From e4373a8747ea3e3222572de98934358a7e32bb30 Mon Sep 17 00:00:00 2001 From: erikfuego Date: Wed, 22 Mar 2023 21:28:26 -0400 Subject: [PATCH 01/47] updated securityContext to include all values from values.yaml --- templates/deployment.yaml | 8 +++----- values.yaml | 1 - 2 files changed, 3 insertions(+), 6 deletions(-) diff --git a/templates/deployment.yaml b/templates/deployment.yaml index 6d2ff0e5..043fd4a5 100644 --- a/templates/deployment.yaml +++ b/templates/deployment.yaml @@ -42,11 +42,9 @@ spec: {{- if .Values.priorityClassName }} priorityClassName: "{{ .Values.priorityClassName }}" {{- end }} - {{- if .Values.securityContext.enabled }} - securityContext: - fsGroup: {{ .Values.securityContext.fsGroup }} - runAsUser: {{ .Values.securityContext.runAsUser }} - {{- end }} + {{- if .Values.securityContext }} + securityContext: {{ toYaml .Values.securityContext | indent 8 }} + {{- end }} {{- with .Values.initContainers }} initContainers: {{- toYaml . | nindent 8 }} diff --git a/values.yaml b/values.yaml index 7f9c5588..a5e2d6ec 100644 --- a/values.yaml +++ b/values.yaml @@ -153,7 +153,6 @@ configData: threshold: 3 securityContext: - enabled: true runAsUser: 1000 fsGroup: 1000 From b91518dbaff83526c5126792702477f60cfbf35f Mon Sep 17 00:00:00 2001 From: erikfuego Date: Wed, 22 Mar 2023 23:14:54 -0400 Subject: [PATCH 02/47] . --- templates/deployment.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/templates/deployment.yaml b/templates/deployment.yaml index 043fd4a5..093b9739 100644 --- a/templates/deployment.yaml +++ b/templates/deployment.yaml @@ -43,7 +43,7 @@ spec: priorityClassName: "{{ .Values.priorityClassName }}" {{- end }} {{- if .Values.securityContext }} - securityContext: {{ toYaml .Values.securityContext | indent 8 }} + securityContext: {{ toYaml .Values.securityContext | nindent 8 }} {{- end }} {{- with .Values.initContainers }} initContainers: From a277e5d090d3aff2d9474f5123da0fb246a5ce43 Mon Sep 17 00:00:00 2001 From: erikfuego Date: Fri, 24 Mar 2023 12:09:25 -0400 Subject: [PATCH 03/47] updated cronjob.yaml securityContext --- templates/cronjob.yaml | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/templates/cronjob.yaml b/templates/cronjob.yaml index 3a04680d..1127393b 100644 --- a/templates/cronjob.yaml +++ b/templates/cronjob.yaml @@ -37,10 +37,8 @@ spec: {{- if .Values.priorityClassName }} priorityClassName: "{{ .Values.priorityClassName }}" {{- end }} - {{- if .Values.securityContext.enabled }} - securityContext: - fsGroup: {{ .Values.securityContext.fsGroup }} - runAsUser: {{ .Values.securityContext.runAsUser }} + {{- if .Values.securityContext }} + securityContext: {{ toYaml .Values.securityContext | nindent 12 }} {{- end }} containers: - name: {{ .Chart.Name }} From 533551b9e31defdfdbb911737e576775b78725d3 Mon Sep 17 00:00:00 2001 From: erikfuego Date: Fri, 24 Mar 2023 12:25:03 -0400 Subject: [PATCH 04/47] added securityContext to containers --- templates/cronjob.yaml | 3 +++ templates/deployment.yaml | 3 +++ 2 files changed, 6 insertions(+) diff --git a/templates/cronjob.yaml b/templates/cronjob.yaml index 1127393b..8ab5aa53 100644 --- a/templates/cronjob.yaml +++ b/templates/cronjob.yaml @@ -50,6 +50,9 @@ spec: - --delete-untagged={{ .Values.garbageCollect.deleteUntagged }} - /etc/docker/registry/config.yml env: {{ include "docker-registry.envs" . | nindent 16 }} + {{- if .Values.securityContext }} + securityContext: {{ toYaml .Values.securityContext | nindent 16 }} + {{- end }} volumeMounts: {{ include "docker-registry.volumeMounts" . | nindent 16 }} restartPolicy: OnFailure {{- if .Values.nodeSelector }} diff --git a/templates/deployment.yaml b/templates/deployment.yaml index 093b9739..65939416 100644 --- a/templates/deployment.yaml +++ b/templates/deployment.yaml @@ -80,6 +80,9 @@ spec: port: 5000 resources: {{ toYaml .Values.resources | nindent 12 }} env: {{ include "docker-registry.envs" . | nindent 12 }} + {{- if .Values.securityContext }} + securityContext: {{ toYaml .Values.securityContext | nindent 12 }} + {{- end }} volumeMounts: {{ include "docker-registry.volumeMounts" . | nindent 12 }} {{- if .Values.nodeSelector }} nodeSelector: {{ toYaml .Values.nodeSelector | nindent 8 }} From ca801de42735f6cd28551c6454bba3cd5ccd49ac Mon Sep 17 00:00:00 2001 From: erikfuego Date: Fri, 24 Mar 2023 15:09:06 -0400 Subject: [PATCH 05/47] added secretRef to secret.yaml --- templates/secret.yaml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/templates/secret.yaml b/templates/secret.yaml index 6265dc84..4f4a1778 100644 --- a/templates/secret.yaml +++ b/templates/secret.yaml @@ -26,8 +26,11 @@ data: azureContainer: {{ .Values.secrets.azure.container | b64enc | quote }} {{- end }} {{- else if eq .Values.storage "s3" }} + {{- if and .Values.secrets.s3.secretRef }} + secretRef: {{ .Values.secrets.s3.secretRef }} + {{- end }} {{- if and .Values.secrets.s3.secretKey .Values.secrets.s3.accessKey }} - s3AccessKey: {{ .Values.secrets.s3.accessKey | b64enc | quote }} + s3AccessKey: {{ .Values.secrets.s3.secretKey | b64enc | quote }} s3SecretKey: {{ .Values.secrets.s3.secretKey | b64enc | quote }} {{- end }} {{- else if eq .Values.storage "swift" }} From a1ef866d1060cee221b1dd2d39e870bb3ea6373c Mon Sep 17 00:00:00 2001 From: erikfuego Date: Fri, 24 Mar 2023 15:21:44 -0400 Subject: [PATCH 06/47] added base64end to secretRef --- templates/secret.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/templates/secret.yaml b/templates/secret.yaml index 4f4a1778..2cb9e766 100644 --- a/templates/secret.yaml +++ b/templates/secret.yaml @@ -27,7 +27,7 @@ data: {{- end }} {{- else if eq .Values.storage "s3" }} {{- if and .Values.secrets.s3.secretRef }} - secretRef: {{ .Values.secrets.s3.secretRef }} + secretRef: {{ .Values.secrets.s3.secretRef | b64enc | quote }} {{- end }} {{- if and .Values.secrets.s3.secretKey .Values.secrets.s3.accessKey }} s3AccessKey: {{ .Values.secrets.s3.secretKey | b64enc | quote }} From bc507bdcd5cb2167addfe3a3d0c486c0c7af2ded Mon Sep 17 00:00:00 2001 From: erikfuego Date: Fri, 24 Mar 2023 15:48:57 -0400 Subject: [PATCH 07/47] bug --- templates/secret.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/templates/secret.yaml b/templates/secret.yaml index 2cb9e766..7d50ec6f 100644 --- a/templates/secret.yaml +++ b/templates/secret.yaml @@ -30,7 +30,7 @@ data: secretRef: {{ .Values.secrets.s3.secretRef | b64enc | quote }} {{- end }} {{- if and .Values.secrets.s3.secretKey .Values.secrets.s3.accessKey }} - s3AccessKey: {{ .Values.secrets.s3.secretKey | b64enc | quote }} + s3AccessKey: {{ .Values.secrets.s3.accessKey | b64enc | quote }} s3SecretKey: {{ .Values.secrets.s3.secretKey | b64enc | quote }} {{- end }} {{- else if eq .Values.storage "swift" }} From eae3454c77d37576cecb8301772826c3631cc279 Mon Sep 17 00:00:00 2001 From: erikfuego Date: Fri, 24 Mar 2023 20:17:34 -0400 Subject: [PATCH 08/47] specified a containerSecurityContext for containers --- templates/cronjob.yaml | 2 +- templates/deployment.yaml | 2 +- values.yaml | 1 - 3 files changed, 2 insertions(+), 3 deletions(-) diff --git a/templates/cronjob.yaml b/templates/cronjob.yaml index 8ab5aa53..4f071928 100644 --- a/templates/cronjob.yaml +++ b/templates/cronjob.yaml @@ -51,7 +51,7 @@ spec: - /etc/docker/registry/config.yml env: {{ include "docker-registry.envs" . | nindent 16 }} {{- if .Values.securityContext }} - securityContext: {{ toYaml .Values.securityContext | nindent 16 }} + securityContext: {{ toYaml .Values.containerSecurityContext | nindent 16 }} {{- end }} volumeMounts: {{ include "docker-registry.volumeMounts" . | nindent 16 }} restartPolicy: OnFailure diff --git a/templates/deployment.yaml b/templates/deployment.yaml index 65939416..cc160f95 100644 --- a/templates/deployment.yaml +++ b/templates/deployment.yaml @@ -81,7 +81,7 @@ spec: resources: {{ toYaml .Values.resources | nindent 12 }} env: {{ include "docker-registry.envs" . | nindent 12 }} {{- if .Values.securityContext }} - securityContext: {{ toYaml .Values.securityContext | nindent 12 }} + securityContext: {{ toYaml .Values.containerSecurityContext | nindent 12 }} {{- end }} volumeMounts: {{ include "docker-registry.volumeMounts" . | nindent 12 }} {{- if .Values.nodeSelector }} diff --git a/values.yaml b/values.yaml index a5e2d6ec..7fa28b24 100644 --- a/values.yaml +++ b/values.yaml @@ -154,7 +154,6 @@ configData: securityContext: runAsUser: 1000 - fsGroup: 1000 priorityClassName: "" From ed363d7c92a025207696214f882a4980ae788a8f Mon Sep 17 00:00:00 2001 From: erikfuego Date: Tue, 28 Mar 2023 12:35:19 -0400 Subject: [PATCH 09/47] added missing fields for securityContext --- templates/cronjob.yaml | 9 +++++---- templates/deployment.yaml | 11 ++++++----- values.yaml | 1 - 3 files changed, 11 insertions(+), 10 deletions(-) diff --git a/templates/cronjob.yaml b/templates/cronjob.yaml index 3a04680d..b6a2457b 100644 --- a/templates/cronjob.yaml +++ b/templates/cronjob.yaml @@ -37,10 +37,8 @@ spec: {{- if .Values.priorityClassName }} priorityClassName: "{{ .Values.priorityClassName }}" {{- end }} - {{- if .Values.securityContext.enabled }} - securityContext: - fsGroup: {{ .Values.securityContext.fsGroup }} - runAsUser: {{ .Values.securityContext.runAsUser }} + {{- if .Values.securityContext }} + securityContext: {{ toYaml .Values.securityContext | nindent 12 }} {{- end }} containers: - name: {{ .Chart.Name }} @@ -52,6 +50,9 @@ spec: - --delete-untagged={{ .Values.garbageCollect.deleteUntagged }} - /etc/docker/registry/config.yml env: {{ include "docker-registry.envs" . | nindent 16 }} + {{- if .Values.containerSecurityContext }} + securityContext: {{ toYaml .Values.containerSecurityContext | nindent 16 }} + {{- end }} volumeMounts: {{ include "docker-registry.volumeMounts" . | nindent 16 }} restartPolicy: OnFailure {{- if .Values.nodeSelector }} diff --git a/templates/deployment.yaml b/templates/deployment.yaml index 6d2ff0e5..15161099 100644 --- a/templates/deployment.yaml +++ b/templates/deployment.yaml @@ -42,11 +42,9 @@ spec: {{- if .Values.priorityClassName }} priorityClassName: "{{ .Values.priorityClassName }}" {{- end }} - {{- if .Values.securityContext.enabled }} - securityContext: - fsGroup: {{ .Values.securityContext.fsGroup }} - runAsUser: {{ .Values.securityContext.runAsUser }} - {{- end }} + {{- if .Values.securityContext }} + securityContext: {{ toYaml .Values.securityContext | nindent 8 }} + {{- end }} {{- with .Values.initContainers }} initContainers: {{- toYaml . | nindent 8 }} @@ -82,6 +80,9 @@ spec: port: 5000 resources: {{ toYaml .Values.resources | nindent 12 }} env: {{ include "docker-registry.envs" . | nindent 12 }} + {{- if .Values.containerSecurityContext }} + securityContext: {{ toYaml .Values.containerSecurityContext | nindent 12 }} + {{- end }} volumeMounts: {{ include "docker-registry.volumeMounts" . | nindent 12 }} {{- if .Values.nodeSelector }} nodeSelector: {{ toYaml .Values.nodeSelector | nindent 8 }} diff --git a/values.yaml b/values.yaml index 7f9c5588..a5e2d6ec 100644 --- a/values.yaml +++ b/values.yaml @@ -153,7 +153,6 @@ configData: