Skip to content

Commit 2dc3fca

Browse files
GridnessGridness
committed
Added existingSecret functionality to the chart
- Added new pre-defined names to helpers to introduce new secrets to deployment to separate concerns - Implemented the ability to specify existing secret field keys if not default - Added conditions to checksum annotations in deployment and cronjob if existing secret is used instead of default one - Bumped chart version to 3.1.0 - Updated README to reflect values structure changes
1 parent ab431e8 commit 2dc3fca

File tree

7 files changed

+125
-17
lines changed

7 files changed

+125
-17
lines changed

‎Chart.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
apiVersion: v1
22
description: A Helm chart for Docker Registry
33
name: docker-registry
4-
version: 3.0.0
4+
version: 3.1.0
55
appVersion: 3.0.0
66
home: https://hub.docker.com/_/registry/
77
icon: https://helm.twun.io/docker-registry.png

‎README.md‎

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -71,10 +71,24 @@ their default values.
7171
| `priorityClassName ` | priorityClassName | `""` |
7272
| `storage` | Storage system to use | `filesystem` |
7373
| `tlsSecretName` | Name of secret for TLS certs | `nil` |
74+
| `secrets.existingSecret` | Name of an existing secret | `""` |
75+
| `secrets.haSharedSecretKey` | Name of the haSharedSecretKey in existing secret | `""` |
76+
| `secrets.htpasswdKey` | Name of the htpasswdKey in existing secret | `""` |
77+
| `secrets.haSharedSecretKey` | HA Shared Secret | `nil` |
7478
| `secrets.htpasswd` | Htpasswd authentication | `nil` |
79+
| `secrets.azure.secretRef` | The ref for an existing secret containing azure credentials | `""` |
80+
| `secrets.azure.accountNameKey` | Azure account name key defined in azure secret (if not default) | `""` |
81+
| `secrets.azure.accountKeyKey` | Azure account key key defined in azure secret (if not default) | `""` |
82+
| `secrets.azure.containerKey` | Azure container key defined in azure secret (if not default) | `""` |
83+
| `secrets.azure.accountName` | Azure account name | `""` |
84+
| `secrets.azure.accountKey` | Azure account key | `""` |
85+
| `secrets.azure.container` | Azure container | `""` |
7586
| `secrets.s3.accessKey` | Access Key for S3 configuration | `nil` |
7687
| `secrets.s3.secretKey` | Secret Key for S3 configuration | `nil` |
77-
| `secrets.s3.secretRef` | The ref for an external secret containing the s3AccessKey and s3SecretKey keys | `""` |
88+
| `secrets.s3.secretRef` | The ref for an external secret containing the s3AccessKey and s3SecretKey keys | `""` |
89+
| `secrets.swift.secretRef` | The ref for an existing secret containing swift credentials | `""` |
90+
| `secrets.swift.usernameKey` | Username key name defined in existing swift secret (if not default) | `""` |
91+
| `secrets.swift.passwordKey` | Password key name defined in existing swift secret (if not default) | `""` |
7892
| `secrets.swift.username` | Username for Swift configuration | `nil` |
7993
| `secrets.swift.password` | Password for Swift configuration | `nil` |
8094
| `secrets.haSharedSecret` | Shared secret for Registry | `nil` |
@@ -95,6 +109,8 @@ their default values.
95109
| `proxy.username` | Remote registry login username | `nil` |
96110
| `proxy.password` | Remote registry login password | `nil` |
97111
| `proxy.secretRef` | The ref for an external secret containing the proxyUsername and proxyPassword keys | `""` |
112+
| `proxy.usernameKey` | Username key name defined in proxy secret (if not default) | `""` |
113+
| `proxy.passwordKey` | Password key name defined in proxy secret (if not default) | `""` |
98114
| `namespace` | specify a namespace to install the chart to - defaults to `.Release.Namespace` | `{{ .Release.Namespace }}` |
99115
| `nodeSelector` | node labels for pod assignment | `{}` |
100116
| `affinity` | affinity settings | `{}` |

‎templates/_helpers.tpl‎

Lines changed: 73 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -23,12 +23,41 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this
2323
{{- end -}}
2424
{{- end -}}
2525

