From 6ba77eebcf1442f38ce4827cf118e00400408ad2 Mon Sep 17 00:00:00 2001 From: keyhan Date: Thu, 2 Jul 2026 18:32:41 +0330 Subject: [PATCH] ci: pull node base image from Harbor instead of docker.io Kaniko builds failed with context deadline exceeded pulling node:24-alpine from index.docker.io through the egress proxy. Seed node:24-alpine into abrban/ and pass BASE_IMAGE build-arg so builds use the internal registry. Co-authored-by: Cursor --- .gitea/workflows/build-deploy.yaml | 7 ++++--- RUNBOOK-CICD.fa.md | 2 +- backend/Dockerfile | 5 +++-- frontend/Dockerfile | 7 ++++--- gitops/jobs/seed-ci-images.yaml | 10 ++++++++-- 5 files changed, 20 insertions(+), 11 deletions(-) diff --git a/.gitea/workflows/build-deploy.yaml b/.gitea/workflows/build-deploy.yaml index b218989..28a639b 100644 --- a/.gitea/workflows/build-deploy.yaml +++ b/.gitea/workflows/build-deploy.yaml @@ -103,15 +103,15 @@ jobs: containers: - name: kaniko image: ${PULL_REGISTRY}/${PROJECT}/kaniko-executor:v1.27.6-debug - # Kaniko pulls base images (node:24-alpine) straight from - # docker.io — needs the egress proxy. NO_PROXY keeps the - # push to harbor-registry direct. + # Base image (node:24-alpine) is seeded in Harbor abrban/ — avoids + # flaky direct pulls from docker.io through the egress proxy. envFrom: - secretRef: name: registry-egress-proxy args: - --dockerfile=/workspace/backend/Dockerfile - --context=dir:///workspace/backend + - --build-arg=BASE_IMAGE=${PULL_REGISTRY}/${PROJECT}/node:24-alpine - --destination=${PUSH_REGISTRY}/${PROJECT}/cloudhost-backend:${IMAGE_TAG} - --insecure - --skip-tls-verify @@ -172,6 +172,7 @@ jobs: args: - --dockerfile=/workspace/frontend/Dockerfile - --context=dir:///workspace/frontend + - --build-arg=BASE_IMAGE=${PULL_REGISTRY}/${PROJECT}/node:24-alpine - --build-arg=NEXT_PUBLIC_API_URL=https://api.abrban.com - --destination=${PUSH_REGISTRY}/${PROJECT}/cloudhost-frontend:${IMAGE_TAG} - --insecure diff --git a/RUNBOOK-CICD.fa.md b/RUNBOOK-CICD.fa.md index 1b7534b..02f10b9 100644 --- a/RUNBOOK-CICD.fa.md +++ b/RUNBOOK-CICD.fa.md @@ -228,7 +228,7 @@ Secretهایی که هنوز دستی‌اند (خارج از چرخهٔ CI): `a |-------|-------| | Workflow اجرا نمی‌شود | `kubectl -n gitea logs deploy/gitea-act-runner` — ثبت Runner و لیبل `abrban-builder` | | Build fail — clone | معتبربودن Secret `CI_TOKEN` در تنظیمات ریپوی `cloud-host` | -| Build fail — pull ایمیج پایه (403 از docker.io) | Kaniko ایمیج پایه (`node:24-alpine`) را مستقیم از docker.io می‌کشد و به پروکسی egress نیاز دارد؛ Secret `registry-egress-proxy` باید در ns `cloudhost-builds` باشد (در Job با `envFrom` ست می‌شود) | +| Build fail — pull ایمیج پایه (403/timeout از docker.io) | Kaniko نباید مستقیم از docker.io بکشد؛ ایمیج `node:24-alpine` باید در Harbor پروژهٔ `abrban/` seed شده باشد (`gitops/jobs/seed-ci-images.yaml`) و Workflow `--build-arg=BASE_IMAGE=registry.abrban.com/abrban/node:24-alpine` را پاس می‌دهد | | Build fail — push به Harbor | `kubectl -n cloudhost-builds get secret kaniko-harbor-auth`؛ پسورد باید با `REGISTRY_CREDENTIAL_PASSWORD` هاربر یکی باشد | | کامیت values push نمی‌شود | دسترسی write کاربر `ci` روی `cloud-host-gitops` | | Argo sync نمی‌کند | `kubectl -n argocd get app abrban-platform`؛ هر دو repo credential (`gitea-repo-creds` و `gitea-gitops-repo-creds`) | diff --git a/backend/Dockerfile b/backend/Dockerfile index 9fbc9ff..73b7835 100644 --- a/backend/Dockerfile +++ b/backend/Dockerfile @@ -1,5 +1,6 @@ # ---- Stage 1: Build ---- -FROM node:24-alpine AS builder +ARG BASE_IMAGE=node:24-alpine +FROM ${BASE_IMAGE} AS builder WORKDIR /app @@ -10,7 +11,7 @@ COPY . . RUN npm run build # ---- Stage 2: Production ---- -FROM node:24-alpine AS production +FROM ${BASE_IMAGE} AS production RUN apk add --no-cache dumb-init curl bash \ && curl -fsSL https://get.helm.sh/helm-v3.15.4-linux-amd64.tar.gz | tar xz -C /tmp \ diff --git a/frontend/Dockerfile b/frontend/Dockerfile index 43c0eb6..6a9354e 100644 --- a/frontend/Dockerfile +++ b/frontend/Dockerfile @@ -1,5 +1,6 @@ # ---- Stage 1: Dependencies ---- -FROM node:24-alpine AS deps +ARG BASE_IMAGE=node:24-alpine +FROM ${BASE_IMAGE} AS deps WORKDIR /app COPY package.json package-lock.json* ./ @@ -8,7 +9,7 @@ RUN sed -i 's|https://registry.npmmirror.com|https://registry.npmjs.org|g' packa && npm ci # ---- Stage 2: Build ---- -FROM node:24-alpine AS builder +FROM ${BASE_IMAGE} AS builder WORKDIR /app COPY --from=deps /app/node_modules ./node_modules @@ -20,7 +21,7 @@ ENV NEXT_TELEMETRY_DISABLED=1 RUN npm run build # ---- Stage 3: Production ---- -FROM node:24-alpine AS production +FROM ${BASE_IMAGE} AS production RUN apk add --no-cache dumb-init diff --git a/gitops/jobs/seed-ci-images.yaml b/gitops/jobs/seed-ci-images.yaml index 9f07f67..8eaef2c 100644 --- a/gitops/jobs/seed-ci-images.yaml +++ b/gitops/jobs/seed-ci-images.yaml @@ -30,6 +30,12 @@ spec: docker://docker.io/gitea/act_runner:0.2.11 \ "${DEST}/act-runner:0.2.11" skopeo copy --dest-tls-verify=false --dest-creds="${CREDS}" \ - docker://gcr.io/kaniko-project/executor:v1.23.2 \ - "${DEST}/kaniko-executor:v1.23.2" + docker://docker.io/alpine/git:2.43.0 \ + "${DEST}/alpine-git:2.43.0" + skopeo copy --dest-tls-verify=false --dest-creds="${CREDS}" \ + docker://docker.io/library/node:24-alpine \ + "${DEST}/node:24-alpine" + skopeo copy --dest-tls-verify=false --dest-creds="${CREDS}" \ + docker://gcr.io/kaniko-project/executor:v1.27.6-debug \ + "${DEST}/kaniko-executor:v1.27.6-debug" echo SEED_OK