keyhan
ec72ee4fca
Route k3s registry mirrors through harbor-core ClusterIP with hostname-only auth keys, use HTTP EXT_ENDPOINT so OAuth tokens work on port 80, extend deploy readiness timeout, and harden Kaniko build/dockerfile fallbacks. Co-authored-by: Cursor <cursoragent@cursor.com>
48 lines
2.5 KiB
Bash
Executable File
48 lines
2.5 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Route registry.abrban.com pulls to harbor-core (HTTP) for proxy-cache support.
|
|
set -euo pipefail
|
|
|
|
NS="${NS:-kube-system}"
|
|
NODE="${NODE:-abr}"
|
|
HARBOR_CORE_IP="${HARBOR_CORE_IP:-$(kubectl -n cloudhost get svc harbor-core -o jsonpath='{.spec.clusterIP}')}"
|
|
REG_USER="${REG_USER:-harbor_registry_user}"
|
|
REG_PASS="${REG_PASS:-$(kubectl -n cloudhost get secret harbor-core -o jsonpath='{.data.REGISTRY_CREDENTIAL_PASSWORD}' | base64 -d)}"
|
|
|
|
REG_PASS_B64="$(printf '%s' "$REG_PASS" | base64 | tr -d '\n')"
|
|
|
|
kubectl -n "${NS}" delete pod k3s-registries-setup --ignore-not-found
|
|
|
|
kubectl -n "${NS}" create secret generic k3s-registries-setup-env \
|
|
--from-literal=HARBOR_CORE_IP="${HARBOR_CORE_IP}" \
|
|
--from-literal=REG_USER="${REG_USER}" \
|
|
--from-literal=REG_PASS_B64="${REG_PASS_B64}" \
|
|
--dry-run=client -o yaml | kubectl apply -f -
|
|
|
|
kubectl -n "${NS}" delete pod k3s-registries-setup --ignore-not-found
|
|
|
|
kubectl -n "${NS}" run k3s-registries-setup \
|
|
--image=rancher/mirrored-library-busybox:1.36.1 \
|
|
--restart=Never \
|
|
--overrides="$(cat <<EOF
|
|
{
|
|
"apiVersion": "v1",
|
|
"spec": {
|
|
"nodeName": "${NODE}",
|
|
"hostNetwork": true,
|
|
"containers": [{
|
|
"name": "setup",
|
|
"image": "rancher/mirrored-library-busybox:1.36.1",
|
|
"securityContext": {"privileged": true},
|
|
"envFrom": [{"secretRef": {"name": "k3s-registries-setup-env"}}],
|
|
"command": ["sh", "-ec", "REG_PASS=\$(echo \"\$REG_PASS_B64\" | base64 -d); mkdir -p /host/etc/rancher/k3s && cat > /host/etc/rancher/k3s/registries.yaml <<REGEOF\nmirrors:\n registry.abrban.com:\n endpoint:\n - http://\${HARBOR_CORE_IP}\n \\\"registry.cloudhost-builds.svc.cluster.local:5000\\\":\n endpoint:\n - \\\"http://127.0.0.1:30500\\\"\nconfigs:\n registry.abrban.com:\n auth:\n username: \${REG_USER}\n password: \${REG_PASS}\n \\\"\${HARBOR_CORE_IP}\\\":\n auth:\n username: \${REG_USER}\n password: \${REG_PASS}\n \\\"registry.cloudhost-builds.svc.cluster.local:5000\\\":\n auth:\n username: admin\n password: \\\"\\\"\n \\\"127.0.0.1:30500\\\":\n auth:\n username: admin\n password: \\\"\\\"\nREGEOF\nnsenter -t 1 -m -u -n -i -- systemctl restart k3s 2>/dev/null || true\necho k3s-restarted\nsleep 30"],
|
|
"volumeMounts": [{"name": "host", "mountPath": "/host"}]
|
|
}],
|
|
"volumes": [{"name": "host", "hostPath": {"path": "/"}}]
|
|
}
|
|
}
|
|
EOF
|
|
)"
|
|
|
|
kubectl -n "${NS}" wait --for=condition=Ready pod/k3s-registries-setup --timeout=180s || true
|
|
kubectl -n "${NS}" logs k3s-registries-setup
|