11## Deploying and Running Nebari from a Private Container Repository
2-
32Nebari deploys and runs FOSS components as containers running in Kubernetes.
43By default, Nebari sources each container from the container's respective public repository, typically ` docker.io ` or ` quay.io ` .
54This introduces supply-chain concerns for security-focused customers.
@@ -12,25 +11,26 @@ One solution to these supply-chain concerns is to deploy Nebari from private loc
1211
1312Deploying Nebari in this fashion eliminates significant supply chain surface-area, but requires identifying all containers used by Nebari.
1413
15- The following configuration enumerates all container images used by Nebari 2024-9-1 and demonstrates how to source them from a private repo denoted by the string ` [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com ` .
14+ The following configuration enumerates all container images used by Nebari 2024-9-1 and demonstrates how to source them from a private repo denoted by the string ` [LOCAL_REPO] ` .
1615The commented-out elements document the original public sources from which the container images are to be mirrored.
1716
17+ ### Nebari 2024-9-1 Containers
1818```
1919default_images:
2020 #jupyterhub: quay.io/nebari/nebari-jupyterhub:2024.5.1
21- jupyterhub: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com /quay.io/nebari/nebari-jupyterhub:2024.5.1
21+ jupyterhub: [LOCAL_REPO] /quay.io/nebari/nebari-jupyterhub:2024.5.1
2222 #jupyterlab: quay.io/nebari/nebari-jupyterlab:2024.5.1
23- jupyterlab: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com /quay.io/nebari/nebari-jupyterlab:2024.5.1
23+ jupyterlab: [LOCAL_REPO] /quay.io/nebari/nebari-jupyterlab:2024.5.1
2424 #dask_worker: quay.io/nebari/nebari-dask-worker:2024.5.1
25- dask_worker: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com /quay.io/nebari/nebari-dask-worker:2024.5.1
25+ dask_worker: [LOCAL_REPO] /quay.io/nebari/nebari-dask-worker:2024.5.1
2626
2727security:
2828 keycloak:
2929 overrides:
3030 image:
3131 # Keycloak image repository
3232 #repository: quay.io/keycloak/keycloak # default
33- repository: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com /quay.io/keycloak/keycloak
33+ repository: [LOCAL_REPO] /quay.io/keycloak/keycloak
3434 # Overrides the Keycloak image tag whose default is the chart version
3535 #tag: "15.0.2" # default
3636 tag: ""
@@ -49,17 +49,17 @@ security:
4949 chown 1000:1000 /data/keycloak-metrics-spi-2.5.3.jar &&
5050 chmod 777 /data/keycloak-metrics-spi-2.5.3.jar
5151 fi
52- image: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com /alpine:latest
52+ image: [LOCAL_REPO] /alpine:latest
5353 name: initialize-spi-metrics-jar
5454 pgchecker:
5555 image:
5656 # repository: docker.io/busybox
57- repository: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com /docker.io/busybox
57+ repository: [LOCAL_REPO] /docker.io/busybox
5858 tag: 1.32
5959 postgresql:
6060 image:
6161 #registry: docker.io
62- registry: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com
62+ registry: [LOCAL_REPO]
6363 #repository: bitnami/postgresql
6464 repository: docker.io/bitnami/postgresql
6565 tag: 11.11.0-debian-10-r31
@@ -69,41 +69,41 @@ cluster_autoscaler:
6969 overrides:
7070 image:
7171 #repository: k8s.gcr.io/autoscaling/cluster-autoscaler
72- repository: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com /k8s.gcr.io/autoscaling/cluster-autoscaler
72+ repository: [LOCAL_REPO] /k8s.gcr.io/autoscaling/cluster-autoscaler
7373 tag: v1.23.0
7474
7575ingress:
7676 traefik-image:
77- image: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com /traefik
77+ image: [LOCAL_REPO] /traefik
7878 tag: 2.9.1
7979
8080conda_store:
81- image: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com /quansight/conda-store-server
81+ image: [LOCAL_REPO] /quansight/conda-store-server
8282 image_tag: 2024.3.1
8383
8484conda_store:
85- nfs_server_image: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com /gcr.io/google_containers/volume-nfs
85+ nfs_server_image: [LOCAL_REPO] /gcr.io/google_containers/volume-nfs
8686 nfs_server_image_tag: "0.8"
8787 overrides:
8888 minio:
8989 image:
9090 #registry: docker.io