threshold: 3 securityContext: - enabled: true runAsUser: 1000 fsGroup: 1000 From 57e4a02d5ad4a4b4567365176b6b12a1f51d8d41 Mon Sep 17 00:00:00 2001 From: Tarun Chinmai Sekar Date: Mon, 24 Apr 2023 17:41:22 -0400 Subject: [PATCH 10/47] allow specifying the override for accesskey and secretkey names --- templates/_helpers.tpl | 4 ++-- values.yaml | 2 ++ 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/templates/_helpers.tpl b/templates/_helpers.tpl index d9d7531b..1cd5269a 100644 --- a/templates/_helpers.tpl +++ b/templates/_helpers.tpl @@ -75,12 +75,12 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this valueFrom: secretKeyRef: name: {{ if .Values.secrets.s3.secretRef }}{{ .Values.secrets.s3.secretRef }}{{ else }}{{ template "docker-registry.fullname" . }}-secret{{ end }} - key: s3AccessKey + key: {{ if .Values.secrets.s3.accessKeyName }}{{ .Values.secrets.s3.accessKeyName }}{{ else }} s3AccessKey {{ end }} - name: REGISTRY_STORAGE_S3_SECRETKEY valueFrom: secretKeyRef: name: {{ if .Values.secrets.s3.secretRef }}{{ .Values.secrets.s3.secretRef }}{{ else }}{{ template "docker-registry.fullname" . }}-secret{{ end }} - key: s3SecretKey + key: {{ if .Values.secrets.s3.secretKeyName}}{{ .Values.secrets.s3.secretKeyName}}{{ else }} s3SecretKey {{ end }} {{- end -}} {{- if .Values.s3.regionEndpoint }} diff --git a/values.yaml b/values.yaml index 7fa28b24..5fed0098 100644 --- a/values.yaml +++ b/values.yaml @@ -85,6 +85,8 @@ secrets: # Use a secretRef with keys (accessKey, secretKey) for secrets stored outside the chart # s3: # secretRef: "" +# secretKeyName: "" # defaults to s3SecretKey if not specified +# accessKeyName: "" # defaults to s3AccessKey if not specified # accessKey: "" # secretKey: "" # Secrets for Swift username and password From 97864101fbdead27752c4d19f1f10381c8a6d89e Mon Sep 17 00:00:00 2001 From: Scott Rager Date: Wed, 23 Aug 2023 14:26:08 -0500 Subject: [PATCH 11/47] Adds more s3-related parameters --- templates/_helpers.tpl | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) diff --git a/templates/_helpers.tpl b/templates/_helpers.tpl index 1cd5269a..f1d27895 100644 --- a/templates/_helpers.tpl +++ b/templates/_helpers.tpl @@ -103,6 +103,31 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this value: {{ .Values.s3.secure | quote }} {{- end -}} +{{- if .Values.s3.chunksize }} +- name: REGISTRY_STORAGE_S3_CHUNKSIZE + value: {{ .Values.s3.chunksize | quote }} +{{- end -}} + +{{- if .Values.s3.multipartcopychunksize }} +- name: REGISTRY_STORAGE_S3_MULTIPARTCOPYCHUNKSIZE + value: {{ .Values.s3.multipartcopychunksize | quote }} +{{- end -}} + +{{- if .Values.s3.multipartcopymaxconcurrency }} +- name: REGISTRY_STORAGE_S3_MULTIPARTCOPYMAXCONCURRENCY + value: {{ .Values.s3.multipartcopymaxconcurrency | quote }} +{{- end -}} + +{{- if .Values.s3.multipartcopythresholdsize }} +- name: REGISTRY_STORAGE_S3_MULTIPARTCOPYTHRESHOLDSIZE + value: {{ .Values.s3.multipartcopythresholdsize | quote }} +{{- end -}} + +{{- if .Values.redirect }} +- name: REGISTRY_STORAGE_REDIRECT + value: {{ .Values.redirect | quote }} +{{- end -}} + {{- else if eq .Values.storage "swift" }} - name: REGISTRY_STORAGE_SWIFT_AUTHURL value: {{ required ".Values.swift.authurl is required" .Values.swift.authurl }} From e71e90c5354774f1c2c482523748ccd736492c95 Mon Sep 17 00:00:00 2001 From: Scott Rager Date: Wed, 23 Aug 2023 14:40:37 -0500 Subject: [PATCH 12/47] Fix redirect parameter --- templates/_helpers.tpl | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/templates/_helpers.tpl b/templates/_helpers.tpl index f1d27895..5b58999b 100644 --- a/templates/_helpers.tpl +++ b/templates/_helpers.tpl @@ -123,9 +123,9 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this value: {{ .Values.s3.multipartcopythresholdsize | quote }} {{- end -}} -{{- if .Values.redirect }} -- name: REGISTRY_STORAGE_REDIRECT - value: {{ .Values.redirect | quote }} +{{- if .Values.redirect.disable }} +- name: REGISTRY_STORAGE_REDIRECT_DISABLE + value: {{ .Values.redirect.disable | quote }} {{- end -}} {{- else if eq .Values.storage "swift" }} From bb0ebe3f8528215bfd0d021a62ce1c4c59ad49d0 Mon Sep 17 00:00:00 2001 From: Scott Rager Date: Wed, 23 Aug 2023 14:50:59 -0500 Subject: [PATCH 13/47] Add default values for new parameters --- values.yaml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/values.yaml b/values.yaml index 5fed0098..7a7837cd 100644 --- a/values.yaml +++ b/values.yaml @@ -102,6 +102,13 @@ secrets: # rootdirectory: /object/prefix # encrypt: false # secure: true +# chunksize: 5242880 +# multipartcopychunksize: 33554432 +# multipartcopymaxconcurrency: 100 +# multipartcopythresholdsize: 33554432 + +# redirect: +# disable: false # Options for swift storage type: # swift: From 765f3623daf5721ca6b662410e2eee5c617c643b Mon Sep 17 00:00:00 2001 From: Scott Rager Date: Wed, 23 Aug 2023 14:53:18 -0500 Subject: [PATCH 14/47] Remove redirect parameter --- templates/_helpers.tpl | 5 ----- values.yaml | 3 --- 2 files changed, 8 deletions(-) diff --git a/templates/_helpers.tpl b/templates/_helpers.tpl index 5b58999b..07bd86b7 100644 --- a/templates/_helpers.tpl +++ b/templates/_helpers.tpl @@ -123,11 +123,6 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this value: {{ .Values.s3.multipartcopythresholdsize | quote }} {{- end -}} -{{- if .Values.redirect.disable }} -- name: REGISTRY_STORAGE_REDIRECT_DISABLE - value: {{ .Values.redirect.disable | quote }} -{{- end -}} - {{- else if eq .Values.storage "swift" }} - name: REGISTRY_STORAGE_SWIFT_AUTHURL value: {{ required ".Values.swift.authurl is required" .Values.swift.authurl }} diff --git a/values.yaml b/values.yaml index 7a7837cd..7cee2fec 100644 --- a/values.yaml +++ b/values.yaml @@ -107,9 +107,6 @@ secrets: # multipartcopymaxconcurrency: 100 # multipartcopythresholdsize: 33554432 -# redirect: -# disable: false - # Options for swift storage type: # swift: # authurl: http://swift.example.com/ From 805e52e3b614f564f69df0d3ec1efa564ad19dba Mon Sep 17 00:00:00 2001 From: Erik Rosales Date: Mon, 27 Nov 2023 12:59:13 -0500 Subject: [PATCH 15/47] Update templates/deployment.yaml Co-authored-by: Joshua Sizer --- templates/deployment.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/templates/deployment.yaml b/templates/deployment.yaml index 15161099..4485d302 100644 --- a/templates/deployment.yaml +++ b/templates/deployment.yaml @@ -44,7 +44,7 @@ spec: {{- end }} {{- if .Values.securityContext }} securityContext: {{ toYaml .Values.securityContext | nindent 8 }} - {{- end }} + {{- end }} {{- with .Values.initContainers }} initContainers: {{- toYaml . | nindent 8 }} From 987b061b4d64226c657fd6c520b68b4a6d031147 Mon Sep 17 00:00:00 2001 From: Erik Rosales Date: Thu, 1 Feb 2024 16:02:46 -0500 Subject: [PATCH 16/47] Add back Tarun's changes (#3) * add back tarun changes * nl --------- Co-authored-by: Erik --- templates/_helpers.tpl | 24 ++++++++++++++++++++++-- templates/secret.yaml | 3 +++ values.yaml | 7 ++++++- 3 files changed, 31 insertions(+), 3 deletions(-) diff --git a/templates/_helpers.tpl b/templates/_helpers.tpl index d9d7531b..07bd86b7 100644 --- a/templates/_helpers.tpl +++ b/templates/_helpers.tpl @@ -75,12 +75,12 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this valueFrom: secretKeyRef: name: {{ if .Values.secrets.s3.secretRef }}{{ .Values.secrets.s3.secretRef }}{{ else }}{{ template "docker-registry.fullname" . }}-secret{{ end }} - key: s3AccessKey + key: {{ if .Values.secrets.s3.accessKeyName }}{{ .Values.secrets.s3.accessKeyName }}{{ else }} s3AccessKey {{ end }} - name: REGISTRY_STORAGE_S3_SECRETKEY valueFrom: secretKeyRef: name: {{ if .Values.secrets.s3.secretRef }}{{ .Values.secrets.s3.secretRef }}{{ else }}{{ template "docker-registry.fullname" . }}-secret{{ end }} - key: s3SecretKey + key: {{ if .Values.secrets.s3.secretKeyName}}{{ .Values.secrets.s3.secretKeyName}}{{ else }} s3SecretKey {{ end }} {{- end -}} {{- if .Values.s3.regionEndpoint }} @@ -103,6 +103,26 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this value: {{ .Values.s3.secure | quote }} {{- end -}} +{{- if .Values.s3.chunksize }} +- name: REGISTRY_STORAGE_S3_CHUNKSIZE + value: {{ .Values.s3.chunksize | quote }} +{{- end -}} + +{{- if .Values.s3.multipartcopychunksize }} +- name: REGISTRY_STORAGE_S3_MULTIPARTCOPYCHUNKSIZE + value: {{ .Values.s3.multipartcopychunksize | quote }} +{{- end -}} + +{{- if .Values.s3.multipartcopymaxconcurrency }} +- name: REGISTRY_STORAGE_S3_MULTIPARTCOPYMAXCONCURRENCY + value: {{ .Values.s3.multipartcopymaxconcurrency | quote }} +{{- end -}} + +{{- if .Values.s3.multipartcopythresholdsize }} +- name: REGISTRY_STORAGE_S3_MULTIPARTCOPYTHRESHOLDSIZE + value: {{ .Values.s3.multipartcopythresholdsize | quote }} +{{- end -}} + {{- else if eq .Values.storage "swift" }} - name: REGISTRY_STORAGE_SWIFT_AUTHURL value: {{ required ".Values.swift.authurl is required" .Values.swift.authurl }} diff --git a/templates/secret.yaml b/templates/secret.yaml index 6265dc84..7d50ec6f 100644 --- a/templates/secret.yaml +++ b/templates/secret.yaml @@ -26,6 +26,9 @@ data: azureContainer: {{ .Values.secrets.azure.container | b64enc | quote }} {{- end }} {{- else if eq .Values.storage "s3" }} + {{- if and .Values.secrets.s3.secretRef }} + secretRef: {{ .Values.secrets.s3.secretRef | b64enc | quote }} + {{- end }} {{- if and .Values.secrets.s3.secretKey .Values.secrets.s3.accessKey }} s3AccessKey: {{ .Values.secrets.s3.accessKey | b64enc | quote }} s3SecretKey: {{ .Values.secrets.s3.secretKey | b64enc | quote }} diff --git a/values.yaml b/values.yaml index a5e2d6ec..7cee2fec 100644 --- a/values.yaml +++ b/values.yaml @@ -85,6 +85,8 @@ secrets: # Use a secretRef with keys (accessKey, secretKey) for secrets stored outside the chart # s3: # secretRef: "" +# secretKeyName: "" # defaults to s3SecretKey if not specified +# accessKeyName: "" # defaults to s3AccessKey if not specified # accessKey: "" # secretKey: "" # Secrets for Swift username and password @@ -100,6 +102,10 @@ secrets: # rootdirectory: /object/prefix # encrypt: false # secure: true +# chunksize: 5242880 +# multipartcopychunksize: 33554432 +# multipartcopymaxconcurrency: 100 +# multipartcopythresholdsize: 33554432 # Options for swift storage type: # swift: @@ -154,7 +160,6 @@ configData: securityContext: runAsUser: 1000 - fsGroup: 1000 priorityClassName: "" From d8c0cfb2c76dfee64349e9e3e66a1f2eea20f791 Mon Sep 17 00:00:00 2001 From: Glenn Pratt Date: Tue, 9 Jul 2024 16:41:13 -0700 Subject: [PATCH 17/47] Add extraContainers value --- templates/deployment.yaml | 3 +++ values.yaml | 10 ++++++++++ 2 files changed, 13 insertions(+) diff --git a/templates/deployment.yaml b/templates/deployment.yaml index dff79cb5..43faffbf 100644 --- a/templates/deployment.yaml +++ b/templates/deployment.yaml @@ -88,6 +88,9 @@ spec: securityContext: {{ omit .Values.containerSecurityContext "enabled" | toYaml | nindent 12 }} {{- end }} volumeMounts: {{ include "docker-registry.volumeMounts" . | nindent 12 }} + {{- if .Values.extraContainers }} + {{- .Values.extraContainers | toYaml | nindent 8 }} + {{- end }} {{- if .Values.nodeSelector }} nodeSelector: {{ toYaml .Values.nodeSelector | nindent 8 }} {{- end }} diff --git a/values.yaml b/values.yaml index 4bdab458..102e1c9d 100644 --- a/values.yaml +++ b/values.yaml @@ -241,6 +241,16 @@ initContainers: [] # image: busybox # command: [] +extraContainers: [] +## Extra containers to add to the Deployment +# - name: istio-proxy +# image: auto +# securityContext: +# allowPrivilegeEscalation: false +# capabilities: +# drop: +# - ALL + garbageCollect: enabled: false deleteUntagged: true From 065f6c5c4454dbc572a5836ef726f916365fde82 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 21 Jan 2025 02:32:57 +0000 Subject: [PATCH 18/47] Bump helm/chart-releaser-action from 1.6.0 to 1.7.0 Bumps [helm/chart-releaser-action](https://github.com/helm/chart-releaser-action) from 1.6.0 to 1.7.0. - [Release notes](https://github.com/helm/chart-releaser-action/releases) - [Commits](https://github.com/helm/chart-releaser-action/compare/v1.6.0...v1.7.0) --- updated-dependencies: - dependency-name: helm/chart-releaser-action dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] --- .github/workflows/helm_release.