fix(build): default Kaniko and init images to Harbor via Helm values

User-app builds no longer pull gcr.io/docker.io directly when build.images
is configured in values.yaml, fixing ImagePullBackOff on clusters without
upstream registry access.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/helm/cloudhost-platform/templates/_helpers.tpl

@@ -113,3 +113,14 @@ PLATFORM_DOMAIN / preview domain from the first entry only. The panel host
 {{- define "cloudhost-platform.frontendImage" -}}
 {{- printf "%s:%s" .Values.images.frontend.repository .Values.images.frontend.tag }}
 {{- end }}
+
+{{- define "cloudhost-platform.buildEnv" -}}
+- name: KANIKO_IMAGE
+  value: {{ .Values.build.images.kaniko | quote }}
+- name: BUILD_ALPINE_IMAGE
+  value: {{ .Values.build.images.alpine | quote }}
+- name: BUILD_ALPINE_GIT_IMAGE
+  value: {{ .Values.build.images.alpineGit | quote }}
+- name: BASE_IMAGE_REGISTRY
+  value: {{ .Values.build.baseImageRegistry | quote }}
+{{- end }}

backend/helm/cloudhost-platform/templates/backend-deployment.yaml

@@ -100,6 +100,7 @@ spec:
                   key: cluster-kubeconfig-key
             - name: FRONTEND_URL
               value: {{ include "cloudhost-platform.corsOrigins" . | quote }}
+            {{- include "cloudhost-platform.buildEnv" . | nindent 12 }}
             {{- range $key, $val := .Values.backend.env }}
             - name: {{ $key }}
               value: {{ $val | quote }}

backend/helm/cloudhost-platform/values-production.example.yaml

@@ -22,6 +22,14 @@ images:
     tag: "1.0.0"
     pullPolicy: Always
 
+# Build job images — override for clusters without Harbor proxy-cache.
+build:
+  images:
+    kaniko: registry.example.com/proxy-gcr/kaniko-project/executor:v1.23.2
+    alpine: registry.example.com/proxy-dockerhub/library/alpine:3.19
+    alpineGit: registry.example.com/proxy-dockerhub/alpine/git:2.43.0
+  baseImageRegistry: registry.example.com/proxy-dockerhub/library
+
 postgres:
   password: "CHANGE_ME_STRONG_POSTGRES_PASSWORD"
   # Pull secret for the mirrored postgres image
@@ -58,8 +66,6 @@ backend:
     PLATFORM_DOMAIN: apps.example.com
     REGISTRY_URL: registry.cloudhost-builds.svc.cluster.local:5000
     REGISTRY_PULL_URL: registry.cloudhost-builds.svc.cluster.local:5000
-    # Mirror prefix for base images in generated Dockerfiles + managed services
-    BASE_IMAGE_REGISTRY: registry.example.com/mirror
     # Elastic log-stack credentials (must match the logging namespace Secret)
     ELASTIC_PASSWORD: "CHANGE_ME_ELASTIC_PASSWORD"
     FLUENTBIT_PASSWORD: "CHANGE_ME_FLUENTBIT_PASSWORD"

backend/helm/cloudhost-platform/values.yaml

@@ -28,6 +28,16 @@ images:
     tag: "1.0.0"
     pullPolicy: IfNotPresent
 
+# Kaniko job images — defaults pull from Harbor proxy-cache.
+# Override any line for a different registry/tag.
+build:
+  images:
+    kaniko: registry.abrban.com/proxy-gcr/kaniko-project/executor:v1.23.2
+    alpine: registry.abrban.com/proxy-dockerhub/library/alpine:3.19
+    alpineGit: registry.abrban.com/proxy-dockerhub/alpine/git:2.43.0
+  # Prefix for Docker Hub images in generated user-app Dockerfiles (node, php, …)
+  baseImageRegistry: registry.abrban.com/proxy-dockerhub/library
+
 postgres:
   enabled: true
   database: cloudhost