fix: Kaniko insecure-registry for Harbor (#193) #216

Merged

forgejo_admin merged 1 commit from 193-kaniko-insecure-registry into main

2026-03-27 03:16:14 +00:00

forgejo_admin commented

2026-03-27 03:03:59 +00:00

Owner

Summary

Kaniko probes HTTPS on port 443 before falling back to HTTP, causing a 90-second timeout against Harbor's HTTP-only in-cluster service. Adding insecure-registry tells Kaniko to skip the HTTPS probe and use HTTP directly.

Changes

.woodpecker.yaml: Added insecure-registry: harbor.harbor.svc.cluster.local to the build-and-push step settings, alongside the existing insecure: true

Test Plan

Tests pass locally (no test changes -- CI config only)
Trigger a CI pipeline on this branch and verify the build-and-push step no longer hangs for 90s on the HTTPS probe
Merge to main and confirm the full pipeline (test, build-and-push, smoke-test) completes successfully

Review Checklist

Passed automated review-fix loop
No secrets committed
No unnecessary file changes
Commit messages are descriptive

Closes forgejo_admin/pal-e-platform#193 -- Kaniko HTTPS probe timeout against Harbor
pal-e-docs -- the project this work belongs to

## Summary Kaniko probes HTTPS on port 443 before falling back to HTTP, causing a 90-second timeout against Harbor's HTTP-only in-cluster service. Adding `insecure-registry` tells Kaniko to skip the HTTPS probe and use HTTP directly. ## Changes - `.woodpecker.yaml`: Added `insecure-registry: harbor.harbor.svc.cluster.local` to the `build-and-push` step settings, alongside the existing `insecure: true` ## Test Plan - [ ] Tests pass locally (no test changes -- CI config only) - [ ] Trigger a CI pipeline on this branch and verify the build-and-push step no longer hangs for 90s on the HTTPS probe - [ ] Merge to main and confirm the full pipeline (test, build-and-push, smoke-test) completes successfully ## Review Checklist - [ ] Passed automated review-fix loop - [ ] No secrets committed - [ ] No unnecessary file changes - [ ] Commit messages are descriptive ## Related Notes - Closes forgejo_admin/pal-e-platform#193 -- Kaniko HTTPS probe timeout against Harbor - `pal-e-docs` -- the project this work belongs to

forgejo_admin added 1 commit

2026-03-27 03:03:59 +00:00

fix: add insecure-registry to skip Kaniko HTTPS probe timeout

ci/woodpecker/pr/woodpecker Pipeline failed

Details

1d84071b8b

Kaniko probes HTTPS on port 443 before falling back to HTTP, causing 90s
timeout against Harbor's HTTP-only service. The insecure-registry setting
tells Kaniko to use HTTP directly.

Refs: forgejo_admin/pal-e-platform#193

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

forgejo_admin commented

2026-03-27 03:05:02 +00:00

Author

Owner

QA Review

Diff Analysis

Single-line addition to .woodpecker.yaml:

insecure-registry: harbor.harbor.svc.cluster.local

Correctness:

The insecure-registry setting is a valid Kaniko plugin parameter that tells Kaniko to skip the HTTPS probe and connect directly via HTTP
The value matches the existing registry field exactly (harbor.harbor.svc.cluster.local), which is correct
Placement within the settings block is syntactically correct YAML

SOP Compliance:

No secrets committed
No unnecessary file changes (1 file, 1 line)
Commit message is descriptive with proper issue reference
PR body follows template with all required sections

Risk Assessment:

Minimal risk -- this only affects the CI build-and-push step behavior
insecure: true (existing) controls the Kaniko daemon push behavior; insecure-registry controls the registry probe behavior -- both are needed for HTTP-only Harbor

No issues found.

VERDICT: APPROVE

## QA Review ### Diff Analysis Single-line addition to `.woodpecker.yaml`: ```yaml insecure-registry: harbor.harbor.svc.cluster.local ``` **Correctness:** - The `insecure-registry` setting is a valid Kaniko plugin parameter that tells Kaniko to skip the HTTPS probe and connect directly via HTTP - The value matches the existing `registry` field exactly (`harbor.harbor.svc.cluster.local`), which is correct - Placement within the `settings` block is syntactically correct YAML **SOP Compliance:** - No secrets committed - No unnecessary file changes (1 file, 1 line) - Commit message is descriptive with proper issue reference - PR body follows template with all required sections **Risk Assessment:** - Minimal risk -- this only affects the CI build-and-push step behavior - `insecure: true` (existing) controls the Kaniko daemon push behavior; `insecure-registry` controls the registry probe behavior -- both are needed for HTTP-only Harbor **No issues found.** --- **VERDICT: APPROVE**