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/helm_release.yaml b/.github/workflows/helm_release.yaml index 4263e76d..c9e1b8ac 100644 --- a/.github/workflows/helm_release.yaml +++ b/.github/workflows/helm_release.yaml @@ -20,7 +20,7 @@ jobs: git config user.email "$GITHUB_ACTOR@users.noreply.github.com" - name: Install chart-releaser - uses: helm/chart-releaser-action@v1.6.0 + uses: helm/chart-releaser-action@v1.7.0 with: install_only: true From 5af937bbce12400628913ff453da5219d53214d0 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 10 Apr 2025 02:47:40 +0000 Subject: [PATCH 19/47] Bump marocchino/sticky-pull-request-comment from 2.2.0 to 2.9.2 Bumps [marocchino/sticky-pull-request-comment](https://github.com/marocchino/sticky-pull-request-comment) from 2.2.0 to 2.9.2. - [Release notes](https://github.com/marocchino/sticky-pull-request-comment/releases) - [Commits](https://github.com/marocchino/sticky-pull-request-comment/compare/39c5b5dc7717447d0cba270cd115037d32d28443...67d0dec7b07ed060a405f9b2a64b8ab319fdd7db) --- updated-dependencies: - dependency-name: marocchino/sticky-pull-request-comment dependency-version: 2.9.2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] --- .github/workflows/pr_diff.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/pr_diff.yaml b/.github/workflows/pr_diff.yaml index 52f6a420..129238bc 100644 --- a/.github/workflows/pr_diff.yaml +++ b/.github/workflows/pr_diff.yaml @@ -44,7 +44,7 @@ jobs: echo 'HELM_DIFF<> $GITHUB_ENV echo "$(diff -ur before after)" >> $GITHUB_ENV echo 'EOF' >> $GITHUB_ENV - - uses: marocchino/sticky-pull-request-comment@39c5b5dc7717447d0cba270cd115037d32d28443 + - uses: marocchino/sticky-pull-request-comment@67d0dec7b07ed060a405f9b2a64b8ab319fdd7db with: message: | Running a `helm template` smoketest on commit ${{ github.ref }} results in the following diff against `${{ github.base_ref }}`: From e73d9e85c4cf73a2a4bf92f9258426cdbe7d94dc Mon Sep 17 00:00:00 2001 From: Mercbot7 <42525173+Mercbot7@users.noreply.github.com> Date: Mon, 14 Apr 2025 09:20:19 -0400 Subject: [PATCH 20/47] Update gargagecollect cronjob This adds podLabels and podAnnotations to the cronjob job pod and defaults them to the root podLabels and podAnnotations. --- templates/cronjob.yaml | 30 +++++++++++++++++++++++++++--- 1 file changed, 27 insertions(+), 3 deletions(-) diff --git a/templates/cronjob.yaml b/templates/cronjob.yaml index 780cf875..a671cf51 100644 --- a/templates/cronjob.yaml +++ b/templates/cronjob.yaml @@ -17,16 +17,40 @@ spec: app: {{ template "docker-registry.name" . }} release: {{ .Release.Name }} {{- with .Values.podLabels }} - {{ toYaml . | nindent 8 }} + {{- toYaml . | nindent 8 }} {{- end }} annotations: checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }} checksum/secret: {{ include (print $.Template.BasePath "/secret.yaml") . | sha256sum }} {{- if .Values.podAnnotations }} - {{ toYaml .Values.podAnnotations | nindent 8 }} + {{- toYaml .Values.podAnnotations | nindent 8 }} {{- end }} spec: template: + metadata: + labels: + release: {{ .Release.Name }} + {{- if .Values.garbageCollect.podLabels }} + {{- with .Values.garbageCollect.podLabels }} + {{- toYaml . | nindent 12 }} + {{- end }} + {{- else if .Values.podLabels }} + {{- with .Values.podLabels }} + {{- toYaml . | nindent 12 }} + {{- end }} + {{- end }} + annotations: + checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }} + checksum/secret: {{ include (print $.Template.BasePath "/secret.yaml") . | sha256sum }} + {{- if .Values.garbageCollect.podAnnotations }} + {{- with .Values.garbageCollect.podAnnotations }} + {{- toYaml . | nindent 12 }} + {{- end }} + {{- else if .Values.podAnnotations }} + {{- with .Values.podAnnotations}} + {{- toYaml . | nindent 12 }} + {{- end }} + {{- end }} spec: {{- if or (eq .Values.serviceAccount.create true) (ne .Values.serviceAccount.name "") }} serviceAccountName: {{ .Values.serviceAccount.name | default (include "docker-registry.fullname" .) }} @@ -49,7 +73,7 @@ spec: - garbage-collect - --delete-untagged={{ .Values.garbageCollect.deleteUntagged }} - /etc/docker/registry/config.yml - resources: {{ toYaml .Values.garbageCollect.resources | nindent 12 }} + resources: {{ toYaml .Values.garbageCollect.resources | nindent 16 }} env: {{ include "docker-registry.envs" . | nindent 16 }} {{- if .Values.containerSecurityContext.enabled }} securityContext: {{ omit .Values.containerSecurityContext "enabled" | toYaml | nindent 16 }} From 88ccbc1313fe910176259cd6258dfffa4f8b073b Mon Sep 17 00:00:00 2001 From: Mercbot7 <42525173+Mercbot7@users.noreply.github.com> Date: Mon, 14 Apr 2025 09:23:32 -0400 Subject: [PATCH 21/47] Update values.yaml to match cronjob updates and minor spacing fixes --- values.yaml | 36 ++++++++++++++++++++++++------------ 1 file changed, 24 insertions(+), 12 deletions(-) diff --git a/values.yaml b/values.yaml index 4bdab458..ef8f0414 100644 --- a/values.yaml +++ b/values.yaml @@ -61,11 +61,11 @@ resources: {} # resources, such as Minikube. If you do want to specify resources, uncomment the following # lines, adjust them as necessary, and remove the curly braces after 'resources:'. # limits: - # cpu: 100m - # memory: 128Mi + # cpu: 100m + # memory: 128Mi # requests: - # cpu: 100m - # memory: 128Mi + # cpu: 100m + # memory: 128Mi persistence: accessMode: 'ReadWriteOnce' enabled: false @@ -98,17 +98,17 @@ secrets: # Options for s3 storage type: # s3: -# region: us-east-1 -# regionEndpoint: https://s3.us-east-1.amazonaws.com -# bucket: my-bucket -# rootdirectory: /object/prefix -# encrypt: false -# secure: true +# region: us-east-1 +# regionEndpoint: https://s3.us-east-1.amazonaws.com +# bucket: my-bucket +# rootdirectory: /object/prefix +# encrypt: false +# secure: true # Options for swift storage type: # swift: -# authurl: http://swift.example.com/ -# container: my-container +# authurl: http://swift.example.com/ +# container: my-container # https://docs.docker.com/registry/recipes/mirror/ proxy: @@ -245,4 +245,16 @@ garbageCollect: enabled: false deleteUntagged: true schedule: "0 1 * * *" + podAnnotations: {} + podLabels: {} resources: {} + # We usually recommend not to specify default resources and to leave this as a conscious + # choice for the user. This also increases chances charts run on environments with little + # resources, such as Minikube. If you do want to specify resources, uncomment the following + # lines, adjust them as necessary, and remove the curly braces after 'resources:'. + # limits: + # cpu: 100m + # memory: 128Mi + # requests: + # cpu: 100m + # memory: 128Mi From d6224c847b7d927357cd0fccc56e17f08837a8d4 Mon Sep 17 00:00:00 2001 From: Mercbot7 <42525173+Mercbot7@users.noreply.github.com> Date: Mon, 14 Apr 2025 15:02:51 -0400 Subject: [PATCH 22/47] refactor logic for lapels and annotations and fix resources --- templates/cronjob.yaml | 29 +++++++++-------------------- 1 file changed, 9 insertions(+), 20 deletions(-) diff --git a/templates/cronjob.yaml b/templates/cronjob.yaml index a671cf51..e15fdab9 100644 --- a/templates/cronjob.yaml +++ b/templates/cronjob.yaml @@ -30,27 +30,13 @@ spec: metadata: labels: release: {{ .Release.Name }} - {{- if .Values.garbageCollect.podLabels }} - {{- with .Values.garbageCollect.podLabels }} - {{- toYaml . | nindent 12 }} - {{- end }} - {{- else if .Values.podLabels }} - {{- with .Values.podLabels }} - {{- toYaml . | nindent 12 }} - {{- end }} + {{- if or .Values.podLabels .Values.garbageCollect.podLabels }} + {{- toYaml (merge (.Values.podLabels | default (dict)) (.Values.garbageCollect.podLabels | default (dict))) | nindent 12 }} {{- end }} + {{- if or .Values.podAnnotations .Values.garbageCollect.podAnnotations }} annotations: - checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }} - checksum/secret: {{ include (print $.Template.BasePath "/secret.yaml") . | sha256sum }} - {{- if .Values.garbageCollect.podAnnotations }} - {{- with .Values.garbageCollect.podAnnotations }} - {{- toYaml . | nindent 12 }} - {{- end }} - {{- else if .Values.podAnnotations }} - {{- with .Values.podAnnotations}} - {{- toYaml . | nindent 12 }} - {{- end }} - {{- end }} + {{- toYaml (merge (.Values.podAnnotations | default (dict)) (.Values.garbageCollect.podAnnotations | default (dict))) | nindent 12 }} + {{- end}} spec: {{- if or (eq .Values.serviceAccount.create true) (ne .Values.serviceAccount.name "") }} serviceAccountName: {{ .Values.serviceAccount.name | default (include "docker-registry.fullname" .) }} @@ -73,7 +59,10 @@ spec: - garbage-collect - --delete-untagged={{ .Values.garbageCollect.deleteUntagged }} - /etc/docker/registry/config.yml - resources: {{ toYaml .Values.garbageCollect.resources | nindent 16 }} + {{- if .Values.garbageCollect.resources }} + resources: + {{- toYaml .Values.garbageCollect.resources | nindent 16 }} + {{- end }} env: {{ include "docker-registry.envs" . | nindent 16 }} {{- if .Values.containerSecurityContext.enabled }} securityContext: {{ omit .Values.containerSecurityContext "enabled" | toYaml | nindent 16 }} From 9bba24a3d2a7c1ce9dc2621136438ecd340dc1f5 Mon Sep 17 00:00:00 2001 From: Mercbot7 <42525173+Mercbot7@users.noreply.github.com> Date: Tue, 15 Apr 2025 09:09:43 -0400 Subject: [PATCH 23/47] reorder merge for proper preference --- templates/cronjob.