91- registry: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com
91+ registry: [LOCAL_REPO]
9292 #repository: bitnami/minio
9393 repository: docker.io/bitnami/minio
9494 tag: 2021.4.22-debian-10-r0
9595 postgresql:
9696 image:
9797 #registry: docker.io
98- registry: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com
98+ registry: [LOCAL_REPO]
9999 #repository: bitnami/postgresql
100100 repository: docker.io/bitnami/postgresql
101101 tag: 11.14.0-debian-10-r17
102102 digest: ""
103103 redis:
104104 image:
105105 #registry: docker.io
106- registry: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com
106+ registry: [LOCAL_REPO]
107107 #repository: bitnami/redis
108108 repository: docker.io/bitnami/redis
109109 tag: 7.0.4-debian-11-r4
@@ -114,20 +114,20 @@ argo_workflows:
114114 controller:
115115 image:
116116 #registry: quay.io
117- registry: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com
117+ registry: [LOCAL_REPO]
118118 #repository: argoproj/workflow-controller
119119 repository: quay.io/argoproj/workflow-controller
120120 tag: ""
121121 server:
122122 image:
123123 #registry: quay.io
124- registry: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com
124+ registry: [LOCAL_REPO]
125125 #repository: argoproj/argocli
126126 repository: quay.io/argoproj/argocli
127127 tag: "v3.4.4"
128128 nebari_workflow_controller:
129129 enabled: true
130- image: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com /quay.io/nebari/nebari-workflow-controller
130+ image: [LOCAL_REPO] /quay.io/nebari/nebari-workflow-controller
131131 image_tag: 2024.5.1
132132
133133monitoring:
@@ -139,14 +139,14 @@ monitoring:
139139 image:
140140 #registry: quay.io
141141 #repository: prometheus/alertmanager
142- registry: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com
142+ registry: [LOCAL_REPO]
143143 repository: quay.io/prometheus/alertmanager
144144 tag: v0.27.0
145145 sha: ""
146146 grafana:
147147 image:
148148 #registry: docker.io
149- registry: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com
149+ registry: [LOCAL_REPO]
150150 #repository: grafana/grafana
151151 repository: docker.io/grafana/grafana
152152 tag: ""
@@ -155,31 +155,31 @@ monitoring:
155155 sidecar:
156156 image:
157157 #registry: quay.io
158- registry: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com
158+ registry: [LOCAL_REPO]
159159 #repository: kiwigrid/k8s-sidecar
160160 repository: quay.io/kiwigrid/k8s-sidecar
161161 tag: 1.26.1
162162 sha: ""
163163 prometheusOperator:
164164 image:
165165 #registry: quay.io
166- registry: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com
166+ registry: [LOCAL_REPO]
167167 #repository: prometheus-operator/prometheus-operator
168168 repository: quay.io/prometheus-operator/prometheus-operator
169169 tag: ""
170170 sha: ""
171171 prometheusConfigReloader:
172172 image:
173173 #registry: quay.io
174- registry: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com
174+ registry: [LOCAL_REPO]
175175 #repository: prometheus-operator/prometheus-config-reloader
176176 repository: quay.io/prometheus-operator/prometheus-config-reloader
177177 tag: ""
178178 sha: ""
179179 kube-state-metrics:
180180 image:
181181 #registry: registry.k8s.io
182- registry: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com
182+ registry: [LOCAL_REPO]
183183 #repository: kube-state-metrics/kube-state-metrics
184184 repository: registry.k8s.io/kube-state-metrics/kube-state-metrics
185185 tag: ""
@@ -188,7 +188,7 @@ monitoring:
188188 prometheus-node-exporter:
189189 image:
190190 #registry: quay.io
191- registry: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com
191+ registry: [LOCAL_REPO]
192192 #repository: prometheus/node-exporter
193193 repository: quay.io/prometheus/node-exporter
194194 tag: ""
@@ -198,7 +198,7 @@ monitoring:
198198 prometheusSpec:
199199 image:
200200 #registry: quay.io
201- registry: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com
201+ registry: [LOCAL_REPO]
202202 #repository: prometheus/prometheus
203203 repository: quay.io/prometheus/prometheus
204204 tag: v2.51.2
@@ -207,93 +207,93 @@ monitoring:
207207 loki:
208208 image:
209209 #registry: docker.io
