pal-e-docs

Bug: ArgoCD Image Updater cannot authenticate to Harbor

bug-argocd-image-updater-harbor-auth Todo

bug resolved
Project

Problem

ArgoCD Image Updater failed every 2-minute cycle with auth errors. Never successfully updated an image since initial deployment (2026-02-22).

Root Cause

Three issues compounding:
  • Auth key mismatch — docker config secret keyed to harbor.tail5b443a.ts.net but Image Updater looked up credentials by api_url host
  • Wrong service name — PR #4 used harbor-nginx which doesn't exist (actual service is harbor)
  • HTTPS token redirect — Harbor's Docker Registry v2 token service redirects to HTTPS (from externalURL config). Internal HTTP api_url can't follow the redirect because the internal service doesn't serve HTTPS

Fix

Use the external HTTPS URL for everything:
  • api_url = https://harbor.${var.tailscale_domain} (Tailscale handles TLS)
  • docker config auth key = harbor.${var.tailscale_domain} (matches api_url)
Applied via tofu apply -target=kubernetes_secret_v1.harbor_pull_creds -target=helm_release.argocd_image_updater on 2026-03-14. Image Updater now pre-loads 86 image tags from Harbor. Only 2 errors remain (repos that don't exist in Harbor: gmail-mcp-remote, linkedin-scheduler-remote).

Verification

  • No auth errors in Image Updater logs
  • pre-loaded 86 meta data entries from 2 registries
  • errors=2 (only non-existent repos)
  • arch-secrets-pipeline — secrets flow through TF, not kubectl patch
  • plan-pal-e-platform / phase-pal-e-platform-ci-hardening
  • pal-e-services PR #4 — partial fix (wrong approach, superseded)