From d7e5281b188955efffc37a5de867afc143eaf6b2 Mon Sep 17 00:00:00 2001 From: wkbrd <30599409+wkbrd@users.noreply.github.com> Date: Thu, 9 May 2024 08:04:44 -0400 Subject: [PATCH 01/14] Update values.yaml --- values.yaml | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/values.yaml b/values.yaml index f16be90..ee196ce 100644 --- a/values.yaml +++ b/values.yaml @@ -155,12 +155,21 @@ configData: threshold: 3 containerSecurityContext: - enabled: false - -securityContext: enabled: true runAsUser: 1000 - fsGroup: 1000 + +podSecurityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + privileged: false + readOnlyRootFilesystem: true + runAsGroup: 1000 + runAsNonRoot: true + runAsUser: 1000 + seccompProfile: + type: RuntimeDefault priorityClassName: "" From da580b62f194f758b271acfc45552e6facee871e Mon Sep 17 00:00:00 2001 From: wkbrd <30599409+wkbrd@users.noreply.github.com> Date: Thu, 9 May 2024 08:06:15 -0400 Subject: [PATCH 02/14] Update deployment.yaml --- templates/deployment.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/templates/deployment.yaml b/templates/deployment.yaml index dff79cb..0226c79 100644 --- a/templates/deployment.yaml +++ b/templates/deployment.yaml @@ -46,8 +46,8 @@ spec: {{- if .Values.priorityClassName }} priorityClassName: "{{ .Values.priorityClassName }}" {{- end }} - {{- if .Values.securityContext.enabled }} - securityContext: {{ omit .Values.securityContext "enabled" | toYaml | nindent 8 }} + {{- if .Values.podSecurityContext.enabled }} + securityContext: {{ omit .Values.podSecurityContext "enabled" | toYaml | nindent 8 }} {{- end }} {{- with .Values.initContainers }} initContainers: From 93ea655866f10f67a224a7b4fd5fb123a12abb65 Mon Sep 17 00:00:00 2001 From: wkbrd <30599409+wkbrd@users.noreply.github.com> Date: Thu, 9 May 2024 08:08:15 -0400 Subject: [PATCH 03/14] Update cronjob.yaml --- templates/cronjob.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/templates/cronjob.yaml b/templates/cronjob.yaml index 780cf87..c90ab15 100644 --- a/templates/cronjob.yaml +++ b/templates/cronjob.yaml @@ -37,8 +37,8 @@ spec: {{- if .Values.priorityClassName }} priorityClassName: "{{ .Values.priorityClassName }}" {{- end }} - {{- if .Values.securityContext.enabled }} - securityContext: {{ omit .Values.securityContext "enabled" | toYaml | nindent 12 }} + {{- if .Values.podSecurityContext.enabled }} + securityContext: {{ omit .Values.podSecurityContext "enabled" | toYaml | nindent 12 }} {{- end }} containers: - name: {{ .Chart.Name }} From 62fa09c19832510709334932ed6317c086296fc5 Mon Sep 17 00:00:00 2001 From: wkbrd <30599409+wkbrd@users.noreply.github.com> Date: Thu, 9 May 2024 08:11:21 -0400 Subject: [PATCH 04/14] Update README.md --- README.md | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/README.md b/README.md index fb6d503..7ccc170 100644 --- a/README.md +++ b/README.md @@ -60,6 +60,21 @@ their default values. | `podAnnotations` | Annotations for pod | `{}` | | `podLabels` | Labels for pod | `{}` | | `podDisruptionBudget` | Pod disruption budget | `{}` | +| `podSecurityContext.enabled` | Enabled Keycloak pods' Security Context | `true` | +| `podSecurityContext.fsGroupChangePolicy` | Set filesystem group change policy | `Always` | +| `podSecurityContext.sysctls` | Set kernel settings using the sysctl interface | `[]` | +| `podSecurityContext.supplementalGroups` | Set filesystem extra groups | `[]` | +| `podSecurityContext.fsGroup` | Set Keycloak pod's Security Context fsGroup | `1001` | +| `containerSecurityContext.enabled` | Enabled containers' Security Context | `true` | +| `containerSecurityContext.seLinuxOptions` | Set SELinux options in container | `{}` | +| `containerSecurityContext.runAsUser` | Set containers' Security Context runAsUser | `1001` | +| `containerSecurityContext.runAsGroup` | Set containers' Security Context runAsGroup | `1001` | +| `containerSecurityContext.runAsNonRoot` | Set container's Security Context runAsNonRoot | `true` | +| `containerSecurityContext.privileged` | Set container's Security Context privileged | `false` | +| `containerSecurityContext.readOnlyRootFilesystem` | Set container's Security Context readOnlyRootFilesystem | `true` | +| `containerSecurityContext.allowPrivilegeEscalation` | Set container's Security Context allowPrivilegeEscalation | `false` | +| `containerSecurityContext.capabilities.drop` | List of capabilities to be dropped | `["ALL"]` | +| `containerSecurityContext.seccompProfile.type` | Set container's Security Context seccomp profile | `RuntimeDefault` | | `resources.limits.cpu` | Container requested CPU | `nil` | | `resources.limits.memory` | Container requested memory | `nil` | | `autoscaling.enabled` | Enable autoscaling using HorizontalPodAutoscaler | `false` | From b7a3239c0ccf1659c3cb4b2d02f67b9a9d0a8f6b Mon Sep 17 00:00:00 2001 From: wkbrd <30599409+wkbrd@users.noreply.github.com> Date: Thu, 9 May 2024 08:12:43 -0400 Subject: [PATCH 05/14] Update README.md Annotations copied from https://github.com/bitnami/charts/blob/main/bitnami/keycloak/README.md?plain=1 ## License Copyright © 2024 Broadcom. The term "Broadcom" refers to Broadcom Inc. and/or its subsidiaries. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. From 3f325fedb94f2e6e227aad0cbf9925b8454b1dd9 Mon Sep 17 00:00:00 2001 From: wkbrd <30599409+wkbrd@users.noreply.github.com> Date: Thu, 9 May 2024 08:16:01 -0400 Subject: [PATCH 06/14] Update values.yaml --- values.yaml | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/values.yaml b/values.yaml index ee196ce..75a5973 100644 --- a/values.yaml +++ b/values.yaml @@ -154,20 +154,25 @@ configData: interval: 10s threshold: 3 +podSecurityContext: + enabled: true + fsGroupChangePolicy: Always + sysctls: [] + supplementalGroups: [] + fsGroup: 1000 + containerSecurityContext: enabled: true - runAsUser: 1000 - -podSecurityContext: + seLinuxOptions: {} allowPrivilegeEscalation: false capabilities: drop: - ALL privileged: false readOnlyRootFilesystem: true + runAsUser: 1000 runAsGroup: 1000 runAsNonRoot: true - runAsUser: 1000 seccompProfile: type: RuntimeDefault From 26bdb34cf7effd71e90a861a239b02b17366c1e5 Mon Sep 17 00:00:00 2001 From: wkbrd <30599409+wkbrd@users.noreply.github.com> Date: Thu, 9 May 2024 08:17:05 -0400 Subject: [PATCH 07/14] Update README.md --- README.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index 7ccc170..b6cba47 100644 --- a/README.md +++ b/README.md @@ -64,11 +64,11 @@ their default values. | `podSecurityContext.fsGroupChangePolicy` | Set filesystem group change policy | `Always` | | `podSecurityContext.sysctls` | Set kernel settings using the sysctl interface | `[]` | | `podSecurityContext.supplementalGroups` | Set filesystem extra groups | `[]` | -| `podSecurityContext.fsGroup` | Set Keycloak pod's Security Context fsGroup | `1001` | +| `podSecurityContext.fsGroup` | Set Keycloak pod's Security Context fsGroup | `1000` | | `containerSecurityContext.enabled` | Enabled containers' Security Context | `true` | | `containerSecurityContext.seLinuxOptions` | Set