Add new infra architecture 12

scripts/build-all-services.sh

@@ -0,0 +1,126 @@
+#!/bin/bash
+
+# Build All Services Script for Bakery-IA
+# This script builds and pushes all service images to the Gitea registry
+# Used for first-time deployment when CI/CD pipeline isn't available yet
+
+set -e
+
+echo "=========================================="
+echo "Bakery-IA Services Build Script"
+echo "=========================================="
+echo ""
+
+# Check if we're in the correct directory
+if [ ! -f "PRODUCTION_DEPLOYMENT_GUIDE.md" ]; then
+    echo "Error: This script must be run from the root of the bakery-ia repository"
+    exit 1
+fi
+
+# Get Gitea admin password
+echo "Getting Gitea admin credentials..."
+if ! GITEA_ADMIN_PASSWORD=$(kubectl get secret gitea-admin-secret -n gitea -o jsonpath='{.data.password}' | base64 -d 2>/dev/null); then
+    echo "Error: Could not get Gitea admin password"
+    echo "Make sure you've completed Phase 5 (CI/CD Infrastructure) first"
+    exit 1
+fi
+
+# Login to Gitea registry
+echo "Logging in to Gitea registry..."
+docker login gitea-http.gitea.svc.cluster.local:3000 -u bakery-admin -p "$GITEA_ADMIN_PASSWORD"
+
+# Define the registry URL
+REGISTRY="gitea-http.gitea.svc.cluster.local:3000/bakery-admin"
+
+# Define all services to build
+# Format: "directory_name:image_name"
+# Note: directory names use underscores (e.g., alert_processor), image names use hyphens (e.g., alert-processor)
+SERVICES=(
+    "gateway:gateway"
+    "frontend:dashboard"
+    "auth:auth-service"
+    "tenant:tenant-service"
+    "training:training-service"
+    "forecasting:forecasting-service"
+    "sales:sales-service"
+    "external:external-service"
+    "notification:notification-service"
+    "inventory:inventory-service"
+    "recipes:recipes-service"
+    "suppliers:suppliers-service"
+    "pos:pos-service"
+    "orders:orders-service"
+    "production:production-service"
+    "procurement:procurement-service"
+    "distribution:distribution-service"
+    "orchestrator:orchestrator-service"
+    "alert_processor:alert-processor"
+    "ai_insights:ai-insights-service"
+    "demo_session:demo-session-service"
+)
+
+# Build each service
+echo ""
+echo "Starting build process..."
+echo "This may take 15-30 minutes depending on your system."
+echo ""
+
+FAILED_SERVICES=()
+SUCCESS_COUNT=0
+
+for service_def in "${SERVICES[@]}"; do
+    IFS=':' read -r service_name image_name <<< "$service_def"
+
+    echo "=========================================="
+    echo "Building: $service_name -> $image_name"
+    echo "=========================================="
+
+    if [ "$service_name" = "gateway" ]; then
+        # Gateway service
+        docker build -t "$REGISTRY/$image_name:latest" \
+            --build-arg BASE_REGISTRY="$REGISTRY" \
+            --build-arg PYTHON_IMAGE="python:3.11-slim" \
+            -f "gateway/Dockerfile" .
+    elif [ "$service_name" = "frontend" ]; then
+        # Frontend service (uses node:18-alpine and nginx:1.25-alpine internally)
+        docker build -t "$REGISTRY/$image_name:latest" \
+            -f "frontend/Dockerfile.kubernetes" frontend/
+    else
+        # Microservices (in services/ directory)
+        docker build -t "$REGISTRY/$image_name:latest" \
+            --build-arg BASE_REGISTRY="$REGISTRY" \
+            --build-arg PYTHON_IMAGE="python:3.11-slim" \
+            -f "services/$service_name/Dockerfile" .
+    fi
+    
+    # Push the image
+    echo "Pushing $image_name to registry..."
+    if docker push "$REGISTRY/$image_name:latest"; then
+        echo "✅ Successfully built and pushed $image_name"
+        SUCCESS_COUNT=$((SUCCESS_COUNT + 1))
+    else
+        echo "❌ Failed to push $image_name"
+        FAILED_SERVICES+=("$image_name")
+    fi
+    
+    echo ""
+done
+
+echo "=========================================="
+echo "Build Summary"
+echo "=========================================="
+echo "Total services: ${#SERVICES[@]}"
+echo "Successfully built and pushed: $SUCCESS_COUNT"
+
+if [ ${#FAILED_SERVICES[@]} -gt 0 ]; then
+    echo "Failed services: ${#FAILED_SERVICES[@]}"
+    echo "Failed list: ${FAILED_SERVICES[*]}"
+    echo ""
+    echo "⚠️  Some services failed to build/push"
+    exit 1
+else
+    echo "✅ All services built and pushed successfully!"
+    echo ""
+    echo "You can now proceed to Phase 6: Deploy Application Services"
+    echo "Run: kubectl apply -k infrastructure/environments/prod/k8s-manifests"
+fi

