Support self-hosted Quay registries (#276)

Signed-off-by: Mykola Morhun <mmorhun@redhat.com>

Author: mmorhun

README.md

@@ -1,11 +1,11 @@
 [![codecov](https://codecov.io/gh/konflux-ci/image-controller/branch/main/graph/badge.svg)](https://codecov.io/gh/konflux-ci/image-controller)
-# The Image Controller for AppStudio
-The Image Controller operator helps set up container image repositories on Quay.io for AppStudio.
+# The Image Repository Controller for Konflux
+The Image Controller operator helps set up container image repositories on Quay image registry for Konflux.
 
 ### Image Controller operator installation
 
 1. Install the project on your cluster by running `make deploy`.
-2. Set up the Quay.io token that would be used by the controller to set up image repositories under the `quay.io/redhat-user-workloads` organization.
+2. Set up the Quay.io token that would be used by the controller to set up image repositories under the `quay.io/user-workloads` organization.
 
 ```
 kind: Secret
@@ -14,7 +14,8 @@ metadata:
   name: quaytoken
   namespace: image-controller-system
 data:
-  organization: redhat-user-workloads
+  quayapiurl: https://quay.io/api/v1
+  organization: user-workloads
   quaytoken: redacted
 type: Opaque
 ```
@@ -154,7 +155,7 @@ in Quay will get deleted as well.
 
 In order to skip the deletion of the repository in Quay, the `image-controller.appstudio.redhat.com/skip-repository-deletion` annotation should be set to "true".
 
