From f2b7d070063872cf2a06fc6133e43328cf260552 Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Sat, 15 Aug 2026 18:30:44 +1000 Subject: [PATCH] ci: add buildkit_config CA trust for artifactapi push Point the buildx docker-container builder at artifactapi's in-image CA (/etc/docker/certs.d/.../ca.crt) so buildkitd, which runs in its own container and performs the push, trusts the registry. Applied to both push steps (docker-operator and docker-tsig-api). Proven in jellyfin-ha v0.1.2. --- .woodpecker/docker.yaml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.woodpecker/docker.yaml b/.woodpecker/docker.yaml index 388e482..b39efc4 100644 --- a/.woodpecker/docker.yaml +++ b/.woodpecker/docker.yaml @@ -9,6 +9,9 @@ steps: registry: artifactapi.k8s.syd1.au.unkin.net repo: artifactapi.k8s.syd1.au.unkin.net/docker-internal/bind-operator dockerfile: Dockerfile.operator + buildkit_config: | + [registry."artifactapi.k8s.syd1.au.unkin.net"] + ca = ["/etc/docker/certs.d/artifactapi.k8s.syd1.au.unkin.net/ca.crt"] tags: - ${CI_COMMIT_TAG} - latest @@ -19,6 +22,9 @@ steps: registry: artifactapi.k8s.syd1.au.unkin.net repo: artifactapi.k8s.syd1.au.unkin.net/docker-internal/bind-tsig-api dockerfile: Dockerfile.tsigapi + buildkit_config: | + [registry."artifactapi.k8s.syd1.au.unkin.net"] + ca = ["/etc/docker/certs.d/artifactapi.k8s.syd1.au.unkin.net/ca.crt"] tags: - ${CI_COMMIT_TAG} - latest