scripts/prepull-base-images-for-prod.sh

@@ -0,0 +1,324 @@
+#!/bin/bash
+
+# Base Image Pre-Pull Script for Bakery-IA Production
+# This script pre-pulls all required base images for production deployment
+# Supports both local development and production environments with Gitea registry
+
+set -e
+
+# Function to display usage
+usage() {
+    echo "Usage: $0 [options]"
+    echo ""
+    echo "Options:"
+    echo "  -e, --environment ENV    Set environment (dev|prod) - default: dev"
+    echo "  -r, --registry REG       Custom registry URL - default: localhost:5000 (dev) or gitea registry (prod)"
+    echo "  --skip-auth              Skip Docker Hub authentication"
+    echo "  --push-images            Push images to registry (default: true for dev, false for prod)"
+    echo "  --no-push-images         Don't push images to registry"
+    echo "  -h, --help               Show this help message"
+    echo ""
+    echo "Examples:"
+    echo "  $0                                      # Run in dev mode with local registry"
+    echo "  $0 -e prod                              # Run in production mode with Gitea registry"
+    echo "  $0 -e prod -r registry.example.com:5000 # Run in production with custom registry"
+    echo "  $0 --skip-auth                          # Skip Docker Hub auth (for air-gapped envs)"
+    exit 1
+}
+
+# Parse command line arguments
+ENVIRONMENT="dev"
+REGISTRY=""
+SKIP_AUTH=false
+PUSH_IMAGES=""
+while [[ $# -gt 0 ]]; do
+    case $1 in
+        -e|--environment)
+            ENVIRONMENT="$2"
+            shift 2
+            ;;
+        -r|--registry)
+            REGISTRY="$2"
+            shift 2
+            ;;
+        --skip-auth)
+            SKIP_AUTH=true
+            shift
+            ;;
+        --push-images)
+            PUSH_IMAGES=true
+            shift
+            ;;
+        --no-push-images)
+            PUSH_IMAGES=false
+            shift
+            ;;
+        -h|--help)
+            usage
+            ;;
+        *)
+            echo "Unknown option: $1"
+            usage
+            ;;
+    esac
+done
+
+# Function to check if required tools are available
+check_required_tools() {
+    local missing_tools=()
+
+    # Check for required tools
+    for tool in docker curl jq kubectl; do
+        if ! command -v "$tool" &> /dev/null; then
+            missing_tools+=("$tool")
+        fi
+    done
+
+    if [ ${#missing_tools[@]} -gt 0 ]; then
+        echo "Error: Missing required tools: ${missing_tools[*]}"
+        echo "Please install them before running this script."
+        echo ""
+        echo "On macOS (with Homebrew):"
+        echo "  brew install docker curl jq kubectl"
+        echo ""
+        echo "On Ubuntu/Debian:"
+        echo "  sudo apt-get install docker.io curl jq kubectl"
+        echo ""
+        echo "On CentOS/RHEL:"
+        echo "  sudo yum install docker curl jq kubectl"
+        exit 1
+    fi
+}
+
+# Check for required tools
+check_required_tools
+
+echo "=========================================="
+echo "Bakery-IA Base Image Pre-Pull Script"
+echo "Environment: $ENVIRONMENT"
+echo "=========================================="
+echo ""
+
+# Set defaults based on environment
+if [ "$ENVIRONMENT" = "prod" ]; then
+    # Production environment - use Gitea registry
+    if [ -z "$REGISTRY" ]; then
+        # Try to get Gitea registry from Kubernetes
+        if kubectl get secret gitea-registry-secret -n bakery-ia &>/dev/null; then
+            # Extract registry URL from the secret
+            REGISTRY_JSON=$(kubectl get secret gitea-registry-secret -n bakery-ia -o jsonpath='{.data.\.dockerconfigjson}' | base64 -d)