-## AppStudio Component image repository
+## Konflux Component image repository
 
 ### Image repository for Component builds
 
@@ -270,7 +271,7 @@ The `Image controller` would create the necessary resources on Quay.io and write
 
 ```json
 {
-   "image":"quay.io/redhat-user-workloads/image-controller-system/city-transit/billing",
+   "image":"quay.io/user-workloads/image-controller-system/city-transit/billing",
    "visibility":"public",
    "secret":"billing"
 }
@@ -283,7 +284,7 @@ metadata:
   annotations:
     image.redhat.com/generate: 'false'
     image.redhat.com/image: >-
-      {"image":"quay.io/redhat-user-workloads/image-controller-system/city-transit/billing","visibility":"public","secret":"billing"}
+      {"image":"quay.io/user-workloads/image-controller-system/city-transit/billing","visibility":"public","secret":"billing"}
   name: billing
   namespace: image-controller-system
   resourceVersion: '86424'
@@ -295,7 +296,7 @@ spec:
 
 ## License
 
-Copyright 2023.
+Copyright 2023-2026.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.

cmd/main.go

@@ -18,6 +18,7 @@ package main
 
 import (
 	"crypto/tls"
+	"errors"
 	"flag"
 	"fmt"
 	"net/http"
@@ -46,7 +47,6 @@ import (
 	metricsserver "sigs.k8s.io/controller-runtime/pkg/metrics/server"
 	"sigs.k8s.io/controller-runtime/pkg/webhook"
 
-	"github.com/go-logr/logr"
 	imagerepositoryv1alpha1 "github.com/konflux-ci/image-controller/api/v1alpha1"
 	controllers "github.com/konflux-ci/image-controller/internal/controller"
 	controllermetrics "github.com/konflux-ci/image-controller/pkg/metrics"
@@ -56,6 +56,7 @@ import (
 )
 
 const (
+	quayApiPath string = "/workspace/quayapiurl"
 	/* #nosec it's the path to the token, not the token itself */
 	quayTokenPath string = "/workspace/quaytoken"
 	quayOrgPath   string = "/workspace/organization"
@@ -179,26 +180,43 @@ func main() {
 		os.Exit(1)
 	}
 
-	readConfig := func(l logr.Logger, path string) string {
+	// Read Quay config (from the mounted secret)
+	readConfig := func(path string) (string, error) {
 		/* #nosec we are sure the input path is clean */
 		tokenContent, err := os.ReadFile(path)
 		if err != nil {
-			l.Error(err, fmt.Sprintf("unable to read %s", path))
+			return "", fmt.Errorf("unable to read %s: %w", path, err)
 		}
-		return strings.TrimSpace(string(tokenContent))
+		return strings.TrimSpace(string(tokenContent)), nil
 	}
-	quayOrganization := readConfig(setupLog, quayOrgPath)
-	buildQuayClientFunc := func(l logr.Logger) quay.QuayService {
-		token := readConfig(l, quayTokenPath)
-		quayClient := quay.NewQuayClient(&http.Client{Transport: &http.Transport{}}, token, "https://quay.io/api/v1")
-		return quayClient
+	quayApiUrl, err := readConfig(quayApiPath)
+	if err != nil {
+		if !errors.Is(err, os.ErrNotExist) {
+			setupLog.Error(err, "unable to read Quay API URL")
+			os.Exit(2)
+		}
+		// Quay API URL is not set, fall back to default
+		quayApiUrl = "https://quay.io/api/v1"
+	}
+	setupLog.Info(fmt.Sprintf("using Quay API URL: %s", quayApiUrl))
+	quayOrganization, err := readConfig(quayOrgPath)
+	if err != nil {
+		setupLog.Error(err, "unable to read Quay Org")
+		os.Exit(2)
+	}
+	setupLog.Info(fmt.Sprintf("using Quay Org: %s", quayOrganization))
+	buildQuayClientFunc := func() (quay.QuayService, error) {
+		token, err := readConfig(quayTokenPath)
+		if err != nil {
+			return nil, fmt.Errorf("unable to get quay token: %w", err)
+		}
+		quayClient := quay.NewQuayClient(&http.Client{Transport: &http.Transport{}}, token, quayApiUrl)
+		return quayClient, nil
 	}
 
 	if err = (&controllers.ComponentReconciler{
-		Client:           mgr.GetClient(),
-		Scheme:           mgr.GetScheme(),
-		BuildQuayClient:  buildQuayClientFunc,
-		QuayOrganization: quayOrganization,
+		Client: mgr.GetClient(),
+		Scheme: mgr.GetScheme(),
 	}).SetupWithManager(mgr); err != nil {
 		setupLog.Error(err, "unable to create controller", "controller", "Controller")
 		os.Exit(1)

internal/controller/component_image_controller.go

@@ -31,10 +31,8 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
 	ctrllog "sigs.k8s.io/controller-runtime/pkg/log"
 
-	"github.com/go-logr/logr"
 	imagerepositoryv1alpha1 "github.com/konflux-ci/image-controller/api/v1alpha1"
 	l "github.com/konflux-ci/image-controller/pkg/logs"
-	"github.com/konflux-ci/image-controller/pkg/quay"
 	appstudioredhatcomv1alpha1 "github.com/redhat-appstudio/application-api/api/v1alpha1"
 )
 
@@ -63,9 +61,6 @@ type ImageRepositoryStatus struct {
 type ComponentReconciler struct {
 	client.Client
 	Scheme *runtime.Scheme
-
-	BuildQuayClient  func(logr.Logger) quay.QuayService
-	QuayOrganization string
 }
 
 // SetupWithManager sets up the controller with the Manager.

internal/controller/imagerepository_controller.go

@@ -27,7 +27,6 @@ import (
 	"strings"
 	"time"
 
-	"github.com/go-logr/logr"
 	imagerepositoryv1alpha1 "github.com/konflux-ci/image-controller/api/v1alpha1"
 	l "github.com/konflux-ci/image-controller/pkg/logs"
 	"github.com/konflux-ci/image-controller/pkg/metrics"
@@ -70,7 +69,7 @@ type ImageRepositoryReconciler struct {
 	Scheme *runtime.Scheme
 
 	QuayClient       quay.QuayService
-	BuildQuayClient  func(logr.Logger) quay.QuayService
+	BuildQuayClient  func() (quay.QuayService, error)
 	QuayOrganization string
 }
 