SELinux options in container | `{}` | -| `containerSecurityContext.runAsUser` | Set containers' Security Context runAsUser | `1001` | -| `containerSecurityContext.runAsGroup` | Set containers' Security Context runAsGroup | `1001` | +| `containerSecurityContext.runAsUser` | Set containers' Security Context runAsUser | `1000` | +| `containerSecurityContext.runAsGroup` | Set containers' Security Context runAsGroup | `1000` | | `containerSecurityContext.runAsNonRoot` | Set container's Security Context runAsNonRoot | `true` | | `containerSecurityContext.privileged` | Set container's Security Context privileged | `false` | | `containerSecurityContext.readOnlyRootFilesystem` | Set container's Security Context readOnlyRootFilesystem | `true` | From bc7d13703250ddbe8c400e4951b00c9c1430dc91 Mon Sep 17 00:00:00 2001 From: wkbrd <30599409+wkbrd@users.noreply.github.com> Date: Thu, 9 May 2024 08:18:07 -0400 Subject: [PATCH 08/14] Update README.md Add license --- README.md | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/README.md b/README.md index b6cba47..2500fbe 100644 --- a/README.md +++ b/README.md @@ -141,3 +141,19 @@ Specify each parameter using the `--set key=value[,key=value]` argument to To generate htpasswd file, run this docker command: `docker run --entrypoint htpasswd registry:2 -Bbn user password > ./htpasswd`. + +## License + +Copyright © 2024 Broadcom. The term "Broadcom" refers to Broadcom Inc. and/or its subsidiaries. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. From 1ad8a414385d619bc456cfe65bd03580dd966ca7 Mon Sep 17 00:00:00 2001 From: wkbrd <30599409+wkbrd@users.noreply.github.com> Date: Thu, 9 May 2024 16:02:08 -0400 Subject: [PATCH 09/14] Update README.md --- README.md | 31 ------------------------------- 1 file changed, 31 deletions(-) diff --git a/README.md b/README.md index 2500fbe..fb6d503 100644 --- a/README.md +++ b/README.md @@ -60,21 +60,6 @@ their default values. | `podAnnotations` | Annotations for pod | `{}` | | `podLabels` | Labels for pod | `{}` | | `podDisruptionBudget` | Pod disruption budget | `{}` | -| `podSecurityContext.enabled` | Enabled Keycloak pods' Security Context | `true` | -| `podSecurityContext.fsGroupChangePolicy` | Set filesystem group change policy | `Always` | -| `podSecurityContext.sysctls` | Set kernel settings using the sysctl interface | `[]` | -| `podSecurityContext.supplementalGroups` | Set filesystem extra groups | `[]` | -| `podSecurityContext.fsGroup` | Set Keycloak pod's Security Context fsGroup | `1000` | -| `containerSecurityContext.enabled` | Enabled containers' Security Context | `true` | -| `containerSecurityContext.seLinuxOptions` | Set SELinux options in container | `{}` | -| `containerSecurityContext.runAsUser` | Set containers' Security Context runAsUser | `1000` | -| `containerSecurityContext.runAsGroup` | Set containers' Security Context runAsGroup | `1000` | -| `containerSecurityContext.runAsNonRoot` | Set container's Security Context runAsNonRoot | `true` | -| `containerSecurityContext.privileged` | Set container's Security Context privileged | `false` | -| `containerSecurityContext.readOnlyRootFilesystem` | Set container's Security Context readOnlyRootFilesystem | `true` | -| `containerSecurityContext.allowPrivilegeEscalation` | Set container's Security Context allowPrivilegeEscalation | `false` | -| `containerSecurityContext.capabilities.drop` | List of capabilities to be dropped | `["ALL"]` | -| `containerSecurityContext.seccompProfile.type` | Set