+            REGISTRY=$(echo "$REGISTRY_JSON" | jq -r '.auths | keys[]' | head -n 1)
+            echo "Detected Gitea registry: $REGISTRY"
+        else
+            echo "Error: Could not detect Gitea registry automatically"
+            echo "Please specify the registry with -r/--registry option"
+            echo "Example: $0 -e prod -r gitea-http.gitea.svc.cluster.local:3000"
+            exit 1
+        fi
+    fi
+    
+    # Default to not pushing images in production - they should be built by CI/CD
+    if [ -z "$PUSH_IMAGES" ]; then
+        PUSH_IMAGES=false
+    fi
+elif [ "$ENVIRONMENT" = "dev" ]; then
+    # Development environment - use local registry
+    if [ -z "$REGISTRY" ]; then
+        REGISTRY="localhost:5000"
+    fi
+    
+    # Default to pushing images in dev
+    if [ -z "$PUSH_IMAGES" ]; then
+        PUSH_IMAGES=true
+    fi
+else
+    echo "Error: Invalid environment. Use 'dev' or 'prod'"
+    exit 1
+fi
+
+echo "Registry configuration:"
+echo "  Environment: $ENVIRONMENT"
+echo "  Registry: $REGISTRY"
+echo "  Push Images: $PUSH_IMAGES"
+echo ""
+
+# Docker Hub credentials (use environment variables or defaults)
+DOCKER_USERNAME="${DOCKER_HUB_USERNAME:-uals}"
+DOCKER_PASSWORD="${DOCKER_HUB_PASSWORD:-dckr_pat_zzEY5Q58x1S0puraIoKEtbpue3A}"
+
+# Authenticate with Docker Hub if not skipping auth
+if [ "$SKIP_AUTH" = false ]; then
+    echo "Authenticating with Docker Hub..."
+    if ! echo "$DOCKER_PASSWORD" | docker login -u "$DOCKER_USERNAME" --password-stdin; then
+        echo "⚠ Warning: Docker Hub authentication failed. Continuing anyway..."
+    else
+        echo "✓ Authentication successful"
+    fi
+else
+    echo "Skipping Docker Hub authentication (--skip-auth flag set)"
+fi
+echo ""
+
+# Define all base images used in the project
+# These are the base images needed for the services
+BASE_IMAGES=(
+    # Service base images (Python microservices)
+    "python:3.11-slim"
+    # Frontend base images (Node.js build + Nginx runtime)
+    "node:18-alpine"
+    "nginx:1.25-alpine"
+    # Database images
+    "postgres:17-alpine"
+    "redis:7.4-alpine"
+    "rabbitmq:4.1-management-alpine"
+    # Utility images
+    "busybox:1.36"
+    "curlimages/curl:latest"
+    "bitnami/kubectl:latest"
+    # Alpine variants
+    "alpine:3.18"
+    "alpine:3.19"
+    "alpine/git:2.43.0"
+    # CI/CD images
+    "gcr.io/kaniko-project/executor:v1.23.0"
+    "gcr.io/go-containerregistry/crane:latest"
+    "registry.k8s.io/kustomize/kustomize:v5.3.0"
+    # Storage images
+    "minio/minio:RELEASE.2024-11-07T00-52-20Z"
+    "minio/mc:RELEASE.2024-11-17T19-35-25Z"
+    # Geocoding
+    "mediagis/nominatim:4.4"
+    # Mail server (Mailu - from GHCR)
+    "ghcr.io/mailu/nginx:2024.06"
+    "ghcr.io/mailu/admin:2024.06"
+    "ghcr.io/mailu/postfix:2024.06"
+    "ghcr.io/mailu/dovecot:2024.06"
+    "ghcr.io/mailu/rspamd:2024.06"
+)
+
+# If using registry, verify it's running
+if [ "$PUSH_IMAGES" = true ]; then
+    echo "Checking registry at $REGISTRY..."
+    if curl -s http://$REGISTRY/v2/ >/dev/null 2>&1; then
+        echo "✓ Registry is accessible"
+    elif curl -s https://$REGISTRY/v2/ >/dev/null 2>&1; then
+        echo "✓ Registry is accessible (HTTPS)"
+        # Update registry to use HTTPS if needed
+        REGISTRY="https://$REGISTRY"
+    else
+        echo "⚠ Registry is not accessible at $REGISTRY"
+        echo "Will only pull images locally (no registry push)"
+        PUSH_IMAGES=false
+    fi
+fi
+
+echo ""
+echo "Base images to pre-pull:"
