diff --git a/.github/workflows/helm_release.yaml b/.github/workflows/helm_release.yaml index 4263e76d..c9e1b8ac 100644 --- a/.github/workflows/helm_release.yaml +++ b/.github/workflows/helm_release.yaml @@ -20,7 +20,7 @@ jobs: git config user.email "$GITHUB_ACTOR@users.noreply.github.com" - name: Install chart-releaser - uses: helm/chart-releaser-action@v1.6.0 + uses: helm/chart-releaser-action@v1.7.0 with: install_only: true diff --git a/.github/workflows/pr_diff.yaml b/.github/workflows/pr_diff.yaml index 52f6a420..a7b20ff4 100644 --- a/.github/workflows/pr_diff.yaml +++ b/.github/workflows/pr_diff.yaml @@ -44,7 +44,7 @@ jobs: echo 'HELM_DIFF<> $GITHUB_ENV echo "$(diff -ur before after)" >> $GITHUB_ENV echo 'EOF' >> $GITHUB_ENV - - uses: marocchino/sticky-pull-request-comment@39c5b5dc7717447d0cba270cd115037d32d28443 + - uses: marocchino/sticky-pull-request-comment@d2ad0de260ae8b0235ce059e63f2949ba9e05943 with: message: | Running a `helm template` smoketest on commit ${{ github.ref }} results in the following diff against `${{ github.base_ref }}`: diff --git a/Chart.yaml b/Chart.yaml index b0e582ab..07887125 100644 --- a/Chart.yaml +++ b/Chart.yaml @@ -1,8 +1,8 @@ apiVersion: v1 description: A Helm chart for Docker Registry name: docker-registry -version: 2.2.3 -appVersion: 2.8.1 +version: 3.0.0 +appVersion: 3.0.0 home: https://hub.docker.com/_/registry/ icon: https://helm.twun.io/docker-registry.png maintainers: diff --git a/README.md b/README.md index 7e7e86b7..45e25b52 100644 --- a/README.md +++ b/README.md @@ -12,12 +12,27 @@ This chart will do the following: * Implement a Docker registry deployment +## ⚠️ Repo Migration and Deprecation Notice + +The following change only affects attempts to install or update the chart via the https://helm.twun.io repo. + +The https://helm.twun.io repo has been migrated to https://twuni.github.io/docker-registry.helm. + +To update your configuration, remove and re-add the repo with the new URL: + +```console +helm repo remove twuni +helm repo add twuni https://twuni.github.io/docker-registry.helm +``` + +The deprecated repo URL, https://helm.twun.io, may become unavailable as early as **October 16, 2025**. + ## Installing the Chart First, add the repo: ```console -helm repo add twuni https://helm.twun.io +helm repo add twuni https://twuni.github.io/docker-registry.helm ``` To install the chart, use the following: @@ -57,8 +72,8 @@ their default values. | `service.sessionAffinityConfig` | service session affinity config | `nil` | | `replicaCount` | k8s replicas | `1` | | `updateStrategy` | update strategy for deployment | `{}` | -| `podAnnotations` | Annotations for pod | `{}` | -| `podLabels` | Labels for pod | `{}` | +| `podAnnotations` | Annotations for deployment pod, and `garbageCollect` pod unless set explicitly there. See `garbageCollect` | `{}` | +| `podLabels` | Labels for deployment pod, and `garbageCollect` pod unless set explicitly there. See `garbageCollect` | `{}` | | `podDisruptionBudget` | Pod disruption budget | `{}` | | `resources.limits.cpu` | Container requested CPU | `nil` | | `resources.limits.memory` | Container requested memory | `nil` | @@ -79,12 +94,15 @@ their default values. | `secrets.swift.password` | Password for Swift configuration | `nil` | | `secrets.haSharedSecret` | Shared secret for Registry | `nil` | | `configData` | Configuration hash for docker | `nil` | +| `configPath` | Configuration mount point in docker, `/etc/docker/registry` for registry version 2, `/etc/distribution` for version 3 | `/etc/docker/registry` | | `s3.region` | S3 region | `nil` | | `s3.regionEndpoint` | S3 region endpoint | `nil` | | `s3.bucket` | S3 bucket name | `nil` | | `s3.rootdirectory` | S3 prefix that is applied to allow you to segment data | `nil` | | `s3.encrypt` | Store images in encrypted format | `nil` | | `s3.secure` | Use HTTPS | `nil` | +| `s3.forcepathstyle` | Use path-style addressing, needed for some s3 compatible storage (minio) | `nil` | +| `s3.skipverify` | Allows connection to s3 storage using TLS with untrusted/self-signed certificate | `nil` | | `swift.authurl` | Swift authurl | `nil` | | `swift.container` | Swift container | `nil` | | `proxy.enabled` | If true, registry will function as a proxy/mirror | `false` | @@ -119,6 +137,8 @@ their default values. | `garbageCollect.enabled` | If true, will deploy garbage-collector cronjob | `false` | | `garbageCollect.deleteUntagged` | If true, garbage-collector will delete manifests that are not currently referenced via tag | `true` | | `garbageCollect.schedule` | CronTab schedule, please use standard crontab format | `0 1 * * *` | +| `garbageCollect.podAnnotations` | CronJob pod Annotations. If left empty and chart `podAnnotations` are set, will use those. If both are set, these take precedence for the `garbageCollect` pods. | `{}` | +| `garbageCollect.podLabels` | CronJob pod Annotations. If left empty and chart `podLabels` are set, will use those. If both are set, these take precedence for the `garbageCollect` pods. | `{}` | | `garbageCollect.resources` | garbage-collector requested resources | `{}` | Specify each parameter using the `--set key=value[,key=value]` argument to diff --git a/templates/_helpers.tpl b/templates/_helpers.tpl index 07bd86b7..af3d3dc6 100644 --- a/templates/_helpers.tpl +++ b/templates/_helpers.tpl @@ -123,6 +123,16 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this value: {{ .Values.s3.multipartcopythresholdsize | quote }} {{- end -}} +{{- if .Values.s3.forcepathstyle }} +- name: REGISTRY_STORAGE_S3_FORCEPATHSTYLE + value: {{ .Values.s3.forcepathstyle | quote }} +{{- end -}} + +{{- if .Values.s3.skipverify }} +- name: REGISTRY_STORAGE_S3_SKIPVERIFY + value: {{ .Values.s3.skipverify | quote }} +{{- end -}} + {{- else if eq .Values.storage "swift" }} - name: REGISTRY_STORAGE_SWIFT_AUTHURL value: {{ required ".Values.swift.authurl is required" .Values.swift.authurl }} @@ -168,7 +178,7 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this {{- define "docker-registry.volumeMounts" -}} - name: "{{ template "docker-registry.fullname" . }}-config" - mountPath: "/etc/docker/registry" + mountPath: {{ .Values.configPath }} {{- if .Values.secrets.htpasswd }} - name: auth diff --git a/templates/cronjob.yaml b/templates/cronjob.yaml index 780cf875..a5419590 100644 --- a/templates/cronjob.yaml +++ b/templates/cronjob.yaml @@ -17,16 +17,26 @@ spec: app: {{ template "docker-registry.name" . }} release: {{ .Release.Name }} {{- with .Values.podLabels }} - {{ toYaml . | nindent 8 }} + {{- toYaml . | nindent 8 }} {{- end }} annotations: checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }} checksum/secret: {{ include (print $.Template.BasePath "/secret.yaml") . | sha256sum }} {{- if .Values.podAnnotations }} - {{ toYaml .Values.podAnnotations | nindent 8 }} + {{- toYaml .Values.podAnnotations | nindent 8 }} {{- end }} spec: template: + metadata: + labels: + release: {{ .Release.Name }} + {{- if or .Values.podLabels .Values.garbageCollect.podLabels }} + {{- toYaml (merge (.Values.garbageCollect.podLabels | default (dict)) (.Values.podLabels | default (dict))) | nindent 12 }} + {{- end }} + {{- if or .Values.podAnnotations .Values.garbageCollect.podAnnotations }} + annotations: + {{- toYaml (merge (.Values.garbageCollect.podAnnotations | default (dict)) (.Values.podAnnotations | default (dict))) | nindent 12 }} + {{- end}} spec: {{- if or (eq .Values.serviceAccount.create true) (ne .Values.serviceAccount.name "") }} serviceAccountName: {{ .Values.serviceAccount.name | default (include "docker-registry.fullname" .) }} @@ -48,8 +58,11 @@ spec: - /bin/registry - garbage-collect - --delete-untagged={{ .Values.garbageCollect.deleteUntagged }} - - /etc/docker/registry/config.yml - resources: {{ toYaml .Values.garbageCollect.resources | nindent 12 }} + - {{ .Values.configPath }}/config.yml + {{- if .Values.garbageCollect.resources }} + resources: + {{- toYaml .Values.garbageCollect.resources | nindent 16 }} + {{- end }} env: {{ include "docker-registry.envs" . | nindent 16 }} {{- if .Values.containerSecurityContext.enabled }} securityContext: {{ omit .Values.containerSecurityContext "enabled" | toYaml | nindent 16 }} diff --git a/templates/deployment.yaml b/templates/deployment.yaml index 43faffbf..dac26835 100644 --- a/templates/deployment.yaml +++ b/templates/deployment.yaml @@ -60,7 +60,7 @@ spec: command: - /bin/registry - serve - - /etc/docker/registry/config.yml + - {{ .Values.configPath }}/config.yml ports: - containerPort: 5000 {{- if .Values.metrics.enabled }} diff --git a/values.yaml b/values.yaml index 093531cf..09314874 100644 --- a/values.yaml +++ b/values.yaml @@ -19,7 +19,7 @@ serviceAccount: image: repository: registry - tag: 2.8.1 + tag: 3.0.0 pullPolicy: IfNotPresent # imagePullSecrets: # - name: docker @@ -61,11 +61,11 @@ resources: {} # resources, such as Minikube. If you do want to specify resources, uncomment the following # lines, adjust them as necessary, and remove the curly braces after 'resources:'. # limits: - # cpu: 100m - # memory: 128Mi + # cpu: 100m + # memory: 128Mi # requests: - # cpu: 100m - # memory: 128Mi + # cpu: 100m + # memory: 128Mi persistence: accessMode: 'ReadWriteOnce' enabled: false @@ -100,21 +100,23 @@ secrets: # Options for s3 storage type: # s3: -# region: us-east-1 -# regionEndpoint: https://s3.us-east-1.amazonaws.com -# bucket: my-bucket -# rootdirectory: /object/prefix -# encrypt: false -# secure: true -# chunksize: 5242880 -# multipartcopychunksize: 33554432 -# multipartcopymaxconcurrency: 100 -# multipartcopythresholdsize: 33554432 +# region: us-east-1 +# regionEndpoint: https://s3.us-east-1.amazonaws.com +# bucket: my-bucket +# rootdirectory: /object/prefix +# encrypt: false +# secure: true +# chunksize: 5242880 +# multipartcopychunksize: 33554432 +# multipartcopymaxconcurrency: 100 +# multipartcopythresholdsize: 33554432 +# forcepathstyle: true +# skipverify: true # Options for swift storage type: # swift: -# authurl: http://swift.example.com/ -# container: my-container +# authurl: http://swift.example.com/ +# container: my-container # https://docs.docker.com/registry/recipes/mirror/ proxy: @@ -139,6 +141,7 @@ metrics: labels: {} rules: {} +configPath: /etc/distribution configData: version: 0.1 log: @@ -182,6 +185,7 @@ securityContext: fsGroupChangePolicy: Always sysctls: [] supplementalGroups: [] + runAsUser: 1000 fsGroup: 1000 priorityClassName: "" @@ -261,4 +265,16 @@ garbageCollect: enabled: false deleteUntagged: true schedule: "0 1 * * *" + podAnnotations: {} + podLabels: {} resources: {} + # We usually recommend not to specify default resources and to leave this as a conscious + # choice for the user. This also increases chances charts run on environments with little + # resources, such as Minikube. If you do want to specify resources, uncomment the following + # lines, adjust them as necessary, and remove the curly braces after 'resources:'. + # limits: + # cpu: 100m + # memory: 128Mi + # requests: + # cpu: 100m + # memory: 128Mi