container's Security Context seccomp profile | `RuntimeDefault` | | `resources.limits.cpu` | Container requested CPU | `nil` | | `resources.limits.memory` | Container requested memory | `nil` | | `autoscaling.enabled` | Enable autoscaling using HorizontalPodAutoscaler | `false` | @@ -141,19 +126,3 @@ Specify each parameter using the `--set key=value[,key=value]` argument to To generate htpasswd file, run this docker command: `docker run --entrypoint htpasswd registry:2 -Bbn user password > ./htpasswd`. - -## License - -Copyright © 2024 Broadcom. The term "Broadcom" refers to Broadcom Inc. and/or its subsidiaries. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. From 2a9672ee7474107fdd613c04abc437cba89c7eb9 Mon Sep 17 00:00:00 2001 From: wkbrd <30599409+wkbrd@users.noreply.github.com> Date: Thu, 9 May 2024 16:02:57 -0400 Subject: [PATCH 10/14] Update cronjob.yaml --- templates/cronjob.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/templates/cronjob.yaml b/templates/cronjob.yaml index c90ab15..780cf87 100644 --- a/templates/cronjob.yaml +++ b/templates/cronjob.yaml @@ -37,8 +37,8 @@ spec: {{- if .Values.priorityClassName }} priorityClassName: "{{ .Values.priorityClassName }}" {{- end }} - {{- if .Values.podSecurityContext.enabled }} - securityContext: {{ omit .Values.podSecurityContext "enabled" | toYaml | nindent 12 }} + {{- if .Values.securityContext.enabled }} + securityContext: {{ omit .Values.securityContext "enabled" | toYaml | nindent 12 }} {{- end }} containers: - name: {{ .Chart.Name }} From 4efb76f3139cc63751abee8439754da995fe23c3 Mon Sep 17 00:00:00 2001 From: wkbrd <30599409+wkbrd@users.noreply.github.com> Date: Thu, 9 May 2024 16:03:22 -0400 Subject: [PATCH 11/14] Update cronjob.yaml --- templates/cronjob.yaml | 121 ++++++++++++++++++++++++++--------------- 1 file changed, 76 insertions(+), 45 deletions(-) diff --git a/templates/cronjob.yaml b/templates/cronjob.yaml index 780cf87..dff79cb 100644 --- a/templates/cronjob.yaml +++ b/templates/cronjob.yaml @@ -1,17 +1,28 @@ -{{- if .Values.garbageCollect.enabled }} -apiVersion: batch/v1 -kind: CronJob +apiVersion: apps/v1 +kind: Deployment metadata: - name: {{ template "docker-registry.fullname" . }}-garbage-collector + name: {{ template "docker-registry.fullname" . }} namespace: {{ .Values.namespace | default .Release.Namespace }} labels: app: {{ template "docker-registry.name" . }} chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }} release: {{ .Release.Name }} heritage: {{ .Release.Service }} +{{- if .Values.deployment.annotations }} + annotations: +{{ toYaml .Values.deployment.annotations | indent 4 }} +{{- end }} spec: - schedule: {{ .Values.garbageCollect.schedule | quote }} - jobTemplate: + selector: + matchLabels: + app: {{ template "docker-registry.name" . }} + release: {{ .Release.Name }} + replicas: {{ .Values.replicaCount }} + {{- if .Values.updateStrategy }} + strategy: {{ toYaml .Values.updateStrategy | nindent 4 }} + {{- end }} + minReadySeconds: 5 + template: metadata: labels: app: {{ template "docker-registry.name" . }} @@ -26,44 +37,64 @@ spec: {{ toYaml .Values.podAnnotations | nindent 8 }} {{- end }} spec: - template: - spec: - {{- if or (eq .Values.serviceAccount.create true) (ne .Values.serviceAccount.name "") }} - serviceAccountName: {{ .Values.serviceAccount.name | default (include "docker-registry.fullname" .) }} - {{- end }} - {{- if .Values.imagePullSecrets }} - imagePullSecrets: {{ toYaml .Values.imagePullSecrets | nindent 12 }} - {{- end }} - {{- if .Values.priorityClassName }} - priorityClassName: "{{ .Values.priorityClassName }}" - {{- end }} - {{- if .Values.securityContext.enabled }} - securityContext: {{ omit .Values.securityContext "enabled" | toYaml | nindent 12 }} - {{- end }} - containers: - - name: {{ .Chart.Name }} - image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}" - imagePullPolicy: {{ .Values.image.pullPolicy }} - command: - - /bin/registry - - garbage-collect - - --delete-untagged={{ .Values.garbageCollect.deleteUntagged }} - - /etc/docker/registry/config.yml - resources: {{ toYaml .Values.garbageCollect.resources | nindent 12 }} - env: {{ include "docker-registry.envs" . | nindent 16 }} - {{- if .Values.containerSecurityContext.enabled }} - securityContext: {{ omit .Values.containerSecurityContext "enabled" | toYaml | nindent 16 }} + {{- if or (eq .Values.serviceAccount.create true) (ne .Values.serviceAccount.name "") }} + serviceAccountName: {{ .Values.serviceAccount.name | default (include "docker-registry.fullname" .) }} + {{- end }} + {{- if .Values.imagePullSecrets }} + imagePullSecrets: {{ toYaml .Values.imagePullSecrets | nindent 8 }} + {{- end }} + {{- if .Values.priorityClassName }} + priorityClassName: "{{ .Values.priorityClassName }}" + {{- end }} + {{- if .Values.securityContext.enabled }} + securityContext: {{ omit .Values.securityContext "enabled" | toYaml | nindent 8 }} + {{- end }} + {{- with .Values.initContainers }} + initContainers: + {{- toYaml . | nindent 8 }} + {{- end }} + containers: + - name: {{ .Chart.Name }} + image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}" + imagePullPolicy: {{ .Values.image.pullPolicy }} + command: + - /bin/registry + - serve + - /etc/docker/registry/config.yml + ports: + - containerPort: 5000 + {{- if .Values.metrics.enabled }} + - containerPort: {{ (split ":" .Values.configData.http.debug.addr)._1 }} + name: http-metrics + protocol: TCP + {{- end }} + livenessProbe: + httpGet: + {{- if .Values.tlsSecretName }} + scheme: HTTPS {{- end }} - volumeMounts: {{ include "docker-registry.volumeMounts" . | nindent 16 }} - restartPolicy: OnFailure - {{- if .Values.nodeSelector }} - nodeSelector: {{ toYaml .Values.nodeSelector | nindent 12 }} + path: / + port: 5000 + readinessProbe: + httpGet: + {{- if .Values.tlsSecretName }} + scheme: HTTPS + {{- end }} + path: / + port: 5000 + resources: {{ toYaml .Values.resources | nindent 12 }} + env: {{ include "docker-registry.envs" . | nindent 12 }} + {{- if .Values.containerSecurityContext.enabled }} + securityContext: {{ omit .Values.containerSecurityContext "enabled" | toYaml | nindent 12 }} {{- end }} - {{- if .Values.affinity }} - affinity: {{ toYaml .Values.affinity | nindent 12 }} - {{- end }} - {{- if .Values.tolerations }} - tolerations: {{ toYaml .Values.tolerations | nindent 12 }} - {{- end }} - volumes: {{ include "docker-registry.volumes" . | nindent 12 }} -{{- end }} + volumeMounts: {{ include "docker-registry.volumeMounts" . | nindent 12 }} + {{- if .Values.nodeSelector }} + nodeSelector: {{ toYaml .Values.nodeSelector | nindent 8 }} + {{- end }} + {{- if .Values.affinity }} + affinity: {{ toYaml .Values.affinity | nindent 8 }} + {{- end }} + {{- if .Values.tolerations }} + tolerations: {{ toYaml .Values.tolerations | nindent 8 }} + {{- end }} + volumes: {{ include "docker-registry.volumes" . | nindent 8 }} From 14b36a8308f4f7b127f7de5613ff76c1e83dc503 Mon Sep 17 00:00:00 2001 From: wkbrd <30599409+wkbrd@users.noreply.github.com> Date: Thu, 9 May 2024 16:03:52 -0400 Subject: [PATCH 12/14] Update values.yaml --- values.yaml | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/values.yaml b/values.yaml index 75a5973..f48949d 100644 --- a/values.yaml +++ b/values.yaml @@ -154,13 +154,6 @@ configData: interval: 10s threshold: 3 -podSecurityContext: - enabled: true - fsGroupChangePolicy: Always - sysctls: [] - supplementalGroups: [] - fsGroup: 1000 - containerSecurityContext: enabled: true seLinuxOptions: {} @@ -176,6 +169,13 @@ containerSecurityContext: seccompProfile: type: RuntimeDefault +securityContext: + enabled: true + fsGroupChangePolicy: Always + sysctls: [] + supplementalGroups: [] + fsGroup: 1000 + priorityClassName: "" podDisruptionBudget: {} From 132d51ea92dad6454d1775979444a1977cfc8b60 Mon Sep 17 00:00:00 2001 From: wkbrd <30599409+wkbrd@users.noreply.github.com> Date: Thu, 9 May 2024 16:05:22 -0400 Subject: [PATCH 13/14] Update cronjob.yaml --- templates/cronjob.yaml | 123 +++++++++++++++-------------------------- 1 file changed, 46 insertions(+), 77 deletions(-) diff --git a/templates/cronjob.yaml b/templates/cronjob.yaml index dff79cb..780cf87 100644 --- a/templates/cronjob.yaml +++ b/templates/cronjob.yaml @@ -1,28 +1,17 @@ -apiVersion: apps/v1 -kind: Deployment +{{- if .Values.garbageCollect.enabled }} +apiVersion: batch/v1 +kind: CronJob metadata: - name: {{ template "docker-registry.fullname" . }} + name: {{ template "docker-registry.fullname" . }}-garbage-collector namespace: {{ .Values.namespace | default .Release.Namespace }} labels: app: {{ template "docker-registry.name" . }} chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }} release: {{ .Release.Name }} heritage: {{ .Release.Service }} -{{- if .Values.deployment.annotations }} - annotations: -{{ toYaml .Values.deployment.annotations | indent 4 }} -{{- end }} spec: - selector: - matchLabels: - app: {{ template "docker-registry.name" . }} - release: {{ .Release.Name }} - replicas: {{ .Values.replicaCount }} - {{- if .Values.updateStrategy }} - strategy: {{ toYaml .Values.updateStrategy | nindent 4 }} - {{- end }} - minReadySeconds: 5 - template: + schedule: {{ .Values.garbageCollect.schedule | quote }} + jobTemplate: metadata: labels: app: {{ template "docker-registry.name" . }} @@ -37,64 +26,44 @@ spec: {{ toYaml .Values.podAnnotations | nindent 8 }} {{- end }} spec: - {{- if or (eq .Values.serviceAccount.create true) (ne .Values.serviceAccount.name "") }} - serviceAccountName: {{ .Values.serviceAccount.name | default (include "docker-registry.fullname" .) }} - {{- end }} - {{- if .Values.imagePullSecrets }} - imagePullSecrets: {{ toYaml .Values.imagePullSecrets | nindent 8 }} - {{- end }} - {{- if .Values.priorityClassName }} - priorityClassName: "{{ .Values.priorityClassName }}" - {{- end }} - {{- if .Values.securityContext.enabled }} - securityContext: {{ omit .Values.securityContext "enabled" | toYaml | nindent 8 }} - {{- end }} - {{- with .Values.initContainers }} - initContainers: - {{- toYaml . | nindent 8 }} - {{- end }} - containers: - - name: {{ .Chart.Name }} - image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}" - imagePullPolicy: {{ .Values.image.pullPolicy }} - command: - - /bin/registry - - serve - - /etc/docker/registry/config.yml - ports: - - containerPort: 5000 - {{- if .Values.metrics.enabled }} - - containerPort: {{ (split ":" .Values.configData.http.debug.addr)._1 }} - name: http-metrics - protocol: TCP - {{- end }} - livenessProbe: - httpGet: - {{- if .Values.tlsSecretName }} - scheme: HTTPS - {{- end }} - path: / - port: 5000 - readinessProbe: - httpGet: - {{- if .Values.tlsSecretName }} - scheme: HTTPS - {{- end }} - path: / - port: 5000 - resources: {{ toYaml .Values.resources | nindent 12 }} - env: {{ include "docker-registry.envs" . | nindent 12 }} - {{- if .Values.containerSecurityContext.enabled }} - securityContext: {{ omit .Values.containerSecurityContext "enabled" | toYaml | nindent 12 }} + template: + spec: + {{- if or (eq .Values.serviceAccount.create true) (ne .Values.serviceAccount.name "") }} + serviceAccountName: {{ .Values.serviceAccount.name | default (include "docker-registry.fullname" .) }} {{- end }} - volumeMounts: {{ include "docker-registry.volumeMounts" . | nindent 12 }} - {{- if .Values.nodeSelector }} - nodeSelector: {{ toYaml .Values.nodeSelector | nindent 8 }} - {{- end }} - {{- if .Values.affinity }} - affinity: {{ toYaml .Values.affinity | nindent 8 }} - {{- end }} - {{- if .Values.tolerations }} - tolerations: {{ toYaml .Values.tolerations | nindent 8 }} - {{- end }} - volumes: {{ include "docker-registry.volumes" . | nindent 8 }} + {{- if .Values.imagePullSecrets }} + imagePullSecrets: {{ toYaml .Values.imagePullSecrets | nindent 12 }} + {{- end }} + {{- if .Values.priorityClassName }} + priorityClassName: "{{ .Values.priorityClassName }}" + {{- end }} + {{- if .Values.securityContext.enabled }} + securityContext: {{ omit .Values.securityContext "enabled" | toYaml | nindent 12 }} + {{- end }} + containers: + - name: {{ .Chart.Name }} + image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}" + imagePullPolicy: {{ .Values.image.pullPolicy }} + command: + - /bin/registry + - garbage-collect + - --delete-untagged={{ .Values.garbageCollect.deleteUntagged }} + - /etc/docker/registry/config.yml + resources: {{ toYaml .Values.garbageCollect.resources | nindent 12 }} + env: {{ include "docker-registry.envs" . | nindent 16 }} + {{- if .Values.containerSecurityContext.enabled }} + securityContext: {{ omit .Values.containerSecurityContext "enabled" | toYaml | nindent 16 }} + {{- end }} + volumeMounts: {{ include "docker-registry.volumeMounts" . | nindent 16 }} + restartPolicy: OnFailure + {{- if .Values.nodeSelector }} + nodeSelector: {{ toYaml .Values.nodeSelector | nindent 12 }} + {{- end }} + {{- if .Values.affinity }} + affinity: {{ toYaml .Values.affinity | nindent 12 }} + {{- end }} + {{- if .Values.tolerations }} + tolerations: {{ toYaml .Values.tolerations | nindent 12 }} + {{- end }} + volumes: {{ include "docker-registry.volumes" . | nindent 12 }} +{{- end }} From 384e09cc0d1bbe750cb05be9db653c25daa7b2fa Mon Sep 17 00:00:00 2001 From: wkbrd <30599409+wkbrd@users.noreply.github.com> Date: Thu, 9 May 2024 16:06:06 -0400 Subject: [PATCH 14/14] Update deployment.yaml --- templates/deployment.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/templates/deployment.yaml b/templates/deployment.yaml index 0226c79..dff79cb 100644 --- a/templates/deployment.yaml +++ b/templates/deployment.yaml @@ -46,8 +46,8 @@ spec: {{- if .Values.priorityClassName }} priorityClassName: "{{ .Values.priorityClassName }}" {{- end }} - {{- if .Values.podSecurityContext.enabled }} - securityContext: {{ omit .Values.podSecurityContext "enabled" | toYaml | nindent 8 }} + {{- if .Values.securityContext.enabled }} + securityContext: {{ omit .Values.securityContext "enabled" | toYaml | nindent 8 }} {{- end }} {{- with .Values.initContainers }} initContainers: