From a9119d7b8ebedd9f8e83df4da5d143c47ffd1c4e Mon Sep 17 00:00:00 2001 From: Mukul Sharma Date: Sun, 13 Sep 2026 08:02:13 +0530 Subject: [PATCH] Push to apps-registry, the project that exists on this Harbor MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The homelab pushes to a project called "homelab"; this cluster's is apps-registry. Harbor rejects a push to a missing project with "unauthorized: project homelab not found" — the word unauthorized sends you looking at the robot account, when the credentials were never the problem. Only the harbor_project default changes. The com/homelab and org/homelab paths in this repo are the library's own package and resource paths and have nothing to do with the registry; renaming those would break the library. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01LEsTefWWifp4ikvhHF5s6N --- README.md | 2 +- vars/homelabPipeline.groovy | 7 ++++++- 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 07bc0bb..9dd8316 100644 --- a/README.md +++ b/README.md @@ -46,7 +46,7 @@ in after checkout; repo-committed values win over the Jenkinsfile call). |---|---|---| | `service_name` | `repo_name` | Second path segment under `devops-helm-charts/values/` | | `argo_app_name` | `repo_name` | Must match the ArgoCD Application's `metadata.name` | -| `harbor_project` | `homelab` | Must be an existing, public Harbor project | +| `harbor_project` | `apps-registry` | Must already exist in Harbor, and be public unless you also wire an `imagePullSecret` — the app values assume anonymous pull. A push to a missing project fails as `unauthorized: project not found` | | `helm_repo_url` | `devops-helm-charts-gcp`, over cluster DNS | `http://gitea-http.gitea.svc.cluster.local:3000/gitadmin/…` — pod-to-pod, so it never leaves the cluster and comes back through the ingress | | `image_tag_yq_path` | `.deployment.image.tag` | **Override this if the app's chart isn't `1.0.0`** — e.g. `sts-2.0.0` uses `.podtemplate.image.tag` instead. Getting this wrong doesn't fail loudly: `yq -i` creates the path if missing rather than erroring, silently leaving the real field un-bumped. | | `dockerBuildVersion` | none | Only read when the repo has **no Dockerfile of its own** — picks a fallback template (see below). No default; either ship a Dockerfile or set this. | diff --git a/vars/homelabPipeline.groovy b/vars/homelabPipeline.groovy index d72c8d3..84f553b 100644 --- a/vars/homelabPipeline.groovy +++ b/vars/homelabPipeline.groovy @@ -23,7 +23,12 @@ def call(Map config) { config.service_name = config.service_name ?: config.repo_name config.argo_app_name = config.argo_app_name ?: config.repo_name - config.harbor_project = config.harbor_project ?: 'homelab' + // The Harbor project images are pushed to. Named apps-registry on this + // cluster, not the homelab's "homelab" — the project has to already + // exist, and Harbor rejects a push to a missing one with + // "unauthorized: project not found", which reads like a + // credentials problem rather than a missing project. + config.harbor_project = config.harbor_project ?: 'apps-registry' // Cluster DNS, not the ingress hostname: this clone happens from a build // pod, so it is pod-to-pod traffic and has no business leaving the // cluster and coming back in through Contour.