Sign in before continuing.

Unverified Commit ac403b9c authored Sep 24, 2026 by Lemon-miaow

fix(build): let kaniko pull base images from the plain-HTTP registry —...

fix(build): let kaniko pull base images from the plain-HTTP registry — push-only insecure flags broke every FROM registry.felis.svc build (#70)

parent 7791ed74

internal/build/jobspec.go

+8 −1

Changes for internal/build/jobspec.go: 8 added lines, 1 removed line.
Original line number	Diff line number	Diff line
		@@ -211,9 +211,16 @@ func BuildJob(p JobParams) (*batchv1.Job, error) {
		"--context=" + contextPath,
		"--destination=" + p.ImageRef,
		// The internal registry is in-cluster only and may serve plain HTTP;
		// it is never a public ingress (spec §17).
		// it is never a public ingress (spec §17). Both directions need the
		// insecure flags: --insecure/--skip-tls-verify cover the PUSH, while
		// the pull side needs its own pair — a Dockerfile's `FROM
		// registry.felis.svc:5000/...` otherwise fails with "server gave
		// HTTP response to HTTPS client", breaking every build based on a
		// platform image (the canonical modpack shape).
		"--insecure",
		"--skip-tls-verify",
		"--insecure-pull",
		"--skip-tls-verify-pull",
		},
		VolumeMounts: kanikoMounts,
		Resources: corev1.ResourceRequirements{Limits: limits, Requests: buildRequests(limits)},

internal/build/jobspec_test.go

+9 −0

Changes for internal/build/jobspec_test.go: 9 added lines, 0 removed lines.
Original line number	Diff line number	Diff line
		@@ -177,6 +177,15 @@ func TestBuildJobKanikoPushesAndTrivyGates(t *testing.T) {
		if !hasArg(kaniko.Args, "--destination="+p.ImageRef) {
		t.Errorf("kaniko must push to %q, args=%v", p.ImageRef, kaniko.Args)
		}
		// The pull direction needs its own flags: --insecure/--skip-tls-verify only
		// cover the push, and without the pull pair a Dockerfile's `FROM` fails
		// against the plain-HTTP registry ("server gave HTTP response to HTTPS
		// client") — the live failure this guards.
		for _, flag := range []string{"--insecure-pull", "--skip-tls-verify-pull"} {
		if !hasArg(kaniko.Args, flag) {
		t.Errorf("kaniko args = %v, want %s so base-image pulls use plain HTTP", kaniko.Args, flag)
		}
		}

		if len(job.Spec.Template.Spec.Containers) != 1 {
		t.Fatalf("expected exactly one (trivy) main container")