Add regcache chart and use it as an ace-installer subchart

Add a standalone regcache Helm chart (charts/regcache) that deploys a CNCF
Distribution (registry:3) pull-through cache, and consume it from ace-installer
as a subchart (file://../regcache, condition regcache.enabled, default true). It
proxies the upstream registry (ghcr.io by default) so ghcr.io/appscode-charts
images are served from within the cluster. Cache image is
ghcr.io/appscode-images/registry:3.1.1.

The regcache chart is global-aware (modeled on charts/billing): it resolves its
image registry from registryFQDN, OpenShift via Capabilities, and the PVC
storage class from persistence.storageClass, else infra.storageClass.name, else
the parent's global.infra.storageClass.name, else the cluster default. Its
helpers are prefixed (regcache.*) to avoid Helm's global template-name
collisions with the parent chart.

ace-installer keeps an appscode-wizards-oci HelmRepository used by the platform
UI deploy wizards. When regcache is enabled, its URL is rewritten to the
in-cluster proxy Service so wizard chart pulls are served from the cache; the
proxy serves plain HTTP, so the repository is marked insecure. The
regcache.serviceAddress helper mirrors the subchart's fullname so the rewritten
URL always matches the Service name.

charts/ace-installer-certified and ace-installer-certified-crds are regenerated
from charts/ace-installer via chart-packer and depend on ../regcache.
update-chart-dependencies.sh now builds the ace-installer dependencies, and the
bundled charts/ dirs are gitignored while Chart.lock is tracked.

Signed-off-by: Tamal Saha <tamal@appscode.com>

Author: tamalsaha

.gitignore

@@ -38,6 +38,8 @@ _testmain.go
 
 /charts/acaas/charts
 /charts/ace/charts
+/charts/ace-installer/charts
+/charts/ace-installer-certified/charts
 /charts/opscenter-features/charts
 /charts/platform-opscenter/charts
 /charts/service-gateway/charts

AGENTS.md

@@ -44,5 +44,12 @@ Helpers (invoked outside Make):
 - License: `LICENSE.md`. Sign off commits (`git commit -s`).
 - Vendor directory is checked in; keep `go mod tidy && go mod vendor` clean.
 - CRDs for charts are imported via `import-crds.sh`; don't hand-author `charts/*/crds/*.yaml`.
-- `-certified` charts mirror the standard charts for Red Hat certification — bumps must apply to both.
+- `-certified` charts mirror the standard charts for Red Hat certification. `charts/ace-installer-certified` and `charts/ace-installer-certified-crds` are **generated** — do not edit them directly. After changing `charts/ace-installer`, regenerate them with:
+
+  ```sh
+  rm -rf charts/ace-installer-certified charts/ace-installer-certified-crds
+  chart-packer crd-less --input charts/ace-installer --output charts
+  chart-packer crd-only --input charts/ace-installer --output charts
+  make gen-chart-doc
+  ```
 - Adding a new chart: create `charts/<name>/`, add a values-schema Go type under `apis/installer/v1alpha1/`, list images in `imagelist.yaml`, then run `make gen`.

apis/installer/v1alpha1/ace_installer_types.go

@@ -58,6 +58,12 @@ type AceInstallerSpec struct {
 	SelfManagement          configapi.SelfManagement `json:"selfManagement"`
 	Precheck                AceInstallerPrecheckSpec `json:"precheck"`
 	Tester                  AceInstallerPodSpec      `json:"tester"`
+	// Regcache configures the in-cluster pull-through Docker registry cache
+	// (CNCF Distribution / registry:3) deployed via the regcache subchart. When
+	// enabled, it transparently proxies images from the upstream registry
+	// (ghcr.io by default), so that ghcr.io/appscode-charts images can be served
+	// from within the cluster.
+	Regcache RegcacheSpec `json:"regcache"`
 	// +optional
 	Options string `json:"options"`
 }

