Registry add TLS and authentication support (#8229)

* Add registry TLS support

* Add registry configmap and htpasswd auth
This commit is contained in:
zhengtianbao 2021-12-07 10:32:00 -06:00 committed by GitHub
parent 990ca38d21
commit 4ef2cf4c28
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
5 changed files with 98 additions and 0 deletions

View file

@ -5,3 +5,27 @@ registry_storage_access_mode: "ReadWriteOnce"
registry_disk_size: "10Gi" registry_disk_size: "10Gi"
registry_port: 5000 registry_port: 5000
registry_replica_count: 1 registry_replica_count: 1
# name of kubernetes secret for registry TLS certs
registry_tls_secret: ""
registry_htpasswd: ""
# registry configuration
# see: https://docs.docker.com/registry/configuration/#list-of-configuration-options
registry_config:
version: 0.1
log:
fields:
service: registry
storage:
cache:
blobdescriptor: inmemory
http:
addr: :{{ registry_port }}
headers:
X-Content-Type-Options: [nosniff]
health:
storagedriver:
enabled: true
interval: 10s
threshold: 3

View file

@ -15,6 +15,8 @@
- { name: registry-sa, file: registry-sa.yml, type: sa } - { name: registry-sa, file: registry-sa.yml, type: sa }
- { name: registry-proxy-sa, file: registry-proxy-sa.yml, type: sa } - { name: registry-proxy-sa, file: registry-proxy-sa.yml, type: sa }
- { name: registry-svc, file: registry-svc.yml, type: svc } - { name: registry-svc, file: registry-svc.yml, type: svc }
- { name: registry-secrets, file: registry-secrets.yml, type: secrets }
- { name: registry-cm, file: registry-cm.yml, type: cm }
- { name: registry-rs, file: registry-rs.yml, type: rs } - { name: registry-rs, file: registry-rs.yml, type: rs }
- { name: registry-proxy-ds, file: registry-proxy-ds.yml, type: ds } - { name: registry-proxy-ds, file: registry-proxy-ds.yml, type: ds }
registry_templates_for_psp: registry_templates_for_psp:

View file

@ -0,0 +1,10 @@
apiVersion: v1
kind: ConfigMap
metadata:
name: registry-config
namespace: {{ registry_namespace }}
{% if registry_config %}
data:
config.yml: |-
{{ registry_config | to_yaml(indent=2, width=1337) | indent(width=4) }}
{% endif %}

View file

@ -33,24 +33,60 @@ spec:
- name: registry - name: registry
image: {{ registry_image_repo }}:{{ registry_image_tag }} image: {{ registry_image_repo }}:{{ registry_image_tag }}
imagePullPolicy: {{ k8s_image_pull_policy }} imagePullPolicy: {{ k8s_image_pull_policy }}
command:
- /bin/registry
- serve
- /etc/docker/registry/config.yml
env: env:
- name: REGISTRY_HTTP_ADDR - name: REGISTRY_HTTP_ADDR
value: :{{ registry_port }} value: :{{ registry_port }}
- name: REGISTRY_STORAGE_FILESYSTEM_ROOTDIRECTORY - name: REGISTRY_STORAGE_FILESYSTEM_ROOTDIRECTORY
value: /var/lib/registry value: /var/lib/registry
{% if registry_htpasswd != "" %}
- name: REGISTRY_AUTH
value: "htpasswd"
- name: REGISTRY_AUTH_HTPASSWD_REALM
value: "Registry Realm"
- name: REGISTRY_AUTH_HTPASSWD_PATH
value: "/auth/htpasswd"
{% endif %}
{% if registry_tls_secret != "" %}
- name: REGISTRY_HTTP_TLS_CERTIFICATE
value: /etc/ssl/docker/tls.crt
- name: REGISTRY_HTTP_TLS_KEY
value: /etc/ssl/docker/tls.key
{% endif %}
volumeMounts: volumeMounts:
- name: registry-pvc - name: registry-pvc
mountPath: /var/lib/registry mountPath: /var/lib/registry
- name: registry-config
mountPath: /etc/docker/registry
{% if registry_htpasswd != "" %}
- name: auth
mountPath: /auth
readOnly: true
{% endif %}
{% if registry_tls_secret != "" %}
- name: tls-cert
mountPath: /etc/ssl/docker
readOnly: true
{% endif %}
ports: ports:
- containerPort: {{ registry_port }} - containerPort: {{ registry_port }}
name: registry name: registry
protocol: TCP protocol: TCP
livenessProbe: livenessProbe:
httpGet: httpGet:
{% if registry_tls_secret != "" %}
scheme: HTTPS
{% endif %}
path: / path: /
port: {{ registry_port }} port: {{ registry_port }}
readinessProbe: readinessProbe:
httpGet: httpGet:
{% if registry_tls_secret != "" %}
scheme: HTTPS
{% endif %}
path: / path: /
port: {{ registry_port }} port: {{ registry_port }}
volumes: volumes:
@ -60,4 +96,20 @@ spec:
claimName: registry-pvc claimName: registry-pvc
{% else %} {% else %}
emptyDir: {} emptyDir: {}
{% endif %}
- name: registry-config
configMap:
name: registry-config
{% if registry_htpasswd != "" %}
- name: auth
secret:
secretName: registry-secret
items:
- key: htpasswd
path: htpasswd
{% endif %}
{% if registry_tls_secret != "" %}
- name: tls-cert
secret:
secretName: {{ registry_tls_secret }}
{% endif %} {% endif %}

View file

@ -0,0 +1,10 @@
apiVersion: v1
kind: Secret
metadata:
name: registry-secret
namespace: {{ registry_namespace }}
type: Opaque
data:
{% if registry_htpasswd != "" %}
htpasswd: {{ registry_htpasswd | b64encode }}
{% endif %}