Mukul SharmaandClaude Opus 5
b38af45c31
Same manifest and same script as the homelab repo; what differs is the registry host and, substantially, TLS. The homelab's Harbor speaks plain HTTP and its mirror pod passes --insecure-registry. Harbor here serves a real certificate issued from the private CA Terraform created, so the pod instead mounts that CA into the dind container at /etc/docker/certs.d/<registry host>/ca.crt. It goes in the dind container specifically: dockerd performs the push, while docker-cli only talks to it over TCP. The README's project-creation and verification curls now use https and --cacert, since a laptop has no reason to trust this CA either. Still no robot credentials in the pod, for the same reason as the homelab's: the jenkins robot is scoped to the homelab project, and making base-images public grants anonymous pull but never push. A one-off admin docker login beats provisioning another robot for something run this rarely. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LEsTefWWifp4ikvhHF5s6N
34 lines
1.2 KiB
Bash
Executable File
34 lines
1.2 KiB
Bash
Executable File
#!/bin/sh
|
|
# Reads images.txt and pulls/retags/pushes each entry into Harbor's
|
|
# base-images project. Meant to run inside a docker-capable container
|
|
# with push credentials already available. On this cluster that means a
|
|
# docker-cli + dind pod where you have run `docker login` as the Harbor
|
|
# admin: the jenkins robot account is scoped to the homelab project and has
|
|
# no grant on base-images, and making base-images public grants anonymous
|
|
# pull, never push.
|
|
#
|
|
# dind must also trust the registry CA (mounted at
|
|
# /etc/docker/certs.d/<registry host>/ca.crt) — Harbor here serves real TLS,
|
|
# unlike the homelab, where the equivalent pod passes --insecure-registry.
|
|
# See README.md for the exact pod manifest.
|
|
#
|
|
# Not run through any Jenkins pipeline — genuinely occasional, re-run by
|
|
# hand when images.txt changes.
|
|
set -eu
|
|
|
|
REGISTRY="${REGISTRY:-harbor.35.238.248.203.nip.io}"
|
|
PROJECT="${PROJECT:-base-images}"
|
|
|
|
while read -r src target; do
|
|
[ -z "$src" ] && continue
|
|
case "$src" in \#*) continue ;; esac
|
|
|
|
dest="${REGISTRY}/${PROJECT}/${target}"
|
|
echo "=== ${src} -> ${dest} ==="
|
|
docker pull "$src"
|
|
docker tag "$src" "$dest"
|
|
docker push "$dest"
|
|
done < images.txt
|
|
|
|
echo "=== done ==="
|