GKE: point the pipeline at this cluster's registry, over TLS

The GCP counterpart of devops-lib. Registered in Jenkins under the same
name, so consuming repos need no change: the two-line Jenkinsfile is
identical on both clusters, and which library it resolves to is a property
of the Jenkins running it.

Substantive changes, all consequences of GKE being a real cloud:

- Harbor speaks TLS here, so dind no longer passes --insecure-registry.
  It mounts the private CA at
  /etc/docker/certs.d/harbor.35.238.248.203.nip.io/ca.crt instead, from the
  registry-ca ConfigMap. This is not redundant with the node pool's trust:
  that covers pulls, performed by containerd on the node, while the push
  comes from dockerd in the build pod with its own trust store. Without it,
  pushes fail TLS verification while pulls of the same image succeed —
  which reads like a broken registry rather than a missing trust anchor.

- The registry hostname changes in the push target and all five fallback
  Dockerfiles. It still must be spelled identically everywhere, because
  Docker matches credentials and trust by exact hostname.

- helm_repo_url moves to cluster DNS. That clone runs in a build pod, so
  sending it out through the ingress and back would make the pipeline
  depend on Contour for pod-to-pod traffic. syncArgoApp already addressed
  ArgoCD this way and needed no change.

- build-tools.Dockerfile is removed: devops-base-images-gcp owns it now,
  next to the mirrored base images, and the pod references the result by
  tag at base-images/build-tools:1. The base-images project is public, so
  the pod can pull it before it has any credentials.

Verified: no homelab addresses remain; the pod template parses with the CA
mount, the new image and no insecure-registry flag; and every fallback
template's base image, with the default version buildDocker would pick, is
present in the mirror manifest — an unmirrored tag now fails the build
rather than silently falling back to Docker Hub.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LEsTefWWifp4ikvhHF5s6N

resources/com/homelab/go-Dockerfile

@@ -13,14 +13,14 @@
 # a dockerBuildVersion whose tag isn't in devops-base-images/images.txt
 # yet needs that added and re-mirrored first, unlike pulling straight
 # from Docker Hub where any tag "just worked".
-FROM harbor.192.168.1.7.nip.io/base-images/golang:${version}-alpine AS build
+FROM harbor.35.238.248.203.nip.io/base-images/golang:${version}-alpine AS build
 WORKDIR /src
 COPY go.mod go.sum* ./
 RUN go mod download 2>/dev/null || true
 COPY . .
 RUN CGO_ENABLED=0 go build -o /app .
 
-FROM harbor.192.168.1.7.nip.io/base-images/alpine:3.20
+FROM harbor.35.238.248.203.nip.io/base-images/alpine:3.20
 COPY --from=build /app /app
 EXPOSE 8080
 ENTRYPOINT ["/app"]

resources/com/homelab/java-Dockerfile

@@ -8,14 +8,14 @@
 # to Maven Central for plugins/dependencies during the build regardless
 # of base image — this only removes the Docker Hub dependency for the
 # base image layer, not package-registry traffic during the build.
-FROM harbor.192.168.1.7.nip.io/base-images/maven:3-eclipse-temurin-${version}-alpine AS build
+FROM harbor.35.238.248.203.nip.io/base-images/maven:3-eclipse-temurin-${version}-alpine AS build
 WORKDIR /src
 COPY pom.xml .
 RUN mvn -B dependency:go-offline
 COPY . .
 RUN mvn -B package -DskipTests
 
-FROM harbor.192.168.1.7.nip.io/base-images/eclipse-temurin:${version}-jre-alpine
+FROM harbor.35.238.248.203.nip.io/base-images/eclipse-temurin:${version}-jre-alpine
 WORKDIR /app
 COPY --from=build /src/target/*.jar app.jar
 EXPOSE 8080

resources/com/homelab/node-Dockerfile

@@ -5,14 +5,14 @@
 # Assumes a standard `npm run build` + `npm start` repo. Switched from
 # node:*-slim (Debian) to node:*-alpine for both stages — smaller, still
 # keeps a shell for kubectl exec debugging (not distroless).
-FROM harbor.192.168.1.7.nip.io/base-images/node:${version}-alpine AS build
+FROM harbor.35.238.248.203.nip.io/base-images/node:${version}-alpine AS build
 WORKDIR /app
 COPY package*.json ./
 RUN npm ci
 COPY . .
 RUN npm run build --if-present
 
-FROM harbor.192.168.1.7.nip.io/base-images/node:${version}-alpine
+FROM harbor.35.238.248.203.nip.io/base-images/node:${version}-alpine
 WORKDIR /app
 COPY --from=build /app .
 ENV NODE_ENV=production

resources/com/homelab/php-Dockerfile

@@ -36,7 +36,7 @@
 # very comment did so), new edits to this header should avoid typing
 # the character at all — write "dollar sign" in words instead of using
 # the glyph.
-FROM harbor.192.168.1.7.nip.io/base-images/php:${version}-cli-alpine
+FROM harbor.35.238.248.203.nip.io/base-images/php:${version}-cli-alpine
 WORKDIR /var/www/html
 RUN apk add --no-cache --virtual .build-deps \$PHPIZE_DEPS \
     && docker-php-ext-install pdo pdo_mysql \

