Add optional in-cluster registry proxy to ace-installer chart

Add an optional CNCF Distribution (registry:3) pull-through cache to the
ace-installer chart, gated behind regproxy.enabled (default false). When
enabled it proxies the upstream registry (ghcr.io by default) so that
ghcr.io/appscode-charts images can be served from within the cluster.

Also add an appscode-wizards-oci HelmRepository, used by the platform UI
deploy wizards. It defaults to the same upstream as appscode-charts-oci
(oci://ghcr.io/appscode-charts). When regproxy.enabled is true, its URL is
rewritten to the in-cluster proxy service so wizard chart pulls are served
from the cache. The proxy serves plain HTTP, so the repository is marked
insecure in that case.

The cache image is ghcr.io/appscode-images/registry:3.

Document that charts/ace-installer-certified and ace-installer-certified-crds
are generated from charts/ace-installer via chart-packer and must not be
edited directly.

Signed-off-by: Tamal Saha <tamal@appscode.com>

Author: tamalsaha

AGENTS.md

@@ -44,5 +44,12 @@ Helpers (invoked outside Make):
 - License: `LICENSE.md`. Sign off commits (`git commit -s`).
 - Vendor directory is checked in; keep `go mod tidy && go mod vendor` clean.
 - CRDs for charts are imported via `import-crds.sh`; don't hand-author `charts/*/crds/*.yaml`.
-- `-certified` charts mirror the standard charts for Red Hat certification — bumps must apply to both.
+- `-certified` charts mirror the standard charts for Red Hat certification. `charts/ace-installer-certified` and `charts/ace-installer-certified-crds` are **generated** — do not edit them directly. After changing `charts/ace-installer`, regenerate them with:
+
+  ```sh
+  rm -rf charts/ace-installer-certified charts/ace-installer-certified-crds
+  chart-packer crd-less --input charts/ace-installer --output charts
+  chart-packer crd-only --input charts/ace-installer --output charts
+  make gen-chart-doc
+  ```
 - Adding a new chart: create `charts/<name>/`, add a values-schema Go type under `apis/installer/v1alpha1/`, list images in `imagelist.yaml`, then run `make gen`.

apis/installer/v1alpha1/ace_installer_types.go

@@ -58,10 +58,59 @@ type AceInstallerSpec struct {
 	SelfManagement          configapi.SelfManagement `json:"selfManagement"`
 	Precheck                AceInstallerPrecheckSpec `json:"precheck"`
 	Tester                  AceInstallerPodSpec      `json:"tester"`
+	// Regproxy configures an optional in-cluster pull-through Docker registry
+	// cache (CNCF Distribution / registry:3). When enabled, it transparently
+	// proxies images from the upstream registry (ghcr.io by default), so that
+	// ghcr.io/appscode-charts images can be served from within the cluster.
+	Regproxy Regproxy `json:"regproxy"`
 	// +optional
 	Options string `json:"options"`
 }
 
+// Regproxy is an optional in-cluster pull-through Docker registry cache
+// (CNCF Distribution / registry:3).
+type Regproxy struct {
+	Enabled      bool           `json:"enabled"`
+	ReplicaCount int            `json:"replicaCount"`
+	Image        ImageReference `json:"image"`
+	// RemoteURL is the upstream registry that this instance proxies as a
+	// pull-through cache.
+	RemoteURL string `json:"remoteURL"`
+	// Username is an optional credential for authenticating against the
+	// upstream registry. Leave empty for anonymous pulls.
+	//+optional
+	Username string `json:"username"`
+	// Password is an optional credential for authenticating against the
+	// upstream registry. Leave empty for anonymous pulls.
+	//+optional
+	Password string `json:"password"`
+	//+optional
+	PodAnnotations map[string]string `json:"podAnnotations"`
+	//+optional
+	PodSecurityContext *core.PodSecurityContext `json:"podSecurityContext"`
+	//+optional
+	SecurityContext *core.SecurityContext `json:"securityContext"`
+	Service         AceServiceSpec        `json:"service"`
+	Persistence     RegproxyPersistence   `json:"persistence"`
+	//+optional
+	Resources core.ResourceRequirements `json:"resources"`
+	//+optional
+	NodeSelector map[string]string `json:"nodeSelector"`
+	// If specified, the pod's tolerations.
+	//+optional
+	Tolerations []core.Toleration `json:"tolerations"`
+	// If specified, the pod's scheduling constraints
+	//+optional
+	Affinity *core.Affinity `json:"affinity"`
+}
+
+type RegproxyPersistence struct {
+	Enabled      bool   `json:"enabled"`
+	StorageClass string `json:"storageClass"`
+	AccessMode   string `json:"accessMode"`
+	Size         string `json:"size"`
+}
+
 type AceInstallerPrecheckSpec struct {
 	Enabled             bool `json:"enabled"`
 	AceInstallerPodSpec `json:",inline"`

apis/installer/v1alpha1/zz_generated.deepcopy.go

@@ -1,5 +1,6 @@
 - alpine:3.20
 - bats/bats:1.11.0
+- ghcr.io/appscode-images/registry:3
 - ghcr.io/appscode/ace:v0.2.0
 - ghcr.io/appscode/acerproxy:v0.2.0
 - ghcr.io/appscode/aceshifter:v0.0.3