Stabilize CI Kaniko tag and keep Harbor free of egress proxy.

Use the seeded kaniko v1.27.6-debug image, retry npm ci, and push via harbor-core without HTTP_PROXY so Harbor UI metadata and blob uploads keep working.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/helm/cloudhost-harbor/scripts/install-harbor-registry.sh

@@ -22,16 +22,17 @@ echo "==> [2/4] Scaling old registry deployment down (rollback-friendly)"
 kubectl -n cloudhost scale deploy/registry --replicas=0 || true
 
 echo "==> [3/4] Installing Harbor"
-HTTP_PROXY="$(kubectl -n cloudhost get secret registry-egress-proxy -o jsonpath='{.data.HTTP_PROXY}' | base64 -d)"
-HTTPS_PROXY="$(kubectl -n cloudhost get secret registry-egress-proxy -o jsonpath='{.data.HTTPS_PROXY}' | base64 -d)"
-NO_PROXY="$(kubectl -n cloudhost get secret registry-egress-proxy -o jsonpath='{.data.NO_PROXY}' | base64 -d)"
-
+# IMPORTANT: do NOT set HTTP(S)_PROXY on harbor-core for in-cluster registry
+# traffic. Egress proxy on core causes 502 on blob uploads via harbor-core
+# (Kaniko/skopeo push fails; Harbor UI metadata never appears).
+# Keep proxy empty here; Harbor proxy-cache projects can still use project-level
+# proxy settings when needed. Expand noProxy for safety if proxy is re-enabled.
 TMP_PROXY_VALUES="$(mktemp)"
 cat > "${TMP_PROXY_VALUES}" <<EOF
 proxy:
-  httpProxy: "${HTTP_PROXY}"
-  httpsProxy: "${HTTPS_PROXY}"
-  noProxy: "${NO_PROXY}"
+  httpProxy: ""
+  httpsProxy: ""
+  noProxy: "harbor-core,harbor-jobservice,harbor-database,harbor-registry,harbor-portal,.svc,.cluster.local,10.43.0.0/16,127.0.0.1,localhost,registry.abrban.com"
 EOF
 
 helm upgrade --install harbor harbor/harbor \
@@ -43,6 +44,9 @@ helm upgrade --install harbor harbor/harbor \
 
 rm -f "${TMP_PROXY_VALUES}" || true
 
-echo "==> [4/4] Done"
+echo "==> [4/4] Apply registry ingress path split (proxy-* → harbor-core)"
+kubectl apply -f "$(dirname "$0")/../../../gitops/harbor/registry-ingress.yaml"
+
+echo "==> Done"
 kubectl -n cloudhost get ingress | grep -n registry || true