26+
{{- define "docker-registry.secretName" -}}
27+
{{- if .Values.secrets.existingSecret }}
28+
{{- .Values.secrets.existingSecret }}
29+
{{- else }}
30+
{{- template "docker-registry.fullname" . }}-secret
31+
{{- end }}
32+
{{- end }}
33+
34+
{{- define "docker-registry.azureSecretName" -}}
35+
{{- if .Values.secrets.azure.existingSecret }}
36+
{{- .Values.secrets.azure.secretRef }}
37+
{{- else }}
38+
{{- template "docker-registry.fullname" . }}-secret
39+
{{- end }}
40+
{{- end }}
41+
42+
{{- define "docker-registry.swiftSecretName" -}}
43+
{{- if .Values.secrets.swift.existingSecret }}
44+
{{- .Values.secrets.swift.secretRef }}
45+
{{- else }}
46+
{{- template "docker-registry.fullname" . }}-secret
47+
{{- end }}
48+
{{- end }}
49+
2650
{{- define "docker-registry.envs" -}}
2751
- name: REGISTRY_HTTP_SECRET
2852
valueFrom:
2953
secretKeyRef:
30-
name: {{ template "docker-registry.fullname" . }}-secret
54+
name: {{ template "docker-registry.secretName" . }}
55+
{{- if and .Values.secrets.haSharedSecretKey .Values.secrets.existingSecret }}
56+
key: {{- .Values.secrets.haSharedSecretKey }}
57+
{{- else }}
3158
key: haSharedSecret
59+
{{- end }}
60+
{{- end }}
3261

3362
{{- if .Values.secrets.htpasswd }}
3463
- name: REGISTRY_AUTH
@@ -53,18 +82,30 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this
5382
- name: REGISTRY_STORAGE_AZURE_ACCOUNTNAME
5483
valueFrom:
5584
secretKeyRef:
56-
name: {{ template "docker-registry.fullname" . }}-secret
85+
name: {{ template "docker-registry.azureSecretName" . }}
86+
{{- if and .Values.secrets.azure.azureAccountNameKey .Values.secrets.azure.existingSecret }}
87+
key: {{- .Values.secrets.azure.accountNameKey }}
88+
{{- else }}
5789
key: azureAccountName
90+
{{- end }}
5891
- name: REGISTRY_STORAGE_AZURE_ACCOUNTKEY
5992
valueFrom:
6093
secretKeyRef:
61-
name: {{ template "docker-registry.fullname" . }}-secret
94+
name: {{ template "docker-registry.azureSecretName" . }}
95+
{{- if and .Values.secrets.azure.azureAccountNameKey .Values.secrets.azure.existingSecret }}
96+
key: {{- .Values.secrets.azure.accountKeyKey }}
97+
{{- else }}
6298
key: azureAccountKey
99+
{{- end }}
63100
- name: REGISTRY_STORAGE_AZURE_CONTAINER
64101
valueFrom:
65102
secretKeyRef:
66-
name: {{ template "docker-registry.fullname" . }}-secret
103+
name: {{ template "docker-registry.azureSecretName" . }}
104+
{{- if and .Values.secrets.azure.containerKey .Values.secrets.azure.existingSecret }}
105+
key: {{- .Values.secrets.azure.containerKey }}
106+
{{- else }}
67107
key: azureContainer
108+
{{- end }}
68109
{{- else if eq .Values.storage "s3" }}
69110
- name: REGISTRY_STORAGE_S3_REGION
70111
value: {{ required ".Values.s3.region is required" .Values.s3.region }}
@@ -74,12 +115,12 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this
74115
- name: REGISTRY_STORAGE_S3_ACCESSKEY
75116
valueFrom:
76117
secretKeyRef:
77-
name: {{ if .Values.secrets.s3.secretRef }}{{ .Values.secrets.s3.secretRef }}{{ else }}{{ template "docker-registry.fullname" . }}-secret{{ end }}
118+
name: {{ if .Values.secrets.s3.secretRef }}{{ .Values.secrets.s3.secretRef }}{{ else }}{{ template "docker-registry.secretName" . }}{{ end }}
78119
key: s3AccessKey
79120
- name: REGISTRY_STORAGE_S3_SECRETKEY
80121
valueFrom:
81122
secretKeyRef:
82-
name: {{ if .Values.secrets.s3.secretRef }}{{ .Values.secrets.s3.secretRef }}{{ else }}{{ template "docker-registry.fullname" . }}-secret{{ end }}
123+
name: {{ if .Values.secrets.s3.secretRef }}{{ .Values.secrets.s3.secretRef }}{{ else }}{{ template "docker-registry.secretName" . }}{{ end }}
83124
key: s3SecretKey
84125
{{- end -}}
85126

