From 2726d10083b3ec48b3394d355cdc64f31297b053 Mon Sep 17 00:00:00 2001 From: Vladimir Kuznichenkov Date: Sat, 18 Sep 2021 12:33:43 +0300 Subject: [PATCH 1/8] Move common sections to defined template to prevent code duplication Cronjob should have the same env variables and volumes to proceed correctly --- templates/_helpers.tpl | 178 ++++++++++++++++++++++++++++++++++++++ templates/deployment.yaml | 178 +++----------------------------------- 2 files changed, 191 insertions(+), 165 deletions(-) diff --git a/templates/_helpers.tpl b/templates/_helpers.tpl index a91077e..277c51d 100644 --- a/templates/_helpers.tpl +++ b/templates/_helpers.tpl @@ -22,3 +22,181 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this {{- end -}} {{- end -}} {{- end -}} + +{{- define "docker-registry.envs" -}} +{{- if .Values.secrets.htpasswd }} +- name: REGISTRY_AUTH + value: "htpasswd" +- name: REGISTRY_AUTH_HTPASSWD_REALM + value: "Registry Realm" +- name: REGISTRY_AUTH_HTPASSWD_PATH + value: "/auth/htpasswd" +{{- end }} + +- name: REGISTRY_HTTP_SECRET + valueFrom: + secretKeyRef: + name: {{ template "docker-registry.fullname" . }}-secret + key: haSharedSecret + +{{- if .Values.tlsSecretName }} +- name: REGISTRY_HTTP_TLS_CERTIFICATE + value: /etc/ssl/docker/tls.crt +- name: REGISTRY_HTTP_TLS_KEY + value: /etc/ssl/docker/tls.key +{{- end }} + +{{- if eq .Values.storage "filesystem" }} +- name: REGISTRY_STORAGE_FILESYSTEM_ROOTDIRECTORY + value: "/var/lib/registry" +{{- else if eq .Values.storage "azure" }} +- name: REGISTRY_STORAGE_AZURE_ACCOUNTNAME + valueFrom: + secretKeyRef: + name: {{ template "docker-registry.fullname" . }}-secret + key: azureAccountName +- name: REGISTRY_STORAGE_AZURE_ACCOUNTKEY + valueFrom: + secretKeyRef: + name: {{ template "docker-registry.fullname" . }}-secret + key: azureAccountKey +- name: REGISTRY_STORAGE_AZURE_CONTAINER + valueFrom: + secretKeyRef: + name: {{ template "docker-registry.fullname" . }}-secret + key: azureContainer +{{- else if eq .Values.storage "s3" }} + +- name: REGISTRY_STORAGE_S3_REGION + value: {{ required ".Values.s3.region is required" .Values.s3.region }} +- name: REGISTRY_STORAGE_S3_BUCKET + value: {{ required ".Values.s3.bucket is required" .Values.s3.bucket }} + +{{- if or (and .Values.secrets.s3.secretKey .Values.secrets.s3.accessKey) .Values.secrets.s3.secretRef }} +- name: REGISTRY_STORAGE_S3_ACCESSKEY + valueFrom: + secretKeyRef: + name: {{ if .Values.secrets.s3.secretRef }}{{ .Values.secrets.s3.secretRef }}{{ else }}{{ template "docker-registry.fullname" . }}-secret{{ end }} + key: s3AccessKey +- name: REGISTRY_STORAGE_S3_SECRETKEY + valueFrom: + secretKeyRef: + name: {{ if .Values.secrets.s3.secretRef }}{{ .Values.secrets.s3.secretRef }}{{ else }}{{ template "docker-registry.fullname" . }}-secret{{ end }} + key: s3SecretKey +{{- end }} + +{{- if .Values.s3.regionEndpoint }} +- name: REGISTRY_STORAGE_S3_REGIONENDPOINT + value: {{ .Values.s3.regionEndpoint }} +{{- end }} + +{{- if .Values.s3.encrypt }} +- name: REGISTRY_STORAGE_S3_ENCRYPT + value: {{ .Values.s3.encrypt | quote }} +{{- end }} + +{{- if .Values.s3.secure }} +- name: REGISTRY_STORAGE_S3_SECURE + value: {{ .Values.s3.secure | quote }} +{{- end }} + +{{- else if eq .Values.storage "swift" }} +- name: REGISTRY_STORAGE_SWIFT_AUTHURL + value: {{ required ".Values.swift.authurl is required" .Values.swift.authurl }} +- name: REGISTRY_STORAGE_SWIFT_USERNAME + valueFrom: + secretKeyRef: + name: {{ template "docker-registry.fullname" . }}-secret + key: swiftUsername +- name: REGISTRY_STORAGE_SWIFT_PASSWORD + valueFrom: + secretKeyRef: + name: {{ template "docker-registry.fullname" . }}-secret + key: swiftPassword +- name: REGISTRY_STORAGE_SWIFT_CONTAINER + value: {{ required ".Values.swift.container is required" .Values.swift.container }} +{{- end }} + +{{- if .Values.proxy.enabled }} +- name: REGISTRY_PROXY_REMOTEURL + value: {{ required ".Values.proxy.remoteurl is required" .Values.proxy.remoteurl }} +- name: REGISTRY_PROXY_USERNAME + valueFrom: + secretKeyRef: + name: {{ if .Values.proxy.secretRef }}{{ .Values.proxy.secretRef }}{{ else }}{{ template "docker-registry.fullname" . }}-secret{{ end }} + key: proxyUsername +- name: REGISTRY_PROXY_PASSWORD + valueFrom: + secretKeyRef: + name: {{ if .Values.proxy.secretRef }}{{ .Values.proxy.secretRef }}{{ else }}{{ template "docker-registry.fullname" . }}-secret{{ end }} + key: proxyPassword +{{- end }} + +{{- if .Values.persistence.deleteEnabled }} +- name: REGISTRY_STORAGE_DELETE_ENABLED + value: "true" +{{- end }} + +{{- end -}} + +{{- define "docker-registry.volumeMounts" -}} +- name: "{{ template "docker-registry.fullname" . }}-config" + mountPath: "/etc/docker/registry" + +{{- if .Values.secrets.htpasswd }} +- name: auth + mountPath: /auth + readOnly: true +{{- end }} + +{{- if eq .Values.storage "filesystem" }} +- name: data + mountPath: /var/lib/registry/ +{{- end }} + +{{- if .Values.tlsSecretName }} +- mountPath: /etc/ssl/docker + name: tls-cert + readOnly: true +{{- end }} + +{{- with .Values.extraVolumeMounts }} +{{- toYaml . }} +{{- end }} + +{{- end -}} + +{{- define "docker-registry.volumes" -}} +- name: {{ template "docker-registry.fullname" . }}-config + configMap: + name: {{ template "docker-registry.fullname" . }}-config + +{{- if .Values.secrets.htpasswd }} +- name: auth + secret: + secretName: {{ template "docker-registry.fullname" . }}-secret + items: + - key: htpasswd + path: htpasswd +{{- end }} + +{{- if eq .Values.storage "filesystem" }} +- name: data + {{- if .Values.persistence.enabled }} + persistentVolumeClaim: + claimName: {{ if .Values.persistence.existingClaim }}{{ .Values.persistence.existingClaim }}{{- else }}{{ template "docker-registry.fullname" . }}{{- end }} + {{- else }} + emptyDir: {} + {{- end -}} +{{- end }} + +{{- if .Values.tlsSecretName }} +- name: tls-cert + secret: + secretName: {{ .Values.tlsSecretName }} +{{- end }} + +{{- with .Values.extraVolumes }} +{{- toYaml . }} +{{- end }} +{{- end -}} \ No newline at end of file diff --git a/templates/deployment.yaml b/templates/deployment.yaml index d3ea7af..c83be3e 100644 --- a/templates/deployment.yaml +++ b/templates/deployment.yaml @@ -68,168 +68,16 @@ spec: {{- end }} path: / port: 5000 - resources: -{{ toYaml .Values.resources | indent 12 }} - env: -{{- if .Values.secrets.htpasswd }} - - name: REGISTRY_AUTH - value: "htpasswd" - - name: REGISTRY_AUTH_HTPASSWD_REALM - value: "Registry Realm" - - name: REGISTRY_AUTH_HTPASSWD_PATH - value: "/auth/htpasswd" -{{- end }} - - name: REGISTRY_HTTP_SECRET - valueFrom: - secretKeyRef: - name: {{ template "docker-registry.fullname" . }}-secret - key: haSharedSecret -{{- if .Values.tlsSecretName }} - - name: REGISTRY_HTTP_TLS_CERTIFICATE - value: /etc/ssl/docker/tls.crt - - name: REGISTRY_HTTP_TLS_KEY - value: /etc/ssl/docker/tls.key -{{- end }} -{{- if eq .Values.storage "filesystem" }} - - name: REGISTRY_STORAGE_FILESYSTEM_ROOTDIRECTORY - value: "/var/lib/registry" -{{- else if eq .Values.storage "azure" }} - - name: REGISTRY_STORAGE_AZURE_ACCOUNTNAME - valueFrom: - secretKeyRef: - name: {{ template "docker-registry.fullname" . }}-secret - key: azureAccountName - - name: REGISTRY_STORAGE_AZURE_ACCOUNTKEY - valueFrom: - secretKeyRef: - name: {{ template "docker-registry.fullname" . }}-secret - key: azureAccountKey - - name: REGISTRY_STORAGE_AZURE_CONTAINER - valueFrom: - secretKeyRef: - name: {{ template "docker-registry.fullname" . }}-secret - key: azureContainer -{{- else if eq .Values.storage "s3" }} - {{- if or (and .Values.secrets.s3.secretKey .Values.secrets.s3.accessKey) .Values.secrets.s3.secretRef }} - - name: REGISTRY_STORAGE_S3_ACCESSKEY - valueFrom: - secretKeyRef: - name: {{ if .Values.secrets.s3.secretRef }}{{ .Values.secrets.s3.secretRef }}{{ else }}{{ template "docker-registry.fullname" . }}-secret{{ end }} - key: s3AccessKey - - name: REGISTRY_STORAGE_S3_SECRETKEY - valueFrom: - secretKeyRef: - name: {{ if .Values.secrets.s3.secretRef }}{{ .Values.secrets.s3.secretRef }}{{ else }}{{ template "docker-registry.fullname" . }}-secret{{ end }} - key: s3SecretKey - {{- end }} - - name: REGISTRY_STORAGE_S3_REGION - value: {{ required ".Values.s3.region is required" .Values.s3.region }} - {{- if .Values.s3.regionEndpoint }} - - name: REGISTRY_STORAGE_S3_REGIONENDPOINT - value: {{ .Values.s3.regionEndpoint }} - {{- end }} - - name: REGISTRY_STORAGE_S3_BUCKET - value: {{ required ".Values.s3.bucket is required" .Values.s3.bucket }} - {{- if .Values.s3.encrypt }} - - name: REGISTRY_STORAGE_S3_ENCRYPT - value: {{ .Values.s3.encrypt | quote }} - {{- end }} - {{- if .Values.s3.secure }} - - name: REGISTRY_STORAGE_S3_SECURE - value: {{ .Values.s3.secure | quote }} - {{- end }} -{{- else if eq .Values.storage "swift" }} - - name: REGISTRY_STORAGE_SWIFT_AUTHURL - value: {{ required ".Values.swift.authurl is required" .Values.swift.authurl }} - - name: REGISTRY_STORAGE_SWIFT_USERNAME - valueFrom: - secretKeyRef: - name: {{ template "docker-registry.fullname" . }}-secret - key: swiftUsername - - name: REGISTRY_STORAGE_SWIFT_PASSWORD - valueFrom: - secretKeyRef: - name: {{ template "docker-registry.fullname" . }}-secret - key: swiftPassword - - name: REGISTRY_STORAGE_SWIFT_CONTAINER - value: {{ required ".Values.swift.container is required" .Values.swift.container }} -{{- end }} -{{- if .Values.proxy.enabled }} - - name: REGISTRY_PROXY_REMOTEURL - value: {{ required ".Values.proxy.remoteurl is required" .Values.proxy.remoteurl }} - - name: REGISTRY_PROXY_USERNAME - valueFrom: - secretKeyRef: - name: {{ if .Values.proxy.secretRef }}{{ .Values.proxy.secretRef }}{{ else }}{{ template "docker-registry.fullname" . }}-secret{{ end }} - key: proxyUsername - - name: REGISTRY_PROXY_PASSWORD - valueFrom: - secretKeyRef: - name: {{ if .Values.proxy.secretRef }}{{ .Values.proxy.secretRef }}{{ else }}{{ template "docker-registry.fullname" . }}-secret{{ end }} - key: proxyPassword -{{- end }} -{{- if .Values.persistence.deleteEnabled }} - - name: REGISTRY_STORAGE_DELETE_ENABLED - value: "true" -{{- end }} - volumeMounts: -{{- if .Values.secrets.htpasswd }} - - name: auth - mountPath: /auth - readOnly: true -{{- end }} -{{- if eq .Values.storage "filesystem" }} - - name: data - mountPath: /var/lib/registry/ -{{- end }} - - name: "{{ template "docker-registry.fullname" . }}-config" - mountPath: "/etc/docker/registry" -{{- if .Values.tlsSecretName }} - - mountPath: /etc/ssl/docker - name: tls-cert - readOnly: true -{{- end }} -{{- with .Values.extraVolumeMounts }} - {{- toYaml . | nindent 12 }} -{{- end }} -{{- if .Values.nodeSelector }} - nodeSelector: -{{ toYaml .Values.nodeSelector | indent 8 }} -{{- end }} -{{- if .Values.affinity }} - affinity: -{{ toYaml .Values.affinity | indent 8 }} -{{- end }} -{{- if .Values.tolerations }} - tolerations: -{{ toYaml .Values.tolerations | indent 8 }} -{{- end }} - volumes: -{{- if .Values.secrets.htpasswd }} - - name: auth - secret: - secretName: {{ template "docker-registry.fullname" . }}-secret - items: - - key: htpasswd - path: htpasswd -{{- end }} -{{- if eq .Values.storage "filesystem" }} - - name: data - {{- if .Values.persistence.enabled }} - persistentVolumeClaim: - claimName: {{ if .Values.persistence.existingClaim }}{{ .Values.persistence.existingClaim }}{{- else }}{{ template "docker-registry.fullname" . }}{{- end }} - {{- else }} - emptyDir: {} - {{- end -}} -{{- end }} - - name: {{ template "docker-registry.fullname" . }}-config - configMap: - name: {{ template "docker-registry.fullname" . }}-config -{{- if .Values.tlsSecretName }} - - name: tls-cert - secret: - secretName: {{ .Values.tlsSecretName }} -{{- end }} -{{- with .Values.extraVolumes }} - {{- toYaml . | nindent 8 }} -{{- end }} + resources: {{ toYaml .Values.resources | nindent 12 }} + env: {{ include "docker-registry.envs" . | nindent 12 }} + volumeMounts: {{ include "docker-registry.volumeMounts" . | nindent 12 }} + {{- if .Values.nodeSelector }} + nodeSelector: {{ toYaml .Values.nodeSelector | nindent 8 }} + {{- end }} + {{- if .Values.affinity }} + affinity: {{ toYaml .Values.affinity | nindent 8 }} + {{- end }} + {{- if .Values.tolerations }} + tolerations: {{ toYaml .Values.tolerations | nindent 8 }} + {{- end }} + volumes: {{ include "docker-registry.volumes" . | nindent 8 }} From 944cf7eb62f969a395998084d89adf30e2276bc5 Mon Sep 17 00:00:00 2001 From: Vladimir Kuznichenkov Date: Sat, 18 Sep 2021 12:34:57 +0300 Subject: [PATCH 2/8] Use a single style of indents `nindent` function insert fist newline before actual content and allow you use it on any level of yaml without breaking visual structure. --- templates/deployment.yaml | 36 +++++++++++++++++------------------- 1 file changed, 17 insertions(+), 19 deletions(-) diff --git a/templates/deployment.yaml b/templates/deployment.yaml index c83be3e..523e9e6 100644 --- a/templates/deployment.yaml +++ b/templates/deployment.yaml @@ -13,37 +13,35 @@ spec: app: {{ template "docker-registry.name" . }} release: {{ .Release.Name }} replicas: {{ .Values.replicaCount }} -{{- if .Values.updateStrategy }} - strategy: -{{ toYaml .Values.updateStrategy | indent 4 }} -{{- end }} + {{- if .Values.updateStrategy }} + strategy: {{ toYaml .Values.updateStrategy | nindent 4 }} + {{- end }} minReadySeconds: 5 template: metadata: labels: app: {{ template "docker-registry.name" . }} release: {{ .Release.Name }} - {{- if .Values.podLabels }} -{{ toYaml .Values.podLabels | indent 8 }} + {{- with .Values.podLabels }} + {{ toYaml . | nindent 8 }} {{- end }} annotations: checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }} -{{- if $.Values.podAnnotations }} -{{ toYaml $.Values.podAnnotations | indent 8 }} -{{- end }} + {{- with .Values.podAnnotations }} + {{ toYaml . | nindent 8 }} + {{- end }} spec: {{- if .Values.imagePullSecrets }} - imagePullSecrets: -{{ toYaml .Values.imagePullSecrets | indent 8 }} + imagePullSecrets: {{ toYaml .Values.imagePullSecrets | nindent 8 }} {{- end }} -{{- if .Values.priorityClassName }} + {{- if .Values.priorityClassName }} priorityClassName: "{{ .Values.priorityClassName }}" -{{- end }} -{{- if .Values.securityContext.enabled }} + {{- end }} + {{- if .Values.securityContext.enabled }} securityContext: fsGroup: {{ .Values.securityContext.fsGroup }} runAsUser: {{ .Values.securityContext.runAsUser }} -{{- end }} + {{- end }} containers: - name: {{ .Chart.Name }} image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}" @@ -56,16 +54,16 @@ spec: - containerPort: 5000 livenessProbe: httpGet: -{{- if .Values.tlsSecretName }} + {{- if .Values.tlsSecretName }} scheme: HTTPS -{{- end }} + {{- end }} path: / port: 5000 readinessProbe: httpGet: -{{- if .Values.tlsSecretName }} + {{- if .Values.tlsSecretName }} scheme: HTTPS -{{- end }} + {{- end }} path: / port: 5000 resources: {{ toYaml .Values.resources | nindent 12 }} From c855e53b9ee6232f25f70b295236858d80711a74 Mon Sep 17 00:00:00 2001 From: Vladimir Kuznichenkov Date: Sat, 18 Sep 2021 12:36:22 +0300 Subject: [PATCH 3/8] Add empty objects to default envs to prevent validation errors In case of S3 we can use IAM role to access bucket, in that case we do not need to define anything in secrets. At the same time due to missed parent level field chart will fail with an error. --- values.yaml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/values.yaml b/values.yaml index 39a42b4..e239d58 100644 --- a/values.yaml +++ b/values.yaml @@ -61,6 +61,7 @@ persistence: enabled: false size: 10Gi # storageClass: '-' + deleteEnabled: false # set the type of filesystem to use: filesystem, s3 storage: filesystem @@ -70,6 +71,10 @@ storage: filesystem secrets: haSharedSecret: "" htpasswd: "" + azure: {} + s3: {} + swift: {} + # Secrets for Azure # azure: # accountName: "" @@ -86,6 +91,7 @@ secrets: # username: "" # password: "" +s3: {} # Options for s3 storage type: # s3: # region: us-east-1 @@ -94,6 +100,7 @@ secrets: # encrypt: false # secure: true +swift: {} # Options for swift storage type: # swift: # authurl: http://swift.example.com/ From a95a3480c6c12c8a21d34001b2bcebbe402ee16f Mon Sep 17 00:00:00 2001 From: Vladimir Kuznichenkov Date: Sat, 18 Sep 2021 12:37:50 +0300 Subject: [PATCH 4/8] Garbage collector job to keep registry tiny We don't have unlimited storage, and we would like to run built-in garbage collector to keep storage usage low. --- Chart.yaml | 2 +- README.md | 3 +++ templates/cronjob.yaml | 47 ++++++++++++++++++++++++++++++++++++++++++ values.yaml | 5 +++++ 4 files changed, 56 insertions(+), 1 deletion(-) create mode 100644 templates/cronjob.yaml diff --git a/Chart.yaml b/Chart.yaml index df95853..b875fc6 100644 --- a/Chart.yaml +++ b/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v1 description: A Helm chart for Docker Registry name: docker-registry -version: 1.13.0 +version: 1.14.0 