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/templates/cronjob.yaml b/templates/cronjob.yaml index e15fdab9..e9207762 100644 --- a/templates/cronjob.yaml +++ b/templates/cronjob.yaml @@ -31,11 +31,11 @@ spec: labels: release: {{ .Release.Name }} {{- if or .Values.podLabels .Values.garbageCollect.podLabels }} - {{- toYaml (merge (.Values.podLabels | default (dict)) (.Values.garbageCollect.podLabels | default (dict))) | nindent 12 }} + {{- toYaml (merge (.Values.garbageCollect.podLabels | default (dict)) (.Values.podLabels | default (dict))) | nindent 12 }} {{- end }} {{- if or .Values.podAnnotations .Values.garbageCollect.podAnnotations }} annotations: - {{- toYaml (merge (.Values.podAnnotations | default (dict)) (.Values.garbageCollect.podAnnotations | default (dict))) | nindent 12 }} + {{- toYaml (merge (.Values.garbageCollect.podAnnotations | default (dict)) (.Values.podAnnotations | default (dict))) | nindent 12 }} {{- end}} spec: {{- if or (eq .Values.serviceAccount.create true) (ne .Values.serviceAccount.name "") }} From 53e594b53d09396871e88d16bfe8ec40bb91385e Mon Sep 17 00:00:00 2001 From: Josh Sizer Date: Tue, 15 Apr 2025 21:50:52 -0400 Subject: [PATCH 24/47] =?UTF-8?q?=F0=9F=8F=81=20v2.3.0=20Release?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Chart.yaml b/Chart.yaml index b0e582ab..c0355720 100644 --- a/Chart.yaml +++ b/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v1 description: A Helm chart for Docker Registry name: docker-registry -version: 2.2.3 +version: 2.3.0 appVersion: 2.8.1 home: https://hub.docker.com/_/registry/ icon: https://helm.twun.io/docker-registry.png From 14fc7bb5a2c48dc4857ce6a59671806f58ddffdf Mon Sep 17 00:00:00 2001 From: Mercbot7 <42525173+Mercbot7@users.noreply.github.com> Date: Wed, 16 Apr 2025 12:06:32 -0400 Subject: [PATCH 25/47] Update README.md for garbageCollect Update README.md for garbageCollect Annotations and Labels keys. --- README.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 7e7e86b7..622ec9fa 100644 --- a/README.md +++ b/README.md @@ -57,8 +57,8 @@ their default values. | `service.sessionAffinityConfig` | service session affinity config | `nil` | | `replicaCount` | k8s replicas | `1` | | `updateStrategy` | update strategy for deployment | `{}` | -| `podAnnotations` | Annotations for pod | `{}` | -| `podLabels` | Labels for pod | `{}` | +| `podAnnotations` | Annotations for deployment pod, and `garbageCollect` pod unless set explicitly there. See `garbageCollect` | `{}` | +| `podLabels` | Labels for deployment pod, and `garbageCollect` pod unless set explicitly there. See `garbageCollect` | `{}` | | `podDisruptionBudget` | Pod disruption budget | `{}` | | `resources.limits.cpu` | Container requested CPU | `nil` | | `resources.limits.memory` | Container requested memory | `nil` | @@ -119,6 +119,8 @@ their default values. | `garbageCollect.enabled` | If true, will deploy garbage-collector cronjob | `false` | | `garbageCollect.deleteUntagged` | If true, garbage-collector will delete manifests that are not currently referenced via tag | `true` | | `garbageCollect.schedule` | CronTab schedule, please use standard crontab format | `0 1 * * *` | +| `garbageCollect.podAnnotations` | CronJob pod Annotations. If left empty and chart `podAnnotations` are set, will use those. If both are set, these take precedence for the `garbageCollect` pods. | `{}` | +| `garbageCollect.podLabels` | CronJob pod Annotations. If left empty and chart `podLabels` are set, will use those. If both are set, these take precedence for the `garbageCollect` pods. | `{}` | | `garbageCollect.resources` | garbage-collector requested resources | `{}` | Specify each parameter using the `--set key=value[,key=value]` argument to From e3a6eb45bf921adc36ced28de2a8e6a027aa9c7f Mon Sep 17 00:00:00 2001 From: Clovis Durand Date: Tue, 3 Jun 2025 12:29:29 +0200 Subject: [PATCH 26/47] Updated chart to accept configPath to fix distribution's 3.0.0 breaking change Signed-off-by: Clovis Durand --- README.md | 1 + templates/_helpers.tpl | 2 +- templates/cronjob.yaml | 2 +- templates/deployment.yaml | 2 +- values.yaml | 4 +++- 5 files changed, 7 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index 622ec9fa..e100b7d3 100644 --- a/README.md +++ b/README.md @@ -79,6 +79,7 @@ their default values. | `secrets.swift.password` | Password for Swift configuration | `nil` | | `secrets.haSharedSecret` | Shared secret for Registry | `nil` | | `configData` | Configuration hash for docker | `nil` | +| `configPath` | Configuration mount point in docker, `/etc/docker/registry` for registry version 2, `/etc/distribution` for version 3 | `/etc/docker/registry` | | `s3.region` | S3 region | `nil` | | `s3.regionEndpoint` | S3 region endpoint | `nil` | | `s3.bucket` | S3 bucket name | `nil` | diff --git a/templates/_helpers.tpl b/templates/_helpers.tpl index d9d7531b..f7681bb4 100644 --- a/templates/_helpers.tpl +++ b/templates/_helpers.tpl @@ -148,7 +148,7 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this {{- define "docker-registry.volumeMounts" -}} - name: "{{ template "docker-registry.fullname" . }}-config" - mountPath: "/etc/docker/registry" + mountPath: {{ .Values.configPath }} {{- if .Values.secrets.htpasswd }} - name: auth diff --git a/templates/cronjob.yaml b/templates/cronjob.yaml index e9207762..a5419590 100644 --- a/templates/cronjob.yaml +++ b/templates/cronjob.yaml @@ -58,7 +58,7 @@ spec: - /bin/registry - garbage-collect - --delete-untagged={{ .Values.garbageCollect.deleteUntagged }} - - /etc/docker/registry/config.yml + - {{ .Values.configPath }}/config.yml {{- if .Values.garbageCollect.resources }} resources: {{- toYaml .Values.garbageCollect.resources | nindent 16 }} diff --git a/templates/deployment.yaml b/templates/deployment.yaml index dff79cb5..a8ef2fca 100644 --- a/templates/deployment.yaml +++ b/templates/deployment.yaml @@ -60,7 +60,7 @@ spec: command: - /bin/registry - serve - - /etc/docker/registry/config.yml + - {{ .Values.configPath }}/config.yml ports: - containerPort: 5000 {{- if .Values.metrics.enabled }} diff --git a/values.yaml b/values.yaml index ef8f0414..b8c5ce27 100644 --- a/values.yaml +++ b/values.yaml @@ -19,7 +19,7 @@ serviceAccount: image: repository: registry - tag: 2.8.1 + tag: 3.0.0 pullPolicy: IfNotPresent # imagePullSecrets: # - name: docker @@ -133,6 +133,7 @@ metrics: labels: {} rules: {} +configPath: /etc/distribution configData: version: 0.1 log: @@ -176,6 +177,7 @@ securityContext: fsGroupChangePolicy: Always sysctls: [] supplementalGroups: [] + runAsUser: 1000 fsGroup: 1000 priorityClassName: "" From ec1706762ebf20ccc1ba060448e886a8419188b7 Mon Sep 17 00:00:00 2001 From: Kevin Boisits Date: Tue, 3 Jun 2025 18:24:15 -0500 Subject: [PATCH 27/47] Add the ability to force path style for s3 storage --- README.md | 1 + templates/_helpers.tpl | 5 +++++ values.yaml | 1 + 3 files changed, 7 insertions(+) diff --git a/README.md b/README.md index 622ec9fa..2871f952 100644 --- a/README.md +++ b/README.md @@ -85,6 +85,7 @@ their default values. | `s3.rootdirectory` | S3 prefix that is applied to allow you to segment data | `nil` | | `s3.encrypt` | Store images in encrypted format | `nil` | | `s3.secure` | Use HTTPS | `nil` | +| `s3.forcepathstyle` | Use path-style addressing, needed for some s3 compatible storage (minio) | `nil` | | `swift.authurl` | Swift authurl | `nil` | | `swift.container` | Swift container | `nil` | | `proxy.enabled` | If true, registry will function as a proxy/mirror | `false` | diff --git a/templates/_helpers.tpl b/templates/_helpers.tpl index d9d7531b..5a754fb7 100644 --- a/templates/_helpers.tpl +++ b/templates/_helpers.tpl @@ -103,6 +103,11 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this value: {{ .Values.s3.secure | quote }} {{- end -}} +{{- if .Values.s3.forcepathstyle }} +- name: REGISTRY_STORAGE_S3_FORCEPATHSTYLE + value: {{ .Values.s3.forcepathstyle | quote }} +{{- end -}} + {{- else if eq .Values.storage "swift" }} - name: REGISTRY_STORAGE_SWIFT_AUTHURL value: {{ required ".Values.swift.authurl is required" .Values.swift.authurl }} diff --git a/values.yaml b/values.yaml index ef8f0414..38f32cb7 100644 --- a/values.yaml +++ b/values.yaml @@ -104,6 +104,7 @@ secrets: # rootdirectory: /object/prefix # encrypt: false # secure: true +# forcepathstyle: true # Options for swift storage type: # swift: From 8b8e96444e0c4ef805c3daa06aa56f261f50cfc6 Mon Sep 17 00:00:00 2001 From: Kevin Boisits Date: Fri, 6 Jun 2025 21:00:14 -0500 Subject: [PATCH 28/47] Add the ability to skip verifying the TLS cert for s3 storage Allow using self signed cert on S3 storage used --- README.md | 1 + templates/_helpers.tpl | 5 +++++ values.yaml | 1 + 3 files changed, 7 insertions(+) diff --git a/README.md b/README.md index 2871f952..b46d44e0 100644 --- a/README.md +++ b/README.md @@ -86,6 +86,7 @@ their default values. | `s3.encrypt` | Store images in encrypted format | `nil` | | `s3.secure` | Use HTTPS | `nil` | | `s3.forcepathstyle` | Use path-style addressing, needed for some s3 compatible storage (minio) | `nil` | +| `s3.insecureSkipVerify` | Allows connection to s3 storage using TLS with untrusted/self-signed certificate | `nil` | | `swift.authurl` | Swift authurl | `nil` | | `swift.container` | Swift container | `nil` | | `proxy.enabled` | If true, registry will function as a proxy/mirror | `false` | diff --git a/templates/_helpers.tpl b/templates/_helpers.tpl index 5a754fb7..b5d75db3 100644 --- a/templates/_helpers.tpl +++ b/templates/_helpers.tpl @@ -108,6 +108,11 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this value: {{ .Values.s3.forcepathstyle | quote }} {{- end -}} +{{- if .Values.s3.insecureSkipVerify }} +- name: REGISTRY_STORAGE_S3_SKIPVERIFY + value: {{ .Values.s3.insecureSkipVerify | quote }} +{{- end -}} + {{- else if eq .Values.storage "swift" }} - name: REGISTRY_STORAGE_SWIFT_AUTHURL value: {{ required ".Values.swift.authurl is required" .Values.swift.authurl }} diff --git a/values.yaml b/values.yaml index 38f32cb7..a04d92e5 100644 --- a/values.yaml +++ b/values.yaml @@ -105,6 +105,7 @@ secrets: # encrypt: false # secure: true # forcepathstyle: true +# insecureSkipVerify: true # Options for swift storage type: # swift: From d344f36b9412363e27b46881047f96699e4c8c0b Mon Sep 17 00:00:00 2001 From: Kevin Boisits Date: Sun, 8 Jun 2025 22:32:26 -0500 Subject: [PATCH 29/47] Change name to match the config variable --- README.md | 2 +- templates/_helpers.tpl | 4 ++-- values.yaml | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index b46d44e0..30f48b4d 100644 --- a/README.md +++ b/README.md @@ -86,7 +86,7 @@ their default values. | `s3.encrypt` | Store images in encrypted format | `nil` | | `s3.secure` | Use HTTPS | `nil` | | `s3.forcepathstyle` | Use path-style addressing, needed for some s3 compatible storage (minio) | `nil` | -| `s3.insecureSkipVerify` | Allows connection to s3 storage using TLS with untrusted/self-signed certificate | `nil` | +| `s3.skipverify` | Allows connection to s3 storage using TLS with untrusted/self-signed certificate | `nil` | | `swift.authurl` | Swift authurl | `nil` | | `swift.container` | Swift container | `nil` | | `proxy.enabled` | If true, registry will function as a proxy/mirror | `false` | diff --git a/templates/_helpers.tpl b/templates/_helpers.tpl index b5d75db3..573276c3 100644 --- a/templates/_helpers.tpl +++ b/templates/_helpers.tpl @@ -108,9 +108,9 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this value: {{ .Values.s3.forcepathstyle | quote }} {{- end -}} -{{- if .Values.s3.insecureSkipVerify }} +{{- if .Values.s3.skipverify }} - name: REGISTRY_STORAGE_S3_SKIPVERIFY - value: {{ .Values.s3.insecureSkipVerify | quote }} + value: {{ .Values.s3.skipverify | quote }} {{- end -}} {{- else if eq .Values.storage "swift" }} diff --git a/values.yaml b/values.yaml index a04d92e5..93f01686 100644 --- a/values.yaml +++ b/values.yaml @@ -105,7 +105,7 @@ secrets: # encrypt: false # secure: true # forcepathstyle: true -# insecureSkipVerify: true +# skipverify: true # Options for swift storage type: # swift: From 55527bf77c9f8e1b8432c9c98d51e2d1b65d9c22 Mon Sep 17 00:00:00 2001 From: Kevin Boisits Date: Sun, 8 Jun 2025 22:33:50 -0500 Subject: [PATCH 30/47] Fix spacing --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 30f48b4d..5c36f88d 100644 --- a/README.md +++ b/README.md @@ -86,7 +86,7 @@ their default values. | `s3.encrypt` | Store images in encrypted format | `nil` | | `s3.secure` | Use HTTPS | `nil` | | `s3.forcepathstyle` | Use path-style addressing, needed for some s3 compatible storage (minio) | `nil` | -| `s3.skipverify` | Allows connection to s3 storage using TLS with untrusted/self-signed certificate | `nil` | +| `s3.skipverify` | Allows connection to s3 storage using TLS with untrusted/self-signed certificate | `nil` | | `swift.authurl` | Swift authurl | `nil` | | `swift.container` | Swift container | `nil` | | `proxy.enabled` | If true, registry will function as a proxy/mirror | `false` | From 1f5763b33d9c269595aa216f6b3c5f1c28c6379f Mon Sep 17 00:00:00 2001 From: Glenn Pratt Date: Wed, 18 Jun 2025 17:14:38 -0700 Subject: [PATCH 31/47] Fix merge conflict --- templates/deployment.yaml | 5 ----- 1 file changed, 5 deletions(-) diff --git a/templates/deployment.yaml b/templates/deployment.yaml index c45b1d49..43faffbf 100644 --- a/templates/deployment.yaml +++ b/templates/deployment.yaml @@ -84,13 +84,8 @@ spec: port: 5000 resources: {{ toYaml .Values.resources | nindent 12 }} env: {{ include "docker-registry.envs" . | nindent 12 }} -<<<<<<< HEAD - {{- if .Values.containerSecurityContext }} - securityContext: {{ toYaml .Values.containerSecurityContext | nindent 12 }} -======= {{- if .Values.containerSecurityContext.enabled }} securityContext: {{ omit .Values.containerSecurityContext "enabled" | toYaml | nindent 12 }} ->>>>>>> d8c0cfb2c76dfee64349e9e3e66a1f2eea20f791 {{- end }} volumeMounts: {{ include "docker-registry.volumeMounts" . | nindent 12 }} {{- if .Values.extraContainers }} From 195a762a64ea63908796c88674671196e6543f40 Mon Sep 17 00:00:00 2001 From: Glenn Pratt Date: Wed, 18 Jun 2025 17:21:51 -0700 Subject: [PATCH 32/47] fix labels --- templates/configmap.yaml | 2 +- templates/pvc.yaml | 2 +- templates/secret.yaml | 2 +- templates/serviceaccount.yaml | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/templates/configmap.yaml b/templates/configmap.yaml index 0f046ea7..db722106 100644 --- a/templates/configmap.yaml +++ b/templates/configmap.yaml @@ -5,7 +5,7 @@ metadata: namespace: {{ .Values.namespace | default .Release.Namespace }} labels: app: {{ template "docker-registry.name" . }} - chart: {{ .Chart.Name }}-{{ .Chart.Version }} + chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }} heritage: {{ .Release.Service }} release: {{ .Release.Name }} data: diff --git a/templates/pvc.yaml b/templates/pvc.yaml index dea05397..74af4b20 100644 --- a/templates/pvc.yaml +++ b/templates/pvc.yaml @@ -7,7 +7,7 @@ metadata: namespace: {{ .Values.namespace | default .Release.Namespace }} labels: app: {{ template "docker-registry.fullname" . }} - chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" + chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }} release: "{{ .Release.Name }}" heritage: "{{ .Release.Service }}" spec: diff --git a/templates/secret.yaml b/templates/secret.yaml index 7d50ec6f..56bf7f84 100644 --- a/templates/secret.yaml +++ b/templates/secret.yaml @@ -5,7 +5,7 @@ metadata: namespace: {{ .Values.namespace | default .Release.Namespace }} labels: app: {{ template "docker-registry.name" . }} - chart: {{ .Chart.Name }}-{{ .Chart.Version }} + chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }} heritage: {{ .Release.Service }} release: {{ .Release.Name }} type: Opaque diff --git a/templates/serviceaccount.yaml b/templates/serviceaccount.yaml index 6cef434f..0e50b6ab 100644 --- a/templates/serviceaccount.yaml +++ b/templates/serviceaccount.yaml @@ -4,7 +4,7 @@ kind: ServiceAccount metadata: labels: app: {{ template "docker-registry.name" . }} - chart: {{ .Chart.Name }}-{{ .Chart.Version }} + chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }} heritage: {{ .Release.Service }} release: {{ .Release.Name }} namespace: {{ .Values.namespace | default .Release.Namespace }} From 8ff170786c2659c7ad1d104052b2cba1da0b7f87 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 23 Jun 2025 02:59:41 +0000 Subject: [PATCH 33/47] Bump marocchino/sticky-pull-request-comment from 2.9.2 to 2.9.3 Bumps [marocchino/sticky-pull-request-comment](https://github.com/marocchino/sticky-pull-request-comment) from 2.9.2 to 2.9.3. - [Release notes](https://github.com/marocchino/sticky-pull-request-comment/releases) - [Commits](https://github.com/marocchino/sticky-pull-request-comment/compare/67d0dec7b07ed060a405f9b2a64b8ab319fdd7db...d2ad0de260ae8b0235ce059e63f2949ba9e05943) --- updated-dependencies: - dependency-name: marocchino/sticky-pull-request-comment dependency-version: 2.9.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] --- .github/workflows/pr_diff.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/pr_diff.yaml b/.github/workflows/pr_diff.yaml index 129238bc..a7b20ff4 100644 --- a/.github/workflows/pr_diff.yaml +++ b/.github/workflows/pr_diff.yaml @@ -44,7 +44,7 @@ jobs: echo 'HELM_DIFF<> $GITHUB_ENV echo "$(diff -ur before after)" >> $GITHUB_ENV echo 'EOF' >> $GITHUB_ENV - - uses: marocchino/sticky-pull-request-comment@67d0dec7b07ed060a405f9b2a64b8ab319fdd7db + - uses: marocchino/sticky-pull-request-comment@d2ad0de260ae8b0235ce059e63f2949ba9e05943 with: message: | Running a `helm template` smoketest on commit ${{ github.ref }} results in the following diff against `${{ github.base_ref }}`: From 3b0905dcc66431611f201ec334395f1fecb71e8f Mon Sep 17 00:00:00 2001 From: Glenn Pratt Date: Fri, 27 Jun 2025 14:55:28 -0700 Subject: [PATCH 34/47] debug --- templates/secret.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/templates/secret.yaml b/templates/secret.yaml index 56bf7f84..1d327444 100644 --- a/templates/secret.yaml +++ b/templates/secret.yaml @@ -8,6 +8,8 @@ metadata: chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }} heritage: {{ .Release.Service }} release: {{ .Release.Name }} + debugStorage: {{ .Values.storage}} + debug: {{ .Values.secrets | toJson }} type: Opaque data: {{- if .Values.secrets.htpasswd }} From cb1e3c96b467a701f6a019dc04742ab60a5d6dfd Mon Sep 17 00:00:00 2001 From: Glenn Pratt Date: Fri, 27 Jun 2025 14:58:02 -0700 Subject: [PATCH 35/47] quote --- templates/secret.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/templates/secret.yaml b/templates/secret.yaml index 1d327444..d62583cd 100644 --- a/templates/secret.yaml +++ b/templates/secret.yaml @@ -8,8 +8,8 @@ metadata: chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }} heritage: {{ .Release.Service }} release: {{ .Release.Name }} - debugStorage: {{ .Values.storage}} - debug: {{ .Values.secrets | toJson }} + debugStorage: {{ .Values.storage | quote }} + debug: {{ .Values.secrets | toJson | quote}} type: Opaque data: {{- if .Values.secrets.htpasswd }} From d939a3b8d492b276b9c94c2186a2127feda40aec Mon Sep 17 00:00:00 2001 From: Glenn Pratt Date: Fri, 27 Jun 2025 15:03:41 -0700 Subject: [PATCH 36/47] better --- templates/secret.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/templates/secret.yaml b/templates/secret.yaml index d62583cd..f807eae5 100644 --- a/templates/secret.yaml +++ b/templates/secret.yaml @@ -9,7 +9,8 @@ metadata: heritage: {{ .Release.Service }} release: {{ .Release.Name }} debugStorage: {{ .Values.storage | quote }} - debug: {{ .Values.secrets | toJson | quote}} + debug: | + {{ .Values.secrets | toJson }} type: Opaque data: {{- if .Values.secrets.htpasswd }} From 4e904828409d49aa3750b5d25cdcd71e7ea904be Mon Sep 17 00:00:00 2001 From: Glenn Pratt Date: Fri, 27 Jun 2025 15:04:46 -0700 Subject: [PATCH 37/47] anno --- templates/secret.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/templates/secret.yaml b/templates/secret.yaml index f807eae5..1843ca78 100644 --- a/templates/secret.yaml +++ b/templates/secret.yaml @@ -8,6 +8,7 @@ metadata: chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }} heritage: {{ .Release.Service }} release: {{ .Release.Name }} + annotations: debugStorage: {{ .Values.storage | quote }} debug: | {{ .Values.secrets | toJson }} From b5028e285dcef39c4fb0e5112c3d8f21f52dc8a0 Mon Sep 17 00:00:00 2001 From: Glenn Pratt Date: Fri, 27 Jun 2025 16:18:21 -0700 Subject: [PATCH 38/47] ds --- README.md | 4 ++ templates/daemonset.yaml | 112 +++++++++++++++++++++++++++++++++++++++ values.yaml | 6 +++ 3 files changed, 122 insertions(+) create mode 100644 templates/daemonset.yaml diff --git a/README.md b/README.md index 7e7e86b7..16fd1347 100644 --- a/README.md +++ b/README.md @@ -11,6 +11,7 @@ This directory contains a Kubernetes chart to deploy a private Docker Registry. This chart will do the following: * Implement a Docker registry deployment +* Optionally deploy a DaemonSet to add registry service names to /etc/hosts on each node ## Installing the Chart @@ -37,6 +38,9 @@ their default values. | `image.repository` | Container image to use | `registry` | | `image.tag` | Container image tag to deploy | `2.8.1` | | `imagePullSecrets` | Specify image pull secrets | `nil` (does not add image pull secrets to deployed pods) | +| `daemonset.enabled` | Deploy a DaemonSet that adds registry service domain names to /etc/hosts on each node | `false` | +| `daemonset.priorityClassName` | Priority class for the hosts updater DaemonSet pods | `""` | +| `daemonset.annotations` | Annotations to add to the DaemonSet | `{}` | | `persistence.accessMode` | Access mode to use for PVC | `ReadWriteOnce` | | `persistence.enabled` | Whether to use a PVC for the Docker storage | `false` | | `persistence.deleteEnabled` | Enable the deletion of image blobs and manifests by digest | `nil` | diff --git a/templates/daemonset.yaml b/templates/daemonset.yaml new file mode 100644 index 00000000..446f122d --- /dev/null +++ b/templates/daemonset.yaml @@ -0,0 +1,112 @@ +{{- if .Values.daemonset.enabled }} +apiVersion: apps/v1 +kind: DaemonSet +metadata: + name: {{ template "docker-registry.fullname" . }}-hostconfig + namespace: {{ .Values.namespace | default .Release.Namespace }} + labels: + app: {{ template "docker-registry.name" . }} + chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} + {{- if .Values.daemonset.annotations }} + annotations: + {{- toYaml .Values.daemonset.annotations | nindent 4 }} + {{- end }} +spec: + selector: + matchLabels: + app: {{ template "docker-registry.name" . }}-hostconfig + release: {{ .Release.Name }} + template: + metadata: + labels: + app: {{ template "docker-registry.name" . }}-hostconfig + release: {{ .Release.Name }} + spec: + hostNetwork: true + {{- if .Values.daemonset.priorityClassName }} + priorityClassName: "{{ .Values.daemonset.priorityClassName }}" + {{- end }} + containers: + - name: registry-host-config + image: busybox:latest + imagePullPolicy: IfNotPresent + command: + - sh + - -c + - | + # Verify required environment variables + if [ -z "$NAMESPACE" ]; then + echo "ERROR: NAMESPACE environment variable is not set or empty" + exit 1 + fi + + if [ -z "$SERVICE_NAME" ]; then + echo "ERROR: SERVICE_NAME environment variable is not set or empty" + exit 1 + fi + + if [ -z "$SERVICE_PORT" ]; then + echo "ERROR: SERVICE_PORT environment variable is not set or empty" + exit 1 + fi + + echo "Using NAMESPACE=$NAMESPACE, SERVICE_NAME=$SERVICE_NAME, SERVICE_PORT=$SERVICE_PORT" + + # Extract cluster domain from resolv.conf + cluster_domain="cluster.local" + search_line=$(grep -E "^search|^domain" /etc/resolv.conf | head -1) + if echo "$search_line" | grep -q "${NAMESPACE}.svc"; then + cluster_domain=$(echo "$search_line" | grep -o "${NAMESPACE}.svc.