Skip to content

Commit 04fc5c5

Browse files
tylergrafftylergraff
authored
Create container-sources-2024-09-1.md
1 parent 2e82b8a commit 04fc5c5

File tree

1 file changed

+183
-0
lines changed

1 file changed

+183
-0
lines changed

‎docs/docs/references/container-sources-2024-09-1.md‎

Lines changed: 183 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,183 @@
1+
## Deploying and Running Nebari from a Private Container Repository
2+
3+
Nebari deploys and runs FOSS components as containers running in Kubernetes.
4+
By default, Nebari sources each container from the container's respective public repository, typically `docker.io` or `quay.io`.
5+
This introduces supply-chain concerns for security-focused customers.
6+
7+
8+
One solution to these supply-chain concerns is to deploy Nebari from private locally-mirrored containers:
9+
- Create a controlled private container repository (e.g. ECR or GitLab Container Repo)
10+
- Mirror all containers used by Nebari into this private container repository
11+
- Use the `overrides` mechanism in `nebari-config.yaml` to specify the mirrored container sources
12+
13+
Deploying Nebari in this fashion eliminates significant supply chain surface-area, but requires identifying all containers used by Nebari.
14+
15+
The following configuration enumerates all container images used by Nebari 2024-9-1 and demonstrates how to source them from a private repo denoted by the string `[LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com`.
16+
The commented-out `registry` and `repository` keys document the original public source repository from which the container images are to be mirrored.
17+
18+
```
19+
monitoring:
20+
overrides:
21+
prometheus:
22+
alertmanager:
23+
alertmanagerSpec:
24+
## Image of Alertmanager
25+
image:
26+
#registry: quay.io
27+
#repository: prometheus/alertmanager
28+
registry: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com
29+
repository: quay.io/prometheus/alertmanager
30+
tag: v0.27.0
31+
sha: ""
32+
grafana:
33+
image:
34+
#registry: docker.io
35+
registry: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com
36+
#repository: grafana/grafana
37+
repository: docker.io/grafana/grafana
38+
tag: ""
39+
sha: ""
40+
pullPolicy: IfNotPresent
41+
sidecar:
42+
image:
43+
#registry: quay.io
44+
registry: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com
45+
#repository: kiwigrid/k8s-sidecar
46+
repository: quay.io/kiwigrid/k8s-sidecar
47+
tag: 1.26.1
48+
sha: ""
49+
prometheusOperator:
50+
image:
51+
#registry: quay.io
52+
registry: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com
53+
#repository: prometheus-operator/prometheus-operator
54+
repository: quay.io/prometheus-operator/prometheus-operator
55+
tag: ""
56+
sha: ""
57+
prometheusConfigReloader:
58+
image:
59+
#registry: quay.io
60+
registry: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com
61+
#repository: prometheus-operator/prometheus-config-reloader
62+
repository: quay.io/prometheus-operator/prometheus-config-reloader
63+
tag: ""
64+
sha: ""
65+
kube-state-metrics:
66+
image:
67+
#registry: registry.k8s.io
68+
registry: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com
69+
#repository: kube-state-metrics/kube-state-metrics
70+
repository: registry.k8s.io/kube-state-metrics/kube-state-metrics
71+
tag: ""
72+
sha: ""
73+
pullPolicy: IfNotPresent
74+
prometheus-node-exporter:
75+
image:
76+
#registry: quay.io
77+
registry: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com
78+
#repository: prometheus/node-exporter
79+
repository: quay.io/prometheus/node-exporter
80+
tag: ""
81+
pullPolicy: IfNotPresent
82+
digest: ""
83+
prometheus:
84+
prometheusSpec:
85+
image:
86+
#registry: quay.io
87+
registry: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com
88+
#repository: prometheus/prometheus
89+
repository: quay.io/prometheus/prometheus
90+
tag: v2.51.2
91+
sha: ""
92+
loki:
93+
loki:
94+
image:
95+
#registry: docker.io
96+
registry: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com
97+
#repository: grafana/loki
98+
repository: docker.io/grafana/loki
99+
tag: null
100+
lokiCanary:
101+
image:
102+
#registry: docker.io
103+
registry: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com
104+
#repository: grafana/loki-canary
105+
repository: docker.io/grafana/loki-canary
106+
tag: null
107+
gateway:
108+
image:
109+
#registry: docker.io
110+
registry: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com
111+
#repository: nginxinc/nginx-unprivileged
112+
repository: docker.io/nginxinc/nginx-unprivileged
113+
tag: 1.24-alpine
114+
sidecar:
115+
image:
116+
#repository: kiwigrid/k8s-sidecar
117+
repository: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com/kiwigrid/k8s-sidecar
118+
tag: 1.24.3
119+
promtail:
120+
image:
121+
#registry: docker.io
122+
registry: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com
123+
#repository: grafana/promtail
124+
repository: docker.io/grafana/promtail
125+
tag: null
126+
# https://github.com/bitnami/charts/blob/440ec159c26e4ff0748b9e9866b345d98220c40a/bitnami/minio/values.yaml
127+
minio:
128+
image:
129+
#registry: docker.io
130+
registry: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com
131+
#repository: bitnami/minio
132+
repository: docker.io/bitnami/minio
133+
tag: 2021.4.22-debian-10-r0
134+
jupyterhub:
135+
#volume_mount_init_image: "busybox:1.31"
136+
volume_mount_init_image: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com/busybox:1.31
137+
proxy:
138+
chp:
139+
image:
140+
#name: quay.io/jupyterhub/configurable-http-proxy
141+
name: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com/quay.io/jupyterhub/configurable-http-proxy
142+
tag: 4.6.1
143+
scheduling:
144+
userScheduler:
145+
enabled: true
146+
image:
147+
#name: registry.k8s.io/kube-scheduler
148+
name: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com/registry.k8s.io/kube-scheduler
149+
tag: "v1.28.10"
150+
singleuser:
151+
networkTools:
152+
image:
153+
#name: quay.io/jupyterhub/k8s-network-tools
154+
name: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com/quay.io/jupyterhub/k8s-network-tools
155+
tag: 4.0.0-0.dev.git.6548.h9b2dfe22
156+
prePuller:
157+
pause:
158+
image:
159+
#name: registry.k8s.io/pause
160+
name: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com/registry.k8s.io/pause
161+
tag: "3.10"
162+
jupyterhub_ssh:
163+
jupyterhub_ssh_image:
164+
name: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com/quay.io/jupyterhub-ssh/ssh
165+
tag: 0.0.1-0.dev.git.136.ha610981
166+
jupyterhub_sftp_image:
167+
name: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com/quay.io/jupyterhub-ssh/sftp
168+
tag: 0.0.1-0.dev.git.142.h402a3d6
169+
dask_gateway:
170+
dask_gateway_image:
171+
#name: ghcr.io/dask/dask-gateway-server
172+
name: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com/ghcr.io/dask/dask-gateway-server
173+
tag: "2022.4.0"
174+
dask_controller_image:
175+
#name: ghcr.io/dask/dask-gateway-server
176+
name: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com/ghcr.io/dask/dask-gateway-server
177+
tag: "2022.4.0"
178+
forward_auth:
179+
traefik_forwardauth_image:
180+
#name: maxisme/traefik-forward-auth
181+
name: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com/maxisme/traefik-forward-auth
182+
tag: "sha-a98e568"
183+
```

0 commit comments

Comments
 (0)