From 7fb35d40624f0557bd8d71f5cc423b4c09d94e62 Mon Sep 17 00:00:00 2001 From: Mukul Sharma Date: Sun, 13 Sep 2026 00:58:48 +0530 Subject: [PATCH] Publish the registry CA to the jenkins namespace MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Node trust covers image pulls, which containerd performs on the node. A docker push from a build pod is a different client with its own trust store and knows nothing about that, so without this a push fails TLS verification while a pull of the same image succeeds — which reads like a broken registry rather than a missing trust anchor. Committed in the clear rather than routed through Vault: this is the CA's public half, the same certificate every node already fetches from Secret Manager. The private key stays in Terraform state and reaches the cluster only as the cert-manager Secret that signs. Consumers mount it at /etc/docker/certs.d/harbor.35.238.248.203.nip.io/ca.crt — the directory name must be the registry hostname exactly, since dockerd looks the path up by host and a mismatch silently does nothing. First consumer is the base-images mirror pod; devops-lib-gcp's build pod follows. Verified the embedded PEM round-trips: its SHA-256 fingerprint matches terraform output registry_ca_cert_pem exactly. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01LEsTefWWifp4ikvhHF5s6N --- extra-manifests/registry-ca-configmap.yaml | 67 ++++++++++++++++++++++ 1 file changed, 67 insertions(+) create mode 100644 extra-manifests/registry-ca-configmap.yaml diff --git a/extra-manifests/registry-ca-configmap.yaml b/extra-manifests/registry-ca-configmap.yaml new file mode 100644 index 0000000..642fddb --- /dev/null +++ b/extra-manifests/registry-ca-configmap.yaml @@ -0,0 +1,67 @@ +# The registry CA's PUBLIC certificate, for Docker clients that push to +# Harbor from inside the cluster. +# +# Not a secret, which is why it is committed here in plain sight rather than +# going through Vault: it is the same certificate every node already fetches +# from Secret Manager, and publishing a CA's public half is what a CA is for. +# The private key is a different matter entirely — it exists only in +# Terraform state and reaches the cluster as the `registry-ca` Secret in the +# cert-manager namespace, which cert-manager uses to sign. +# +# Why this exists at all: the node pool trusting the CA covers image PULLS, +# performed by containerd on the node. A `docker push` from a build pod is a +# separate client with its own trust store, and it has no idea the node +# trusts anything. Without this, pushes fail TLS verification while pulls of +# the very same image work — which reads like a broken registry rather than a +# missing trust anchor. +# +# Mount it in whichever container runs dockerd, at +# /etc/docker/certs.d/harbor.35.238.248.203.nip.io/ca.crt +# The directory name must be the registry hostname exactly; dockerd looks the +# path up by host, so a mismatch silently does nothing. Consumers so far: the +# base-images mirror pod (devops-base-images-gcp) and devops-lib-gcp's build +# pod template. +# +# The homelab needs none of this — its Harbor is plain HTTP and its dind +# passes --insecure-registry instead. +# +# If the CA is ever regenerated in Terraform, this file must be updated to +# match, along with the cert-manager Secret and the node pool's Secret +# Manager version. +apiVersion: v1 +kind: ConfigMap +metadata: + name: registry-ca + namespace: jenkins +data: + ca.crt: | + -----BEGIN CERTIFICATE----- + MIIFMTCCAxmgAwIBAgIRAPf5gf3756sdf3nlZBTnlREwDQYJKoZIhvcNAQELBQAw + MjERMA8GA1UEChMIdG9vbHNoZWQxHTAbBgNVBAMTFHRvb2xzaGVkLXJlZ2lzdHJ5 + LWNhMB4XDTI2MDkxMTA0MDIxNloXDTM2MDkwODA0MDIxNlowMjERMA8GA1UEChMI + dG9vbHNoZWQxHTAbBgNVBAMTFHRvb2xzaGVkLXJlZ2lzdHJ5LWNhMIICIjANBgkq + hkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA5GS3vpS2iG+Gl9YQx/NwlIXfMLhKVfDM + YixjPzYQv93Md9iR8c7CDFPijw8kf7200L7Z6Cp4hrCseL7QZZyvGnrmAt8lfhmz + Fj1Q9RP/WbKam2GHXanz3sWQ7XtUQiEg0yHkBchglgHQYQhdbePMi3zXPx8KPhis + QcNtOAAsLdisIaCz+NrA8qgPMel9LcdZTejaxhBRkOGPHO47xDslNl2JBnermbLc + XqWMh1exyWcscylaE8/e8brufRGWAXMfA+JElDH92VLIGaTQwI2KcTFr9SM7UwYN + tdcggT3BzPOmV/DaICJu+81RplZiEj+rU6ZQ1rwYUMPcEelWaDjL5e+27z5bFTJk + JCGc2x4HjfwD65961d0Mn/BqG8VzwS4lck9QvHcMNlw8o7AKr/q0ZWCcslMFZq7E + fmv6lZLl2Jw0go6dsh2kCRRGjoG4CoQ5YelRYgjzmNPDp4cN8rwKy/Oy80OGjvXt + +AgZvpjuBYGEEvSIM3QttU+6OOuHKxseAY5sbWzuhru0xASq3P4e2pQk8EacnTJc + OrMMDXd39vTazhEb1INJzOeD0fiBNTscQD/vbO0vffrNQiTF6NaKZErRhadZWDCq + 3w5SslAEuHMF3op8KhrCggWG3HlQiHyt0GTKagz8DAKum8/ZMyuoIwp1UIrgp/q7 + fZeqdSDqS5UCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgGGMA8GA1UdEwEB/wQFMAMB + Af8wHQYDVR0OBBYEFEjYpg0hI2j/UC88pR/aG1oeY4VnMA0GCSqGSIb3DQEBCwUA + A4ICAQDNIXgdYnKyDjI95dYSiqsdc4Je7hdFA62/9HXYkjtlsycmm3GM33DcX94N + 9siAtnir6Br3yzGKdwQ8ZB5iZw6aIZTfgwgcnJA/Zrhsx0nfIyIlgZQHOalHXvXt + keE2XoMzF8vzN3YsMpEHT7gRrRQ7Rvn+wufgql5oiO0iaf6XYLypoyXKrBsg+gLh + 8Ek29TuWry9Ip04wtfNCff0+o/vrSpsDVIA34ayEpDqKQqjEgxA8EF3MfXaA3aYb + JWcz+BR2eX3xACkkjCNMuVJFPdsdJyDPmWe8hESpdDY0ATBgyOiZtlcpK+3Uo/WN + AZX856Axi4vJjkNe8ve8+B3oCCbBVZHaPjoi9jEWt/FmO1mtM1On2SWKgHGM4olz + 9nQUL6G+4qypWOCzgu1xtCGIOP184oWR6TMplEHafBUWfamRmNsMxzzWCujGCtFh + O43WajhM2fo2T3egtpCX3orzuOVIisT2trP8pgClB5IKqvoCKc7cyKEb8Va1MVur + pqu+4wNmvZ+M7xRAJhd7FljkeOUTGb3ziuVd8YHsx/GTmJV9QXN1CZsVaRJCZdTt + DcHPaQDiwfSdr+p6ILpyGPH0l+2A+NXSjDI/tCK9CIzeleCPy4m1UhffSqKOaEKs + Gn1E5oROiqzjN5SWKHJRShbxKMq+v3VBN0OZJxQAMshK9aC+eg== + -----END CERTIFICATE-----