43.0
+    alpineGit: registry.abrban.com/abrban/alpine-git:2.43.0
   baseImageRegistry: registry.abrban.com/proxy-dockerhub/library
   # Kaniko + init containers (npm/apk/composer/pip/git clone) on restricted egress.
   egressProxySecret: registry-egress-proxy

scripts/trigger-platform-build.sh

@@ -40,7 +40,7 @@ spec:
               mountPath: /workspace
       containers:
         - name: kaniko
-          image: registry.abrban.com/proxy-gcr/kaniko-project/executor:v1.23.2
+          image: registry.abrban.com/abrban/kaniko-executor:v1.23.2
           command:
             - sh
             - -ec