From 3ffa2d84445ceb50de87457aa35f1b90a5d682f0 Mon Sep 17 00:00:00 2001
From: Mukul Sharma <mukul.sharma909.ms@gmail.com>
Date: Wed, 2 Sep 2026 23:54:11 +0530
Subject: [PATCH] Switch registry hostname to Contour ingress
 (harbor.192.168.1.7.nip.io)

demo-go-app's Deployment failed to pull: "dial tcp: lookup
harbor-core.harbor.svc.cluster.local on 127.0.0.53:53: server
misbehaving". docker push worked from the Jenkins build pod because
it has pod-network DNS (CoreDNS); pulling for a real Deployment
happens via containerd on the node itself, using the node's host-level
resolver, which has no route to *.svc.cluster.local at all. Switches
buildDocker.groovy's push target and dind-pod.yaml's
--insecure-registry flag to the Contour ingress hostname instead,
which resolves via normal public DNS (nip.io) from both pods and the
host.
---
 resources/org/homelab/dind-pod.yaml       | 19 ++++++++++---------
 src/com/homelab/stages/buildDocker.groovy | 10 +++++++++-
 2 files changed, 19 insertions(+), 10 deletions(-)

diff --git a/resources/org/homelab/dind-pod.yaml b/resources/org/homelab/dind-pod.yaml
index 38d643c..726e68d 100644
--- a/resources/org/homelab/dind-pod.yaml
+++ b/resources/org/homelab/dind-pod.yaml
@@ -15,16 +15,17 @@ spec:
       image: docker:27-dind
       securityContext:
         privileged: true
-      # Harbor's harbor-core Service serves plain HTTP internally (TLS is
-      # disabled cluster-wide by design — see claude.md's "everything is
-      # plain HTTP" note). Docker still defaults to attempting HTTPS
-      # against any bare registry hostname regardless of whether the
-      # network path actually involves TLS anywhere — that default isn't
-      # about routing through Contour/Ingress, it's just the client's own
-      # convention. Without this flag, `docker push` hangs doing a TLS
-      # handshake against a server that's only ever spoken HTTP.
+      # Harbor's ingress serves plain HTTP too (TLS disabled cluster-wide
+      # by design — see claude.md's "everything is plain HTTP" note).
+      # Docker defaults to attempting HTTPS against any bare registry
+      # hostname regardless of network path, so this is needed
+      # regardless of which hostname is used — was previously
+      # harbor-core.harbor.svc.cluster.local (cluster-internal Service
+      # DNS, works from this pod but not from the node's own containerd
+      # when pulling for a real Deployment); switched to the Contour
+      # ingress hostname so push and pull can share one reference.
       args:
-        - "--insecure-registry=harbor-core.harbor.svc.cluster.local"
+        - "--insecure-registry=harbor.192.168.1.7.nip.io"
       env:
         - name: DOCKER_TLS_CERTDIR
           value: ""
diff --git a/src/com/homelab/stages/buildDocker.groovy b/src/com/homelab/stages/buildDocker.groovy
index 31902a3..d524176 100644
--- a/src/com/homelab/stages/buildDocker.groovy
+++ b/src/com/homelab/stages/buildDocker.groovy
@@ -20,7 +20,15 @@ import com.homelab.utilities.constructTemplate
 def run(Map config) {
     def tag = "${env.BUILD_NUMBER}-${env.GIT_COMMIT?.take(7) ?: 'dev'}"
     env.TAG = tag
-    def image = "harbor-core.harbor.svc.cluster.local/${config.harbor_project}/${config.repo_name}:${tag}"
+    // Was harbor-core.harbor.svc.cluster.local (cluster-internal Service
+    // DNS) — worked for this push, since it runs inside a pod with
+    // pod-network DNS (CoreDNS). But the actual Deployment's image PULL
+    // happens via containerd running on the node itself, using the
+    // node's host-level DNS resolver, which has no route to
+    // *.svc.cluster.local at all. Using the Contour ingress hostname
+    // instead makes the same reference resolvable from both contexts
+    // (nip.io resolves via normal public DNS, reachable from the host).
+    def image = "harbor.192.168.1.7.nip.io/${config.harbor_project}/${config.repo_name}:${tag}"
     try {
         stage(stageName('Build & push image')) {
             container('docker-cli') {