+echo "----------------------------------------"
+for image in "${BASE_IMAGES[@]}"; do
+    echo "  - $image"
+done
+echo ""
+
+echo "Starting pre-pull process..."
+echo "----------------------------------------"
+
+# Track success/failure
+FAILED_IMAGES=()
+SUCCESS_COUNT=0
+
+# Pull each base image
+for image in "${BASE_IMAGES[@]}"; do
+    echo "Pulling: $image"
+
+    # Pull the image
+    if ! docker pull "$image"; then
+        echo "  ⚠ Failed to pull $image"
+        FAILED_IMAGES+=("$image")
+        continue
+    fi
+
+    # Tag for registry if enabled
+    if [ "$PUSH_IMAGES" = true ]; then
+        # Extract registry host and image name
+        if [[ "$REGISTRY" == https://* ]]; then
+            REGISTRY_HOST=${REGISTRY#https://}
+        else
+            REGISTRY_HOST=$REGISTRY
+        fi
+        
+        # Format for registry: use bakery-admin namespace and preserve original name/tag
+        # Extract image name and tag
+        if [[ "$image" == *:* ]]; then
+            image_name="${image%:*}"
+            image_tag="${image#*:}"
+        else
+            image_name="$image"
+            image_tag="latest"
+        fi
+        
+        # Replace slashes with underscores for repository name
+        repo_name="$(echo "$image_name" | sed 's|/|_|g' | tr '[:upper:]' '[:lower:]')"
+        
+        # Use bakery-admin namespace and preserve original tag
+        registry_image="$REGISTRY_HOST/bakery-admin/${repo_name}:${image_tag}"
+
+        docker tag "$image" "$registry_image"
+        echo "  Tagged as: $registry_image"
+
+        # Push to registry
+        if docker push "$registry_image"; then
+            echo "  ✓ Pushed to registry"
+        else
+            echo "  ⚠ Failed to push to registry (image still available locally)"
+        fi
+    fi
+
+    echo "  ✓ Successfully pulled $image"
+    SUCCESS_COUNT=$((SUCCESS_COUNT + 1))
+    echo ""
+done
+
+echo "=========================================="
+echo "Base Image Pre-Pull Complete!"
+echo "=========================================="
+echo ""
+echo "Summary:"
+echo "  - Total images: ${#BASE_IMAGES[@]}"
+echo "  - Successfully pulled: $SUCCESS_COUNT"
+if [ ${#FAILED_IMAGES[@]} -gt 0 ]; then
+    echo "  - Failed: ${#FAILED_IMAGES[@]}"
+    echo "  - Failed images: ${FAILED_IMAGES[*]}"
+fi
+echo "  - Environment: $ENVIRONMENT"
+if [ "$PUSH_IMAGES" = true ]; then
+    echo "  - Registry: $REGISTRY"
+else
+    echo "  - Registry: None (local Docker only)"
+fi
+echo ""
+
+# Exit with error if any images failed
+if [ ${#FAILED_IMAGES[@]} -gt 0 ]; then
+    echo "⚠ Some images failed to pull. This may be due to Docker Hub rate limits."
+    echo "Please try again later or configure Docker Hub credentials."
+    exit 1
+fi
+
+echo "✓ All images pulled successfully!"
+
+if [ "$ENVIRONMENT" = "prod" ] && [ "$PUSH_IMAGES" = false ]; then
+    echo ""
+    echo "💡 Note: In production mode, images are not pushed to registry."
+    echo "   Images should be built and pushed by your CI/CD pipeline."
+    echo "   Make sure your CI/CD pipeline has built and pushed the required images."
+    echo ""
+    echo "💡 To build and push service images to Gitea registry:"
+    echo "   1. Ensure your CI/CD pipeline is running (Tekton)"
+    echo "   2. Push a commit to trigger the pipeline: git commit --allow-empty -m 'Trigger build'"
+    echo "   3. Or manually trigger a pipeline run"
+    echo ""
+    echo "💡 Check pipeline status:"
+    echo "   kubectl get pipelineruns -n tekton-pipelines"
+    echo "   kubectl get pods -n tekton-pipelines"
+fi

