Stabilize CI Kaniko tag and keep Harbor free of egress proxy.

Use the seeded kaniko v1.27.6-debug image, retry npm ci, and push via harbor-core without HTTP_PROXY so Harbor UI metadata and blob uploads keep working.

Co-authored-by: Cursor <cursoragent@cursor.com>

.gitea/workflows/build-deploy.yaml

@@ -102,7 +102,10 @@ jobs:
                         apk add --no-cache git &&
                         git clone --depth=1 --branch main http://oauth2:${GITEA_TOKEN}@${GITEA_HOST}/${REPO_PATH} /workspace &&
                         cd /workspace/backend &&
-                        npm ci --legacy-peer-deps &&
+                        npm config set fetch-retries 5 &&
+                        npm config set fetch-retry-mintimeout 20000 &&
+                        npm config set fetch-retry-maxtimeout 120000 &&
+                        (npm ci --legacy-peer-deps || (echo 'npm ci failed, retrying...' && sleep 5 && npm ci --legacy-peer-deps) || (echo 'npm ci failed again, retrying...' && sleep 10 && npm ci --legacy-peer-deps)) &&
                         npm run test -- --ci --runInBand
                     resources:
                       requests: { cpu: 500m, memory: 1Gi }
@@ -159,7 +162,7 @@ jobs:
                         mountPath: /workspace
                 containers:
                   - name: kaniko
-                    image: ${PULL_REGISTRY}/${PROJECT}/kaniko-executor:v1.23.2
+                    image: ${PULL_REGISTRY}/${PROJECT}/kaniko-executor:v1.27.6-debug
                     # Base image (node:24-alpine) is seeded in Harbor abrban/ — avoids
                     # flaky direct pulls from docker.io through the egress proxy.
                     envFrom:
@@ -224,7 +227,7 @@ jobs:
                         mountPath: /workspace
                 containers:
                   - name: kaniko
-                    image: ${PULL_REGISTRY}/${PROJECT}/kaniko-executor:v1.23.2
+                    image: ${PULL_REGISTRY}/${PROJECT}/kaniko-executor:v1.27.6-debug
                     envFrom:
                       - secretRef:
                           name: registry-egress-proxy

backend/helm/cloudhost-harbor/scripts/install-harbor-registry.sh

@@ -22,16 +22,17 @@ echo "==> [2/4] Scaling old registry deployment down (rollback-friendly)"
 kubectl -n cloudhost scale deploy/registry --replicas=0 || true
 
 echo "==> [3/4] Installing Harbor"
-HTTP_PROXY="$(kubectl -n cloudhost get secret registry-egress-proxy -o jsonpath='{.data.HTTP_PROXY}' | base64 -d)"
-HTTPS_PROXY="$(kubectl -n cloudhost get secret registry-egress-proxy -o jsonpath='{.data.HTTPS_PROXY}' | base64 -d)"
-NO_PROXY="$(kubectl -n cloudhost get secret registry-egress-proxy -o jsonpath='{.data.NO_PROXY}' | base64 -d)"
-
+# IMPORTANT: do NOT set HTTP(S)_PROXY on harbor-core for in-cluster registry
+# traffic. Egress proxy on core causes 502 on blob uploads via harbor-core
+# (Kaniko/skopeo push fails; Harbor UI metadata never appears).
+# Keep proxy empty here; Harbor proxy-cache projects can still use project-level
+# proxy settings when needed. Expand noProxy for safety if proxy is re-enabled.
 TMP_PROXY_VALUES="$(mktemp)"
 cat > "${TMP_PROXY_VALUES}" <<EOF
 proxy:
-  httpProxy: "${HTTP_PROXY}"
-  httpsProxy: "${HTTPS_PROXY}"
-  noProxy: "${NO_PROXY}"
+  httpProxy: ""
+  httpsProxy: ""
+  noProxy: "harbor-core,harbor-jobservice,harbor-database,harbor-registry,harbor-portal,.svc,.cluster.local,10.43.0.0/16,127.0.0.1,localhost,registry.abrban.com"
 EOF
 
 helm upgrade --install harbor harbor/harbor \
@@ -43,6 +44,9 @@ helm upgrade --install harbor harbor/harbor \
 
 rm -f "${TMP_PROXY_VALUES}" || true
 
-echo "==> [4/4] Done"
+echo "==> [4/4] Apply registry ingress path split (proxy-* → harbor-core)"
+kubectl apply -f "$(dirname "$0")/../../../gitops/harbor/registry-ingress.yaml"
+
+echo "==> Done"
 kubectl -n cloudhost get ingress | grep -n registry || true
 

gitops/jobs/build-platform-kaniko.yaml

@@ -31,7 +31,7 @@ spec:
               mountPath: /workspace
       containers:
         - name: kaniko
-          image: registry.abrban.com/abrban/kaniko-executor:v1.23.2
+          image: registry.abrban.com/abrban/kaniko-executor:v1.27.6-debug
           env:
             - name: IMAGE_TAG
               value: bootstrap
@@ -40,7 +40,10 @@ spec:
             - -ec
             - |
               set -eux
-              REG="harbor-registry.cloudhost.svc.cluster.local:5000/abrban"
+              REG="harbor-core.cloudhost.svc.cluster.local/abrban"
+              unset HTTP_PROXY HTTPS_PROXY http_proxy https_proxy || true
+              export NO_PROXY="harbor-core.cloudhost.svc.cluster.local,harbor-registry.cloudhost.svc.cluster.local,registry.abrban.com,10.43.0.0/16,.svc,.cluster.local"
+              export no_proxy="$NO_PROXY"
               /kaniko/executor \
                 --dockerfile=/workspace/backend/Dockerfile \
                 --context=dir:///workspace/backend \
@@ -55,6 +58,14 @@ spec:
           volumeMounts:
             - name: workspace
               mountPath: /workspace
+            - name: docker-config
+              mountPath: /kaniko/.docker
       volumes:
         - name: workspace
           emptyDir: {}
+        - name: docker-config
+          secret:
+            secretName: kaniko-harbor-auth
+            items:
+              - key: .dockerconfigjson
+                path: config.json

scripts/trigger-platform-build.sh

@@ -40,13 +40,17 @@ spec:
               mountPath: /workspace
       containers:
         - name: kaniko
-          image: registry.abrban.com/abrban/kaniko-executor:v1.23.2
+          image: registry.abrban.com/abrban/kaniko-executor:v1.27.6-debug
           command:
             - sh
             - -ec
             - |
               set -eux
-              REG="harbor-registry.cloudhost.svc.cluster.local:5000/abrban"
+              # Push via harbor-core so artifacts appear in Harbor UI
+              REG="harbor-core.cloudhost.svc.cluster.local/abrban"
+              unset HTTP_PROXY HTTPS_PROXY http_proxy https_proxy || true
+              export NO_PROXY="harbor-core.cloudhost.svc.cluster.local,harbor-registry.cloudhost.svc.cluster.local,registry.abrban.com,10.43.0.0/16,.svc,.cluster.local"
+              export no_proxy="$NO_PROXY"
               /kaniko/executor \
                 --dockerfile=/workspace/backend/Dockerfile \
                 --context=dir:///workspace/backend \
@@ -62,9 +66,17 @@ spec:
           volumeMounts:
             - name: workspace
               mountPath: /workspace
+            - name: docker-config
+              mountPath: /kaniko/.docker
       volumes:
         - name: workspace
           emptyDir: {}
+        - name: docker-config
+          secret:
+            secretName: kaniko-harbor-auth
+            items:
+              - key: .dockerconfigjson
+                path: config.json
 EOF
 
 echo "==> Waiting for build job..."