fix: Kaniko skip-push-permission-check (#193) #182

Merged

forgejo_admin merged 1 commit from 193-kaniko-skip-push-check into main

2026-03-27 05:20:52 +00:00

forgejo_admin commented

2026-03-27 05:03:19 +00:00

Owner

Summary

Kaniko's push permission check uses a separate HTTPS transport that ignores the insecure-registry setting, causing a timeout when pushing to Harbor over HTTP inside the cluster. Adding --skip-push-permission-check bypasses this probe entirely.

Changes

.woodpecker.yaml: Added extra_opts: "--skip-push-permission-check" to the build-and-push Kaniko step settings

Test Plan

Merge to main and verify the Woodpecker pipeline completes the build-and-push step without the previous HTTPS timeout error
Confirm the image is pushed to Harbor at harbor.harbor.svc.cluster.local/basketball-api/api

Review Checklist

Single-file change, minimal blast radius
Validated flag behavior in a real Kaniko pod before shipping
No secrets or env var changes required

Closes forgejo_admin/pal-e-platform#193

## Summary Kaniko's push permission check uses a separate HTTPS transport that ignores the `insecure-registry` setting, causing a timeout when pushing to Harbor over HTTP inside the cluster. Adding `--skip-push-permission-check` bypasses this probe entirely. ## Changes - `.woodpecker.yaml`: Added `extra_opts: "--skip-push-permission-check"` to the `build-and-push` Kaniko step settings ## Test Plan - Merge to main and verify the Woodpecker pipeline completes the build-and-push step without the previous HTTPS timeout error - Confirm the image is pushed to Harbor at `harbor.harbor.svc.cluster.local/basketball-api/api` ## Review Checklist - [x] Single-file change, minimal blast radius - [x] Validated flag behavior in a real Kaniko pod before shipping - [x] No secrets or env var changes required ## Related Notes Closes forgejo_admin/pal-e-platform#193

forgejo_admin added 1 commit

2026-03-27 05:03:19 +00:00

fix: add skip-push-permission-check to Kaniko build step

ci/woodpecker/pr/woodpecker Pipeline was successful

Details

e26f953b22

The insecure-registry setting does not apply to Kaniko's push permission
check, which uses a separate transport that still probes HTTPS on 443.
Adding --skip-push-permission-check bypasses this entirely. Validated
in a real Kaniko pod before shipping.

Refs: forgejo_admin/pal-e-platform#193

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>