210- registry: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com
210+ registry: [LOCAL_REPO]
211211 #repository: grafana/loki
212212 repository: docker.io/grafana/loki
213213 tag: null
214214 lokiCanary:
215215 image:
216216 #registry: docker.io
217- registry: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com
217+ registry: [LOCAL_REPO]
218218 #repository: grafana/loki-canary
219219 repository: docker.io/grafana/loki-canary
220220 tag: null
221221 gateway:
222222 image:
223223 #registry: docker.io
224- registry: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com
224+ registry: [LOCAL_REPO]
225225 #repository: nginxinc/nginx-unprivileged
226226 repository: docker.io/nginxinc/nginx-unprivileged
227227 tag: 1.24-alpine
228228 sidecar:
229229 image:
230230 #repository: kiwigrid/k8s-sidecar
231- repository: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com /kiwigrid/k8s-sidecar
231+ repository: [LOCAL_REPO] /kiwigrid/k8s-sidecar
232232 tag: 1.24.3
233233 promtail:
234234 image:
235235 #registry: docker.io
236- registry: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com
236+ registry: [LOCAL_REPO]
237237 #repository: grafana/promtail
238238 repository: docker.io/grafana/promtail
239239 tag: null
240240 minio:
241241 image:
242242 #registry: docker.io
243- registry: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com
243+ registry: [LOCAL_REPO]
244244 #repository: bitnami/minio
245245 repository: docker.io/bitnami/minio
246246 tag: 2021.4.22-debian-10-r0
247247
248248jupyterhub:
249249 #volume_mount_init_image: "busybox:1.31"
250- volume_mount_init_image: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com /busybox:1.31
250+ volume_mount_init_image: [LOCAL_REPO] /busybox:1.31
251251 proxy:
252252 chp:
253253 image:
254254 #name: quay.io/jupyterhub/configurable-http-proxy
255- name: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com /quay.io/jupyterhub/configurable-http-proxy
255+ name: [LOCAL_REPO] /quay.io/jupyterhub/configurable-http-proxy
256256 tag: 4.6.1
257257 scheduling:
258258 userScheduler:
259259 enabled: true
260260 image:
261261 #name: registry.k8s.io/kube-scheduler
262- name: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com /registry.k8s.io/kube-scheduler
262+ name: [LOCAL_REPO] /registry.k8s.io/kube-scheduler
263263 tag: "v1.28.10"
264264 singleuser:
265265 networkTools:
266266 image:
267267 #name: quay.io/jupyterhub/k8s-network-tools
268- name: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com /quay.io/jupyterhub/k8s-network-tools
268+ name: [LOCAL_REPO] /quay.io/jupyterhub/k8s-network-tools
269269 tag: 4.0.0-0.dev.git.6548.h9b2dfe22
270270 prePuller:
271271 pause:
272272 image:
273273 #name: registry.k8s.io/pause
274- name: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com /registry.k8s.io/pause
274+ name: [LOCAL_REPO] /registry.k8s.io/pause
275275 tag: "3.10"
276276jupyterhub_ssh:
277277 jupyterhub_ssh_image:
278- name: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com /quay.io/jupyterhub-ssh/ssh
278+ name: [LOCAL_REPO] /quay.io/jupyterhub-ssh/ssh
279279 tag: 0.0.1-0.dev.git.136.ha610981
280280 jupyterhub_sftp_image:
281- name: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com /quay.io/jupyterhub-ssh/sftp
281+ name: [LOCAL_REPO] /quay.io/jupyterhub-ssh/sftp
282282 tag: 0.0.1-0.dev.git.142.h402a3d6
283283
284284dask_gateway:
285285 dask_gateway_image:
286286 #name: ghcr.io/dask/dask-gateway-server
287- name: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com /ghcr.io/dask/dask-gateway-server
287+ name: [LOCAL_REPO] /ghcr.io/dask/dask-gateway-server
288288 tag: "2022.4.0"
289289 dask_controller_image:
290290 #name: ghcr.io/dask/dask-gateway-server
291- name: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com /ghcr.io/dask/dask-gateway-server
291+ name: [LOCAL_REPO] /ghcr.io/dask/dask-gateway-server
292292 tag: "2022.4.0"
293293
294294forward_auth:
295295 traefik_forwardauth_image:
296296 #name: maxisme/traefik-forward-auth
297- name: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com /maxisme/traefik-forward-auth
297+ name: [LOCAL_REPO] /maxisme/traefik-forward-auth
298298 tag: "sha-a98e568"
299299```
0 commit comments