Skip to content

Commit 1e19131

Browse files
authored
Update and rename container-sources-2024-09-1.md to container-sources.md
1 parent 150541e commit 1e19131

File tree

1 file changed

+43
-43
lines changed

1 file changed

+43
-43
lines changed
Lines changed: 43 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,4 @@
11
## Deploying and Running Nebari from a Private Container Repository
2-
32
Nebari deploys and runs FOSS components as containers running in Kubernetes.
43
By default, Nebari sources each container from the container's respective public repository, typically `docker.io` or `quay.io`.
54
This introduces supply-chain concerns for security-focused customers.
@@ -12,25 +11,26 @@ One solution to these supply-chain concerns is to deploy Nebari from private loc
1211

1312
Deploying Nebari in this fashion eliminates significant supply chain surface-area, but requires identifying all containers used by Nebari.
1413

15-
The following configuration enumerates all container images used by Nebari 2024-9-1 and demonstrates how to source them from a private repo denoted by the string `[LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com`.
14+
The following configuration enumerates all container images used by Nebari 2024-9-1 and demonstrates how to source them from a private repo denoted by the string `[LOCAL_REPO]`.
1615
The commented-out elements document the original public sources from which the container images are to be mirrored.
1716

17+
### Nebari 2024-9-1 Containers
1818
```
1919
default_images:
2020
#jupyterhub: quay.io/nebari/nebari-jupyterhub:2024.5.1
21-
jupyterhub: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com/quay.io/nebari/nebari-jupyterhub:2024.5.1
21+
jupyterhub: [LOCAL_REPO]/quay.io/nebari/nebari-jupyterhub:2024.5.1
2222
#jupyterlab: quay.io/nebari/nebari-jupyterlab:2024.5.1
23-
jupyterlab: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com/quay.io/nebari/nebari-jupyterlab:2024.5.1
23+
jupyterlab: [LOCAL_REPO]/quay.io/nebari/nebari-jupyterlab:2024.5.1
2424
#dask_worker: quay.io/nebari/nebari-dask-worker:2024.5.1
25-
dask_worker: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com/quay.io/nebari/nebari-dask-worker:2024.5.1
25+
dask_worker: [LOCAL_REPO]/quay.io/nebari/nebari-dask-worker:2024.5.1
2626
2727
security:
2828
keycloak:
2929
overrides:
3030
image:
3131
# Keycloak image repository
3232
#repository: quay.io/keycloak/keycloak # default
33-
repository: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com/quay.io/keycloak/keycloak
33+
repository: [LOCAL_REPO]/quay.io/keycloak/keycloak
3434
# Overrides the Keycloak image tag whose default is the chart version
3535
#tag: "15.0.2" # default
3636
tag: ""
@@ -49,17 +49,17 @@ security:
4949
chown 1000:1000 /data/keycloak-metrics-spi-2.5.3.jar &&
5050
chmod 777 /data/keycloak-metrics-spi-2.5.3.jar
5151
fi
52-
image: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com/alpine:latest
52+
image: [LOCAL_REPO]/alpine:latest
5353
name: initialize-spi-metrics-jar
5454
pgchecker:
5555
image:
5656
# repository: docker.io/busybox
57-
repository: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com/docker.io/busybox
57+
repository: [LOCAL_REPO]/docker.io/busybox
5858
tag: 1.32
5959
postgresql:
6060
image:
6161
#registry: docker.io
62-
registry: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com
62+
registry: [LOCAL_REPO]
6363
#repository: bitnami/postgresql
6464
repository: docker.io/bitnami/postgresql
6565
tag: 11.11.0-debian-10-r31
@@ -69,41 +69,41 @@ cluster_autoscaler:
6969
overrides:
7070
image:
7171
#repository: k8s.gcr.io/autoscaling/cluster-autoscaler
72-
repository: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com/k8s.gcr.io/autoscaling/cluster-autoscaler
72+
repository: [LOCAL_REPO]/k8s.gcr.io/autoscaling/cluster-autoscaler
7373
tag: v1.23.0
7474
7575
ingress:
7676
traefik-image:
77-
image: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com/traefik
77+
image: [LOCAL_REPO]/traefik
7878
tag: 2.9.1
7979
8080
conda_store:
81-
image: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com/quansight/conda-store-server
81+
image: [LOCAL_REPO]/quansight/conda-store-server
8282
image_tag: 2024.3.1
8383
8484
conda_store:
85-
nfs_server_image: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com/gcr.io/google_containers/volume-nfs