@@ -119,13 +160,21 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this
119160
- name: REGISTRY_STORAGE_SWIFT_USERNAME
120161
valueFrom:
121162
secretKeyRef:
122-
name: {{ template "docker-registry.fullname" . }}-secret
163+
name: {{ template "docker-registry.swiftSecretName" . }}
164+
{{- if and .Values.secrets.swift.usernameKey .Values.secrets.swift.secretRef -}}
165+
key: {{- .Values.secrets.swift.usernameKey -}}
166+
{{- else -}}
123167
key: swiftUsername
168+
{{- end -}}
124169
- name: REGISTRY_STORAGE_SWIFT_PASSWORD
125170
valueFrom:
126171
secretKeyRef:
127-
name: {{ template "docker-registry.fullname" . }}-secret
172+
name: {{ template "docker-registry.swiftSecretName" . }}
173+
{{- if and .Values.secrets.swift.passwordKey .Values.secrets.swift.secretRef -}}
174+
key: {{- .Values.secrets.swift.passwordKey -}}
175+
{{- else -}}
128176
key: swiftPassword
177+
{{- end -}}
129178
- name: REGISTRY_STORAGE_SWIFT_CONTAINER
130179
value: {{ required ".Values.swift.container is required" .Values.swift.container }}
131180
{{- end -}}
@@ -136,13 +185,21 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this
136185
- name: REGISTRY_PROXY_USERNAME
137186
valueFrom:
138187
secretKeyRef:
139-
name: {{ if .Values.proxy.secretRef }}{{ .Values.proxy.secretRef }}{{ else }}{{ template "docker-registry.fullname" . }}-secret{{ end }}
188+
name: {{ if .Values.proxy.secretRef }}{{ .Values.proxy.secretRef }}{{ else }}{{ template "docker-registry.secretName" . }}{{ end }}
189+
{{- if and .Values.proxy.proxyUsernameKey .Values.proxy.secretRef -}}
190+
key: {{- .Values.proxy.proxyUsernameKey -}}
191+
{{- else -}}
140192
key: proxyUsername
193+
{{- end -}}
141194
- name: REGISTRY_PROXY_PASSWORD
142195
valueFrom:
143196
secretKeyRef:
144-
name: {{ if .Values.proxy.secretRef }}{{ .Values.proxy.secretRef }}{{ else }}{{ template "docker-registry.fullname" . }}-secret{{ end }}
197+
name: {{ if .Values.proxy.secretRef }}{{ .Values.proxy.secretRef }}{{ else }}{{ template "docker-registry.secretName" . }}{{ end }}
198+
{{- if and .Values.proxy.proxyPasswordKey .Values.proxy.secretRef -}}
199+
key: {{- .Values.proxy.proxyPasswordKey -}}
200+
{{- else -}}
145201
key: proxyPassword
202+
{{- end -}}
146203
{{- end -}}
147204

148205
{{- if .Values.persistence.deleteEnabled }}
@@ -154,8 +211,6 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this
154211
{{ toYaml . }}
155212
{{- end -}}
156213

