cloud-host/gitops/jobs/seed-ci-images.yaml

# Bootstrap: seed CI/build images into Harbor project abrban/
#
# kubelet and Kaniko cannot reliably use Harbor proxy-cache for all images.
# Run once after Harbor is up and registry-egress-proxy exists in cloudhost:
#
#   kubectl apply -f gitops/jobs/seed-ci-images.yaml
#   kubectl -n cloudhost wait --for=condition=complete job/seed-ci-images --timeout=15m
#
# Images copied (see RUNBOOK-CICD.fa.md):
#   abrban/act-runner, abrban/alpine, abrban/alpine-git, abrban/node, abrban/kaniko-executor
apiVersion: batch/v1
kind: Job
metadata:
  name: seed-ci-images
  namespace: cloudhost
spec:
  ttlSecondsAfterFinished: 3600
  backoffLimit: 2
  template:
    spec:
      restartPolicy: Never
      imagePullSecrets:
        - name: registry-pull-secret
      containers:
        - name: skopeo
          image: quay.io/skopeo/stable:latest
          imagePullPolicy: IfNotPresent
          envFrom:
            - secretRef:
                name: registry-egress-proxy
          command:
            - sh
            - -ec
            - |
              set -eux
              DEST="docker://harbor-registry.cloudhost.svc.cluster.local:5000/abrban"
              # Must match harbor-core → REGISTRY_CREDENTIAL_PASSWORD (default: harbor_registry_password)
              CREDS="harbor_registry_user:harbor_registry_password"
              skopeo copy --dest-tls-verify=false --dest-creds="${CREDS}" \
                docker://docker.io/gitea/act_runner:0.2.11 \
                "${DEST}/act-runner:0.2.11"
              skopeo copy --dest-tls-verify=false --dest-creds="${CREDS}" \
                docker://docker.io/library/alpine:3.19 \
                "${DEST}/alpine:3.19"
              skopeo copy --dest-tls-verify=false --dest-creds="${CREDS}" \
                docker://docker.io/alpine/git:2.43.0 \
                "${DEST}/alpine-git:2.43.0"
              skopeo copy --dest-tls-verify=false --dest-creds="${CREDS}" \
                docker://docker.io/library/node:24-alpine \
                "${DEST}/node:24-alpine"
              # v1.27.6-debug does not exist on gcr.io — use v1.23.2 (matches platform values).
              skopeo copy --dest-tls-verify=false --dest-creds="${CREDS}" \
                docker://gcr.io/kaniko-project/executor:v1.23.2 \
                "${DEST}/kaniko-executor:v1.23.2"
              echo SEED_OK