Merge pull request #68 from ddelange/garbage-collector-additive

Add option to enable garbage collector

README.md

@@ -115,6 +115,9 @@ their default values.
 | `extraVolumes`              | Additional volumes to the pod                                                              | `[]`            |
 | `extraEnvVars`              | Additional environment variables to the pod                                                | `[]`            |
 | `initContainers`            | Init containers to be created in the pod                                                   | `[]`            |
+| `garbageCollect.enabled`    | If true, will deploy garbage-collector cronjob                                             | `false`         |
+| `garbageCollect.deleteUntagged` | If true, garbage-collector will delete manifests that are not currently referenced via tag | `true` |    |
+| `garbageCollect.schedule`   | CronTab schedule, please use standard crontab format                                        | `0 1 * * *` |  |
 
 Specify each parameter using the `--set key=value[,key=value]` argument to
 `helm install`.

templates/cronjob.yaml

@@ -0,0 +1,222 @@
+{{- if .Values.garbageCollect.enabled }}
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: {{ template "docker-registry.fullname" . }}-garbage-collector
+  namespace: {{ .Values.namespace | default .Release.Namespace }}
+  labels:
+    app: {{ template "docker-registry.name" . }}
+    chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+spec:
+  schedule: {{ .Values.garbageCollect.schedule | quote }}
+  jobTemplate:
+    metadata:
+      labels:
+        app: {{ template "docker-registry.name" . }}
+        release: {{ .Release.Name }}
+        {{- with .Values.podLabels }}
+        {{ toYaml . | nindent 8 }}
+        {{- end }}
+      annotations:
+        checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
+        checksum/secret: {{ include (print $.Template.BasePath "/secret.yaml") . | sha256sum }}
+{{- if $.Values.podAnnotations }}
+{{ toYaml $.Values.podAnnotations | indent 8 }}
+{{- end }}
+    spec:
+      template:
+        spec:
+          {{- if or (eq .Values.serviceAccount.create true) (ne .Values.serviceAccount.name "") }}
+          serviceAccountName: {{ .Values.serviceAccount.name | default (include "docker-registry.fullname" .) }}
+          {{- end }}
+          {{- if .Values.imagePullSecrets }}
+          imagePullSecrets: {{ toYaml .Values.imagePullSecrets | nindent 12 }}
+          {{- end }}
+          {{- if .Values.priorityClassName }}
+          priorityClassName: "{{ .Values.priorityClassName }}"
+          {{- end }}
+          {{- if .Values.securityContext.enabled }}
+          securityContext:
+            fsGroup: {{ .Values.securityContext.fsGroup }}
+            runAsUser: {{ .Values.securityContext.runAsUser }}
+          {{- end }}
+          containers:
+            - name: {{ .Chart.Name }}
+              image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+              imagePullPolicy: {{ .Values.image.pullPolicy }}
+              command:
+              - /bin/registry
+              - garbage-collect
+              - --delete-untagged={{ .Values.garbageCollect.deleteUntagged }}
+              - /etc/docker/registry/config.yml
+              env:
+{{- if .Values.secrets.htpasswd }}
+              - name: REGISTRY_AUTH
+                value: "htpasswd"
+              - name: REGISTRY_AUTH_HTPASSWD_REALM
+                value: "Registry Realm"
+              - name: REGISTRY_AUTH_HTPASSWD_PATH
+                value: "/auth/htpasswd"
+{{- end }}
+              - name: REGISTRY_HTTP_SECRET
+                valueFrom:
+                  secretKeyRef:
+                    name: {{ template "docker-registry.fullname" . }}-secret
+                    key: haSharedSecret
+{{- if .Values.tlsSecretName }}
+              - name: REGISTRY_HTTP_TLS_CERTIFICATE
+                value: /etc/ssl/docker/tls.crt
+              - name: REGISTRY_HTTP_TLS_KEY
+                value: /etc/ssl/docker/tls.key
+{{- end }}
+{{- if eq .Values.storage "filesystem" }}
+              - name: REGISTRY_STORAGE_FILESYSTEM_ROOTDIRECTORY
+                value: "/var/lib/registry"
+{{- else if eq .Values.storage "azure" }}
+              - name: REGISTRY_STORAGE_AZURE_ACCOUNTNAME
+                valueFrom:
+                  secretKeyRef:
+                    name: {{ template "docker-registry.fullname" . }}-secret
+                    key: azureAccountName
+              - name: REGISTRY_STORAGE_AZURE_ACCOUNTKEY
+                valueFrom:
+                  secretKeyRef:
+                    name: {{ template "docker-registry.fullname" . }}-secret
+                    key: azureAccountKey
+              - name: REGISTRY_STORAGE_AZURE_CONTAINER
+                valueFrom:
+                  secretKeyRef:
+                    name: {{ template "docker-registry.fullname" . }}-secret
+                    key: azureContainer
+{{- else if eq .Values.storage "s3" }}
+              {{- if or (and .Values.secrets.s3.secretKey .Values.secrets.s3.accessKey) .Values.secrets.s3.secretRef }}
+              - name: REGISTRY_STORAGE_S3_ACCESSKEY
+                valueFrom:
+                  secretKeyRef:
+                    name: {{ if .Values.secrets.s3.secretRef }}{{ .Values.secrets.s3.secretRef }}{{ else }}{{ template "docker-registry.fullname" . }}-secret{{ end }}
+                    key: s3AccessKey
+              - name: REGISTRY_STORAGE_S3_SECRETKEY
+                valueFrom:
+                  secretKeyRef:
+                    name: {{ if .Values.secrets.s3.secretRef }}{{ .Values.secrets.s3.secretRef }}{{ else }}{{ template "docker-registry.fullname" . }}-secret{{ end }}
+                    key: s3SecretKey
+              {{- end }}
+              - name: REGISTRY_STORAGE_S3_REGION
+                value: {{ required ".Values.s3.region is required" .Values.s3.region }}
+            {{- if .Values.s3.regionEndpoint }}
+              - name: REGISTRY_STORAGE_S3_REGIONENDPOINT
+                value: {{ .Values.s3.regionEndpoint }}
+            {{- end }}
+              - name: REGISTRY_STORAGE_S3_BUCKET
+                value: {{ required ".Values.s3.bucket is required" .Values.s3.bucket }}
+            {{- if .Values.s3.rootdirectory }}
+              - name: REGISTRY_STORAGE_S3_ROOTDIRECTORY
+                value: {{ .Values.s3.rootdirectory | quote }}
+            {{- end }}
+            {{- if .Values.s3.encrypt }}
+              - name: REGISTRY_STORAGE_S3_ENCRYPT
+                value: {{ .Values.s3.encrypt | quote }}
+            {{- end }}
+            {{- if .Values.s3.secure }}
+              - name: REGISTRY_STORAGE_S3_SECURE
+                value: {{ .Values.s3.secure | quote }}
+            {{- end }}
+{{- else if eq .Values.storage "swift" }}
+              - name: REGISTRY_STORAGE_SWIFT_AUTHURL
+                value: {{ required ".Values.swift.authurl is required" .Values.swift.authurl }}
+              - name: REGISTRY_STORAGE_SWIFT_USERNAME
+                valueFrom:
+                  secretKeyRef:
+                    name: {{ template "docker-registry.fullname" . }}-secret
+                    key: swiftUsername
+              - name: REGISTRY_STORAGE_SWIFT_PASSWORD
+                valueFrom:
+                  secretKeyRef:
+                    name: {{ template "docker-registry.fullname" . }}-secret
+                    key: swiftPassword
+              - name: REGISTRY_STORAGE_SWIFT_CONTAINER
+                value: {{ required ".Values.swift.container is required" .Values.swift.container }}
+{{- end }}
+{{- if .Values.proxy.enabled }}
+              - name: REGISTRY_PROXY_REMOTEURL
+                value: {{ required ".Values.proxy.remoteurl is required" .Values.proxy.remoteurl }}
+              - name: REGISTRY_PROXY_USERNAME
+                valueFrom:
+                  secretKeyRef:
+                    name: {{ if .Values.proxy.secretRef }}{{ .Values.proxy.secretRef }}{{ else }}{{ template "docker-registry.fullname" . }}-secret{{ end }}
+                    key: proxyUsername
+              - name: REGISTRY_PROXY_PASSWORD
+                valueFrom:
+                  secretKeyRef:
+                    name: {{ if .Values.proxy.secretRef }}{{ .Values.proxy.secretRef }}{{ else }}{{ template "docker-registry.fullname" . }}-secret{{ end }}
+                    key: proxyPassword
+{{- end }}
+{{- if .Values.persistence.deleteEnabled }}
+              - name: REGISTRY_STORAGE_DELETE_ENABLED
+                value: "true"
+{{- end }}
+{{- with .Values.extraEnvVars }}
+              {{- toYaml . | nindent 14 }}
+{{- end }}
+              volumeMounts:
+{{- if .Values.secrets.htpasswd }}
+                - name: auth
+                  mountPath: /auth
+                  readOnly: true
+{{- end }}
+{{- if eq .Values.storage "filesystem" }}
+                - name: data
+                  mountPath: /var/lib/registry/
+{{- end }}
+                - name: "{{ template "docker-registry.fullname" . }}-config"
+                  mountPath: "/etc/docker/registry"
+{{- if .Values.tlsSecretName }}
+                - mountPath: /etc/ssl/docker
+                  name: tls-cert
+                  readOnly: true
+{{- end }}
+{{- with .Values.extraVolumeMounts }}
+                {{- toYaml . | nindent 16 }}
+{{- end }}
+          restartPolicy: OnFailure
+          {{- if .Values.nodeSelector }}
+          nodeSelector: {{ toYaml .Values.nodeSelector | nindent 12 }}
+          {{- end }}
+          {{- if .Values.affinity }}
+          affinity: {{ toYaml .Values.affinity | nindent 12 }}
+          {{- end }}
+          {{- if .Values.tolerations }}
+          tolerations: {{ toYaml .Values.tolerations | nindent 12 }}
+          {{- end }}
+          volumes:
+{{- if .Values.secrets.htpasswd }}
+            - name: auth
+              secret:
+                secretName: {{ template "docker-registry.fullname" . }}-secret
+                items:
+                - key: htpasswd
+                  path: htpasswd
+{{- end }}
+{{- if eq .Values.storage "filesystem" }}
+            - name: data
+          {{- if .Values.persistence.enabled }}
+              persistentVolumeClaim:
+                claimName: {{ if .Values.persistence.existingClaim }}{{ .Values.persistence.existingClaim }}{{- else }}{{ template "docker-registry.fullname" . }}{{- end }}
+          {{- else }}
+              emptyDir: {}
+          {{- end -}}
+{{- end }}
+            - name: {{ template "docker-registry.fullname" . }}-config
+              configMap:
+                name: {{ template "docker-registry.fullname" . }}-config
+{{- if .Values.tlsSecretName }}
+            - name: tls-cert
+              secret:
+                secretName: {{ .Values.tlsSecretName }}
+{{- end }}
+{{- with .Values.extraVolumes }}
+            {{- toYaml . | nindent 12 }}
+{{- end }}
+{{- end }}

values.yaml

@@ -219,3 +219,8 @@ initContainers: []
 # - name: init
 #   image: busybox
 #   command: []
+
+garbageCollect:
+  enabled: false
+  deleteUntagged: true
+  schedule: "0 1 * * *"