appVersion: 2.7.1 home: https://hub.docker.com/_/registry/ icon: https://helm.twun.io/docker-registry.png diff --git a/README.md b/README.md index 440667d..889916a 100644 --- a/README.md +++ b/README.md @@ -92,6 +92,9 @@ their default values. | `ingress.tls` | Ingress TLS configuration (YAML) | `[]` | | `extraVolumeMounts` | Additional volumeMounts to the registry container | `[]` | | `extraVolumes` | Additional volumes to the pod | `[]` | +| `garbageCollect.enabled` | If true, will deploy garbage-collector cronjob | `false` | +| `garbageCollect.deleteUntagged` | If true, garbage-collector will delete manifests that are not currently referenced via tag | `true` | | +| `garbageCollect.schedule` | CronTab schedule, please use standard crontab format | `0 1 * * *` | | Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. diff --git a/templates/cronjob.yaml b/templates/cronjob.yaml new file mode 100644 index 0000000..6cf1253 --- /dev/null +++ b/templates/cronjob.yaml @@ -0,0 +1,47 @@ +{{- if .Values.garbageCollect.enabled }} +apiVersion: batch/v1 +kind: CronJob +metadata: + name: {{ template "docker-registry.fullname" . }}-garbage-collector + labels: + app: {{ template "docker-registry.name" . }} + chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +spec: + schedule: {{ .Values.garbageCollect.schedule | quote }} + jobTemplate: + spec: + template: + spec: + {{- if .Values.imagePullSecrets }} + imagePullSecrets: {{ toYaml .Values.imagePullSecrets | nindent 12 }} + {{- end }} + {{- if .Values.securityContext.enabled }} + securityContext: + fsGroup: {{ .Values.securityContext.fsGroup }} + runAsUser: {{ .Values.securityContext.runAsUser }} + {{- end }} + containers: + - name: {{ .Chart.Name }} + image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}" + imagePullPolicy: {{ .Values.image.pullPolicy }} + command: + - /bin/registry + - garbage-collect + - --delete-untagged={{ .Values.garbageCollect.deleteUntagged }} + - /etc/docker/registry/config.yml + env: {{ include "docker-registry.envs" . | nindent 16 }} + volumeMounts: {{ include "docker-registry.volumeMounts" . | nindent 16 }} + restartPolicy: OnFailure + {{- if .Values.nodeSelector }} + nodeSelector: {{ toYaml .Values.nodeSelector | nindent 12 }} + {{- end }} + {{- if .Values.affinity }} + affinity: {{ toYaml .Values.affinity | nindent 12 }} + {{- end }} + {{- if .Values.tolerations }} + tolerations: {{ toYaml .Values.tolerations | nindent 12 }} + {{- end }} + volumes: {{ include "docker-registry.volumes" . | nindent 12 }} +{{- end }} diff --git a/values.yaml b/values.yaml index e239d58..92116aa 100644 --- a/values.yaml +++ b/values.yaml @@ -166,3 +166,8 @@ extraVolumes: [] # - key: cloudfront.pem # path: cloudfront.pem # mode: 511 + +garbageCollect: + enabled: false + deleteUntagged: true + schedule: "0 1 * * *" From 3b4ff679f81fca3d9774bc29e143e3712e639ba2 Mon Sep 17 00:00:00 2001 From: ddelange <14880945+ddelange@users.noreply.github.com> Date: Thu, 4 Aug 2022 08:44:44 +0200 Subject: [PATCH 5/8] Revert version bump in Chart.yaml --- Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Chart.yaml b/Chart.yaml index 4701118..3d6c22c 100644 --- a/Chart.yaml +++ b/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v1 description: A Helm chart for Docker Registry name: docker-registry -version: 2.2.0 +version: 2.1.0 appVersion: 2.7.1 home: https://hub.docker.com/_/registry/ icon: https://helm.twun.io/docker-registry.png From fd7fdcaa441f496a77b23ebba771b03543f1c3df Mon Sep 17 00:00:00 2001 From: ddelange <14880945+ddelange@users.noreply.github.com> Date: Fri, 5 Aug 2022 14:04:37 +0200 Subject: [PATCH 6/8] Make the changes additive --- README.md | 2 +- templates/_helpers.tpl | 187 --------------------------------- templates/cronjob.yaml | 161 +++++++++++++++++++++++++++- templates/deployment.yaml | 213 +++++++++++++++++++++++++++++++++----- values.yaml | 1 - 5 files changed, 346 insertions(+), 218 deletions(-) diff --git a/README.md b/README.md index 1a7d2a4..6f32d81 100644 --- a/README.md +++ b/README.md @@ -117,7 +117,7 @@ their default values. | `initContainers` | Init containers to be created in the pod | `[]` | | `garbageCollect.enabled` | If true, will deploy garbage-collector cronjob | `false` | | `garbageCollect.deleteUntagged` | If true, garbage-collector will delete manifests that are not currently referenced via tag | `true` | | -| `garbageCollect.schedule` | CronTab schedule, please use standard crontab format | `0 1 * * *` | | +| `garbageCollect.schedule` | CronTab schedule, please use standard crontab format | `0 1 * * *` | | Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. diff --git a/templates/_helpers.tpl b/templates/_helpers.tpl index 0cf03fc..a91077e 100644 --- a/templates/_helpers.tpl +++ b/templates/_helpers.tpl @@ -22,190 +22,3 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this {{- end -}} {{- end -}} {{- end -}} - -{{- define "docker-registry.envs" -}} -{{- if .Values.secrets.htpasswd }} -- name: REGISTRY_AUTH - value: "htpasswd" -- name: REGISTRY_AUTH_HTPASSWD_REALM - value: "Registry Realm" -- name: REGISTRY_AUTH_HTPASSWD_PATH - value: "/auth/htpasswd" -{{- end }} - -- name: REGISTRY_HTTP_SECRET - valueFrom: - secretKeyRef: - name: {{ template "docker-registry.fullname" . }}-secret - key: haSharedSecret - -{{- if .Values.tlsSecretName }} -- name: REGISTRY_HTTP_TLS_CERTIFICATE - value: /etc/ssl/docker/tls.crt -- name: REGISTRY_HTTP_TLS_KEY - value: /etc/ssl/docker/tls.key -{{- end }} - -{{- if eq .Values.storage "filesystem" }} -- name: REGISTRY_STORAGE_FILESYSTEM_ROOTDIRECTORY - value: "/var/lib/registry" -{{- else