@@ -120,7 +119,10 @@ func (r *ImageRepositoryReconciler) Reconcile(ctx context.Context, req ctrl.Requ
 		delete(metrics.RepositoryTimesForMetrics, repositoryIdForMetrics)
 
 		// Reread quay token
-		r.QuayClient = r.BuildQuayClient(log)
+		r.QuayClient, err = r.BuildQuayClient()
+		if err != nil {
+			return ctrl.Result{}, err
+		}
 
 		if isComponentLinked(imageRepository) {
 			// unlink secret from component SA
@@ -185,7 +187,10 @@ func (r *ImageRepositoryReconciler) Reconcile(ctx context.Context, req ctrl.Requ
 	}
 
 	// Reread quay token
-	r.QuayClient = r.BuildQuayClient(log)
+	r.QuayClient, err = r.BuildQuayClient()
+	if err != nil {
+		return ctrl.Result{}, err
+	}
 
 	// Provision image repository if it hasn't been done yet
 	if !controllerutil.ContainsFinalizer(imageRepository, ImageRepositoryFinalizer) {

internal/controller/suite_test.go

@@ -106,23 +106,21 @@ var _ = BeforeSuite(func() {
 	err = (&ImageRepositoryReconciler{
 		Client:           k8sManager.GetClient(),
 		Scheme:           k8sManager.GetScheme(),
-		BuildQuayClient:  func(l logr.Logger) quay.QuayService { return quay.TestQuayClient{} },
+		BuildQuayClient:  func() (quay.QuayService, error) { return quay.TestQuayClient{}, nil },
 		QuayOrganization: quay.TestQuayOrg,
 	}).SetupWithManager(k8sManager)
 	Expect(err).ToNot(HaveOccurred())
 
 	err = (&ComponentReconciler{
-		Client:           k8sManager.GetClient(),
-		Scheme:           k8sManager.GetScheme(),
-		BuildQuayClient:  func(logr.Logger) quay.QuayService { return quay.TestQuayClient{} },
-		QuayOrganization: quay.TestQuayOrg,
+		Client: k8sManager.GetClient(),
+		Scheme: k8sManager.GetScheme(),
 	}).SetupWithManager(k8sManager)
 	Expect(err).ToNot(HaveOccurred())
 
 	err = (&QuayUsersConfigMapReconciler{
 		Client:           k8sManager.GetClient(),
 		Scheme:           k8sManager.GetScheme(),
-		BuildQuayClient:  func(l logr.Logger) quay.QuayService { return quay.TestQuayClient{} },
+		BuildQuayClient:  func() (quay.QuayService, error) { return quay.TestQuayClient{}, nil },
 		QuayOrganization: quay.TestQuayOrg,
 	}).SetupWithManager(k8sManager)
 	Expect(err).ToNot(HaveOccurred())

internal/controller/users_config_map_controller.go

@@ -21,7 +21,6 @@ import (
 	"fmt"
 	"strings"
 
-	"github.com/go-logr/logr"
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/runtime"
@@ -48,7 +47,7 @@ type QuayUsersConfigMapReconciler struct {
 	Scheme *runtime.Scheme
 
 	QuayClient       quay.QuayService
-	BuildQuayClient  func(logr.Logger) quay.QuayService
+	BuildQuayClient  func() (quay.QuayService, error)
 	QuayOrganization string
 }
 
@@ -144,7 +143,11 @@ func (r *QuayUsersConfigMapReconciler) Reconcile(ctx context.Context, req ctrl.R
 	}
 
 	// reread quay token
-	r.QuayClient = r.BuildQuayClient(log)
+	var err error
+	r.QuayClient, err = r.BuildQuayClient()
+	if err != nil {
+		return ctrl.Result{}, err
+	}
 
 	// remove team if config map is being removed, or doesn't contain key additionalUsersConfigMapKey
 	if removeTeam {

pkg/metrics/metrics_test.go

@@ -4,7 +4,6 @@ import (
 	"context"
 	"testing"
 
-	"github.com/go-logr/logr"
 	"github.com/konflux-ci/image-controller/pkg/quay"
 	"github.com/prometheus/client_golang/prometheus"
 	"github.com/prometheus/client_golang/prometheus/testutil"
@@ -36,7 +35,7 @@ func TestRegisterMetrics(t *testing.T) {
 	})
 }
 
-func getTestClient(logger logr.Logger) quay.QuayService {
+func getTestClient() (quay.QuayService, error) {
 	quay.ResetTestQuayClient()
-	return &quay.TestQuayClient{}
+	return &quay.TestQuayClient{}, nil
 }

pkg/metrics/quay.go

@@ -4,23 +4,25 @@ import (
 	"context"
 	"fmt"
 
-	"github.com/go-logr/logr"
 	"github.com/konflux-ci/image-controller/pkg/quay"
 	"github.com/prometheus/client_golang/prometheus"
-	ctrllog "sigs.k8s.io/controller-runtime/pkg/log"
 )
 
 type QuayAvailabilityProbe struct {
-	BuildQuayClient  func(logr.Logger) quay.QuayService
+	BuildQuayClient  func() (quay.QuayService, error)
 	QuayOrganization string
 	gauge            prometheus.Gauge
 }
 
 const testRobotAccountName = "robot_konflux_api_healthcheck"
 
-func NewQuayAvailabilityProbe(ctx context.Context, clientBuilder func(logr.Logger) quay.QuayService, quayOrganization string) (*QuayAvailabilityProbe, error) {
-	client := clientBuilder(ctrllog.FromContext(ctx))
-	_, err := client.CreateRobotAccount(quayOrganization, testRobotAccountName)
+func NewQuayAvailabilityProbe(ctx context.Context, clientBuilder func() (quay.QuayService, error), quayOrganization string) (*QuayAvailabilityProbe, error) {
+	client, err := clientBuilder()
+	if err != nil {
+		return nil, fmt.Errorf("could not create quay client: %w", err)
+	}
+
+	_, err = client.CreateRobotAccount(quayOrganization, testRobotAccountName)
 	if err != nil {
 		return nil, fmt.Errorf("could not create test robot account: %w", err)
 	}
@@ -38,8 +40,11 @@ func NewQuayAvailabilityProbe(ctx context.Context, clientBuilder func(logr.Logge
 }
 
 func (q *QuayAvailabilityProbe) CheckAvailability(ctx context.Context) error {
-	client := q.BuildQuayClient(ctrllog.FromContext(ctx))
-	_, err := client.GetRobotAccount(q.QuayOrganization, testRobotAccountName)
+	client, err := q.BuildQuayClient()
+	if err != nil {
+		return fmt.Errorf("could not create quay client: %w", err)
+	}
+	_, err = client.GetRobotAccount(q.QuayOrganization, testRobotAccountName)
 	return err
 }