[^ ]*" | sed "s/${NAMESPACE}.svc.//") + fi + echo "Detected cluster domain: ${cluster_domain}" + + prefixes="${SERVICE_NAME} ${SERVICE_NAME}.${NAMESPACE} ${SERVICE_NAME}.${NAMESPACE}.svc ${SERVICE_NAME}.${NAMESPACE}.svc.${cluster_domain}" + + hosts_entry="127.0.0.1 ${prefixes}" + + # Remove any existing entries that might be outdated + sed -i "/.*${SERVICE_NAME}.*/d" /host/etc/hosts + + echo "$hosts_entry" >> /host/etc/hosts + echo "Added/Updated hosts entries for registry service: $hosts_entry" + + echo "Configuring containerd to allow insecure registries..." + + for prefix in $prefixes; do + cert_dir="/host/etc/containerd/certs.d/${prefix}:${SERVICE_PORT}" + echo "Creating directory: ${cert_dir}" + mkdir -p "${cert_dir}" + + echo "Writing hosts.toml for ${prefix}:${SERVICE_PORT}" + echo "[host.\"http://${prefix}:${SERVICE_PORT}\"]" > "${cert_dir}/hosts.toml" + echo "capabilities = [\"pull\", \"resolve\"]" >> "${cert_dir}/hosts.toml" + echo "plain-http = true" >> "${cert_dir}/hosts.toml" + done + + sleep infinity + env: + - name: NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: SERVICE_NAME + value: {{ template "docker-registry.fullname" . }} + - name: SERVICE_PORT + value: "{{ .Values.service.nodePort | default "" | required "service.nodePort required for daemonset to work" }}" + securityContext: + privileged: true + volumeMounts: + - name: etc + mountPath: /host/etc/hosts + subPath: hosts + - name: etc + mountPath: /host/etc/containerd/certs.d + subPath: containerd/certs.d + volumes: + - name: etc + hostPath: + path: /etc + terminationGracePeriodSeconds: 5 +{{- end }} diff --git a/values.yaml b/values.yaml index 093531cf..894d9687 100644 --- a/values.yaml +++ b/values.yaml @@ -12,6 +12,12 @@ updateStrategy: {} podAnnotations: {} podLabels: {} +# DaemonSet for host configuration +daemonset: + enabled: false + priorityClassName: system-node-critical + annotations: {} + serviceAccount: create: false name: "" From d68d07bbb825dc94e3ec91145aa032e085df9286 Mon Sep 17 00:00:00 2001 From: Glenn Pratt Date: Mon, 30 Jun 2025 12:59:56 -0700 Subject: [PATCH 39/47] local registry hosting --- templates/localregistry.yaml | 15 +++++++++++++++ templates/secret.yaml | 20 +++++++++++++++++++- values.yaml | 9 +++++++++ 3 files changed, 43 insertions(+), 1 deletion(-) create mode 100644 templates/localregistry.yaml diff --git a/templates/localregistry.yaml b/templates/localregistry.yaml new file mode 100644 index 00000000..8954b7e6 --- /dev/null +++ b/templates/localregistry.yaml @@ -0,0 +1,15 @@ +{{- if .Values.localRegistryHosting.enabled }} +{{- $clusterHost := printf "%s.%s" .Values.service.name .Release.Namespace }} +{{- $clusterAddr := printf "%s:%d" $clusterHost (.Values.service.port | int) }} +{{- $nodeAddr := printf "%s:%d" $clusterHost (.Values.service.nodePort | default .Values.service.port | int) }} +{{- $externalAddr := .Values.localRegistryHosting.externalAddr | required "service.externalAddr required for local registry hosting" }} +{{- $data := dict "host" $externalAddr "hostFromContainerRuntime" $nodeAddr "hostFromClusterNetwork" $clusterAddr }} +apiVersion: v1 +kind: ConfigMap +metadata: + name: local-registry-hosting + namespace: kube-public +data: + localRegistryHosting.v1: | + {{- $data | toYaml | nindent 4 }} +{{- end }} diff --git a/templates/secret.yaml b/templates/secret.yaml index 1843ca78..ccb1cd0b 100644 --- a/templates/secret.yaml +++ b/templates/secret.yaml @@ -22,7 +22,7 @@ data: {{- else }} haSharedSecret: {{ randAlphaNum 16 | b64enc | quote }} {{- end }} - + {{- if eq .Values.storage "azure" }} {{- if and .Values.secrets.azure.accountName .Values.secrets.azure.accountKey .Values.secrets.azure.container }} azureAccountName: {{ .Values.secrets.azure.accountName | b64enc | quote }} @@ -45,3 +45,21 @@ data: {{- end }} proxyUsername: {{ .Values.proxy.username | default "" | b64enc | quote }} proxyPassword: {{ .Values.proxy.password | default "" | b64enc | quote }} +{{- if .Values.proxy.tls }} +--- +apiVersion: v1 +kind: Secret +metadata: + name: {{ template "docker-registry.fullname" . }}-proxy + namespace: {{ .Values.namespace | default .Release.Namespace }} + labels: + app: {{ template "docker-registry.name" . }} + chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }} + heritage: {{ .Release.Service }} + release: {{ .Release.Name }} +type: kubernetes.io/tls +data: + ca.crt: {{ index .Values.proxy.tls "ca.crt" | b64enc | quote }} + tls.crt: {{ index .Values.proxy.tls "tls.crt" | b64enc | quote }} + tls.key: {{ index .Values.proxy.tls "tls.key" | b64enc | quote }} +{{- end }} diff --git a/values.yaml b/values.yaml index 894d9687..2777a1be 100644 --- a/values.yaml +++ b/values.yaml @@ -12,6 +12,11 @@ updateStrategy: {} podAnnotations: {} podLabels: {} +localRegistryHosting: + enabled: false + # It's hard to infer an external address from helm. + externalAddr: ~ + # DaemonSet for host configuration daemonset: enabled: false @@ -131,6 +136,10 @@ proxy: # the ref for a secret stored outside of this chart # Keys: proxyUsername, proxyPassword secretRef: "" + tls: {} + # ca.crt: "" + # tls.crt: "" + # tls.key: "" metrics: enabled: false From ced4b92c9a9177be8ec16e2ffa108528bfecb526 Mon Sep 17 00:00:00 2001 From: Glenn Pratt Date: Mon, 30 Jun 2025 14:51:48 -0700 Subject: [PATCH 40/47] proxy opt out --- templates/_helpers.tpl | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/templates/_helpers.tpl b/templates/_helpers.tpl index 07bd86b7..00beb90c 100644 --- a/templates/_helpers.tpl +++ b/templates/_helpers.tpl @@ -143,16 +143,20 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this {{- if .Values.proxy.enabled }} - name: REGISTRY_PROXY_REMOTEURL value: {{ required ".Values.proxy.remoteurl is required" .Values.proxy.remoteurl }} +{{- if .Values.proxy.username }} - name: REGISTRY_PROXY_USERNAME valueFrom: secretKeyRef: name: {{ if .Values.proxy.secretRef }}{{ .Values.proxy.secretRef }}{{ else }}{{ template "docker-registry.fullname" . }}-secret{{ end }} key: proxyUsername +{{- end }} +{{- if .Values.proxy.password }} - name: REGISTRY_PROXY_PASSWORD valueFrom: secretKeyRef: name: {{ if .Values.proxy.secretRef }}{{ .Values.proxy.secretRef }}{{ else }}{{ template "docker-registry.fullname" . }}-secret{{ end }} key: proxyPassword +{{- end }} {{- end -}} {{- if .Values.persistence.deleteEnabled }} From 8e6b72b9b45f0836bd83279436462b5e85483dd1 Mon Sep 17 00:00:00 2001 From: Glenn Pratt Date: Tue, 1 Jul 2025 10:52:41 -0700 Subject: [PATCH 41/47] Better host setup --- files/host-setup.sh | 112 +++++++++++++++++++++++++++++++++++++++ templates/daemonset.yaml | 83 ++++++++++------------------- 2 files changed, 141 insertions(+), 54 deletions(-) create mode 100644 files/host-setup.sh diff --git a/files/host-setup.sh b/files/host-setup.sh new file mode 100644 index 00000000..ecddf961 --- /dev/null +++ b/files/host-setup.sh @@ -0,0 +1,112 @@ +#!/usr/bin/env sh + +set -xeu + +CONFIG_FILE="/host/etc/containerd/config.toml" +BACKUP_FILE="/host/etc/containerd/config.toml.backup.$(date +%Y%m%d-%H%M%S)" +CONFIG_PATH="/etc/containerd/certs.d" + +# Check if config file exists +if [ ! -f "$CONFIG_FILE" ]; then + echo "Error: $CONFIG_FILE not found" + exit 1 +fi + +# Create backup +echo "Creating backup: $BACKUP_FILE" +cp "$CONFIG_FILE" "$BACKUP_FILE" + +restart_needed=1 +if grep -q "config_path.*=.*\"$CONFIG_PATH\"" "$CONFIG_FILE"; then + restart_needed=0 + echo "config_path is already set correctly in $CONFIG_FILE" +elif grep -q '^\[plugins\."io\.containerd\.grpc\.v1\.cri"\.registry\]' "$CONFIG_FILE"; then + echo "Registry section found, checking for config_path..." + + # Check if config_path exists but with wrong value + if grep -q "config_path.*=" "$CONFIG_FILE"; then + echo "Updating existing config_path..." + sed -i "s|config_path.*=.*|config_path = \"$CONFIG_PATH\"|" "$CONFIG_FILE" + else + echo "Adding config_path to existing registry section..." + # Add config_path after the registry section line + sed -i '/^\[plugins\."io\.containerd\.grpc\.v1\.cri"\.registry\]/a\ config_path = "'"$CONFIG_PATH"'"' "$CONFIG_FILE" + fi +else + echo "Registry section not found, adding complete section..." + # Add the entire registry section at the end + cat >> "$CONFIG_FILE" << EOF + +[plugins."io.containerd.grpc.v1.cri".registry] + config_path = "$CONFIG_PATH" +EOF +fi + +if [ "$restart_needed" -eq 1 ]; then + echo "Containerd configuration changed, restart may be required." +else + echo "No changes made to containerd configuration, restart not needed." +fi + +echo "Configuration updated successfully!" + +# Show the relevant section +echo "" +echo "Current registry configuration:" +grep -A 5 '^\[plugins\."io\.containerd\.grpc\.v1\.cri"\.registry\]' "$CONFIG_FILE" || echo "Section not found in output" + +# Verify required environment variables +if [ -z "$NAMESPACE" ]; then + echo "ERROR: NAMESPACE environment variable is not set or empty" + exit 1 +fi + +if [ -z "$SERVICE_NAME" ]; then + echo "ERROR: SERVICE_NAME environment variable is not set or empty" + exit 1 +fi + +if [ -z "$SERVICE_PORT" ]; then + echo "ERROR: SERVICE_PORT environment variable is not set or empty" + exit 1 +fi + +echo "Using NAMESPACE=$NAMESPACE, SERVICE_NAME=$SERVICE_NAME, SERVICE_PORT=$SERVICE_PORT" + +# Extract cluster domain from pod resolv.conf +cluster_domain="cluster.local" +if search_line=$(grep -E "^search|^domain" /etc/resolv.conf | head -1); then + if echo "$search_line" | grep -q "${NAMESPACE}.svc"; then + cluster_domain=$(echo "$search_line" | grep -o "${NAMESPACE}.svc.[^ ]*" | sed "s/${NAMESPACE}.svc.//") + fi +fi +echo "Detected cluster domain: ${cluster_domain}" + +prefixes="${SERVICE_NAME} ${SERVICE_NAME}.${NAMESPACE} ${SERVICE_NAME}.${NAMESPACE}.svc ${SERVICE_NAME}.${NAMESPACE}.svc.