Skip to content

Commit 3909200

Browse files
author
Dimitris Karakasilis
authored
Merge pull request #17 from epinio/add_container_registry_chart
Move container registry helm chart from epinio/epinio repo
2 parents e1f5836 + e5167ff commit 3909200

6 files changed

Lines changed: 254 additions & 0 deletions

File tree

‎chart/container-registry/.helmignore‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# Patterns to ignore when building packages.
2+
# This supports shell glob matching, relative path matching, and
3+
# negation (prefixed with !). Only one pattern per line.
4+
.DS_Store
5+
# Common VCS dirs
6+
.git/
7+
.gitignore
8+
.bzr/
9+
.bzrignore
10+
.hg/
11+
.hgignore
12+
.svn/
13+
# Common backup files
14+
*.swp
15+
*.bak
16+
*.tmp
17+
*.orig
18+
*~
19+
# Various IDEs
20+
.project
21+
.idea/
22+
*.tmproj
23+
.vscode/

‎chart/container-registry/Chart.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
apiVersion: v2
2+
name: container-registry
3+
description: A Helm chart for the Container Registry
4+
type: application
5+
version: 0.1.0
6+
maintainers:
7+
- name: SUSE
8+
email: team@epinio.io

‎chart/container-registry/templates/_helpers.tpl‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
{{/*
2+
Expand the name of the chart.
3+
*/}}
4+
{{- define "container-registry.name" -}}
5+
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
6+
{{- end }}
7+
8+
{{/*
9+
Create a default fully qualified app name.
10+
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
11+
If release name contains chart name it will be used as a full name.
12+
*/}}
13+
{{- define "container-registry.fullname" -}}
14+
{{- if .Values.fullnameOverride }}
15+
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
16+
{{- else }}
17+
{{- $name := default .Chart.Name .Values.nameOverride }}
18+
{{- if contains $name .Release.Name }}
19+
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
20+
{{- else }}
21+
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
22+
{{- end }}
23+
{{- end }}
24+
{{- end }}
25+
26+
{{/*
27+
Create chart name and version as used by the chart label.
28+
*/}}
29+
{{- define "container-registry.chart" -}}
30+
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
31+
{{- end }}
32+
33+
{{/*
34+
Common labels
35+
*/}}
36+
{{- define "container-registry.labels" -}}
37+
helm.sh/chart: {{ include "container-registry.chart" . }}
38+
{{ include "container-registry.selectorLabels" . }}
39+
{{- if .Chart.AppVersion }}
40+
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
41+
{{- end }}
42+
app.kubernetes.io/managed-by: {{ .Release.Service }}
43+
{{- end }}
44+
45+
{{/*
46+
Selector labels
47+
*/}}
48+
{{- define "container-registry.selectorLabels" -}}
49+
app.kubernetes.io/name: {{ include "container-registry.name" . }}
50+
app.kubernetes.io/instance: {{ .Release.Name }}
51+
{{- end }}
52+
53+
{{/*
54+
Create the name of the service account to use
55+
*/}}
56+
{{- define "container-registry.serviceAccountName" -}}
57+
{{- if .Values.serviceAccount.create }}
58+
{{- default (include "container-registry.fullname" .) .Values.serviceAccount.name }}
59+
{{- else }}
60+
{{- default "default" .Values.serviceAccount.name }}
61+
{{- end }}
62+
{{- end }}

‎chart/container-registry/templates/certificate.yaml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
apiVersion: cert-manager.io/v1
2+
kind: Certificate
3+
metadata:
4+
name: epinio-registry
5+
namespace: epinio-registry
6+
spec:
7+
dnsNames:
8+
- {{ .Values.domain }}
9+
issuerRef:
10+
kind: ClusterIssuer
11+
name: {{ .Values.tlsIssuer }}
12+
secretName: epinio-registry-tls
13+
secretTemplate:
14+
annotations:
15+
kubed.appscode.com/sync: "kubed-registry-tls-from=epinio-registry" # Sync certificate to matching namespaces

