Skip to content

Commit 41026b3

Browse files
tamalsahatamalsaha
committed
Add optional in-cluster registry proxy for ghcr.io to ace chart
Add an optional CNCF Distribution (registry:2) pull-through cache to the ace chart, gated behind regproxy.enabled (default false). When enabled it proxies the upstream registry (ghcr.io by default) so that ghcr.io/appscode-charts images can be served from within the cluster. Routing node/client pulls to the cache (e.g. via containerd registry mirror configuration) is left to the cluster operator. Signed-off-by: Tamal Saha <tamal@appscode.com>
1 parent 802ccc5 commit 41026b3

12 files changed

Lines changed: 1107 additions & 3 deletions

File tree

‎apis/installer/v1alpha1/ace_ace_types.go‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -70,6 +70,7 @@ type AceSpec struct {
7070
OutboxSyncer AceOutboxSyncer `json:"outbox-syncer"`
7171
PostgresAlerts AcePostgresAlerts `json:"postgres-alerts"`
7272
RedisAlerts AceRedisAlerts `json:"redis-alerts"`
73+
Regproxy AceRegproxy `json:"regproxy"`
7374
// KubeBindServer AceKubeBindServer `json:"kube-bind-server"`
7475
Global AceGlobalValues `json:"global"`
7576
Settings Settings `json:"settings"`
@@ -197,6 +198,52 @@ type AceRedisAlerts struct {
197198
Form AceAlertForm `json:"form,omitempty"`
198199
}
199200

201+
// AceRegproxy configures an optional in-cluster pull-through Docker registry
202+
// cache (CNCF Distribution / registry:2). When enabled, it transparently
203+
// proxies images from the upstream registry (ghcr.io by default), so that
204+
// ghcr.io/appscode-charts images can be served from within the cluster.
205+
type AceRegproxy struct {
206+
Enabled bool `json:"enabled"`
207+
ReplicaCount int `json:"replicaCount"`
208+
Image ImageReference `json:"image"`
209+
// RemoteURL is the upstream registry that this instance proxies as a
210+
// pull-through cache.
211+
RemoteURL string `json:"remoteURL"`
212+
// Username is an optional credential for authenticating against the
213+
// upstream registry. Leave empty for anonymous pulls.
214+
//+optional
215+
Username string `json:"username"`
216+
// Password is an optional credential for authenticating against the
217+
// upstream registry. Leave empty for anonymous pulls.
218+
//+optional
219+
Password string `json:"password"`
220+
//+optional
221+
PodAnnotations map[string]string `json:"podAnnotations"`
222+
//+optional
223+
PodSecurityContext *core.PodSecurityContext `json:"podSecurityContext"`
224+
//+optional
225+
SecurityContext *core.SecurityContext `json:"securityContext"`
226+
Service AceServiceSpec `json:"service"`
227+
Persistence RegproxyPersistence `json:"persistence"`
228+
//+optional
229+
Resources core.ResourceRequirements `json:"resources"`
230+
//+optional
231+
NodeSelector map[string]string `json:"nodeSelector"`
232+
// If specified, the pod's tolerations.
233+
//+optional
234+
Tolerations []core.Toleration `json:"tolerations"`
235+
// If specified, the pod's scheduling constraints
236+
//+optional
237+
Affinity *core.Affinity `json:"affinity"`
238+
}
239+
240+
type RegproxyPersistence struct {
241+
Enabled bool `json:"enabled"`
242+
StorageClass string `json:"storageClass"`
243+
AccessMode string `json:"accessMode"`
244+
Size string `json:"size"`
245+
}
246+
200247
type AceGlobalValues struct {
201248
NameOverride string `json:"nameOverride"`
202249
FullnameOverride string `json:"fullnameOverride"`

‎apis/installer/v1alpha1/zz_generated.deepcopy.go‎

Lines changed: 72 additions & 3 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎catalog/imagelist.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@
2727
- ghcr.io/appscode/offline-license-server:v0.0.76
2828
- ghcr.io/appscode/outboxsyncer:v0.4.0
2929
- ghcr.io/appscode/platform-ui:2.4.0
30+
- ghcr.io/appscode/registry:2.8.3
3031
- ghcr.io/appscode/s3proxy:sha-a82ca68
3132
- ghcr.io/appscode/service-provider:v0.0.2
3233
- ghcr.io/appscode/smtprelay:v0.0.4

‎charts/ace/README.md‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -75,6 +75,28 @@ The following table lists the configurable parameters of the `ace` chart and the
7575
| redis-alerts.enabled | | <code>true</code> |
7676
| redis-alerts.form.alert.appSuffix | | <code>"-cache"</code> |
7777
| redis-alerts.form.alert.groups.stash.enabled | | <code>""</code> |
78+
| regproxy.enabled | | <code>false</code> |
79+
| regproxy.replicaCount | | <code>1</code> |
80+
| regproxy.image.registry | Docker registry used to pull the registry image | <code>appscode</code> |
81+
| regproxy.image.repository | registry container image | <code>registry</code> |
82+
| regproxy.image.tag | Overrides the image tag | <code>"2.8.3"</code> |
83+
| regproxy.image.pullPolicy | | <code>IfNotPresent</code> |
84+
| regproxy.remoteURL | Upstream registry URL that this instance proxies as a pull-through cache. | <code>https://ghcr.io</code> |
85+
| regproxy.username | Optional credentials for authenticating against the upstream registry. Leave empty for anonymous pulls (ghcr.io/appscode-charts is public). | <code>""</code> |
86+
| regproxy.password | | <code>""</code> |
87+
| regproxy.podAnnotations | | <code>{}</code> |
88+
| regproxy.podSecurityContext | | <code>{"fsGroup":65534}</code> |
89+
| regproxy.securityContext | | <code>{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"readOnlyRootFilesystem":true,"runAsNonRoot":true,"runAsUser":65534,"seccompProfile":{"type":"RuntimeDefault"}}</code> |
90+
| regproxy.service.type | | <code>ClusterIP</code> |
91+
| regproxy.service.port | | <code>5000</code> |
92+
| regproxy.persistence.enabled | | <code>true</code> |
93+
| regproxy.persistence.storageClass | | <code>""</code> |
94+
| regproxy.persistence.accessMode | | <code>ReadWriteOnce</code> |
95+
| regproxy.persistence.size | | <code>10Gi</code> |
96+
| regproxy.resources | | <code>{}</code> |
97+
| regproxy.nodeSelector | | <code>{}</code> |
98+
| regproxy.tolerations | | <code>[]</code> |
99+
| regproxy.affinity | | <code>{}</code> |
78100
| global.nameOverride | | <code>"ace"</code> |
79101
| global.fullnameOverride | | <code>""</code> |
80102
| global.platform.host | | <code>appscode.ninja</code> |

0 commit comments

Comments
 (0)