Celes Renata
b0e64bf90f
The Kyverno policy injected HTTP_PROXY into build pods but NO_PROXY was missing .celestium.life. Docker login to registry.celestium.life was going through the Squid proxy which does SSL interception, causing auth failures.
54 lines
1.7 KiB
YAML
54 lines
1.7 KiB
YAML
apiVersion: kyverno.io/v1
|
|
kind: ClusterPolicy
|
|
metadata:
|
|
name: woodpecker-proxy-ca
|
|
annotations:
|
|
policies.kyverno.io/title: "Woodpecker Proxy CA Injection"
|
|
policies.kyverno.io/category: "Networking"
|
|
policies.kyverno.io/subject: "Pod"
|
|
spec:
|
|
rules:
|
|
- name: inject-ca-cert
|
|
match:
|
|
any:
|
|
- resources:
|
|
kinds:
|
|
- Pod
|
|
namespaces:
|
|
- woodpecker
|
|
exclude:
|
|
any:
|
|
- resources:
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: server
|
|
- resources:
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: agent
|
|
mutate:
|
|
patchStrategicMerge:
|
|
spec:
|
|
containers:
|
|
- (name): "*"
|
|
env:
|
|
- name: HTTP_PROXY
|
|
value: "http://192.168.42.1:3128"
|
|
- name: HTTPS_PROXY
|
|
value: "http://192.168.42.1:3128"
|
|
- name: NO_PROXY
|
|
value: "10.0.0.0/8,192.168.0.0/16,127.0.0.1,localhost,.local,.celestium.life"
|
|
- name: no_proxy
|
|
value: "10.0.0.0/8,192.168.0.0/16,127.0.0.1,localhost,.local,.celestium.life"
|
|
- name: SSL_CERT_FILE
|
|
value: "/etc/ssl/certs/proxy-ca.crt"
|
|
volumeMounts:
|
|
- name: proxy-ca
|
|
mountPath: /etc/ssl/certs/proxy-ca.crt
|
|
subPath: ca.crt
|
|
readOnly: true
|
|
volumes:
|
|
- name: proxy-ca
|
|
configMap:
|
|
name: proxy-ca-cert
|