keyhan
214b617be0
Use seeded abrban/ images instead of flaky proxy-gcr pulls, fix Kaniko dockerfile path for v1.27, correct docker auth host keys, route /v2/abrban/ through harbor-core, and prefer abrban/ for base images. Co-authored-by: Cursor <cursoragent@cursor.com>
63 lines
2.8 KiB
YAML
63 lines
2.8 KiB
YAML
# Bootstrap: seed CI/build images into Harbor project abrban/
|
|
#
|
|
# kubelet and Kaniko cannot reliably use Harbor proxy-cache for all images.
|
|
# Run once after Harbor is up and registry-egress-proxy exists in cloudhost:
|
|
#
|
|
# kubectl apply -f gitops/jobs/seed-ci-images.yaml
|
|
# kubectl -n cloudhost wait --for=condition=complete job/seed-ci-images --timeout=15m
|
|
#
|
|
# Images copied (see RUNBOOK-CICD.fa.md):
|
|
# abrban/act-runner, abrban/alpine, abrban/alpine-git, abrban/node, abrban/kaniko-executor
|
|
apiVersion: batch/v1
|
|
kind: Job
|
|
metadata:
|
|
name: seed-ci-images
|
|
namespace: cloudhost
|
|
spec:
|
|
ttlSecondsAfterFinished: 3600
|
|
backoffLimit: 2
|
|
template:
|
|
spec:
|
|
restartPolicy: Never
|
|
imagePullSecrets:
|
|
- name: registry-pull-secret
|
|
containers:
|
|
- name: skopeo
|
|
image: quay.io/skopeo/stable:latest
|
|
imagePullPolicy: IfNotPresent
|
|
envFrom:
|
|
- secretRef:
|
|
name: registry-egress-proxy
|
|
command:
|
|
- sh
|
|
- -ec
|
|
- |
|
|
set -eux
|
|
DEST="docker://harbor-registry.cloudhost.svc.cluster.local:5000/abrban"
|
|
# Must match harbor-core → REGISTRY_CREDENTIAL_PASSWORD (default: harbor_registry_password)
|
|
CREDS="harbor_registry_user:harbor_registry_password"
|
|
skopeo copy --dest-tls-verify=false --dest-creds="${CREDS}" \
|
|
docker://docker.io/gitea/act_runner:0.2.11 \
|
|
"${DEST}/act-runner:0.2.11"
|
|
skopeo copy --dest-tls-verify=false --dest-creds="${CREDS}" \
|
|
docker://docker.io/library/alpine:3.19 \
|
|
"${DEST}/alpine:3.19"
|
|
skopeo copy --dest-tls-verify=false --dest-creds="${CREDS}" \
|
|
docker://docker.io/alpine/git:2.43.0 \
|
|
"${DEST}/alpine-git:2.43.0"
|
|
skopeo copy --dest-tls-verify=false --dest-creds="${CREDS}" \
|
|
docker://docker.io/library/node:24-alpine \
|
|
"${DEST}/node:24-alpine"
|
|
skopeo copy --dest-tls-verify=false --dest-creds="${CREDS}" \
|
|
docker://docker.io/library/node:20-alpine \
|
|
"${DEST}/node:20-alpine"
|
|
# Tag present in Harbor abrban/ — seed via proxy-gcr (see seed-ci-images.yaml).
|
|
skopeo copy --dest-tls-verify=false --dest-creds="${CREDS}" \
|
|
docker://registry.abrban.com/proxy-gcr/kaniko-project/executor:v1.23.2 \
|
|
"${DEST}/kaniko-executor:v1.23.2"
|
|
# Alias for CI/configs that reference the debug tag name.
|
|
skopeo copy --dest-tls-verify=false --dest-creds="${CREDS}" \
|
|
docker://harbor-registry.cloudhost.svc.cluster.local:5000/abrban/kaniko-executor:v1.23.2 \
|
|
"${DEST}/kaniko-executor:v1.27.6-debug"
|
|
echo SEED_OK
|