scripts/prepull-base-images.sh

@@ -2,16 +2,74 @@
 
 # Base Image Pre-Pull Script for Bakery-IA
 # This script pre-pulls all required base images to reduce Docker Hub usage
+# Supports both local development and production environments with Gitea registry
 # Run this script before building services to cache base images locally
 
 set -e
 
+# Function to display usage
+usage() {
+    echo "Usage: $0 [options]"
+    echo ""
+    echo "Options:"
+    echo "  -e, --environment ENV    Set environment (dev|prod) - default: dev"
+    echo "  -r, --registry REG       Custom registry URL - default: localhost:5000 (dev) or gitea registry (prod)"
+    echo "  --skip-auth              Skip Docker Hub authentication"
+    echo "  --push-images            Push images to registry (default: true for dev, false for prod)"
+    echo "  --no-push-images         Don't push images to registry"
+    echo "  -h, --help               Show this help message"
+    echo ""
+    echo "Examples:"
+    echo "  $0                                      # Run in dev mode with local registry"
+    echo "  $0 -e prod                              # Run in production mode with Gitea registry"
+    echo "  $0 -e prod -r registry.example.com:5000 # Run in production with custom registry"
+    echo "  $0 --skip-auth                          # Skip Docker Hub auth (for air-gapped envs)"
+    exit 1
+}
+
+# Parse command line arguments
+ENVIRONMENT="dev"
+REGISTRY=""
+SKIP_AUTH=false
+PUSH_IMAGES=""
+while [[ $# -gt 0 ]]; do
+    case $1 in
+        -e|--environment)
+            ENVIRONMENT="$2"
+            shift 2
+            ;;
+        -r|--registry)
+            REGISTRY="$2"
+            shift 2
+            ;;
+        --skip-auth)
+            SKIP_AUTH=true
+            shift
+            ;;
+        --push-images)
+            PUSH_IMAGES=true
+            shift
+            ;;
+        --no-push-images)
+            PUSH_IMAGES=false
+            shift
+            ;;
+        -h|--help)
+            usage
+            ;;
+        *)
+            echo "Unknown option: $1"
+            usage
+            ;;
+    esac
+done
+
 # Function to check if required tools are available
 check_required_tools() {
     local missing_tools=()
 
     # Check for required tools
-    for tool in docker curl jq; do
+    for tool in docker curl jq kubectl; do
         if ! command -v "$tool" &> /dev/null; then
             missing_tools+=("$tool")
         fi
@@ -22,13 +80,13 @@ check_required_tools() {
         echo "Please install them before running this script."
         echo ""
         echo "On macOS (with Homebrew):"
-        echo "  brew install docker curl jq"
+        echo "  brew install docker curl jq kubectl"
         echo ""
         echo "On Ubuntu/Debian:"
-        echo "  sudo apt-get install docker.io curl jq"
+        echo "  sudo apt-get install docker.io curl jq kubectl"
         echo ""
         echo "On CentOS/RHEL:"
-        echo "  sudo yum install docker curl jq"
+        echo "  sudo yum install docker curl jq kubectl"
         exit 1
     fi
 }
@@ -38,24 +96,78 @@ check_required_tools
 
 echo "=========================================="
 echo "Bakery-IA Base Image Pre-Pull Script"
+echo "Environment: $ENVIRONMENT"
 echo "=========================================="
 echo ""
 
