insecure registry

internal/config/defaults.go

@@ -103,7 +103,8 @@ func applyRegistryDefaults(r *RegistryConfig, m *MetaConfig) {
 	if r.URL == "" {
 		r.URL = DefaultRegistryURL
 	}
-	if r.PullSecret == "" {
+	// Insecure (in-cluster) registries need no imagePullSecret.
+	if r.PullSecret == "" && !r.Insecure {
 		r.PullSecret = DefaultPullSecret
 	}
 	if r.Repository == "" {

internal/config/types.go

@@ -41,7 +41,12 @@ type MetaConfig struct {
 type RegistryConfig struct {
 	URL        string `yaml:"url"`
 	Repository string `yaml:"repository,omitempty"`  // default: ${tenant}/${name}
-	PullSecret string `yaml:"pull_secret,omitempty"` // default: regcred
+	PullSecret string `yaml:"pull_secret,omitempty"` // default: regcred; set to "" to disable
+	// Insecure marks the registry as HTTP-only (no TLS). Skips docker login,
+	// omits imagePullSecrets from manifests, and configures buildkitd for
+	// plain-HTTP pushes. Typical for in-cluster registries accessed via
+	// ClusterIP/service DNS rather than an Ingress.
+	Insecure bool `yaml:"insecure,omitempty"`
 }
 
 // ------------------------------------------------------------

internal/generator/gitea_actions.go

@@ -78,6 +78,7 @@ func writeDeployJobs(b *strings.Builder, cfg *config.KforgeConfig, opts GiteaAct
 		"run": `echo "SHORT_SHA=$(git rev-parse --short HEAD)" >> $GITHUB_ENV`,
 	})
 
+	if !cfg.Registry.Insecure {
 		writeStep(b, "Login to registry", map[string]any{
 			"uses": "docker/login-action@v2",
 			"with": map[string]any{
@@ -86,11 +87,10 @@ func writeDeployJobs(b *strings.Builder, cfg *config.KforgeConfig, opts GiteaAct
 				"password": "${{ secrets.DOCKER_PASSWORD }}",
 			},
 		})
+	}
 
 	fullRepo := cfg.Registry.URL + "/" + cfg.Meta.Tenant + "/" + cfg.Meta.Name
-	writeStep(b, "Build and push image", map[string]any{
-		"uses": "docker/build-push-action@v5",
-		"with": map[string]any{
+	buildWith := map[string]any{
 		"context":    ".",
 		"platforms":  "linux/amd64",
 		"file":       cfg.Defaults.Dockerfile,
@@ -98,7 +98,16 @@ func writeDeployJobs(b *strings.Builder, cfg *config.KforgeConfig, opts GiteaAct
 		"tags":       fmt.Sprintf("%s:latest\n%s:${{ env.SHORT_SHA }}", fullRepo, fullRepo),
 		"provenance": false,
 		"sbom":       false,
-		},
+	}
+	if cfg.Registry.Insecure {
+		buildWith["buildkitd-config-inline"] = fmt.Sprintf(
+			"[registry.%q]\n  http = true\n  insecure = true",
+			cfg.Registry.URL,
+		)
+	}
+	writeStep(b, "Build and push image", map[string]any{
+		"uses": "docker/build-push-action@v5",
+		"with": buildWith,
 	})
 
 	if cfg.ActionRef != "" {

internal/generator/manifests.go

@@ -151,8 +151,10 @@ func Deployment(env *config.ResolvedEnvironment, tokens interpolate.Tokens) (str
 
 	b.WriteString(renderResourceLines(env.Resources, "        "))
 
+	if env.ImagePullSecret != "" {
 		b.WriteString("      imagePullSecrets:\n")
 		fmt.Fprintf(&b, "      - name: %s\n", env.ImagePullSecret)
+	}
 
 	return b.String(), nil
 }
@@ -331,8 +333,10 @@ func CronJob(env *config.ResolvedEnvironment, job *config.ResolvedCronJob, token
 		b.WriteString(renderResourceLines(*job.Resources, "            "))
 	}
 
+	if env.ImagePullSecret != "" {
 		b.WriteString("          imagePullSecrets:\n")
 		fmt.Fprintf(&b, "          - name: %s\n", env.ImagePullSecret)
+	}
 
 	return b.String(), nil
 }