Add in-cluster registry proxy to ace-installer chart

Add a CNCF Distribution (registry:3) pull-through cache to the ace-installer
chart via regproxy.enabled (default true). It proxies the upstream registry
(ghcr.io by default) so ghcr.io/appscode-charts images are served from within
the cluster.

Also add an appscode-wizards-oci HelmRepository, used by the platform UI
deploy wizards. It defaults to the same upstream as appscode-charts-oci
(oci://ghcr.io/appscode-charts). When regproxy is enabled, its URL is
rewritten to the in-cluster proxy service so wizard chart pulls are served
from the cache. The proxy serves plain HTTP, so the repository is marked
insecure in that case.

The cache image is ghcr.io/appscode-images/registry:3.

Cache disk management:
- regproxy.ttl (default 72h) bounds disk usage; the pull-through cache purges
  entries older than the ttl and has no capacity-based eviction.
- The cache PVC storage class falls back to the ACE data/backup storage class
  (helm.releases.ace.values.global.infra.storageClass.name) when no explicit
  regproxy.persistence.storageClass is set, then to the cluster default.

Document that charts/ace-installer-certified and ace-installer-certified-crds
are generated from charts/ace-installer via chart-packer and must not be
edited directly.

Signed-off-by: Tamal Saha <tamal@appscode.com>

Author: tamalsaha

AGENTS.md

@@ -44,5 +44,12 @@ Helpers (invoked outside Make):
 - License: `LICENSE.md`. Sign off commits (`git commit -s`).
 - Vendor directory is checked in; keep `go mod tidy && go mod vendor` clean.
 - CRDs for charts are imported via `import-crds.sh`; don't hand-author `charts/*/crds/*.yaml`.
-- `-certified` charts mirror the standard charts for Red Hat certification — bumps must apply to both.
+- `-certified` charts mirror the standard charts for Red Hat certification. `charts/ace-installer-certified` and `charts/ace-installer-certified-crds` are **generated** — do not edit them directly. After changing `charts/ace-installer`, regenerate them with:
+
+  ```sh
+  rm -rf charts/ace-installer-certified charts/ace-installer-certified-crds
+  chart-packer crd-less --input charts/ace-installer --output charts
+  chart-packer crd-only --input charts/ace-installer --output charts
+  make gen-chart-doc
+  ```
 - Adding a new chart: create `charts/<name>/`, add a values-schema Go type under `apis/installer/v1alpha1/`, list images in `imagelist.yaml`, then run `make gen`.

apis/installer/v1alpha1/ace_installer_types.go

@@ -58,10 +58,65 @@ type AceInstallerSpec struct {
 	SelfManagement          configapi.SelfManagement `json:"selfManagement"`
 	Precheck                AceInstallerPrecheckSpec `json:"precheck"`
 	Tester                  AceInstallerPodSpec      `json:"tester"`
+	// Regproxy configures an optional in-cluster pull-through Docker registry
+	// cache (CNCF Distribution / registry:3). When enabled, it transparently
+	// proxies images from the upstream registry (ghcr.io by default), so that
+	// ghcr.io/appscode-charts images can be served from within the cluster.
+	Regproxy Regproxy `json:"regproxy"`
 	// +optional
 	Options string `json:"options"`
 }
 
+// Regproxy is an optional in-cluster pull-through Docker registry cache
+// (CNCF Distribution / registry:3).
+type Regproxy struct {
+	Enabled      bool           `json:"enabled"`
+	ReplicaCount int            `json:"replicaCount"`
+	Image        ImageReference `json:"image"`
+	// RemoteURL is the upstream registry that this instance proxies as a
+	// pull-through cache.
+	RemoteURL string `json:"remoteURL"`
+	// TTL is how long a cached blob/manifest is kept before the pull-through
+	// cache scheduler purges it. This is the only mechanism that frees disk:
+	// the cache has no capacity-based (LRU) eviction, so lower values bound
+	// disk usage at the cost of re-fetching from upstream more often.
+	//+optional
+	TTL string `json:"ttl"`
+	// Username is an optional credential for authenticating against the
+	// upstream registry. Leave empty for anonymous pulls.
+	//+optional
+	Username string `json:"username"`
+	// Password is an optional credential for authenticating against the
+	// upstream registry. Leave empty for anonymous pulls.
+	//+optional
+	Password string `json:"password"`
+	//+optional
+	PodAnnotations map[string]string `json:"podAnnotations"`
+	//+optional
+	PodSecurityContext *core.PodSecurityContext `json:"podSecurityContext"`
+	//+optional
+	SecurityContext *core.SecurityContext `json:"securityContext"`
+	Service         AceServiceSpec        `json:"service"`
+	Persistence     RegproxyPersistence   `json:"persistence"`
+	//+optional
+	Resources core.ResourceRequirements `json:"resources"`
+	//+optional
+	NodeSelector map[string]string `json:"nodeSelector"`
+	// If specified, the pod's tolerations.
+	//+optional
+	Tolerations []core.Toleration `json:"tolerations"`
+	// If specified, the pod's scheduling constraints
+	//+optional
+	Affinity *core.Affinity `json:"affinity"`
+}
+
+type RegproxyPersistence struct {
+	Enabled      bool   `json:"enabled"`
+	StorageClass string `json:"storageClass"`
+	AccessMode   string `json:"accessMode"`
+	Size         string `json:"size"`
+}
+
 type AceInstallerPrecheckSpec struct {
 	Enabled             bool `json:"enabled"`
 	AceInstallerPodSpec `json:",inline"`

apis/installer/v1alpha1/zz_generated.deepcopy.go

@@ -1,5 +1,6 @@
 - alpine:3.20
 - bats/bats:1.11.0
+- ghcr.io/appscode-images/registry:3
 - ghcr.io/appscode/ace:v0.2.0
 - ghcr.io/appscode/acerproxy:v0.2.0
 - ghcr.io/appscode/aceshifter:v0.0.3