apis/installer/v1alpha1/regcache_types.go

@@ -0,0 +1,122 @@
+/*
+Copyright AppsCode Inc. and Contributors
+
+Licensed under the AppsCode Community License 1.0.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    https://github.com/appscode/licenses/raw/1.0.0/AppsCode-Community-1.0.0.md
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1alpha1
+
+import (
+	core "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"kmodules.xyz/resource-metadata/apis/shared"
+)
+
+const (
+	ResourceKindRegcache = "Regcache"
+	ResourceRegcache     = "regcache"
+	ResourceRegcaches    = "regcaches"
+)
+
+// Regcache defines the schema for the regcache chart values.
+
+// +genclient
+// +genclient:skipVerbs=updateStatus
+// +k8s:openapi-gen=true
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// +kubebuilder:object:root=true
+// +kubebuilder:resource:path=regcaches,singular=regcache,categories={kubeops,appscode}
+type Regcache struct {
+	metav1.TypeMeta   `json:",inline,omitempty"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+	Spec              RegcacheSpec `json:"spec,omitempty"`
+}
+
+// RegcacheSpec is the schema for the regcache chart values. It deploys an
+// in-cluster pull-through Docker registry cache (CNCF Distribution / registry:3)
+// that transparently proxies images from an upstream registry (ghcr.io by
+// default), so that ghcr.io/appscode-charts images can be served from within
+// the cluster.
+type RegcacheSpec struct {
+	Enabled      bool `json:"enabled"`
+	ReplicaCount int  `json:"replicaCount"`
+	//+optional
+	NameOverride string `json:"nameOverride"`
+	//+optional
+	FullnameOverride string `json:"fullnameOverride"`
+	// RegistryFQDN is the docker registry fqdn used to pull the registry image.
+	RegistryFQDN string         `json:"registryFQDN"`
+	Image        ImageReference `json:"image"`
+	//+optional
+	ImagePullSecrets []string `json:"imagePullSecrets"`
+	// RemoteURL is the upstream registry that this instance proxies as a
+	// pull-through cache.
+	RemoteURL string `json:"remoteURL"`
+	// TTL is how long a cached blob/manifest is kept before the pull-through
+	// cache scheduler purges it. This is the only mechanism that frees disk:
+	// the cache has no capacity-based (LRU) eviction, so lower values bound
+	// disk usage at the cost of re-fetching from upstream more often.
+	//+optional
+	TTL string `json:"ttl"`
+	// Username is an optional credential for authenticating against the
+	// upstream registry. Leave empty for anonymous pulls.
+	//+optional
+	Username string `json:"username"`
+	// Password is an optional credential for authenticating against the
+	// upstream registry. Leave empty for anonymous pulls.
+	//+optional
+	Password string `json:"password"`
+	//+optional
+	PodAnnotations map[string]string `json:"podAnnotations"`
+	//+optional
+	PodSecurityContext *core.PodSecurityContext `json:"podSecurityContext"`
+	//+optional
+	SecurityContext *core.SecurityContext `json:"securityContext"`
+	Service         AceServiceSpec        `json:"service"`
+	Persistence     RegcachePersistence   `json:"persistence"`
+	//+optional
+	Resources core.ResourceRequirements `json:"resources"`
+	//+optional
+	NodeSelector map[string]string `json:"nodeSelector"`
+	// If specified, the pod's tolerations.
+	//+optional
+	Tolerations []core.Toleration `json:"tolerations"`
+	// If specified, the pod's scheduling constraints
+	//+optional
+	Affinity *core.Affinity `json:"affinity"`
+	Infra    RegcacheInfra  `json:"infra"`
+	//+optional
+	Distro shared.DistroSpec `json:"distro"`
+}
+
+type RegcacheInfra struct {
+	StorageClass LocalObjectReference `json:"storageClass"`
+}
+
+type RegcachePersistence struct {
+	Enabled      bool   `json:"enabled"`
+	StorageClass string `json:"storageClass"`
+	AccessMode   string `json:"accessMode"`
+	Size         string `json:"size"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// RegcacheList is a list of Regcaches
+type RegcacheList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+	// Items is a list of Regcache CRD objects
+	Items []Regcache `json:"items,omitempty"`
+}

apis/installer/v1alpha1/register.go

@@ -130,6 +130,8 @@ func addKnownTypes(scheme *runtime.Scheme) error {
 		&NatsList{},
 		&Openfga{},
 		&OpenfgaList{},
+		&Regcache{},
+		&RegcacheList{},
 		&Reloader{},
 		&ReloaderList{},
 		&S3proxy{},