unkin-agent
b13a8cec78
Bake the internal Vault-PKI CA into a rebuild of woodpeckerci/plugin-docker-buildx so k8s buildx jobs can push to artifactapi's docker-internal registry over TLS. - Dockerfile: copy unkin-ca.crt into /etc/docker/certs.d/<registry>/ca.crt and the system trust store - unkin-ca.crt: vault-ca-cert bundle (root + intermediate) - .woodpecker/build.yaml: PR gate, buildah build-only - .woodpecker/release.yaml: on v* tag, buildah build + credless push to docker-internal with --tls-verify=false (bootstrap)
7 lines
428 B
Docker
7 lines
428 B
Docker
FROM woodpeckerci/plugin-docker-buildx:latest
|
|
# buildkit reads this to trust artifactapi's internal-CA registry on push
|
|
COPY unkin-ca.crt /etc/docker/certs.d/artifactapi.k8s.syd1.au.unkin.net/ca.crt
|
|
# fallback: system trust store (docker login / other code paths)
|
|
COPY unkin-ca.crt /usr/local/share/ca-certificates/unkin-ca.crt
|
|
RUN cat /usr/local/share/ca-certificates/unkin-ca.crt >> /etc/ssl/certs/ca-certificates.crt || true
|