ci: trust artifactapi internal CA when pushing docker-internal #5

2026-08-15T16:35:03+10:00

unkin-agent commented

2026-08-15 16:35:03 +10:00

The v0.1.0 release pipeline (#3) built the runtime image successfully but failed the push to artifactapi.k8s.syd1.au.unkin.net/docker-internal/jellyfin-ha:v0.1.0 with:

tls: failed to verify certificate: x509: certificate signed by unknown authority

buildkit did not trust artifactapi's TLS cert (signed by the estate's internal Vault CA). The image builds fine and anonymous push to docker-internal is allowed for trusted clients, so the only gap is CA trust during the push handshake.

This change:

Adds a ca-trust step (image git.unkin.net/unkin/almalinux9-base, which already trusts the unkin CA and is the same image the RPM release pipelines use to reach artifactapi over HTTPS) that copies the consolidated trust bundle into the shared workspace.
Points the docker-buildx plugin at that CA via buildkit_config [registry."artifactapi.k8s.syd1.au.unkin.net"] ca=[...]. buildx copies the referenced CA into the buildkitd container under /etc/buildkit/certs when it creates the builder, so the push now verifies.
Uses the fixed workspace path in buildkit_config because CI_WORKSPACE is runtime-only (not substituted at config-evaluation time).
Sets sane k8s resources + serviceAccountName on the new step per repo conventions.

The .NET build and image name/tag logic are unchanged.

This unblocks the v0.1.x image push. autobackup-operator pushes to the same docker-internal registry with the same plugin and no CA trust, so it has the identical gap and will need the same fix.

The v0.1.0 release pipeline (#3) built the runtime image successfully but failed the push to `artifactapi.k8s.syd1.au.unkin.net/docker-internal/jellyfin-ha:v0.1.0` with: ``` tls: failed to verify certificate: x509: certificate signed by unknown authority ``` buildkit did not trust artifactapi's TLS cert (signed by the estate's internal Vault CA). The image builds fine and anonymous push to `docker-internal` is allowed for trusted clients, so the only gap is CA trust during the push handshake. This change: - Adds a `ca-trust` step (image `git.unkin.net/unkin/almalinux9-base`, which already trusts the unkin CA and is the same image the RPM release pipelines use to reach artifactapi over HTTPS) that copies the consolidated trust bundle into the shared workspace. - Points the `docker-buildx` plugin at that CA via `buildkit_config` `[registry."artifactapi.k8s.syd1.au.unkin.net"] ca=[...]`. buildx copies the referenced CA into the buildkitd container under `/etc/buildkit/certs` when it creates the builder, so the push now verifies. - Uses the fixed workspace path in `buildkit_config` because `CI_WORKSPACE` is runtime-only (not substituted at config-evaluation time). - Sets sane k8s resources + `serviceAccountName` on the new step per repo conventions. The `.NET` build and image name/tag logic are unchanged. This unblocks the v0.1.x image push. `autobackup-operator` pushes to the same `docker-internal` registry with the same plugin and no CA trust, so it has the identical gap and will need the same fix.

unkin-agent added 1 commit 2026-08-15 16:35:04 +10:00

ci: trust artifactapi internal CA when pushing docker-internal

ci/woodpecker/pr/build Pipeline was successful

Details

ec04b35b39

The v0.1.0 release pipeline built the runtime image fine but failed the
push to artifactapi.k8s.syd1.au.unkin.net/docker-internal with a TLS
x509 unknown-authority error: buildkit did not trust artifactapi's
Vault-signed cert.

Stage the internal CA into the shared workspace via the almalinux9-base
image (already trusts the unkin CA; same image the RPM release pipelines
use to reach artifactapi over HTTPS) and point the docker-buildx plugin
at it through buildkit_config. buildx copies the referenced CA into the
buildkitd container at builder-create time, so the push handshake now
verifies. No credentials needed: anonymous push to docker-internal is
allowed for trusted clients.

benvin merged commit b1470f3158 into main

2026-08-15 16:42:07 +10:00

benvin deleted branch benvin/jellyfin-buildkit-ca

2026-08-15 16:42:07 +10:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/jellyfin-ha#5