unkin-agent
f2b7d07006
Point the buildx docker-container builder at artifactapi's in-image CA (/etc/docker/certs.d/.../ca.crt) so buildkitd, which runs in its own container and performs the push, trusts the registry. Applied to both push steps (docker-operator and docker-tsig-api). Proven in jellyfin-ha v0.1.2.
31 lines
1.0 KiB
YAML
31 lines
1.0 KiB
YAML
when:
|
|
- event: tag
|
|
ref: refs/tags/v*
|
|
|
|
steps:
|
|
- name: docker-operator
|
|
image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/plugin-docker-buildx:latest
|
|
settings:
|
|
registry: artifactapi.k8s.syd1.au.unkin.net
|
|
repo: artifactapi.k8s.syd1.au.unkin.net/docker-internal/bind-operator
|
|
dockerfile: Dockerfile.operator
|
|
buildkit_config: |
|
|
[registry."artifactapi.k8s.syd1.au.unkin.net"]
|
|
ca = ["/etc/docker/certs.d/artifactapi.k8s.syd1.au.unkin.net/ca.crt"]
|
|
tags:
|
|
- ${CI_COMMIT_TAG}
|
|
- latest
|
|
|
|
- name: docker-tsig-api
|
|
image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/plugin-docker-buildx:latest
|
|
settings:
|
|
registry: artifactapi.k8s.syd1.au.unkin.net
|
|
repo: artifactapi.k8s.syd1.au.unkin.net/docker-internal/bind-tsig-api
|
|
dockerfile: Dockerfile.tsigapi
|
|
buildkit_config: |
|
|
[registry."artifactapi.k8s.syd1.au.unkin.net"]
|
|
ca = ["/etc/docker/certs.d/artifactapi.k8s.syd1.au.unkin.net/ca.crt"]
|
|
tags:
|
|
- ${CI_COMMIT_TAG}
|
|
- latest
|