Skip to content

Commit 1dfdc46

Browse files
maxim-mityutkomaxim-mityutko
authored
[feature] Zot (#1296)
1 parent 7823d9d commit 1dfdc46

File tree

8 files changed

+271
-74
lines changed

8 files changed

+271
-74
lines changed

‎README.md‎

Lines changed: 73 additions & 72 deletions
Large diffs are not rendered by default.

‎kubernetes/argocd/03_default/zot.yaml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
apiVersion: argoproj.io/v1alpha1
2+
kind: Application
3+
metadata:
4+
name: zot
5+
namespace: argocd
6+
spec:
7+
destination:
8+
name: ''
9+
namespace: default
10+
server: 'https://kubernetes.default.svc'
11+
source:
12+
path: kubernetes/cluster/default/zot
13+
repoURL: 'https://github.com/maxim-mityutko/home-infra.git'
14+
targetRevision: main
15+
project: default
16+
syncPolicy:
17+
automated:
18+
prune: true
19+
selfHeal: true
20+
syncOptions:
21+
- CreateNamespace=true

‎kubernetes/cluster/default/blocky/blocky.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ spec:
2424
restartPolicy: Always
2525
containers:
2626
- name: blocky
27-
image: ghcr.io/0xerr0r/blocky:v0.27.0
27+
image: registry.brhd.io/ghcr.io/0xerr0r/blocky:v0.27.0
2828
args:
2929
- --config
3030
- ./config/

‎kubernetes/cluster/default/zot/dns-endpoint.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
apiVersion: externaldns.k8s.io/v1alpha1
2+
kind: DNSEndpoint
3+
metadata:
4+
name: registry.brhd.io
5+
namespace: default
6+
spec:
7+
endpoints:
8+
- dnsName: registry.brhd.io
9+
recordTTL: 86400
10+
recordType: CNAME
11+
targets:
12+
- casa.brhd.io

‎kubernetes/cluster/default/zot/kustomization.yaml‎

Lines changed: 131 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,131 @@
1+
---
2+
apiVersion: kustomize.config.k8s.io/v1beta1
3+
kind: Kustomization
4+
namespace: default
5+
resources:
6+
- dns-endpoint.yaml
7+
- secret.yaml
8+
helmCharts:
9+
- name: zot
10+
namespace: default
11+
releaseName: zot
12+
version: 0.1.87
13+
repo: http://zotregistry.dev/helm-charts
14+
valuesInline:
15+
image:
16+
# Override repo path to get access to different image architectures
17+
repository: ghcr.io/project-zot/zot
18+
serviceAccount:
19+
create: true
20+
serviceHeadless:
21+
enabled: false
22+
ingress:
23+
enabled: true
24+
annotations:
25+
kubernetes.io/ingress.class: public
26+
cert-manager.io/cluster-issuer: lets-encrypt
27+
nginx.ingress.kubernetes.io/proxy-body-size: '0'
28+
className: public
29+
hosts:
30+
- host: registry.brhd.io
31+
paths:
32+
- path: /
33+
tls: []
34+
startupProbe:
35+
initialDelaySeconds: 5
36+
periodSeconds: 10
37+
failureThreshold: 3
38+
mountConfig: true
39+
configFiles:
40+
# Refs:
41+
# Authorization: https://zotregistry.dev/latest/articles/authn-authz/
42+
# OIDC: https://zotregistry.dev/latest/articles/authn-authz/#using-openidoauth2-when-zot-is-behind-a-proxy-or-load-balancer
43+
config.json: |-
44+
{
45+
"storage": { "rootDirectory": "/var/lib/registry" },
46+
"http": {
47+
"address": "0.0.0.0",
48+
"port": "5000",
49+
"externalUrl": "https://registry.brhd.io",
50+
"auth": {
51+
"openid": {
52+
"providers": {
53+
"oidc": {
54+
"issuer": "https://auth.brhd.io/application/o/zot/",
55+
"credentialsFile": "secrets/oidc.json",
56+
"scopes": ["openid", "profile", "email"]
57+
}
58+
}
59+
}
60+
},
61+
"accessControl": {
62+
"repositories": {
63+
"**": {
64+
"defaultPolicy": ["read", "create", "update", "delete"],
65+
"anonymousPolicy": ["read"]
66+
}
67+
}
68+
}
69+
},
70+
"log": { "level": "warn" },
71+
"extensions": {
72+
"search": {"enable": true},
73+
"ui": {"enable": true},
74+
"sync": {
75+
"enable": true,
76+
"registries": [
77+
{
78+
"urls": ["https://index.docker.io"],
79+
"content": [{"prefix": "**", "destination": "/docker.io"}],
80+
"onDemand": true,
81+
"tlsVerify": true
82+
},
83+
{
84+
"urls": ["https://ghcr.io"],
85+
"content": [{"prefix": "**", "destination": "/ghcr.io"}],
86+
"onDemand": true,
87+
"tlsVerify": true
88+
},
89+
{
90+
"urls": ["https://quay.io"],
91+
"content": [{"prefix": "**", "destination": "/quay.io"}],
92+
"onDemand": true,
93+
"tlsVerify": true
94+
},
95+
{
96+
"urls": ["https://gcr.io"],
97+
"content": [{"prefix": "**", "destination": "/gcr.io"}],
98+
"onDemand": true,
99+
"tlsVerify": true
100+
},
101+
{
102+
"urls": ["https://registry.k8s.io"],
103+
"content": [{"prefix": "**", "destination": "/k8s.io"}],
104+
"onDemand": true,
105+
"tlsVerify": true
106+
}
107+
]
108+
},
109+
"scrub": {
110+
"interval": "24h"
111+
}
112+
}
113+
}
114+
externalSecrets:
115+
- secretName: zot-oidc
116+
mountPath: /secrets
117+
persistence: true
118+
pvc:
119+
create: true
120+
accessModes: ["ReadWriteOnce"]
121+
storage: 5Gi
122+
storageClassName: openebs-hostpath
123+
env: []
124+
strategy:
125+
type: RollingUpdate
126+
metrics:
127+
enabled: false
128+
serviceMonitor:
129+
enabled: false
130+
patches:
131+
- path: patch.yaml