85+
nfs_server_image: [LOCAL_REPO]/gcr.io/google_containers/volume-nfs
8686
nfs_server_image_tag: "0.8"
8787
overrides:
8888
minio:
8989
image:
9090
#registry: docker.io
91-
registry: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com
91+
registry: [LOCAL_REPO]
9292
#repository: bitnami/minio
9393
repository: docker.io/bitnami/minio
9494
tag: 2021.4.22-debian-10-r0
9595
postgresql:
9696
image:
9797
#registry: docker.io
98-
registry: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com
98+
registry: [LOCAL_REPO]
9999
#repository: bitnami/postgresql
100100
repository: docker.io/bitnami/postgresql
101101
tag: 11.14.0-debian-10-r17
102102
digest: ""
103103
redis:
104104
image:
105105
#registry: docker.io
106-
registry: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com
106+
registry: [LOCAL_REPO]
107107
#repository: bitnami/redis
108108
repository: docker.io/bitnami/redis
109109
tag: 7.0.4-debian-11-r4
@@ -114,20 +114,20 @@ argo_workflows:
114114
controller:
115115
image:
116116
#registry: quay.io
117-
registry: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com
117+
registry: [LOCAL_REPO]
118118
#repository: argoproj/workflow-controller
119119
repository: quay.io/argoproj/workflow-controller
120120
tag: ""
121121
server:
122122
image:
123123
#registry: quay.io
124-
registry: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com
124+
registry: [LOCAL_REPO]
125125
#repository: argoproj/argocli
126126
repository: quay.io/argoproj/argocli
127127
tag: "v3.4.4"
128128
nebari_workflow_controller:
129129
enabled: true
130-
image: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com/quay.io/nebari/nebari-workflow-controller
130+
image: [LOCAL_REPO]/quay.io/nebari/nebari-workflow-controller
131131
image_tag: 2024.5.1
132132
133133
monitoring:
@@ -139,14 +139,14 @@ monitoring:
139139
image:
140140
#registry: quay.io
141141
#repository: prometheus/alertmanager
142-
registry: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com
142+
registry: [LOCAL_REPO]
143143
repository: quay.io/prometheus/alertmanager
144144
tag: v0.27.0
145145
sha: ""
146146
grafana:
147147
image:
148148
#registry: docker.io
149-
registry: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com
149+
registry: [LOCAL_REPO]
150150
#repository: grafana/grafana
151151
repository: docker.io/grafana/grafana
152152
tag: ""
@@ -155,31 +155,31 @@ monitoring:
155155
sidecar:
156156
image:
157157
#registry: quay.io
158-
registry: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com
158+
registry: [LOCAL_REPO]
159159
#repository: kiwigrid/k8s-sidecar
160160
repository: quay.io/kiwigrid/k8s-sidecar
161161
tag: 1.26.1
162162
sha: ""
163163
prometheusOperator:
164164
image:
165165
#registry: quay.io
166-
registry: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com
166+
registry: [LOCAL_REPO]
167167
#repository: prometheus-operator/prometheus-operator
168168
repository: quay.io/prometheus-operator/prometheus-operator
169169
tag: ""
170170
sha: ""
171171
prometheusConfigReloader:
172172
image:
173173
#registry: quay.io
174-
registry: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com
174+
registry: [LOCAL_REPO]
175175
#repository: prometheus-operator/prometheus-config-reloader
176176
repository: quay.io/prometheus-operator/prometheus-config-reloader
177177
tag: ""
178178
sha: ""
179179
kube-state-metrics:
180180
image:
181181
#registry: registry.k8s.io
182-
registry: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com
182+
registry: [LOCAL_REPO]
183183
#repository: kube-state-metrics/kube-state-metrics
184184
repository: registry.k8s.io/kube-state-metrics/kube-state-metrics
185185
tag: ""
@@ -188,7 +188,7 @@ monitoring:
188188
prometheus-node-exporter:
189189
image:
190190
#registry: quay.io
191-
registry: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com
191+
registry: [LOCAL_REPO]
192192
#repository: prometheus/node-exporter
193193
repository: quay.io/prometheus/node-exporter
194194
tag: ""
@@ -198,7 +198,7 @@ monitoring:
198198
prometheusSpec:
199199
image:
200200
#registry: quay.io
201-
registry: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com
201+
registry: [LOCAL_REPO]
202202
#repository: prometheus/prometheus
203203
repository: quay.io/prometheus/prometheus
204204
