Push Kaniko artifacts via harbor-core for Harbor UI visibility.

Add REGISTRY_PUSH_URL config, route CI Kaniko to harbor-core, and document dual-host kaniko auth for core push plus registry base-image pull.

Co-authored-by: Cursor <cursoragent@cursor.com>

gitops/jobs/kaniko-harbor-auth.example.yaml

@@ -2,21 +2,15 @@
 # The real secret is managed as a SealedSecret in the cloud-host-gitops repo
 # (sealed-secrets/kaniko-harbor-auth.yaml).
 #
-# Kaniko pushes directly to the internal registry endpoint
-# (harbor-registry.cloudhost.svc.cluster.local:5000), which bypasses harbor-core.
-# That endpoint only accepts the internal registry credential — Harbor robot
-# accounts do NOT work there (their tokens are issued by harbor-core's token
-# service). Use the harbor_registry_user credential from the harbor-core secret:
+# Kaniko pushes via harbor-core (Harbor UI metadata). Pull base images may still
+# use harbor-registry:5000 — include auth for both hosts in one dockerconfigjson.
 #
-#   REG_PASS="$(kubectl -n cloudhost get secret harbor-core \
-#     -o jsonpath='{.data.REGISTRY_CREDENTIAL_PASSWORD}' | base64 -d)"
-#   kubectl -n cloudhost-builds create secret docker-registry kaniko-harbor-auth \
-#     --docker-server=harbor-registry.cloudhost.svc.cluster.local:5000 \
-#     --docker-username=harbor_registry_user \
-#     --docker-password="${REG_PASS}"
+#   ADMIN="$(kubectl -n cloudhost get secret harbor-core -o jsonpath='{.data.HARBOR_ADMIN_PASSWORD}' | base64 -d)"
+#   REG_PASS="$(kubectl -n cloudhost get secret harbor-core -o jsonpath='{.data.REGISTRY_CREDENTIAL_PASSWORD}' | base64 -d)"
+#   kubectl -n cloudhost-builds create secret generic kaniko-harbor-auth \
+#     --from-literal=admin="${ADMIN}" --from-literal=reg_pass="${REG_PASS}" --dry-run=client -o yaml | ...
 #
-# The build-deploy workflow mounts this secret at /kaniko/.docker/config.json
-# inside every Kaniko Job. See RUNBOOK-CICD.fa.md for the full procedure.
+# See RUNBOOK-CICD.fa.md for the full procedure.
 apiVersion: v1
 kind: Secret
 metadata:
@@ -27,10 +21,20 @@ stringData:
   .dockerconfigjson: |
     {
       "auths": {
+        "harbor-core.cloudhost.svc.cluster.local": {
+          "username": "admin",
+          "password": "<HARBOR_ADMIN_PASSWORD>",
+          "auth": "<base64 of admin:password>"
+        },
         "harbor-registry.cloudhost.svc.cluster.local:5000": {
           "username": "harbor_registry_user",
           "password": "<REGISTRY_CREDENTIAL_PASSWORD>",
-          "auth": "<base64 of username:password>"
+          "auth": "<base64 of harbor_registry_user:password>"
+        },
+        "registry.abrban.com": {
+          "username": "harbor_registry_user",
+          "password": "<REGISTRY_CREDENTIAL_PASSWORD>",
+          "auth": "<base64>"
         }
       }
     }

gitops/platform/values-abrban.example.yaml

@@ -103,6 +103,8 @@ backend:
     PLATFORM_DOMAIN: apps.abrban.com
     PREVIEW_BASE_DOMAIN: apps.abrban.com
     FRONTEND_URL: https://panel.abrban.com,https://abrban.com
+    # Push via harbor-core so artifacts appear in Harbor UI; pull stays on registry.abrban.com.
+    REGISTRY_PUSH_URL: harbor-core.cloudhost.svc.cluster.local/abrban
     REGISTRY_URL: harbor-registry.cloudhost.svc.cluster.local:5000/abrban
     REGISTRY_PULL_URL: registry.abrban.com/abrban
     BUILD_NAMESPACE: cloudhost-builds