if eq .Values.storage "azure" }} -- name: REGISTRY_STORAGE_AZURE_ACCOUNTNAME - valueFrom: - secretKeyRef: - name: {{ template "docker-registry.fullname" . }}-secret - key: azureAccountName -- name: REGISTRY_STORAGE_AZURE_ACCOUNTKEY - valueFrom: - secretKeyRef: - name: {{ template "docker-registry.fullname" . }}-secret - key: azureAccountKey -- name: REGISTRY_STORAGE_AZURE_CONTAINER - valueFrom: - secretKeyRef: - name: {{ template "docker-registry.fullname" . }}-secret - key: azureContainer -{{- else if eq .Values.storage "s3" }} - -- name: REGISTRY_STORAGE_S3_REGION - value: {{ required ".Values.s3.region is required" .Values.s3.region }} -- name: REGISTRY_STORAGE_S3_BUCKET - value: {{ required ".Values.s3.bucket is required" .Values.s3.bucket }} - -{{- if or (and .Values.secrets.s3.secretKey .Values.secrets.s3.accessKey) .Values.secrets.s3.secretRef }} -- name: REGISTRY_STORAGE_S3_ACCESSKEY - valueFrom: - secretKeyRef: - name: {{ if .Values.secrets.s3.secretRef }}{{ .Values.secrets.s3.secretRef }}{{ else }}{{ template "docker-registry.fullname" . }}-secret{{ end }} - key: s3AccessKey -- name: REGISTRY_STORAGE_S3_SECRETKEY - valueFrom: - secretKeyRef: - name: {{ if .Values.secrets.s3.secretRef }}{{ .Values.secrets.s3.secretRef }}{{ else }}{{ template "docker-registry.fullname" . }}-secret{{ end }} - key: s3SecretKey -{{- end }} - -{{- if .Values.s3.regionEndpoint }} -- name: REGISTRY_STORAGE_S3_REGIONENDPOINT - value: {{ .Values.s3.regionEndpoint }} -{{- end }} - -{{- if .Values.s3.rootdirectory }} -- name: REGISTRY_STORAGE_S3_ROOTDIRECTORY - value: {{ .Values.s3.rootdirectory | quote }} -{{- end }} - -{{- if .Values.s3.encrypt }} -- name: REGISTRY_STORAGE_S3_ENCRYPT - value: {{ .Values.s3.encrypt | quote }} -{{- end }} - -{{- if .Values.s3.secure }} -- name: REGISTRY_STORAGE_S3_SECURE - value: {{ .Values.s3.secure | quote }} -{{- end }} - -{{- else if eq .Values.storage "swift" }} -- name: REGISTRY_STORAGE_SWIFT_AUTHURL - value: {{ required ".Values.swift.authurl is required" .Values.swift.authurl }} -- name: REGISTRY_STORAGE_SWIFT_USERNAME - valueFrom: - secretKeyRef: - name: {{ template "docker-registry.fullname" . }}-secret - key: swiftUsername -- name: REGISTRY_STORAGE_SWIFT_PASSWORD - valueFrom: - secretKeyRef: - name: {{ template "docker-registry.fullname" . }}-secret - key: swiftPassword -- name: REGISTRY_STORAGE_SWIFT_CONTAINER - value: {{ required ".Values.swift.container is required" .Values.swift.container }} -{{- end }} - -{{- if .Values.proxy.enabled }} -- name: REGISTRY_PROXY_REMOTEURL - value: {{ required ".Values.proxy.remoteurl is required" .Values.proxy.remoteurl }} -- name: REGISTRY_PROXY_USERNAME - valueFrom: - secretKeyRef: - name: {{ if .Values.proxy.secretRef }}{{ .Values.proxy.secretRef }}{{ else }}{{ template "docker-registry.fullname" . }}-secret{{ end }} - key: proxyUsername -- name: REGISTRY_PROXY_PASSWORD - valueFrom: - secretKeyRef: - name: {{ if .Values.proxy.secretRef }}{{ .Values.proxy.secretRef }}{{ else }}{{ template "docker-registry.fullname" . }}-secret{{ end }} - key: proxyPassword -{{- end }} - -{{- if .Values.persistence.deleteEnabled }} -- name: REGISTRY_STORAGE_DELETE_ENABLED - value: "true" -{{- end }} - -{{- with .Values.extraEnvVars }} - {{- toYaml . | nindent 12 }} -{{- end }} - -{{- end -}} - -{{- define "docker-registry.volumeMounts" -}} -- name: "{{ template "docker-registry.fullname" . }}-config" - mountPath: "/etc/docker/registry" - -{{- if .Values.secrets.htpasswd }} -- name: auth - mountPath: /auth - readOnly: true -{{- end }} - -{{- if eq .Values.storage "filesystem" }} -- name: data - mountPath: /var/lib/registry/ -{{- end }} - -{{- if .Values.tlsSecretName }} -- mountPath: /etc/ssl/docker - name: tls-cert - readOnly: true -{{- end }} - -{{- with .Values.extraVolumeMounts }} -{{- toYaml . }} -{{- end }} - -{{- end -}} - -{{- define "docker-registry.volumes" -}} -- name: {{ template "docker-registry.fullname" . }}-config - configMap: - name: {{ template "docker-registry.fullname" . }}-config - -{{- if .Values.secrets.htpasswd }} -- name: auth - secret: - secretName: {{ template "docker-registry.fullname" . }}-secret - items: - - key: htpasswd - path: htpasswd -{{- end }} - -{{- if eq .Values.storage "filesystem" }} -- name: data - {{- if .Values.persistence.enabled }} - persistentVolumeClaim: - claimName: {{ if .Values.persistence.existingClaim }}{{ .Values.persistence.existingClaim }}{{- else }}{{ template "docker-registry.fullname" . }}{{- end }} - {{- else }} - emptyDir: {} - {{- end -}} -{{- end }} - -{{- if .Values.tlsSecretName }} -- name: tls-cert - secret: - secretName: {{ .Values.tlsSecretName }} -{{- end }} - -{{- with .Values.extraVolumes }} -{{- toYaml . }} -{{- end }} -{{- end -}} diff --git a/templates/cronjob.yaml b/templates/cronjob.yaml index 6cf1253..f784469 100644 --- a/templates/cronjob.yaml +++ b/templates/cronjob.yaml @@ -31,8 +31,135 @@ spec: - garbage-collect - --delete-untagged={{ .Values.garbageCollect.deleteUntagged }} - /etc/docker/registry/config.yml - env: {{ include "docker-registry.envs" . | nindent 16 }} - volumeMounts: {{ include "docker-registry.volumeMounts" . | nindent 16 }} + env: +{{- if .Values.secrets.htpasswd }} + - name: REGISTRY_AUTH + value: "htpasswd" + - name: REGISTRY_AUTH_HTPASSWD_REALM + value: "Registry Realm" + - name: REGISTRY_AUTH_HTPASSWD_PATH + value: "/auth/htpasswd" +{{- end }} + - name: REGISTRY_HTTP_SECRET + valueFrom: + secretKeyRef: + name: {{ template "docker-registry.fullname" . }}-secret + key: haSharedSecret +{{- if .Values.tlsSecretName }} + - name: REGISTRY_HTTP_TLS_CERTIFICATE + value: /etc/ssl/docker/tls.crt + - name: REGISTRY_HTTP_TLS_KEY + value: /etc/ssl/docker/tls.key +{{- end }} +{{- if eq .Values.storage "filesystem" }} + - name: REGISTRY_STORAGE_FILESYSTEM_ROOTDIRECTORY + value: "/var/lib/registry" +{{- else if eq .Values.storage "azure" }} + - name: REGISTRY_STORAGE_AZURE_ACCOUNTNAME + valueFrom: + secretKeyRef: + name: {{ template "docker-registry.fullname" . }}-secret + key: azureAccountName + - name: REGISTRY_STORAGE_AZURE_ACCOUNTKEY + valueFrom: + secretKeyRef: + name: {{ template "docker-registry.fullname" . }}-secret + key: azureAccountKey + - name: REGISTRY_STORAGE_AZURE_CONTAINER + valueFrom: + secretKeyRef: + name: {{ template "docker-registry.fullname" . }}-secret + key: azureContainer +{{- else if eq .Values.storage "s3" }} + {{- if or (and .Values.secrets.s3.secretKey .Values.secrets.s3.accessKey) .Values.secrets.s3.secretRef }} + - name: REGISTRY_STORAGE_S3_ACCESSKEY + valueFrom: + secretKeyRef: + name: {{ if .Values.secrets.s3.secretRef }}{{ .Values.secrets.s3.secretRef }}{{ else }}{{ template "docker-registry.fullname" . }}-secret{{ end }} + key: s3AccessKey + - name: REGISTRY_STORAGE_S3_SECRETKEY + valueFrom: + secretKeyRef: + name: {{ if .Values.secrets.s3.secretRef }}{{ .Values.secrets.s3.secretRef }}{{ else }}{{ template "docker-registry.fullname" . }}-secret{{ end }} + key: s3SecretKey + {{- end }} + - name: REGISTRY_STORAGE_S3_REGION + value: {{ required ".Values.s3.region is required" .Values.s3.region }} + {{- if .Values.s3.regionEndpoint }} + - name: REGISTRY_STORAGE_S3_REGIONENDPOINT + value: {{ .Values.s3.regionEndpoint }} + {{- end }} + - name: REGISTRY_STORAGE_S3_BUCKET + value: {{ required ".Values.s3.bucket is required" .Values.s3.bucket }} + {{- if .Values.s3.rootdirectory }} + - name: REGISTRY_STORAGE_S3_ROOTDIRECTORY + value: {{ .Values.s3.rootdirectory | quote }} + {{- end }} + {{- if .Values.s3.encrypt }} + - name: REGISTRY_STORAGE_S3_ENCRYPT + value: {{ .Values.s3.encrypt | quote }} + {{- end }} + {{- if .Values.s3.secure }} + - name: REGISTRY_STORAGE_S3_SECURE + value: {{ .Values.s3.secure | quote }} + {{- end }} +{{- else if eq .Values.storage "swift" }} + - name: REGISTRY_STORAGE_SWIFT_AUTHURL + value: {{ required ".Values.swift.authurl is required" .Values.swift.authurl }} + - name: REGISTRY_STORAGE_SWIFT_USERNAME + valueFrom: + secretKeyRef: + name: {{ template "docker-registry.fullname" . }}-secret + key: swiftUsername + - name: REGISTRY_STORAGE_SWIFT_PASSWORD + valueFrom: + secretKeyRef: + name: {{ template "docker-registry.fullname" . }}-secret + key: swiftPassword + - name: REGISTRY_STORAGE_SWIFT_CONTAINER + value: {{ required ".Values.swift.container is required" .Values.swift.container }} +{{- end }} +{{- if .Values.proxy.enabled }} + - name: REGISTRY_PROXY_REMOTEURL + value: {{ required ".Values.proxy.remoteurl is required" .Values.proxy.remoteurl }} + - name: REGISTRY_PROXY_USERNAME + valueFrom: + secretKeyRef: + name: {{ if .Values.proxy.secretRef }}{{ .Values.proxy.secretRef }}{{ else }}{{ template "docker-registry.fullname" . }}-secret{{ end }} + key: proxyUsername + - name: REGISTRY_PROXY_PASSWORD + valueFrom: + secretKeyRef: + name: {{ if .Values.proxy.secretRef }}{{ .Values.proxy.secretRef }}{{ else }}{{ template "docker-registry.fullname" . }}-secret{{ end }} + key: proxyPassword +{{- end }} +{{- if .Values.persistence.deleteEnabled }} + - name: REGISTRY_STORAGE_DELETE_ENABLED + value: "true" +{{- end }} +{{- with .Values.extraEnvVars }} + {{- toYaml . | nindent 14 }} +{{- end }} + volumeMounts: +{{- if .Values.secrets.htpasswd }} + - name: auth + mountPath: /auth + readOnly: true +{{- end }} +{{- if eq .Values.storage "filesystem" }} + - name: data + mountPath: /var/lib/registry/ +{{- end }} + - name: "{{ template "docker-registry.fullname" . }}-config" + mountPath: "/etc/docker/registry" +{{- if .Values.tlsSecretName }} + - mountPath: /etc/ssl/docker + name: tls-cert + readOnly: true +{{- end }} +{{- with .Values.extraVolumeMounts }} + {{- toYaml . | nindent 16 }} +{{- end }} restartPolicy: OnFailure {{- if .Values.nodeSelector }} nodeSelector: {{ toYaml .Values.nodeSelector | nindent 12 }} @@ -43,5 +170,33 @@ spec: {{- if .Values.tolerations }} tolerations: {{ toYaml .Values.tolerations | nindent 12 }} {{- end }} - volumes: {{ include "docker-registry.volumes" . | nindent 12 }} + volumes: +{{- if .Values.secrets.htpasswd }} + - name: auth + secret: + secretName: {{ template "docker-registry.fullname" . }}-secret + items: + - key: htpasswd + path: htpasswd +{{- end }} +{{- if eq .Values.storage "filesystem" }} + - name: data + {{- if .Values.persistence.enabled }} + persistentVolumeClaim: + claimName: {{ if .Values.persistence.existingClaim }}{{ .Values.persistence.existingClaim }}{{- else }}{{ template "docker-registry.fullname" . }}{{- end }} + {{- else }} + emptyDir: {} + {{- end -}} +{{- end }} + - name: {{ template "docker-registry.fullname" . }}-config + configMap: + name: {{ template "docker-registry.fullname" . }}-config +{{- if .Values.tlsSecretName }} + - name: tls-cert + secret: + secretName: {{ .Values.tlsSecretName }} +{{- end }} +{{- with .Values.extraVolumes }} + {{- toYaml . | nindent 12 }} +{{- end }} {{- end }} diff --git a/templates/deployment.yaml b/templates/deployment.yaml index ab77236..88b941e 100644 --- a/templates/deployment.yaml +++ b/templates/deployment.yaml @@ -14,17 +14,18 @@ spec: app: {{ template "docker-registry.name" . }} release: {{ .Release.Name }} replicas: {{ .Values.replicaCount }} - {{- if .Values.updateStrategy }} - strategy: {{ toYaml .Values.updateStrategy | nindent 4 }} - {{- end }} +{{- if .Values.updateStrategy }} + strategy: +{{ toYaml .Values.updateStrategy | indent 4 }} +{{- end }} minReadySeconds: 5 template: metadata: labels: app: {{ template "docker-registry.name" . }} release: {{ .Release.Name }} - {{- with .Values.podLabels }} - {{ toYaml . | nindent 8 }} + {{- if .Values.podLabels }} +{{ toYaml .Values.podLabels | indent 8 }} {{- end }} annotations: checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }} @@ -37,12 +38,13 @@ spec: serviceAccountName: {{ .Values.serviceAccount.name | default (include "docker-registry.fullname" .) }} {{- end }} {{- if .Values.imagePullSecrets }} - imagePullSecrets: {{ toYaml .Values.imagePullSecrets | nindent 8 }} + imagePullSecrets: +{{ toYaml .Values.imagePullSecrets | indent 8 }} {{- end }} - {{- if .Values.priorityClassName }} +{{- if .Values.priorityClassName }} priorityClassName: "{{ .Values.priorityClassName }}" - {{- end }} - {{- if .Values.securityContext.enabled }} +{{- end }} +{{- if .Values.securityContext.enabled }} securityContext: fsGroup: {{ .Values.securityContext.fsGroup }} runAsUser: {{ .Values.securityContext.runAsUser }} @@ -68,28 +70,187 @@ spec: {{- end }} livenessProbe: httpGet: - {{- if .Values.tlsSecretName }} +{{- if .Values.tlsSecretName }} scheme: HTTPS - {{- end }} +{{- end }} path: / port: 5000 readinessProbe: httpGet: - {{- if .Values.tlsSecretName }} +{{- if .Values.tlsSecretName }} scheme: HTTPS - {{- end }} +{{- end }} path: / port: 5000 - resources: {{ toYaml .Values.resources | nindent 12 }} - env: {{ include "docker-registry.envs" . | nindent 12 }} - volumeMounts: {{ include "docker-registry.volumeMounts" . | nindent 12 }} - {{- if .Values.nodeSelector }} - nodeSelector: {{ toYaml .Values.nodeSelector | nindent 8 }} - {{- end }} - {{- if .Values.affinity }} - affinity: {{ toYaml .Values.affinity | nindent 8 }} - {{- end }} - {{- if .Values.tolerations }} - tolerations: {{ toYaml .Values.tolerations | nindent 8 }} - {{- end }} - volumes: {{ include "docker-registry.volumes" . | nindent 8 }} + resources: +{{ toYaml .Values.resources | indent 12 }} + env: +{{- if .Values.secrets.htpasswd }} + - name: REGISTRY_AUTH + value: "htpasswd" + - name: REGISTRY_AUTH_HTPASSWD_REALM + value: "Registry Realm" + - name: REGISTRY_AUTH_HTPASSWD_PATH + value: "/auth/htpasswd" +{{- end }} + - name: REGISTRY_HTTP_SECRET + valueFrom: + secretKeyRef: + name: {{ template "docker-registry.fullname" . }}-secret + key: haSharedSecret +{{- if .Values.tlsSecretName }} + - name: REGISTRY_HTTP_TLS_CERTIFICATE + value: /etc/ssl/docker/tls.crt + - name: REGISTRY_HTTP_TLS_KEY + value: /etc/ssl/docker/tls.key +{{- end }} +{{- if eq .Values.storage "filesystem" }} + - name: REGISTRY_STORAGE_FILESYSTEM_ROOTDIRECTORY + value: "/var/lib/registry" +{{- else if eq .Values.storage "azure" }} + - name: REGISTRY_STORAGE_AZURE_ACCOUNTNAME + valueFrom: + secretKeyRef: + name: {{ template "docker-registry.fullname" . }}-secret + key: azureAccountName + - name: REGISTRY_STORAGE_AZURE_ACCOUNTKEY + valueFrom: + secretKeyRef: + name: {{ template "docker-registry.fullname" . }}-secret + key: azureAccountKey + - name: REGISTRY_STORAGE_AZURE_CONTAINER + valueFrom: + secretKeyRef: + name: {{ template "docker-registry.fullname" . }}-secret + key: azureContainer +{{- else if eq .Values.storage "s3" }} + {{- if or (and .Values.secrets.s3.secretKey .Values.secrets.s3.accessKey) .Values.secrets.s3.secretRef }} + - name: REGISTRY_STORAGE_S3_ACCESSKEY + valueFrom: + secretKeyRef: + name: {{ if .Values.secrets.s3.secretRef }}{{ .Values.secrets.s3.secretRef }}{{ else }}{{ template "docker-registry.fullname" . }}-secret{{ end }} + key: s3AccessKey + - name: REGISTRY_STORAGE_S3_SECRETKEY + valueFrom: + secretKeyRef: + name: {{ if .Values.secrets.s3.secretRef }}{{ .Values.secrets.s3.secretRef }}{{ else }}{{ template "docker-registry.fullname" . }}-secret{{ end }} + key: s3SecretKey + {{- end }} + - name: REGISTRY_STORAGE_S3_REGION + value: {{ required ".Values.s3.region is required" .Values.s3.region }} + {{- if .Values.s3.regionEndpoint }} + - name: REGISTRY_STORAGE_S3_REGIONENDPOINT + value: {{ .Values.s3.regionEndpoint }} + {{- end }} + - name: REGISTRY_STORAGE_S3_BUCKET + value: {{ required ".Values.s3.bucket is required" .Values.s3.bucket }} + {{- if .Values.s3.rootdirectory }} + - name: REGISTRY_STORAGE_S3_ROOTDIRECTORY + value: {{ .Values.s3.rootdirectory | quote }} + {{- end }} + {{- if .Values.s3.encrypt }} + - name: REGISTRY_STORAGE_S3_ENCRYPT + value: {{ .Values.s3.encrypt | quote }} + {{- end }} + {{- if .Values.s3.secure }} + - name: REGISTRY_STORAGE_S3_SECURE + value: {{ .Values.s3.secure | quote }} + {{- end }} +{{- else if eq .Values.storage "swift" }} + - name: REGISTRY_STORAGE_SWIFT_AUTHURL + value: {{ required ".Values.swift.authurl is required" .Values.swift.authurl }} + - name: REGISTRY_STORAGE_SWIFT_USERNAME + valueFrom: + secretKeyRef: + name: {{ template "docker-registry.fullname" . }}-secret + key: swiftUsername + - name: REGISTRY_STORAGE_SWIFT_PASSWORD + valueFrom: + secretKeyRef: + name: {{ template "docker-registry.fullname" . }}-secret + key: swiftPassword + - name: REGISTRY_STORAGE_SWIFT_CONTAINER + value: {{ required ".Values.swift.container is required" .Values.swift.container }} +{{- end }} +{{- if .Values.proxy.enabled }} + - name: REGISTRY_PROXY_REMOTEURL + value: {{ required ".Values.proxy.remoteurl is required" .Values.proxy.remoteurl }} + - name: REGISTRY_PROXY_USERNAME + valueFrom: + secretKeyRef: + name: {{ if .Values.proxy.secretRef }}{{ .Values.proxy.secretRef }}{{ else }}{{ template "docker-registry.fullname" . }}-secret{{ end }} + key: proxyUsername + - name: REGISTRY_PROXY_PASSWORD + valueFrom: + secretKeyRef: + name: {{ if .Values.proxy.secretRef }}{{ .Values.proxy.secretRef }}{{ else }}{{ template "docker-registry.fullname" . }}-secret{{ end }} + key: proxyPassword +{{- end }} +{{- if .Values.persistence.deleteEnabled }} + - name: REGISTRY_STORAGE_DELETE_ENABLED + value: "true" +{{- end }} +{{- with .Values.extraEnvVars }} + {{- toYaml . | nindent 12 }} +{{- end }} + volumeMounts: +{{- if .Values.secrets.htpasswd }} + - name: auth + mountPath: /auth + readOnly: true +{{- end }} +{{- if eq .Values.storage "filesystem" }} + - name: data + mountPath: /var/lib/registry/ +{{- end }} + - name: "{{ template "docker-registry.fullname" . }}-config" + mountPath: "/etc/docker/registry" +{{- if .Values.tlsSecretName }} + - mountPath: /etc/ssl/docker + name: tls-cert + readOnly: true +{{- end }} +{{- with .Values.extraVolumeMounts }} + {{- toYaml . | nindent 12 }} +{{- end }} +{{- if .Values.nodeSelector }} + nodeSelector: +{{ toYaml .Values.nodeSelector | indent 8 }} +{{- end }} +{{- if .Values.affinity }} + affinity: +{{ toYaml .Values.affinity | indent 8 }} +{{- end }} +{{- if .Values.tolerations }} + tolerations: +{{ toYaml .Values.tolerations | indent 8 }} +{{- end }} + volumes: +{{- if .Values.secrets.htpasswd }} + - name: auth + secret: + secretName: {{ template "docker-registry.fullname" . }}-secret + items: + - key: htpasswd + path: htpasswd +{{- end }} +{{- if eq .Values.storage "filesystem" }} + - name: data + {{- if .Values.persistence.enabled }} + persistentVolumeClaim: + claimName: {{ if .Values.persistence.existingClaim }}{{ .Values.persistence.existingClaim }}{{- else }}{{ template "docker-registry.fullname" . }}{{- end }} + {{- else }} + emptyDir: {} + {{- end -}} +{{- end }} + - name: {{ template "docker-registry.fullname" . }}-config + configMap: + name: {{ template "docker-registry.fullname" . }}-config +{{- if .Values.tlsSecretName }} + - name: tls-cert + secret: + secretName: {{ .Values.tlsSecretName }} +{{- end }} +{{- with .Values.extraVolumes }} + {{- toYaml . | nindent 8 }} +{{- end }} diff --git a/values.yaml b/values.yaml index b1d28cd..8285f67 100644 --- a/values.yaml +++ b/values.yaml @@ -80,7 +80,6 @@ secrets: azure: {} s3: {} swift: {} - # Secrets for Azure # azure: # accountName: "" From 76ff283a25985d13718a61784e0aea63a5ce5b82 Mon Sep 17 00:00:00 2001 From: ddelange <14880945+ddelange@users.noreply.github.com> Date: Mon, 8 Aug 2022 10:57:43 +0200 Subject: [PATCH 7/8] PR Suggestions --- templates/cronjob.yaml | 20 ++++++++++++++++++++ values.yaml | 5 ----- 2 files changed, 20 insertions(+), 5 deletions(-) diff --git a/templates/cronjob.yaml b/templates/cronjob.yaml index f784469..23a4485 100644 --- a/templates/cronjob.yaml +++ b/templates/cronjob.yaml @@ -3,6 +3,7 @@ apiVersion: batch/v1 kind: CronJob metadata: name: {{ template "docker-registry.fullname" . }}-garbage-collector + namespace: {{ .Values.namespace | default .Release.Namespace }} labels: app: {{ template "docker-registry.name" . }} chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }} @@ -11,12 +12,31 @@ metadata: spec: schedule: {{ .Values.garbageCollect.schedule | quote }} jobTemplate: + metadata: + labels: + app: {{ template "docker-registry.name" . }} + release: {{ .Release.Name }} + {{- with .Values.podLabels }} + {{ toYaml . | nindent 8 }} + {{- end }} + annotations: + checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }} + checksum/secret: {{ include (print $.Template.BasePath "/secret.yaml") . | sha256sum }} +{{- if $.Values.podAnnotations }} +{{ toYaml $.Values.podAnnotations | indent 8 }} +{{- end }} spec: template: spec: + {{- if or (eq .Values.serviceAccount.create true) (ne .Values.serviceAccount.name "") }} + serviceAccountName: {{ .Values.serviceAccount.name | default (include "docker-registry.fullname" .) }} + {{- end }} {{- if .Values.imagePullSecrets }} imagePullSecrets: {{ toYaml .Values.imagePullSecrets | nindent 12 }} {{- end }} + {{- if .Values.priorityClassName }} + priorityClassName: "{{ .Values.priorityClassName }}" + {{- end }} {{- if .Values.securityContext.enabled }} securityContext: fsGroup: {{ .Values.securityContext.fsGroup }} diff --git a/values.yaml b/values.yaml index 8285f67..cbf0ec8 100644 --- a/values.yaml +++ b/values.yaml @@ -77,9 +77,6 @@ storage: filesystem secrets: haSharedSecret: "" htpasswd: "" - azure: {} - s3: {} - swift: {} # Secrets for Azure # azure: # accountName: "" @@ -96,7 +93,6 @@ secrets: # username: "" # password: "" -s3: {} # Options for s3 storage type: # s3: # region: us-east-1 @@ -106,7 +102,6 @@ s3: {} # encrypt: false # secure: true -swift: {} # Options for swift storage type: # swift: # authurl: http://swift.example.com/ From 25bf25dda10348f46c4b636b7d1d4da72ba325cf Mon Sep 17 00:00:00 2001 From: Devin Canterberry Date: Tue, 9 Aug 2022 10:09:14 -0700 Subject: [PATCH 8/8] =?UTF-8?q?=F0=9F=94=A5=20Remove=20default=20value=20f?= =?UTF-8?q?or=20persistence.deleteEnabled?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The default value is documented in the README as `nil`, and where referenced, a falsey value is adequate. Co-authored-by: ddelange <14880945+ddelange@users.noreply.github.com> --- values.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/values.yaml b/values.yaml index cbf0ec8..93f247c 100644 --- a/values.yaml +++ b/values.yaml @@ -67,7 +67,6 @@ persistence: enabled: false size: 10Gi # storageClass: '-' - deleteEnabled: false # set the type of filesystem to use: filesystem, s3 storage: filesystem