keyhan
fec9ec386f
Build and Deploy Platform / build-and-deploy (push) Failing after 12m36s
Add REGISTRY_PUSH_URL config, route CI Kaniko to harbor-core, and document dual-host kaniko auth for core push plus registry base-image pull. Co-authored-by: Cursor <cursoragent@cursor.com>
41 lines
1.6 KiB
YAML
41 lines
1.6 KiB
YAML
# Example only — DO NOT commit real credentials.
|
|
# The real secret is managed as a SealedSecret in the cloud-host-gitops repo
|
|
# (sealed-secrets/kaniko-harbor-auth.yaml).
|
|
#
|
|
# Kaniko pushes via harbor-core (Harbor UI metadata). Pull base images may still
|
|
# use harbor-registry:5000 — include auth for both hosts in one dockerconfigjson.
|
|
#
|
|
# ADMIN="$(kubectl -n cloudhost get secret harbor-core -o jsonpath='{.data.HARBOR_ADMIN_PASSWORD}' | base64 -d)"
|
|
# REG_PASS="$(kubectl -n cloudhost get secret harbor-core -o jsonpath='{.data.REGISTRY_CREDENTIAL_PASSWORD}' | base64 -d)"
|
|
# kubectl -n cloudhost-builds create secret generic kaniko-harbor-auth \
|
|
# --from-literal=admin="${ADMIN}" --from-literal=reg_pass="${REG_PASS}" --dry-run=client -o yaml | ...
|
|
#
|
|
# See RUNBOOK-CICD.fa.md for the full procedure.
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: kaniko-harbor-auth
|
|
namespace: cloudhost-builds
|
|
type: kubernetes.io/dockerconfigjson
|
|
stringData:
|
|
.dockerconfigjson: |
|
|
{
|
|
"auths": {
|
|
"harbor-core.cloudhost.svc.cluster.local": {
|
|
"username": "admin",
|
|
"password": "<HARBOR_ADMIN_PASSWORD>",
|
|
"auth": "<base64 of admin:password>"
|
|
},
|
|
"harbor-registry.cloudhost.svc.cluster.local:5000": {
|
|
"username": "harbor_registry_user",
|
|
"password": "<REGISTRY_CREDENTIAL_PASSWORD>",
|
|
"auth": "<base64 of harbor_registry_user:password>"
|
|
},
|
|
"registry.abrban.com": {
|
|
"username": "harbor_registry_user",
|
|
"password": "<REGISTRY_CREDENTIAL_PASSWORD>",
|
|
"auth": "<base64>"
|
|
}
|
|
}
|
|
}
|