From 58ab81469bba5479f499b9033647073f354ef945 Mon Sep 17 00:00:00 2001 From: keyhan Date: Fri, 17 Jul 2026 16:47:23 +0330 Subject: [PATCH] Stabilize CI Kaniko tag and keep Harbor free of egress proxy. Use the seeded kaniko v1.27.6-debug image, retry npm ci, and push via harbor-core without HTTP_PROXY so Harbor UI metadata and blob uploads keep working. Co-authored-by: Cursor --- .gitea/workflows/build-deploy.yaml | 9 ++++++--- .../scripts/install-harbor-registry.sh | 20 +++++++++++-------- gitops/jobs/build-platform-kaniko.yaml | 15 ++++++++++++-- scripts/trigger-platform-build.sh | 16 +++++++++++++-- 4 files changed, 45 insertions(+), 15 deletions(-) diff --git a/.gitea/workflows/build-deploy.yaml b/.gitea/workflows/build-deploy.yaml index 42b4138..17e2273 100644 --- a/.gitea/workflows/build-deploy.yaml +++ b/.gitea/workflows/build-deploy.yaml @@ -102,7 +102,10 @@ jobs: apk add --no-cache git && git clone --depth=1 --branch main http://oauth2:${GITEA_TOKEN}@${GITEA_HOST}/${REPO_PATH} /workspace && cd /workspace/backend && - npm ci --legacy-peer-deps && + npm config set fetch-retries 5 && + npm config set fetch-retry-mintimeout 20000 && + npm config set fetch-retry-maxtimeout 120000 && + (npm ci --legacy-peer-deps || (echo 'npm ci failed, retrying...' && sleep 5 && npm ci --legacy-peer-deps) || (echo 'npm ci failed again, retrying...' && sleep 10 && npm ci --legacy-peer-deps)) && npm run test -- --ci --runInBand resources: requests: { cpu: 500m, memory: 1Gi } @@ -159,7 +162,7 @@ jobs: mountPath: /workspace containers: - name: kaniko - image: ${PULL_REGISTRY}/${PROJECT}/kaniko-executor:v1.23.2 + image: ${PULL_REGISTRY}/${PROJECT}/kaniko-executor:v1.27.6-debug # Base image (node:24-alpine) is seeded in Harbor abrban/ — avoids # flaky direct pulls from docker.io through the egress proxy. envFrom: @@ -224,7 +227,7 @@ jobs: mountPath: /workspace containers: - name: kaniko - image: ${PULL_REGISTRY}/${PROJECT}/kaniko-executor:v1.23.2 + image: ${PULL_REGISTRY}/${PROJECT}/kaniko-executor:v1.27.6-debug envFrom: - secretRef: name: registry-egress-proxy diff --git a/backend/helm/cloudhost-harbor/scripts/install-harbor-registry.sh b/backend/helm/cloudhost-harbor/scripts/install-harbor-registry.sh index 7f601f7..0c9f543 100755 --- a/backend/helm/cloudhost-harbor/scripts/install-harbor-registry.sh +++ b/backend/helm/cloudhost-harbor/scripts/install-harbor-registry.sh @@ -22,16 +22,17 @@ echo "==> [2/4] Scaling old registry deployment down (rollback-friendly)" kubectl -n cloudhost scale deploy/registry --replicas=0 || true echo "==> [3/4] Installing Harbor" -HTTP_PROXY="$(kubectl -n cloudhost get secret registry-egress-proxy -o jsonpath='{.data.HTTP_PROXY}' | base64 -d)" -HTTPS_PROXY="$(kubectl -n cloudhost get secret registry-egress-proxy -o jsonpath='{.data.HTTPS_PROXY}' | base64 -d)" -NO_PROXY="$(kubectl -n cloudhost get secret registry-egress-proxy -o jsonpath='{.data.NO_PROXY}' | base64 -d)" - +# IMPORTANT: do NOT set HTTP(S)_PROXY on harbor-core for in-cluster registry +# traffic. Egress proxy on core causes 502 on blob uploads via harbor-core +# (Kaniko/skopeo push fails; Harbor UI metadata never appears). +# Keep proxy empty here; Harbor proxy-cache projects can still use project-level +# proxy settings when needed. Expand noProxy for safety if proxy is re-enabled. TMP_PROXY_VALUES="$(mktemp)" cat > "${TMP_PROXY_VALUES}" < [4/4] Done" +echo "==> [4/4] Apply registry ingress path split (proxy-* → harbor-core)" +kubectl apply -f "$(dirname "$0")/../../../gitops/harbor/registry-ingress.yaml" + +echo "==> Done" kubectl -n cloudhost get ingress | grep -n registry || true diff --git a/gitops/jobs/build-platform-kaniko.yaml b/gitops/jobs/build-platform-kaniko.yaml index b760934..ee6d91d 100644 --- a/gitops/jobs/build-platform-kaniko.yaml +++ b/gitops/jobs/build-platform-kaniko.yaml @@ -31,7 +31,7 @@ spec: mountPath: /workspace containers: - name: kaniko - image: registry.abrban.com/abrban/kaniko-executor:v1.23.2 + image: registry.abrban.com/abrban/kaniko-executor:v1.27.6-debug env: - name: IMAGE_TAG value: bootstrap @@ -40,7 +40,10 @@ spec: - -ec - | set -eux - REG="harbor-registry.cloudhost.svc.cluster.local:5000/abrban" + REG="harbor-core.cloudhost.svc.cluster.local/abrban" + unset HTTP_PROXY HTTPS_PROXY http_proxy https_proxy || true + export NO_PROXY="harbor-core.cloudhost.svc.cluster.local,harbor-registry.cloudhost.svc.cluster.local,registry.abrban.com,10.43.0.0/16,.svc,.cluster.local" + export no_proxy="$NO_PROXY" /kaniko/executor \ --dockerfile=/workspace/backend/Dockerfile \ --context=dir:///workspace/backend \ @@ -55,6 +58,14 @@ spec: volumeMounts: - name: workspace mountPath: /workspace + - name: docker-config + mountPath: /kaniko/.docker volumes: - name: workspace emptyDir: {} + - name: docker-config + secret: + secretName: kaniko-harbor-auth + items: + - key: .dockerconfigjson + path: config.json diff --git a/scripts/trigger-platform-build.sh b/scripts/trigger-platform-build.sh index 16118c8..1019913 100755 --- a/scripts/trigger-platform-build.sh +++ b/scripts/trigger-platform-build.sh @@ -40,13 +40,17 @@ spec: mountPath: /workspace containers: - name: kaniko - image: registry.abrban.com/abrban/kaniko-executor:v1.23.2 + image: registry.abrban.com/abrban/kaniko-executor:v1.27.6-debug command: - sh - -ec - | set -eux - REG="harbor-registry.cloudhost.svc.cluster.local:5000/abrban" + # Push via harbor-core so artifacts appear in Harbor UI + REG="harbor-core.cloudhost.svc.cluster.local/abrban" + unset HTTP_PROXY HTTPS_PROXY http_proxy https_proxy || true + export NO_PROXY="harbor-core.cloudhost.svc.cluster.local,harbor-registry.cloudhost.svc.cluster.local,registry.abrban.com,10.43.0.0/16,.svc,.cluster.local" + export no_proxy="$NO_PROXY" /kaniko/executor \ --dockerfile=/workspace/backend/Dockerfile \ --context=dir:///workspace/backend \ @@ -62,9 +66,17 @@ spec: volumeMounts: - name: workspace mountPath: /workspace + - name: docker-config + mountPath: /kaniko/.docker volumes: - name: workspace emptyDir: {} + - name: docker-config + secret: + secretName: kaniko-harbor-auth + items: + - key: .dockerconfigjson + path: config.json EOF echo "==> Waiting for build job..."