157-
{{- end -}}
158-
159214
{{- define "docker-registry.volumeMounts" -}}
160215
- name: "{{ template "docker-registry.fullname" . }}-config"
161216
mountPath: {{ .Values.configPath }}
@@ -191,10 +246,15 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this
191246
{{- if .Values.secrets.htpasswd }}
192247
- name: auth
193248
secret:
194-
secretName: {{ template "docker-registry.fullname" . }}-secret
249+
secretName: {{ template "docker-registry.secretName" . }}
195250
items:
251+
{{- if and .Values.secrets.htpasswdKey .Values.secrets.existingSecret }}
252+
- key: {{- .Values.secrets.htpasswdKey }}
253+
path: htpasswd
254+
{{- else }}
196255
- key: htpasswd
197256
path: htpasswd
257+
{{- end }}
198258
{{- end }}
199259

200260
{{- if eq .Values.storage "filesystem" }}

‎templates/cronjob.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,9 @@ spec:
2121
{{- end }}
2222
annotations:
2323
checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
24+
{{- if not .Values.secrets.existingSecret }}
2425
checksum/secret: {{ include (print $.Template.BasePath "/secret.yaml") . | sha256sum }}
26+
{{- end }}
2527
{{- if .Values.podAnnotations }}
2628
{{- toYaml .Values.podAnnotations | nindent 8 }}
2729
{{- end }}

‎templates/deployment.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,9 @@ spec:
3232
{{- end }}
3333
annotations:
3434
checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
35+
{{- if not .Values.existingSecret }}
3536
checksum/secret: {{ include (print $.Template.BasePath "/secret.yaml") . | sha256sum }}
37+
{{- end }}
3638
{{- if .Values.podAnnotations }}
3739
{{ toYaml .Values.podAnnotations | nindent 8 }}
3840
{{- end }}

‎templates/secret.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
{{- if not .Values.secrets.existingSecret }}
12
apiVersion: v1
23
kind: Secret
34
metadata:
@@ -38,3 +39,4 @@ data:
3839
{{- end }}
3940
proxyUsername: {{ .Values.proxy.username | default "" | b64enc | quote }}
4041
proxyPassword: {{ .Values.proxy.password | default "" | b64enc | quote }}
42+
{{- end }}

‎values.yaml‎

Lines changed: 28 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -78,21 +78,41 @@ storage: filesystem
7878
# Set this to name of secret for tls certs
7979
# tlsSecretName: registry.docker.example.com
8080
secrets:
81+
# Specifies the name of an existing secret containing authorization credentials
82+
# If set, overrides htpasswd and doesn't create secret
83+
existingSecret: ""
84+
# Specifies the key name in existing secret containing haSharedSecret
85+
# If not set, defaults to haSharedSecret
86+
haSharedSecretKey: ""
87+
# Specifies the key name in existing secret containing htpasswd
88+
# If not set, defaults to htpasswd
89+
htpasswdKey: ""
90+
91+
# If existing secret is not set, this value will be used to generate secret
8192
haSharedSecret: ""
93+
# If existing secret is not set, this value will be used to generate secret
8294
htpasswd: ""
8395
# Secrets for Azure
8496
# azure:
97+
# secretRef: ""
98+
# accountNameKey: ""
99+
# accountKeyKey: ""
100+
# containerKey: ""
101+
#
85102
# accountName: ""
86103
# accountKey: ""
87104
# container: ""
88105
# Secrets for S3 access and secret keys
89106
# Use a secretRef with keys (accessKey, secretKey) for secrets stored outside the chart
90-
# s3:
107+
# s3:
91108
# secretRef: ""
92109
# accessKey: ""
93110
# secretKey: ""
94111
# Secrets for Swift username and password
95112
# swift:
113+
# secretRef: ""
114+
# usernameKey: ""
115+
# passwordKey: ""
96116
# username: ""
97117
# password: ""
98118

@@ -119,8 +139,14 @@ proxy:
119139
username: ""
120140
password: ""
121141
# the ref for a secret stored outside of this chart
122-
# Keys: proxyUsername, proxyPassword
142+
# Default keys: proxyUsername, proxyPassword
123143
secretRef: ""
144+
# Specifies the key name for proxy username to look for in secretRef
145+
# Defaults to proxyUsername
146+
proxyUsernameKey: ""
147+
# Specifies the key name for proxy password to look for in secretRef
148+
# Defaults to proxyPassword
149+
proxyPasswordKey: ""
124150

125151
metrics:
126152
enabled: false

0 commit comments

Comments
 (0)