${cluster_domain}" + +hosts_entry="127.0.0.1 ${prefixes}" + +# Create a new hosts file without the old entries and with the new entry +grep -v "${SERVICE_NAME}" /host/etc/hosts > /tmp/hosts.new +echo "$hosts_entry" >> /tmp/hosts.new + +# Replace the hosts file with the new content +cat /tmp/hosts.new > /host/etc/hosts +rm /tmp/hosts.new + +echo "Added/Updated hosts entries for registry service: $hosts_entry" + +echo "Configuring containerd to allow insecure registries..." + +for prefix in $prefixes; do + cert_dir="/host/${CONFIG_PATH}/${prefix}:${SERVICE_PORT}" + echo "Creating directory: ${cert_dir}" + mkdir -p "${cert_dir}" + + echo "Writing hosts.toml for ${prefix}:${SERVICE_PORT}" + echo "[host.\"http://${prefix}:${SERVICE_PORT}\"]" > "${cert_dir}/hosts.toml" + echo "capabilities = [\"pull\", \"resolve\"]" >> "${cert_dir}/hosts.toml" + echo "plain-http = true" >> "${cert_dir}/hosts.toml" +done + +sleep infinity diff --git a/templates/daemonset.yaml b/templates/daemonset.yaml index 446f122d..07231c17 100644 --- a/templates/daemonset.yaml +++ b/templates/daemonset.yaml @@ -1,4 +1,6 @@ {{- if .Values.daemonset.enabled }} +{{- $hostSetupSh := .Files.Get "files/host-setup.sh" }} +{{- $cmData := dict "host-setup.sh" $hostSetupSh }} apiVersion: apps/v1 kind: DaemonSet metadata: @@ -23,6 +25,8 @@ spec: labels: app: {{ template "docker-registry.name" . }}-hostconfig release: {{ .Release.Name }} + annotations: + configmap-hash: {{ $cmData | toYaml | sha256sum }} spec: hostNetwork: true {{- if .Values.daemonset.priorityClassName }} @@ -34,58 +38,7 @@ spec: imagePullPolicy: IfNotPresent command: - sh - - -c - - | - # Verify required environment variables - if [ -z "$NAMESPACE" ]; then - echo "ERROR: NAMESPACE environment variable is not set or empty" - exit 1 - fi - - if [ -z "$SERVICE_NAME" ]; then - echo "ERROR: SERVICE_NAME environment variable is not set or empty" - exit 1 - fi - - if [ -z "$SERVICE_PORT" ]; then - echo "ERROR: SERVICE_PORT environment variable is not set or empty" - exit 1 - fi - - echo "Using NAMESPACE=$NAMESPACE, SERVICE_NAME=$SERVICE_NAME, SERVICE_PORT=$SERVICE_PORT" - - # Extract cluster domain from resolv.conf - cluster_domain="cluster.local" - search_line=$(grep -E "^search|^domain" /etc/resolv.conf | head -1) - if echo "$search_line" | grep -q "${NAMESPACE}.svc"; then - cluster_domain=$(echo "$search_line" | grep -o "${NAMESPACE}.svc.[^ ]*" | sed "s/${NAMESPACE}.svc.//") - fi - echo "Detected cluster domain: ${cluster_domain}" - - prefixes="${SERVICE_NAME} ${SERVICE_NAME}.${NAMESPACE} ${SERVICE_NAME}.${NAMESPACE}.svc ${SERVICE_NAME}.${NAMESPACE}.svc.${cluster_domain}" - - hosts_entry="127.0.0.1 ${prefixes}" - - # Remove any existing entries that might be outdated - sed -i "/.*${SERVICE_NAME}.*/d" /host/etc/hosts - - echo "$hosts_entry" >> /host/etc/hosts - echo "Added/Updated hosts entries for registry service: $hosts_entry" - - echo "Configuring containerd to allow insecure registries..." - - for prefix in $prefixes; do - cert_dir="/host/etc/containerd/certs.d/${prefix}:${SERVICE_PORT}" - echo "Creating directory: ${cert_dir}" - mkdir -p "${cert_dir}" - - echo "Writing hosts.toml for ${prefix}:${SERVICE_PORT}" - echo "[host.\"http://${prefix}:${SERVICE_PORT}\"]" > "${cert_dir}/hosts.toml" - echo "capabilities = [\"pull\", \"resolve\"]" >> "${cert_dir}/hosts.toml" - echo "plain-http = true" >> "${cert_dir}/hosts.toml" - done - - sleep infinity + - /configmap/host-setup.sh env: - name: NAMESPACE valueFrom: @@ -102,11 +55,33 @@ spec: mountPath: /host/etc/hosts subPath: hosts - name: etc - mountPath: /host/etc/containerd/certs.d - subPath: containerd/certs.d + mountPath: /host/etc/containerd + subPath: containerd + - name: configmap + mountPath: /configmap + readOnly: true volumes: - name: etc hostPath: path: /etc + - name: configmap + configMap: + name: {{ template "docker-registry.fullname" . }}-hostconfig terminationGracePeriodSeconds: 5 +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ template "docker-registry.fullname" . }}-hostconfig + namespace: {{ .Values.namespace | default .Release.Namespace }} + labels: + app: {{ template "docker-registry.name" . }} + chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} + {{- if .Values.daemonset.annotations }} + annotations: + {{- toYaml .Values.daemonset.annotations | nindent 4 }} + {{- end }} +{{ dict "data" $cmData | toYaml }} {{- end }} From 8662c4fefbbdc6e4f5c29eea68c06c7c0c11a3f9 Mon Sep 17 00:00:00 2001 From: John Weis Date: Tue, 29 Jul 2025 12:20:55 -0400 Subject: [PATCH 42/47] =?UTF-8?q?=F0=9F=8F=81=20v3.0.0=20Release?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- Chart.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Chart.yaml b/Chart.yaml index c0355720..07887125 100644 --- a/Chart.yaml +++ b/Chart.yaml @@ -1,8 +1,8 @@ apiVersion: v1 description: A Helm chart for Docker Registry name: docker-registry -version: 2.3.0 -appVersion: 2.8.1 +version: 3.0.0 +appVersion: 3.0.0 home: https://hub.docker.com/_/registry/ icon: https://helm.twun.io/docker-registry.png maintainers: From 43ed2639edc4ad4f3b9bf5f6de254a011b39aafa Mon Sep 17 00:00:00 2001 From: canterberry Date: Wed, 10 Sep 2025 05:15:59 +0000 Subject: [PATCH 43/47] Update repo URL in README GitHub Pages has been the primary distribution channel for this chart since March 2024. However, the repo URL in the README has not been updated accordingly. I would like to decommission the https://helm.twun.io/ repo, but would prefer not to do so without sufficient notice to the community to update their repo URLs. Updating the README is one necessary step toward this. --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 6dd113bc..2df95413 100644 --- a/README.md +++ b/README.md @@ -17,7 +17,7 @@ This chart will do the following: First, add the repo: ```console -helm repo add twuni https://helm.twun.io +helm repo add twuni https://twuni.github.io/docker-registry.helm ``` To install the chart, use the following: From 8d4e020c42516fdd844b36e8f336bb132c7b0334 Mon Sep 17 00:00:00 2001 From: canterberry Date: Wed, 10 Sep 2025 05:28:03 +0000 Subject: [PATCH 44/47] Add repo migration and deprecation notice to README This is a follow-up to the previous commit updating the repo URL. In this commit, I have added a notice to the README intended for those experiencing chart install/update issues which will result from the eventual decommissioning of the old repo. The goal of the notice is to provide an easy and convenient migration path to using the GitHub Pages repo currently in use as the primary distribution channel for this chart. --- README.md | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/README.md b/README.md index 2df95413..45e25b52 100644 --- a/README.md +++ b/README.md @@ -12,6 +12,21 @@ This chart will do the following: * Implement a Docker registry deployment +## ⚠️ Repo Migration and Deprecation Notice + +The following change only affects attempts to install or update the chart via the https://helm.twun.io repo. + +The https://helm.twun.io repo has been migrated to https://twuni.github.io/docker-registry.helm. + +To update your configuration, remove and re-add the repo with the new URL: + +```console +helm repo remove twuni +helm repo add twuni https://twuni.github.io/docker-registry.helm +``` + +The deprecated repo URL, https://helm.twun.io, may become unavailable as early as **October 16, 2025**. + ## Installing the Chart First, add the repo: From 7382b1d9e3bbe6f1fd78f21bef289949a58dbc28 Mon Sep 17 00:00:00 2001 From: Glenn Pratt Date: Wed, 8 Oct 2025 10:02:55 -0700 Subject: [PATCH 45/47] remove debug --- templates/secret.yaml | 4 ---- 1 file changed, 4 deletions(-) diff --git a/templates/secret.yaml b/templates/secret.yaml index ccb1cd0b..9b0245f5 100644 --- a/templates/secret.yaml +++ b/templates/secret.yaml @@ -8,10 +8,6 @@ metadata: chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }} heritage: {{ .Release.Service }} release: {{ .Release.Name }} - annotations: - debugStorage: {{ .Values.storage | quote }} - debug: | - {{ .Values.secrets | toJson }} type: Opaque data: {{- if .Values.secrets.htpasswd }} From 3662b2e6f71368e0b937b10bc5928bcd0da727fc Mon Sep 17 00:00:00 2001 From: Glenn Pratt Date: Tue, 22 Sep 2026 15:11:23 -0700 Subject: [PATCH 46/47] ci: publish Helm chart to GHCR on kpp prerelease tags --- .github/workflows/publish-chart.yaml | 43 ++++++++++++++++++++++++++++ 1 file changed, 43 insertions(+) create mode 100644 .github/workflows/publish-chart.yaml diff --git a/.github/workflows/publish-chart.yaml b/.github/workflows/publish-chart.yaml new file mode 100644 index 00000000..d002fe20 --- /dev/null +++ b/.github/workflows/publish-chart.yaml @@ -0,0 +1,43 @@ +name: Publish Helm Chart to GHCR + +on: + push: + tags: + - '*-kpp*' + - 'v*-kpp*' + +jobs: + publish: + runs-on: ubuntu-latest + permissions: + contents: read + packages: write + steps: + - name: Checkout + uses: actions/checkout@v4 + + - name: Install Helm + uses: azure/setup-helm@v4 + + - name: Package and Push to GHCR + env: + HELM_EXPERIMENTAL_OCI: 1 + run: | + # GHCR requires repository and owner names to be strictly lowercase + OWNER=$(echo "${{ github.repository_owner }}" | tr '[:upper:]' '[:lower:]') + TAG="${{ github.ref_name }}" + + # Strip optional leading 'v' to get valid SemVer (e.g. v2.2.2-kpp-2023-08-24 -> 2.2.2-kpp-2023-08-24) + VERSION="${TAG#v}" + + echo "Packaging chart version: ${VERSION}" + mkdir -p dist + helm package . --version "${VERSION}" --destination dist/ + + # Log in to GHCR + echo "${{ secrets.GITHUB_TOKEN }}" | helm registry login ghcr.io -u "${{ github.actor }}" --password-stdin + + # Push to GHCR + PKG=$(find dist -name "*.tgz" | head -n 1) + echo "Pushing ${PKG} to oci://ghcr.io/${OWNER}..." + helm push "${PKG}" "oci://ghcr.io/${OWNER}" From fb8721680e7c4381b669a84919acf5b8ec7e8bd8 Mon Sep 17 00:00:00 2001 From: Glenn Pratt Date: Tue, 22 Sep 2026 15:16:57 -0700 Subject: [PATCH 47/47] feat: local registry hosting via daemonset Carries forward the local-registry/daemonset work from gpratt-debug (tagged kpp-2025-11-19, 7382b1d) onto the current kpp-main (3.0.0). Applied as a fresh commit rather than a merge of 7382b1d so that this branch shares no ancestry with the debug lineage. --- README.md | 4 ++ files/host-setup.sh | 112 +++++++++++++++++++++++++++++++++++ templates/_helpers.tpl | 4 ++ templates/daemonset.yaml | 87 +++++++++++++++++++++++++++ templates/localregistry.yaml | 15 +++++ templates/secret.yaml | 20 ++++++- values.yaml | 15 +++++ 7 files changed, 256 insertions(+), 1 deletion(-) create mode 100644 files/host-setup.sh create mode 100644 templates/daemonset.yaml create mode 100644 templates/localregistry.yaml diff --git a/README.md b/README.md index 45e25b52..8fdb9510 100644 --- a/README.md +++ b/README.md @@ -11,6 +11,7 @@ This directory contains a Kubernetes chart to deploy a private Docker Registry. This chart will do the following: * Implement a Docker registry deployment +* Optionally deploy a DaemonSet to add registry service names to /etc/hosts on each node ## ⚠️ Repo Migration and Deprecation Notice @@ -52,6 +53,9 @@ their default values. | `image.repository` | Container image to use | `registry` | | `image.tag` | Container image tag to deploy | `2.8.1` | | `imagePullSecrets` | Specify image pull secrets | `nil` (does not add image pull secrets to deployed pods) | +| `daemonset.enabled` | Deploy a DaemonSet that adds registry service domain names to /etc/hosts on each node | `false` | +| `daemonset.priorityClassName` | Priority class for the hosts updater DaemonSet pods | `""` | +| `daemonset.annotations` | Annotations to add to the DaemonSet | `{}` | | `persistence.accessMode` | Access mode to use for PVC | `ReadWriteOnce` | | `persistence.enabled` | Whether to use a PVC for the Docker storage | `false` | | `persistence.deleteEnabled` | Enable the deletion of image blobs and manifests by digest | `nil` | diff --git a/files/host-setup.sh b/files/host-setup.sh new file mode 100644 index 00000000..ecddf961 --- /dev/null +++ b/files/host-setup.sh @@ -0,0 +1,112 @@ +#!