‎kubernetes/cluster/default/zot/patch.yaml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
apiVersion: apps/v1
2+
kind: StatefulSet
3+
metadata:
4+
name: zot
5+
namespace: default
6+
spec:
7+
revisionHistoryLimit: 2

‎kubernetes/cluster/default/zot/secret.yaml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
---
2+
apiVersion: bitnami.com/v1alpha1
3+
kind: SealedSecret
4+
metadata:
5+
creationTimestamp: null
6+
name: zot-oidc
7+
namespace: default
8+
spec:
9+
encryptedData:
10+
oidc.json: AgBq4kSa3xrY0q4mpmuKQ1o6bhRW6At/foPiTFp7kxk5AcRhZG5RpZR/17Mxo49VFWqBrYqNhnsttTSZFqYpuEYQoIJQ3HL9k6QADvYkVSJcjLKz6kgyy31/d2FVkd/P2bwUZQE/Ia8XgTfb52vrHmqs9SJUy8F+RD/7AxJPPv0Lm5BluXaBkMU3ZZaKYMYfXuMILupxc/bl4nxAxZ8XqdQol3LxKVhkBm8IPjq0/yKoLAPcTroRqEvZqKJn6ITSxu35PTVJVya/fWXmkhZXaRsFRRFM/sYvXcXx2gF0CrPRpE55NoTi8QuHW/Yo29Z/8cga3pji6MjPg8vB3cjIXmLayhx8aPEJg81wpckA0eFRSqMx2tSJ5GcTTHtGlVPVE3dYJLLNXGM0k2DZEJ+7UTm1ht8rwo65s3K4iB+/lKls5dKwjgg2z1l4M2X4FLPlOF/DdSVXc4sc67G7gLtgP6auLcQ+fmy4BJwPYDYFoQm5AJdEFL6Tbto3Q/pSlFWhRIQ0AizKhrvA2fwyHF0QXAmAQfhfmN/H7M54xkJDcaLLzZQrum4vOSAY90OhHyPSN6Naa6n+VdXWTc2kbNWPTs5scgNK1AJeuc0G9p6oyTJsfB0frUQGz/Kh7QePVOWqPRVg+Kanx9bMoGFzGD42zqXQTB1BWNtPQsyHJ04YPc00b8D5ONqv+WiLiOckzdagEPDdWhxbPjbQo72aaXBR+qpAuKSJXoNXV0HW8gsIHqa4T+7I0uoWxQwtXrRJfmb1mDjU77AlMHIfdo2UWykq8Dh0MXWPoYYUO8zaboi3wOwXLD5PwYWV4/GVDE9d9FfdQYZc+4V+Z3S+0zVzKX+2Gl/Ob7ziA3vzeqh7f2REDbzQemJFP/iYuz+xRl5OV6fLRCwlGrTcklt0JCHbYcwf5YI8c83vc81hUWrSE69WVtgk26M8AWQvAgCLbtaAGfLZpaiQgiPZMu4Dnlvm9p10DWmhKJs=
11+
template:
12+
metadata:
13+
creationTimestamp: null
14+
labels:
15+
app.kubernetes.io/name: zot
16+
name: zot-oidc
17+
namespace: default
18+
type: Opaque

‎renovate.json‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,12 +3,19 @@
33
"enabled": true,
44
"dependencyDashboard": true,
55
"dependencyDashboardTitle": "Renovate Dashboard",
6+
"registryAliases": {
7+
"registry.brhd.io/docker.io": "https://index.docker.io",
8+
"registry.brhd.io/ghcr.io": "https://ghcr.io",
9+
"registry.brhd.io/quay.io": "https://quay.io",
10+
"registry.brhd.io/gcr.io": "https://gcr.io",
11+
"registry.brhd.io/k8s.io": "https://registry.k8s.io"
12+
},
613
"kubernetes": {
714
"managerFilePatterns": [
815
"/kubernetes/cluster/.+\\.ya?ml$/"
916
]
1017
},
11-
"prHourlyLimit": 15,
18+
"prHourlyLimit": 25,
1219
"includePaths": [
1320
"kubernetes/cluster/**/**"
1421
],

0 commit comments

Comments
 (0)