resources/com/homelab/python-Dockerfile

@@ -9,7 +9,7 @@
 # extensions that only ship glibc wheels may need musl-dev/gcc added
 # here to build from source on Alpine — fine for this repo's pure-Python
 # deps, worth knowing if a future repo's requirements.txt needs more.
-FROM harbor.192.168.1.7.nip.io/base-images/python:${version}-alpine
+FROM harbor.35.238.248.203.nip.io/base-images/python:${version}-alpine
 WORKDIR /app
 COPY requirements.txt .
 RUN pip install --no-cache-dir -r requirements.txt

resources/org/homelab/build-tools.Dockerfile

@@ -1,13 +0,0 @@
-# Custom docker-cli image for dind-pod.yaml's docker-cli container —
-# bakes in everything the pipeline stages need at runtime (git, yq,
-# bash, python3 + pip/venv for runHooks' python hooks, curl) so nothing
-# gets apk-installed or curl-downloaded on every single build. Rebuild
-# and push this (see the one-off build commands in the commit that
-# added this file) whenever this list changes; dind-pod.yaml pins the
-# resulting image tag explicitly, so a rebuild doesn't silently roll
-# out until that pin is also bumped.
-FROM docker:27-cli
-
-RUN apk add --no-cache git bash python3 py3-pip py3-virtualenv curl \
-    && curl -sL -o /usr/local/bin/yq https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64 \
-    && chmod +x /usr/local/bin/yq

resources/org/homelab/dind-pod.yaml

@@ -15,32 +15,47 @@ spec:
       image: docker:27-dind
       securityContext:
         privileged: true
-      # Harbor's ingress serves plain HTTP too (TLS disabled cluster-wide
-      # by design — see claude.md's "everything is plain HTTP" note).
-      # Docker defaults to attempting HTTPS against any bare registry
-      # hostname regardless of network path, so this is needed
-      # regardless of which hostname is used — was previously
-      # harbor-core.harbor.svc.cluster.local (cluster-internal Service
-      # DNS, works from this pod but not from the node's own containerd
-      # when pulling for a real Deployment); switched to the Contour
-      # ingress hostname so push and pull can share one reference.
-      args:
-        - "--insecure-registry=harbor.192.168.1.7.nip.io"
+      # No --insecure-registry, unlike the homelab: Harbor here serves a real
+      # certificate, issued by cert-manager from the private CA that the node
+      # pool was told to trust when it was created.
+      #
+      # That node trust covers image PULLS, which containerd performs on the
+      # node. This push is a different client — dockerd, inside this pod,
+      # with its own trust store and no knowledge of what the node trusts —
+      # so it needs the CA mounted itself. dockerd looks it up at
+      # /etc/docker/certs.d/<registry host>/ca.crt, and the directory name
+      # must be the registry hostname exactly; anything else is silently
+      # ignored, and the push then fails TLS verification while a pull of the
+      # very same image works.
+      #
+      # The registry hostname (rather than harbor-core.harbor.svc.cluster.local)
+      # carries over unchanged from the homelab, for a reason that still
+      # holds: cluster DNS resolves from this pod but not from the node's
+      # containerd doing the real Deployment pull, and Docker matches both
+      # stored credentials and trust by exact hostname — so push and pull
+      # have to name the registry identically.
       env:
         - name: DOCKER_TLS_CERTDIR
           value: ""
       volumeMounts:
         - name: docker-graph-storage
           mountPath: /var/lib/docker
+        - name: registry-ca
+          mountPath: /etc/docker/certs.d/harbor.35.238.248.203.nip.io
+          readOnly: true
     - name: docker-cli
-      # Custom image (see build-tools.Dockerfile in this same directory)
-      # — bakes in git/yq/bash/python3+pip/venv/curl so nothing needs
-      # apk-installing or curl-downloading on every single build (was
-      # slow and, per its own point, defeats the purpose of a
-      # reproducible pipeline to be quietly downloading a tool binary
-      # fresh on every run). Versioned tag, not :latest — a rebuild of
-      # the tools image doesn't roll out until this pin is bumped too.
-      image: harbor.192.168.1.7.nip.io/homelab/build-tools:1
+      # Custom image, built and pushed by hand from devops-base-images-gcp
+      # (build-tools.Dockerfile there) — bakes in git/yq/bash/python3 with
+      # pip and venv/curl so nothing needs installing on every single build,
+      # which was slow and quietly undermined reproducibility.
+      #
+      # It lives in the base-images project rather than homelab because that
+      # project is public: this pod pulls the image before any credential is
+      # available to it.
+      #
+      # Versioned tag, never :latest — rebuilding the tools image must not
+      # roll out until this pin is bumped deliberately.
+      image: harbor.35.238.248.203.nip.io/base-images/build-tools:1
       command: ["cat"]
       tty: true
       env:
@@ -77,6 +92,13 @@ spec:
   volumes:
     - name: docker-graph-storage
       emptyDir: {}
+    - name: registry-ca
+      configMap:
+        # Published by devops-infra-argo-config-gcp (extra-manifests). The
+        # CA's public certificate only — its private key never leaves
+        # Terraform state and cert-manager, which is why this is a ConfigMap
+        # rather than a Secret.
+        name: registry-ca
     - name: docker-config
       secret:
         secretName: harbor-robot-dockerconfig