‎chart/container-registry/templates/container-registry.yaml‎

Lines changed: 128 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,128 @@
1+
---
2+
apiVersion: v1
3+
kind: Secret
4+
metadata:
5+
name: auth
6+
namespace: {{ .Release.Namespace }}
7+
stringData:
8+
htpasswd: {{ .Values.auth.htpasswd | quote }}
9+
---
10+
apiVersion: v1
11+
kind: Service
12+
metadata:
13+
name: registry
14+
namespace: {{ .Release.Namespace }}
15+
labels:
16+
{{- include "container-registry.labels" . | nindent 4 }}
17+
spec:
18+
type: ClusterIP
19+
selector:
20+
{{- include "container-registry.selectorLabels" . | nindent 4 }}
21+
ports:
22+
- name: registry
23+
port: 5000
24+
targetPort: 5000
25+
---
26+
apiVersion: networking.k8s.io/v1
27+
kind: Ingress
28+
metadata:
29+
annotations:
30+
kubernetes.io/ingress.class: traefik
31+
traefik.ingress.kubernetes.io/router.entrypoints: websecure
32+
traefik.ingress.kubernetes.io/router.tls: "true"
33+
labels:
34+
{{- include "container-registry.labels" . | nindent 4 }}
35+
name: registry
36+
namespace: {{ .Release.Namespace }}
37+
spec:
38+
rules:
39+
- host: {{ .Values.domain }}
40+
http:
41+
paths:
42+
- backend:
43+
service:
44+
name: registry
45+
port:
46+
number: 5000
47+
path: /
48+
pathType: ImplementationSpecific
49+
tls:
50+
- hosts:
51+
- {{ .Values.domain }}
52+
secretName: epinio-registry-tls
53+
{{ if .Values.createNodePort }}
54+
---
55+
apiVersion: v1
56+
kind: Service
57+
metadata:
58+
name: registry-node
59+
namespace: {{ .Release.Namespace }}
60+
labels:
61+
{{- include "container-registry.labels" . | nindent 4 }}
62+
spec:
63+
type: NodePort
64+
selector:
65+
{{- include "container-registry.selectorLabels" . | nindent 4 }}
66+
ports:
67+
- name: registry
68+
port: 5000
69+
targetPort: 5000
70+
nodePort: 30500
71+
{{- end }}
72+
---
73+
apiVersion: apps/v1
74+
kind: Deployment
75+
metadata:
76+
name: registry
77+
namespace: {{ .Release.Namespace }}
78+
labels:
79+
{{- include "container-registry.labels" . | nindent 4 }}
80+
spec:
81+
replicas: 1
82+
selector:
83+
matchLabels:
84+
{{- include "container-registry.selectorLabels" . | nindent 6 }}
85+
template:
86+
metadata:
87+
labels:
88+
{{- include "container-registry.labels" . | nindent 8 }}
89+
spec:
90+
containers:
91+
- name: registry
92+
image: {{ .Values.registry.image }}
93+
imagePullPolicy: {{ .Values.registry.imagePullPolicy }}
94+
env:
95+
- name: REGISTRY_AUTH
96+
value: htpasswd
97+
- name: REGISTRY_AUTH_HTPASSWD_REALM
98+
value: Registry Realm
99+
- name: REGISTRY_AUTH_HTPASSWD_PATH
100+
value: /etc/registry/auth/htpasswd
101+
volumeMounts:
102+
- name: registry
103+
mountPath: /var/lib/registry
104+
readOnly: false
105+
- name: auth
106+
mountPath: /etc/registry/auth
107+
readOnly: true
108+
securityContext:
109+
runAsUser: 1000
110+
runAsNonRoot: true
111+
allowPrivilegeEscalation: false
112+
readOnlyRootFilesystem: true
113+
livenessProbe:
114+
tcpSocket:
115+
port: 5000
116+
initialDelaySeconds: 15
117+
periodSeconds: 20
118+
readinessProbe:
119+
tcpSocket:
120+
port: 5000
121+
initialDelaySeconds: 5
122+
periodSeconds: 5
123+
volumes:
124+
- name: registry
125+
emptyDir: {}
126+
- name: auth
127+
secret:
128+
secretName: auth

‎chart/container-registry/values.yaml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
# htpasswd encoded credentials for access to the registry.
2+
# Must be set on deployment.
3+
auth:
4+
htpasswd: ~
5+
6+
registry:
7+
image: registry:2.7.1
8+
imagePullPolicy: IfNotPresent
9+
10+
nginx:
11+
image: nginx:1.19.3
12+
imagePullPolicy: IfNotPresent
13+
14+
# We create a service with type `NodePort` only in
15+
# local deployment as Kubelet cannot access the
16+
# secured registry because there is no way to add
17+
# registry CA to kubelet.
18+
createNodePort: true

0 commit comments

Comments
 (0)