-# Docker Hub credentials (use the same as in your Kubernetes setup)
-DOCKER_USERNAME="uals"
-DOCKER_PASSWORD="dckr_pat_zzEY5Q58x1S0puraIoKEtbpue3A"
+# Set defaults based on environment
+if [ "$ENVIRONMENT" = "prod" ]; then
+    # Production environment - use Gitea registry
+    if [ -z "$REGISTRY" ]; then
+        # Try to get Gitea registry from Kubernetes
+        if kubectl get secret gitea-registry-secret -n bakery-ia &>/dev/null; then
+            # Extract registry URL from the secret
+            REGISTRY_JSON=$(kubectl get secret gitea-registry-secret -n bakery-ia -o jsonpath='{.data.\.dockerconfigjson}' | base64 -d)
+            REGISTRY=$(echo "$REGISTRY_JSON" | jq -r '.auths | keys[]' | head -n 1)
+            echo "Detected Gitea registry: $REGISTRY"
+        else
+            echo "Error: Could not detect Gitea registry automatically"
+            echo "Please specify the registry with -r/--registry option"
+            echo "Example: $0 -e prod -r gitea-http.gitea.svc.cluster.local:3000"
+            exit 1
+        fi
+    fi
 
-# Authenticate with Docker Hub
-echo "Authenticating with Docker Hub..."
-echo "$DOCKER_PASSWORD" | docker login -u "$DOCKER_USERNAME" --password-stdin
-echo "✓ Authentication successful"
+    # Default to not pushing images in production - they should be built by CI/CD
+    if [ -z "$PUSH_IMAGES" ]; then
+        PUSH_IMAGES=false
+    fi
+elif [ "$ENVIRONMENT" = "dev" ]; then
+    # Development environment - use local registry
+    if [ -z "$REGISTRY" ]; then
+        REGISTRY="localhost:5000"
+    fi
+
+    # Default to pushing images in dev
+    if [ -z "$PUSH_IMAGES" ]; then
+        PUSH_IMAGES=true
+    fi
+else
+    echo "Error: Invalid environment. Use 'dev' or 'prod'"
+    exit 1
+fi
+
+echo "Registry configuration:"
+echo "  Environment: $ENVIRONMENT"
+echo "  Registry: $REGISTRY"
+echo "  Push Images: $PUSH_IMAGES"
+echo ""
+
+# Docker Hub credentials (use environment variables or defaults)
+DOCKER_USERNAME="${DOCKER_HUB_USERNAME:-uals}"
+DOCKER_PASSWORD="${DOCKER_HUB_PASSWORD:-dckr_pat_zzEY5Q58x1S0puraIoKEtbpue3A}"
+
+# Authenticate with Docker Hub if not skipping auth
+if [ "$SKIP_AUTH" = false ]; then
+    echo "Authenticating with Docker Hub..."
+    if ! echo "$DOCKER_PASSWORD" | docker login -u "$DOCKER_USERNAME" --password-stdin; then
+        echo "⚠ Warning: Docker Hub authentication failed. Continuing anyway..."
+    else
+        echo "✓ Authentication successful"
+    fi
+else
+    echo "Skipping Docker Hub authentication (--skip-auth flag set)"
+fi
 echo ""
 
 # Define all base images used in the project
-# All images are cached in local registry for dev environment
+# These are the base images needed for the services
 BASE_IMAGES=(
-    # Service base images
+    # Service base images (Python microservices)
     "python:3.11-slim"
+    # Frontend base images (Node.js build + Nginx runtime)
+    "node:18-alpine"
+    "nginx:1.25-alpine"
     # Database images
     "postgres:17-alpine"
     "redis:7.4-alpine"
@@ -85,27 +197,19 @@ BASE_IMAGES=(
     "ghcr.io/mailu/rspamd:2024.06"
 )
 
