From f323d18cf7cf2ce30dff83b6f9a128fa1cd889c4 Mon Sep 17 00:00:00 2001
From: Nathanial Lubitz <nate.lubitz@gmail.com>
Date: Mon, 29 Jun 2026 17:32:29 +1000
Subject: [PATCH] insecure registry

---
 internal/config/defaults.go         |  3 +-
 internal/config/types.go            |  9 ++++--
 internal/generator/gitea_actions.go | 43 +++++++++++++++++------------
 internal/generator/manifests.go     | 12 +++++---
 4 files changed, 43 insertions(+), 24 deletions(-)

diff --git a/internal/config/defaults.go b/internal/config/defaults.go
index d86098d..8cf1e5b 100644
--- a/internal/config/defaults.go
+++ b/internal/config/defaults.go
@@ -103,7 +103,8 @@ func applyRegistryDefaults(r *RegistryConfig, m *MetaConfig) {
 	if r.URL == "" {
 		r.URL = DefaultRegistryURL
 	}
-	if r.PullSecret == "" {
+	// Insecure (in-cluster) registries need no imagePullSecret.
+	if r.PullSecret == "" && !r.Insecure {
 		r.PullSecret = DefaultPullSecret
 	}
 	if r.Repository == "" {
diff --git a/internal/config/types.go b/internal/config/types.go
index b47c0b4..fafef3b 100644
--- a/internal/config/types.go
+++ b/internal/config/types.go
@@ -40,8 +40,13 @@ type MetaConfig struct {
 
 type RegistryConfig struct {
 	URL        string `yaml:"url"`
-	Repository string `yaml:"repository,omitempty"` // default: ${tenant}/${name}
-	PullSecret string `yaml:"pull_secret,omitempty"` // default: regcred
+	Repository string `yaml:"repository,omitempty"`  // default: ${tenant}/${name}
+	PullSecret string `yaml:"pull_secret,omitempty"` // default: regcred; set to "" to disable
+	// Insecure marks the registry as HTTP-only (no TLS). Skips docker login,
+	// omits imagePullSecrets from manifests, and configures buildkitd for
+	// plain-HTTP pushes. Typical for in-cluster registries accessed via
+	// ClusterIP/service DNS rather than an Ingress.
+	Insecure bool `yaml:"insecure,omitempty"`
 }
 
 // ------------------------------------------------------------
diff --git a/internal/generator/gitea_actions.go b/internal/generator/gitea_actions.go
index 83f93fa..d266c85 100644
--- a/internal/generator/gitea_actions.go
+++ b/internal/generator/gitea_actions.go
@@ -78,27 +78,36 @@ func writeDeployJobs(b *strings.Builder, cfg *config.KforgeConfig, opts GiteaAct
 		"run": `echo "SHORT_SHA=$(git rev-parse --short HEAD)" >> $GITHUB_ENV`,
 	})
 
-	writeStep(b, "Login to registry", map[string]any{
-		"uses": "docker/login-action@v2",
-		"with": map[string]any{
-			"registry": cfg.Registry.URL,
-			"username": "${{ secrets.DOCKER_USERNAME }}",
-			"password": "${{ secrets.DOCKER_PASSWORD }}",
-		},
-	})
+	if !cfg.Registry.Insecure {
+		writeStep(b, "Login to registry", map[string]any{
+			"uses": "docker/login-action@v2",
+			"with": map[string]any{
+				"registry": cfg.Registry.URL,
+				"username": "${{ secrets.DOCKER_USERNAME }}",
+				"password": "${{ secrets.DOCKER_PASSWORD }}",
+			},
+		})
+	}
 
 	fullRepo := cfg.Registry.URL + "/" + cfg.Meta.Tenant + "/" + cfg.Meta.Name
+	buildWith := map[string]any{
+		"context":    ".",
+		"platforms":  "linux/amd64",
+		"file":       cfg.Defaults.Dockerfile,
+		"push":       true,
+		"tags":       fmt.Sprintf("%s:latest\n%s:${{ env.SHORT_SHA }}", fullRepo, fullRepo),
+		"provenance": false,
+		"sbom":       false,
+	}
+	if cfg.Registry.Insecure {
+		buildWith["buildkitd-config-inline"] = fmt.Sprintf(
+			"[registry.%q]\n  http = true\n  insecure = true",
+			cfg.Registry.URL,
+		)
+	}
 	writeStep(b, "Build and push image", map[string]any{
 		"uses": "docker/build-push-action@v5",
-		"with": map[string]any{
-			"context":    ".",
-			"platforms":  "linux/amd64",
-			"file":       cfg.Defaults.Dockerfile,
-			"push":       true,
-			"tags":       fmt.Sprintf("%s:latest\n%s:${{ env.SHORT_SHA }}", fullRepo, fullRepo),
-			"provenance": false,
-			"sbom":       false,
-		},
+		"with": buildWith,
 	})
 
 	if cfg.ActionRef != "" {
diff --git a/internal/generator/manifests.go b/internal/generator/manifests.go
index 90cd56f..fe17589 100644
--- a/internal/generator/manifests.go
+++ b/internal/generator/manifests.go
@@ -151,8 +151,10 @@ func Deployment(env *config.ResolvedEnvironment, tokens interpolate.Tokens) (str
 
 	b.WriteString(renderResourceLines(env.Resources, "        "))
 
-	b.WriteString("      imagePullSecrets:\n")
-	fmt.Fprintf(&b, "      - name: %s\n", env.ImagePullSecret)
+	if env.ImagePullSecret != "" {
+		b.WriteString("      imagePullSecrets:\n")
+		fmt.Fprintf(&b, "      - name: %s\n", env.ImagePullSecret)
+	}
 
 	return b.String(), nil
 }
@@ -331,8 +333,10 @@ func CronJob(env *config.ResolvedEnvironment, job *config.ResolvedCronJob, token
 		b.WriteString(renderResourceLines(*job.Resources, "            "))
 	}
 
-	b.WriteString("          imagePullSecrets:\n")
-	fmt.Fprintf(&b, "          - name: %s\n", env.ImagePullSecret)
+	if env.ImagePullSecret != "" {
+		b.WriteString("          imagePullSecrets:\n")
+		fmt.Fprintf(&b, "          - name: %s\n", env.ImagePullSecret)
+	}
 
 	return b.String(), nil
 }