Kaniko build-arg override breaks base image pull via cluster-internal address #77

New issue

Closed

opened 2026-06-04 04:36:28 +00:00 by ldraney · 0 comments

ldraney commented

2026-06-04 04:36:28 +00:00

Owner

Type

Bug

Lineage

Regression from ldraney/landscaping-assistant #76 — build-arg override introduced in that PR.

Repo

ldraney/landscaping-assistant

What Broke

Pipelines #171, #172, #173 all fail at build-and-push. Kaniko tries to pull the base image from harbor.harbor.svc.cluster.local (overridden via build_args in .woodpecker.yaml) but can't connect — HTTPS times out on 443, HTTP refused on 80. The Dockerfile defaults REGISTRY to harbor.tail5b443a.ts.net (Tailscale FQDN) which works reliably, but the CI config overrides it to the cluster-internal address.

error building image: Get "https://harbor.harbor.svc.cluster.local/v2/": dial tcp 10.43.131.178:443: i/o timeout
Get "http://harbor.harbor.svc.cluster.local/v2/": dial tcp 10.43.131.178:80: connect: connection refused

Push to harbor.harbor.svc.cluster.local works fine (pipeline #164 confirmed). The issue is pull-side only.

Repro Steps

Merge any PR to main
Pipeline triggers, lint + test pass
build-and-push step fails pulling base image from cluster-internal Harbor

Expected Behavior

Kaniko pulls base images via the Tailscale FQDN (Dockerfile default) and pushes via the cluster-internal address. Both paths work.

Environment

Cluster/namespace: prod / woodpecker
Service version/commit: HEAD of main after PR #76
Related alerts: none

Acceptance Criteria

Pipeline builds and pushes image successfully on merge to main
Base image pull uses reliable Tailscale FQDN
Push still uses cluster-internal address

ldraney/landscaping-assistant #23 — parent CI optimization issue
ldraney/landscaping-assistant #76 — PR that introduced the regression
landscaping-assistant — project this affects

### Type Bug ### Lineage Regression from `ldraney/landscaping-assistant #76` — build-arg override introduced in that PR. ### Repo `ldraney/landscaping-assistant` ### What Broke Pipelines #171, #172, #173 all fail at `build-and-push`. Kaniko tries to pull the base image from `harbor.harbor.svc.cluster.local` (overridden via `build_args` in `.woodpecker.yaml`) but can't connect — HTTPS times out on 443, HTTP refused on 80. The Dockerfile defaults `REGISTRY` to `harbor.tail5b443a.ts.net` (Tailscale FQDN) which works reliably, but the CI config overrides it to the cluster-internal address. ``` error building image: Get "https://harbor.harbor.svc.cluster.local/v2/": dial tcp 10.43.131.178:443: i/o timeout Get "http://harbor.harbor.svc.cluster.local/v2/": dial tcp 10.43.131.178:80: connect: connection refused ``` Push to `harbor.harbor.svc.cluster.local` works fine (pipeline #164 confirmed). The issue is pull-side only. ### Repro Steps 1. Merge any PR to main 2. Pipeline triggers, lint + test pass 3. `build-and-push` step fails pulling base image from cluster-internal Harbor ### Expected Behavior Kaniko pulls base images via the Tailscale FQDN (Dockerfile default) and pushes via the cluster-internal address. Both paths work. ### Environment - Cluster/namespace: prod / woodpecker - Service version/commit: HEAD of main after PR #76 - Related alerts: none ### Acceptance Criteria - [ ] Pipeline builds and pushes image successfully on merge to main - [ ] Base image pull uses reliable Tailscale FQDN - [ ] Push still uses cluster-internal address ### Related - `ldraney/landscaping-assistant #23` — parent CI optimization issue - `ldraney/landscaping-assistant #76` — PR that introduced the regression - `landscaping-assistant` — project this affects