keyhan
7e66d1edf3
Build and Deploy Platform / build-and-deploy (push) Failing after 20m1s
- Workflow now pushes image tags to the separate cloud-host-gitops repo
(no more CI loop risk) and authenticates via CI_TOKEN secret
- Fix undefined ${REGISTRY} in Kaniko jobs, add concurrency group,
targeted tag update, and mounted kaniko-harbor-auth docker config
- Argo CD Application is now multi-source (chart from cloud-host,
values from cloud-host-gitops)
- Remove plaintext runner token and proxy credentials from manifests;
secrets are now SealedSecrets in the gitops repo
Co-authored-by: Cursor <cursoragent@cursor.com>
37 lines
1.5 KiB
YAML
37 lines
1.5 KiB
YAML
# Example only — DO NOT commit real credentials.
|
|
# The real secret is managed as a SealedSecret in the cloud-host-gitops repo
|
|
# (sealed-secrets/kaniko-harbor-auth.yaml).
|
|
#
|
|
# Kaniko pushes directly to the internal registry endpoint
|
|
# (harbor-registry.cloudhost.svc.cluster.local:5000), which bypasses harbor-core.
|
|
# That endpoint only accepts the internal registry credential — Harbor robot
|
|
# accounts do NOT work there (their tokens are issued by harbor-core's token
|
|
# service). Use the harbor_registry_user credential from the harbor-core secret:
|
|
#
|
|
# REG_PASS="$(kubectl -n cloudhost get secret harbor-core \
|
|
# -o jsonpath='{.data.REGISTRY_CREDENTIAL_PASSWORD}' | base64 -d)"
|
|
# kubectl -n cloudhost-builds create secret docker-registry kaniko-harbor-auth \
|
|
# --docker-server=harbor-registry.cloudhost.svc.cluster.local:5000 \
|
|
# --docker-username=harbor_registry_user \
|
|
# --docker-password="${REG_PASS}"
|
|
#
|
|
# The build-deploy workflow mounts this secret at /kaniko/.docker/config.json
|
|
# inside every Kaniko Job. See RUNBOOK-CICD.fa.md for the full procedure.
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: kaniko-harbor-auth
|
|
namespace: cloudhost-builds
|
|
type: kubernetes.io/dockerconfigjson
|
|
stringData:
|
|
.dockerconfigjson: |
|
|
{
|
|
"auths": {
|
|
"harbor-registry.cloudhost.svc.cluster.local:5000": {
|
|
"username": "harbor_registry_user",
|
|
"password": "<REGISTRY_CREDENTIAL_PASSWORD>",
|
|
"auth": "<base64 of username:password>"
|
|
}
|
|
}
|
|
}
|