tag: v2.51.2
@@ -207,93 +207,93 @@ monitoring:
207207
loki:
208208
image:
209209
#registry: docker.io
210-
registry: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com
210+
registry: [LOCAL_REPO]
211211
#repository: grafana/loki
212212
repository: docker.io/grafana/loki
213213
tag: null
214214
lokiCanary:
215215
image:
216216
#registry: docker.io
217-
registry: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com
217+
registry: [LOCAL_REPO]
218218
#repository: grafana/loki-canary
219219
repository: docker.io/grafana/loki-canary
220220
tag: null
221221
gateway:
222222
image:
223223
#registry: docker.io
224-
registry: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com
224+
registry: [LOCAL_REPO]
225225
#repository: nginxinc/nginx-unprivileged
226226
repository: docker.io/nginxinc/nginx-unprivileged
227227
tag: 1.24-alpine
228228
sidecar:
229229
image:
230230
#repository: kiwigrid/k8s-sidecar
231-
repository: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com/kiwigrid/k8s-sidecar
231+
repository: [LOCAL_REPO]/kiwigrid/k8s-sidecar
232232
tag: 1.24.3
233233
promtail:
234234
image:
235235
#registry: docker.io
236-
registry: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com
236+
registry: [LOCAL_REPO]
237237
#repository: grafana/promtail
238238
repository: docker.io/grafana/promtail
239239
tag: null
240240
minio:
241241
image:
242242
#registry: docker.io
243-
registry: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com
243+
registry: [LOCAL_REPO]
244244
#repository: bitnami/minio
245245
repository: docker.io/bitnami/minio
246246
tag: 2021.4.22-debian-10-r0
247247
248248
jupyterhub:
249249
#volume_mount_init_image: "busybox:1.31"
250-
volume_mount_init_image: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com/busybox:1.31
250+
volume_mount_init_image: [LOCAL_REPO]/busybox:1.31
251251
proxy:
252252
chp:
253253
image:
254254
#name: quay.io/jupyterhub/configurable-http-proxy
255-
name: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com/quay.io/jupyterhub/configurable-http-proxy
255+
name: [LOCAL_REPO]/quay.io/jupyterhub/configurable-http-proxy
256256
tag: 4.6.1
257257
scheduling:
258258
userScheduler:
259259
enabled: true
260260
image:
261261
#name: registry.k8s.io/kube-scheduler
262-
name: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com/registry.k8s.io/kube-scheduler
262+
name: [LOCAL_REPO]/registry.k8s.io/kube-scheduler
263263
tag: "v1.28.10"
264264
singleuser:
265265
networkTools:
266266
image:
267267
#name: quay.io/jupyterhub/k8s-network-tools
268-
name: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com/quay.io/jupyterhub/k8s-network-tools
268+
name: [LOCAL_REPO]/quay.io/jupyterhub/k8s-network-tools
269269
tag: 4.0.0-0.dev.git.6548.h9b2dfe22
270270
prePuller:
271271
pause:
272272
image:
273273
#name: registry.k8s.io/pause
274-
name: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com/registry.k8s.io/pause
274+
name: [LOCAL_REPO]/registry.k8s.io/pause
275275
tag: "3.10"
276276
jupyterhub_ssh:
277277
jupyterhub_ssh_image:
278-
name: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com/quay.io/jupyterhub-ssh/ssh
278+
name: [LOCAL_REPO]/quay.io/jupyterhub-ssh/ssh
279279
tag: 0.0.1-0.dev.git.136.ha610981
280280
jupyterhub_sftp_image:
281-
name: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com/quay.io/jupyterhub-ssh/sftp
281+
name: [LOCAL_REPO]/quay.io/jupyterhub-ssh/sftp
282282
tag: 0.0.1-0.dev.git.142.h402a3d6
283283
284284
dask_gateway:
285285
dask_gateway_image:
286286
#name: ghcr.io/dask/dask-gateway-server
287-
name: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com/ghcr.io/dask/dask-gateway-server
287+
name: [LOCAL_REPO]/ghcr.io/dask/dask-gateway-server
288288
tag: "2022.4.0"
289289
dask_controller_image:
290290
#name: ghcr.io/dask/dask-gateway-server
291-
name: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com/ghcr.io/dask/dask-gateway-server
291+
name: [LOCAL_REPO]/ghcr.io/dask/dask-gateway-server
292292
tag: "2022.4.0"
293293
294294
forward_auth:
295295
traefik_forwardauth_image:
296296
#name: maxisme/traefik-forward-auth
297-
name: [LOCAL_ECR].dkr.ecr.us-gov-east-1.amazonaws.com/maxisme/traefik-forward-auth
297+
name: [LOCAL_REPO]/maxisme/traefik-forward-auth
298298
tag: "sha-a98e568"
299299
```

0 commit comments

Comments
 (0)