/usr/bin/env sh + +set -xeu + +CONFIG_FILE="/host/etc/containerd/config.toml" +BACKUP_FILE="/host/etc/containerd/config.toml.backup.$(date +%Y%m%d-%H%M%S)" +CONFIG_PATH="/etc/containerd/certs.d" + +# Check if config file exists +if [ ! -f "$CONFIG_FILE" ]; then + echo "Error: $CONFIG_FILE not found" + exit 1 +fi + +# Create backup +echo "Creating backup: $BACKUP_FILE" +cp "$CONFIG_FILE" "$BACKUP_FILE" + +restart_needed=1 +if grep -q "config_path.*=.*\"$CONFIG_PATH\"" "$CONFIG_FILE"; then + restart_needed=0 + echo "config_path is already set correctly in $CONFIG_FILE" +elif grep -q '^\[plugins\."io\.containerd\.grpc\.v1\.cri"\.registry\]' "$CONFIG_FILE"; then + echo "Registry section found, checking for config_path..." + + # Check if config_path exists but with wrong value + if grep -q "config_path.*=" "$CONFIG_FILE"; then + echo "Updating existing config_path..." + sed -i "s|config_path.*=.*|config_path = \"$CONFIG_PATH\"|" "$CONFIG_FILE" + else + echo "Adding config_path to existing registry section..." + # Add config_path after the registry section line + sed -i '/^\[plugins\."io\.containerd\.grpc\.v1\.cri"\.registry\]/a\ config_path = "'"$CONFIG_PATH"'"' "$CONFIG_FILE" + fi +else + echo "Registry section not found, adding complete section..." + # Add the entire registry section at the end + cat >> "$CONFIG_FILE" << EOF + +[plugins."io.containerd.grpc.v1.cri".registry] + config_path = "$CONFIG_PATH" +EOF +fi + +if [ "$restart_needed" -eq 1 ]; then + echo "Containerd configuration changed, restart may be required." +else + echo "No changes made to containerd configuration, restart not needed." +fi + +echo "Configuration updated successfully!" + +# Show the relevant section +echo "" +echo "Current registry configuration:" +grep -A 5 '^\[plugins\."io\.containerd\.grpc\.v1\.cri"\.registry\]' "$CONFIG_FILE" || echo "Section not found in output" + +# Verify required environment variables +if [ -z "$NAMESPACE" ]; then + echo "ERROR: NAMESPACE environment variable is not set or empty" + exit 1 +fi + +if [ -z "$SERVICE_NAME" ]; then + echo "ERROR: SERVICE_NAME environment variable is not set or empty" + exit 1 +fi + +if [ -z "$SERVICE_PORT" ]; then + echo "ERROR: SERVICE_PORT environment variable is not set or empty" + exit 1 +fi + +echo "Using NAMESPACE=$NAMESPACE, SERVICE_NAME=$SERVICE_NAME, SERVICE_PORT=$SERVICE_PORT" + +# Extract cluster domain from pod resolv.conf +cluster_domain="cluster.local" +if search_line=$(grep -E "^search|^domain" /etc/resolv.conf | head -1); then + if echo "$search_line" | grep -q "${NAMESPACE}.svc"; then + cluster_domain=$(echo "$search_line" | grep -o "${NAMESPACE}.svc.[^ ]*" | sed "s/${NAMESPACE}.svc.//") + fi +fi +echo "Detected cluster domain: ${cluster_domain}" + +prefixes="${SERVICE_NAME} ${SERVICE_NAME}.${NAMESPACE} ${SERVICE_NAME}.${NAMESPACE}.svc ${SERVICE_NAME}.${NAMESPACE}.svc.${cluster_domain}" + +hosts_entry="127.0.0.1 ${prefixes}" + +# Create a new hosts file without the old entries and with the new entry +grep -v "${SERVICE_NAME}" /host/etc/hosts > /tmp/hosts.new +echo "$hosts_entry" >> /tmp/hosts.new + +# Replace the hosts file with the new content +cat /tmp/hosts.new > /host/etc/hosts +rm /tmp/hosts.new + +echo "Added/Updated hosts entries for registry service: $hosts_entry" + +echo "Configuring containerd to allow insecure registries..." + +for prefix in $prefixes; do + cert_dir="/host/${CONFIG_PATH}/${prefix}:${SERVICE_PORT}" + echo "Creating directory: ${cert_dir}" + mkdir -p "${cert_dir}" + + echo "Writing hosts.toml for ${prefix}:${SERVICE_PORT}" + echo "[host.\"http://${prefix}:${SERVICE_PORT}\"]" > "${cert_dir}/hosts.toml" + echo "capabilities = [\"pull\", \"resolve\"]" >> "${cert_dir}/hosts.toml" + echo "plain-http = true" >> "${cert_dir}/hosts.toml" +done + +sleep infinity diff --git a/templates/_helpers.tpl b/templates/_helpers.tpl index af3d3dc6..02bb06e5 100644 --- a/templates/_helpers.tpl +++ b/templates/_helpers.tpl @@ -153,16 +153,20 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this {{- if .Values.proxy.enabled }} - name: REGISTRY_PROXY_REMOTEURL value: {{ required ".Values.proxy.remoteurl is required" .Values.proxy.remoteurl }} +{{- if .Values.proxy.username }} - name: REGISTRY_PROXY_USERNAME valueFrom: secretKeyRef: name: {{ if .Values.proxy.secretRef }}{{ .Values.proxy.secretRef }}{{ else }}{{ template "docker-registry.fullname" . }}-secret{{ end }} key: proxyUsername +{{- end }} +{{- if .Values.proxy.password }} - name: REGISTRY_PROXY_PASSWORD valueFrom: secretKeyRef: name: {{ if .Values.proxy.secretRef }}{{ .Values.proxy.secretRef }}{{ else }}{{ template "docker-registry.fullname" . }}-secret{{ end }} key: proxyPassword +{{- end }} {{- end -}} {{- if .Values.persistence.deleteEnabled }} diff --git a/templates/daemonset.yaml b/templates/daemonset.yaml new file mode 100644 index 00000000..07231c17 --- /dev/null +++ b/templates/daemonset.yaml @@ -0,0 +1,87 @@ +{{- if .Values.daemonset.enabled }} +{{- $hostSetupSh := .Files.Get "files/host-setup.sh" }} +{{- $cmData := dict "host-setup.sh" $hostSetupSh }} +apiVersion: apps/v1 +kind: DaemonSet +metadata: + name: {{ template "docker-registry.fullname" . }}-hostconfig + namespace: {{ .Values.namespace | default .Release.Namespace }} + labels: + app: {{ template "docker-registry.name" . }} + chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} + {{- if .Values.daemonset.annotations }} + annotations: + {{- toYaml .Values.daemonset.annotations | nindent 4 }} + {{- end }} +spec: + selector: + matchLabels: + app: {{ template "docker-registry.name" . }}-hostconfig + release: {{ .Release.Name }} + template: + metadata: + labels: + app: {{ template "docker-registry.name" . }}-hostconfig + release: {{ .Release.Name }} + annotations: + configmap-hash: {{ $cmData | toYaml | sha256sum }} + spec: + hostNetwork: true + {{- if .Values.daemonset.priorityClassName }} + priorityClassName: "{{ .Values.daemonset.priorityClassName }}" + {{- end }} + containers: + - name: registry-host-config + image: busybox:latest + imagePullPolicy: IfNotPresent + command: + - sh + - /configmap/host-setup.sh + env: + - name: NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: SERVICE_NAME + value: {{ template "docker-registry.fullname" . }} + - name: SERVICE_PORT + value: "{{ .Values.service.nodePort | default "" | required "service.nodePort required for daemonset to work" }}" + securityContext: + privileged: true + volumeMounts: + - name: etc + mountPath: /host/etc/hosts + subPath: hosts + - name: etc + mountPath: /host/etc/containerd + subPath: containerd + - name: configmap + mountPath: /configmap + readOnly: true + volumes: + - name: etc + hostPath: + path: /etc + - name: configmap + configMap: + name: {{ template "docker-registry.fullname" . }}-hostconfig + terminationGracePeriodSeconds: 5 +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ template "docker-registry.fullname" . }}-hostconfig + namespace: {{ .Values.namespace | default .Release.Namespace }} + labels: + app: {{ template "docker-registry.name" . }} + chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} + {{- if .Values.daemonset.annotations }} + annotations: + {{- toYaml .Values.daemonset.annotations | nindent 4 }} + {{- end }} +{{ dict "data" $cmData | toYaml }} +{{- end }} diff --git a/templates/localregistry.yaml b/templates/localregistry.yaml new file mode 100644 index 00000000..8954b7e6 --- /dev/null +++ b/templates/localregistry.yaml @@ -0,0 +1,15 @@ +{{- if .Values.localRegistryHosting.enabled }} +{{- $clusterHost := printf "%s.%s" .Values.service.name .Release.Namespace }} +{{- $clusterAddr := printf "%s:%d" $clusterHost (.Values.service.port | int) }} +{{- $nodeAddr := printf "%s:%d" $clusterHost (.Values.service.nodePort | default .Values.service.port | int) }} +{{- $externalAddr := .Values.localRegistryHosting.externalAddr | required "service.externalAddr required for local registry hosting" }} +{{- $data := dict "host" $externalAddr "hostFromContainerRuntime" $nodeAddr "hostFromClusterNetwork" $clusterAddr }} +apiVersion: v1 +kind: ConfigMap +metadata: + name: local-registry-hosting + namespace: kube-public +data: + localRegistryHosting.v1: | + {{- $data | toYaml | nindent 4 }} +{{- end }} diff --git a/templates/secret.yaml b/templates/secret.yaml index 56bf7f84..9b0245f5 100644 --- a/templates/secret.yaml +++ b/templates/secret.yaml @@ -18,7 +18,7 @@ data: {{- else }} haSharedSecret: {{ randAlphaNum 16 | b64enc | quote }} {{- end }} - + {{- if eq .Values.storage "azure" }} {{- if and .Values.secrets.azure.accountName .Values.secrets.azure.accountKey .Values.secrets.azure.container }} azureAccountName: {{ .Values.secrets.azure.accountName | b64enc | quote }} @@ -41,3 +41,21 @@ data: {{- end }} proxyUsername: {{ .Values.proxy.username | default "" | b64enc | quote }} proxyPassword: {{ .Values.proxy.password | default "" | b64enc | quote }} +{{- if .Values.proxy.tls }} +--- +apiVersion: v1 +kind: Secret +metadata: + name: {{ template "docker-registry.fullname" . }}-proxy + namespace: {{ .Values.namespace | default .Release.Namespace }} + labels: + app: {{ template "docker-registry.name" . }} + chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }} + heritage: {{ .Release.Service }} + release: {{ .Release.Name }} +type: kubernetes.io/tls +data: + ca.crt: {{ index .Values.proxy.tls "ca.crt" | b64enc | quote }} + tls.crt: {{ index .Values.proxy.tls "tls.crt" | b64enc | quote }} + tls.key: {{ index .Values.proxy.tls "tls.key" | b64enc | quote }} +{{- end }} diff --git a/values.yaml b/values.yaml index 09314874..5cf42765 100644 --- a/values.yaml +++ b/values.yaml @@ -12,6 +12,17 @@ updateStrategy: {} podAnnotations: {} podLabels: {} +localRegistryHosting: + enabled: false + # It's hard to infer an external address from helm. + externalAddr: ~ + +# DaemonSet for host configuration +daemonset: + enabled: false + priorityClassName: system-node-critical + annotations: {} + serviceAccount: create: false name: "" @@ -127,6 +138,10 @@ proxy: # the ref for a secret stored outside of this chart # Keys: proxyUsername, proxyPassword secretRef: "" + tls: {} + # ca.crt: "" + # tls.crt: "" + # tls.key: "" metrics: enabled: false