pal-e-docs

Review: Kaniko HTTPS probe timeout — insecure-registry fix

review-428-2026-03-26 Review

review ready
Project

Verdict: READY

Final re-review 2026-03-27 after issue body rewrite and reopen. All three prior NEEDS_REFINEMENT actions have been addressed.

Template Completeness

  • [x] Type — Bug
  • [x] Lineage — traces to incident #184, identifies this as fix 2 (agent routing was fix 1)
  • [x] Repo — cross-repo, primary pal-e-platform (convention owner)
  • [x] What Broke — documents both Kaniko code paths: push permission check (HTTPS 443 probe, ignores insecure-registry) and actual push (defaults to HTTPS without insecure-registry). Explains why insecure-registry alone is insufficient.
  • [x] Validated Fix — new section documenting real Kaniko pod test (skip-push-permission-check + insecure + insecure-registry = immediate HTTP push, exit 0)
  • [x] Repro Steps — clear 3-step repro with 90s timeout observation
  • [x] Expected Behavior — present
  • [x] Environment — cluster, Kaniko version 2.3.0, Harbor service URL, alerts
  • [x] Acceptance Criteria — 4 items including extra_opts requirement and SOP update
  • [x] File Targets — all 6 internal repos listed with before/after diff; 3 external repos explicitly excluded
  • [x] Change per repo — correct 4-line config (registry + insecure + insecure-registry + extra_opts)
  • [x] Related — links #184, #191, project page

Traceability

  • [x] story:superuser-deploy — present on board item #428
  • [x] arch:ci-pipeline — present on board item #428
  • [x] arch:harbor — present on board item #428
  • [x] Forgejo issue — #193, open (reopened after premature auto-close)

File Targets

All 6 repos verified in filesystem. Each has insecure-registry already merged but no extra_opts:
  • [x] basketball-api/.woodpecker.yaml — verified: has insecure-registry, missing extra_opts. Before/after diff matches.
  • [x] pal-e-docs/.woodpecker.yaml — verified: has insecure-registry, missing extra_opts. Before/after diff matches.
  • [x] pal-e-app/.woodpecker.yaml — verified: has insecure-registry, missing extra_opts. Before/after diff matches.
  • [x] westside-app/.woodpecker.yaml — verified: has insecure-registry, missing extra_opts. Before/after diff matches.
  • [x] westside-contracts/.woodpecker.yaml — verified: has insecure-registry, missing extra_opts. Before/after diff matches.
  • [x] pal-e-mail/.woodpecker.yaml — verified: has insecure-registry, missing extra_opts. Before/after diff matches.
External repos verified safe (no change needed):
  • [x] mcd-tracker-api/.woodpecker.yaml — uses harbor.tail5b443a.ts.net (TLS via funnel), no insecure settings
  • [x] mcd-tracker-app/.woodpecker.yaml — uses harbor.tail5b443a.ts.net (TLS via funnel), no insecure settings
  • [x] minio-api/.woodpecker.yaml — uses harbor.tail5b443a.ts.net (TLS via funnel), no insecure settings

Repo Placement

Issue filed on forgejo_admin/pal-e-platform as convention owner for cross-repo CI concerns — correct. Actual changes are .woodpecker.yaml edits across 6 consumer repos, each requiring its own PR.

Dependencies

  • #184 (parent incident) — in_progress on board. This is fix 2.
  • #191 (fix 1: agent routing) — merged. No blocker.
  • #194 (bump agent parallel workflows) — in_progress. Independent, not blocking.
  • No undocumented dependencies found.

Acceptance Criteria Assessment

All 4 criteria are testable by an agent:
  • [x] "All 6 internal-registry repos have extra_opts" — grep-verifiable in .woodpecker.yaml
  • [x] "build-and-push step completes without HTTPS probe" — verifiable from Woodpecker pipeline logs
  • [x] "No regression on 3 external-registry repos" — they don't change, verifiable by diff
  • [x] "service-onboarding-sop CI registry section updated" — verifiable via pal-e-docs API

Blast Radius

  • All 6 internal repos confirmed affected (all use harbor.harbor.svc.cluster.local with insecure: true)
  • All 3 external repos confirmed unaffected (use harbor.tail5b443a.ts.net with TLS)
  • service-onboarding-sop CI registry row currently says harbor-core.harbor.svc.cluster.local but repos use harbor.harbor.svc.cluster.local — pre-existing hostname mismatch, not in scope for this ticket but should be tracked separately

Prior Review Actions (all resolved)

  • Reopen issue #193 — DONE (issue state = open)
  • Update issue body with validated fix — DONE (body now documents both code paths, validated fix, correct before/after diff, extra_opts in AC)
  • Add SOP update AC — DONE (AC item #4)

Recommendation

No action needed. Ticket is READY for execution. The SOP hostname mismatch (harbor-core vs harbor) is out of scope — track as discovered scope if desired.