-# Registry configuration
-# Read from environment variables (set by Tiltfile or manually)
-# USE_LOCAL_REGISTRY=true to push images to local registry after pulling
-USE_LOCAL_REGISTRY="${USE_LOCAL_REGISTRY:-true}"
-
-echo "Registry configuration:"
-echo "  USE_LOCAL_REGISTRY=$USE_LOCAL_REGISTRY"
-echo ""
-
-# Use local registry (kind registry)
-REGISTRY="localhost:5000"
-
-# If using local registry, verify it's running
-if [ "$USE_LOCAL_REGISTRY" = "true" ]; then
-    echo "Checking local registry at $REGISTRY..."
+# If using registry, verify it's running
+if [ "$PUSH_IMAGES" = true ]; then
+    echo "Checking registry at $REGISTRY..."
     if curl -s http://$REGISTRY/v2/ >/dev/null 2>&1; then
-        echo "✓ Local registry is accessible"
+        echo "✓ Registry is accessible"
+    elif curl -s https://$REGISTRY/v2/ >/dev/null 2>&1; then
+        echo "✓ Registry is accessible (HTTPS)"
+        # Update registry to use HTTPS if needed
+        REGISTRY="https://$REGISTRY"
     else
-        echo "⚠ Local registry is not accessible at $REGISTRY"
+        echo "⚠ Registry is not accessible at $REGISTRY"
         echo "Will only pull images locally (no registry push)"
-        USE_LOCAL_REGISTRY="false"
+        PUSH_IMAGES=false
     fi
 fi
 
@@ -136,17 +240,24 @@ for image in "${BASE_IMAGES[@]}"; do
     fi
 
     # Tag for registry if enabled
-    if [ "$USE_LOCAL_REGISTRY" = "true" ]; then
-        # Local registry format: replace /, :, -, and . with _
+    if [ "$PUSH_IMAGES" = true ]; then
+        # Extract registry host and image name
+        if [[ "$REGISTRY" == https://* ]]; then
+            REGISTRY_HOST=${REGISTRY#https://}
+        else
+            REGISTRY_HOST=$REGISTRY
+        fi
+
+        # Format for registry: replace /, :, -, and . with _
         local_repo="$(echo $image | sed 's|/|_|g' | sed 's|:|_|g' | sed 's|-|_|g' | sed 's|\.|_|g' | tr '[:upper:]' '[:lower:]')"
-        registry_image="$REGISTRY/${local_repo}:latest"
+        registry_image="$REGISTRY_HOST/${local_repo}:latest"
 
         docker tag "$image" "$registry_image"
         echo "  Tagged as: $registry_image"
 
         # Push to registry
         if docker push "$registry_image"; then
-            echo "  ✓ Pushed to local registry"
+            echo "  ✓ Pushed to registry"
         else
             echo "  ⚠ Failed to push to registry (image still available locally)"
         fi
@@ -168,8 +279,9 @@ if [ ${#FAILED_IMAGES[@]} -gt 0 ]; then
     echo "  - Failed: ${#FAILED_IMAGES[@]}"
     echo "  - Failed images: ${FAILED_IMAGES[*]}"
 fi
-if [ "$USE_LOCAL_REGISTRY" = "true" ]; then
-    echo "  - Registry: Local ($REGISTRY)"
+echo "  - Environment: $ENVIRONMENT"
+if [ "$PUSH_IMAGES" = true ]; then
+    echo "  - Registry: $REGISTRY"
 else
     echo "  - Registry: None (local Docker only)"
 fi
@@ -183,3 +295,19 @@ if [ ${#FAILED_IMAGES[@]} -gt 0 ]; then
 fi
 
 echo "✓ All images pulled successfully!"
+
+if [ "$ENVIRONMENT" = "prod" ] && [ "$PUSH_IMAGES" = false ]; then
+    echo ""
+    echo "💡 Note: In production mode, images are not pushed to registry."
+    echo "   Images should be built and pushed by your CI/CD pipeline."
+    echo "   Make sure your CI/CD pipeline has built and pushed the required images."
+    echo ""
+    echo "💡 To build and push service images to Gitea registry:"
+    echo "   1. Ensure your CI/CD pipeline is running (Tekton)"
+    echo "   2. Push a commit to trigger the pipeline: git commit --allow-empty -m 'Trigger build'"
+    echo "   3. Or manually trigger a pipeline run"
+    echo ""
+    echo "💡 Check pipeline status:"
+    echo "   kubectl get pipelineruns -n tekton-pipelines"
+    echo "   kubectl get pods -n tekton-pipelines"
+fi