Skip to content

Commit 61f154b

Browse files
ikhandamirovikhandamirov
authored
feat: in-cluster zot registry as part of deployment (#112)
#### What this PR does / why we need it With this PR an in-cluster instance of `zot` OCI registry will be deployed aside to the controllers: * `make deploy-dev` makes `zot` accessible via http. * `make deploy` makes `zot` accessible via https. #### Which issue(s) this PR fixes This PR is in the context of #75 and should be merged before #98
1 parent 438d76a commit 61f154b

11 files changed

+250
-6
lines changed

‎Makefile

Lines changed: 44 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -121,8 +121,8 @@ docker-buildx: ## Build and push docker image for the manager for cross-platform
121121
.PHONY: build-installer
122122
build-installer: manifests generate kustomize ## Generate a consolidated YAML with CRDs and deployment.
123123
mkdir -p dist
124-
cd config/manager && $(KUSTOMIZE) edit set image controller=${IMG}
125-
$(KUSTOMIZE) build config/default > dist/install.yaml
124+
$(call set-images)
125+
$(KUSTOMIZE) build config/default-zot-https > dist/install.yaml
126126

127127
##@ Deployment
128128

@@ -138,14 +138,26 @@ install: manifests kustomize ## Install CRDs into the K8s cluster specified in ~
138138
uninstall: manifests kustomize ## Uninstall CRDs from the K8s cluster specified in ~/.kube/config. Call with ignore-not-found=true to ignore resource not found errors during deletion.
139139
$(KUSTOMIZE) build config/crd | $(KUBECTL) delete --ignore-not-found=$(IGNORE_NOT_FOUND) -f -
140140

141-
.PHONY: deploy
142-
deploy: manifests kustomize ## Deploy controller to the K8s cluster specified in ~/.kube/config.
143-
cd config/manager && $(KUSTOMIZE) edit set image controller=${IMG}
141+
.PHONY: deploy-dev
142+
deploy-dev: manifests kustomize ## Deploy controller to the K8s cluster specified in ~/.kube/config. In-cluster zot registry is accessible via http. If you need https, use deploy target.
143+
$(call set-images)
144144
$(KUSTOMIZE) build config/default | $(KUBECTL) apply -f -
145145

146+
.PHONY: undeploy-dev
147+
undeploy-dev: kustomize ## Undeploy controller from the K8s cluster specified in ~/.kube/config. Call with ignore-not-found=true to ignore resource not found errors during deletion.
148+
$(KUSTOMIZE) build config/default | $(KUBECTL) delete --ignore-not-found=$(IGNORE_NOT_FOUND) -f -
149+
150+
.PHONY: deploy
151+
deploy: deploy-cert-manager manifests kustomize ## Deploy controller to the K8s cluster specified in ~/.kube/config. In-cluster zot registry is accessible via https. If you need http, use deploy-dev target.
152+
$(call set-images)
153+
$(KUSTOMIZE) build config/default-zot-https | $(KUBECTL) apply -f -
154+
155+
# Undeploy target undeploys the controller, its zot regostry and related certificates.
156+
# However, it does not undeploy the cert-manager, which might still be needed by other applications in the cluster.
157+
# If you wish to undeploy cert manager as well, execute 'make undeploy-cert-manager' in addition.
146158
.PHONY: undeploy
147159
undeploy: kustomize ## Undeploy controller from the K8s cluster specified in ~/.kube/config. Call with ignore-not-found=true to ignore resource not found errors during deletion.
148-
$(KUSTOMIZE) build config/default | $(KUBECTL) delete --ignore-not-found=$(IGNORE_NOT_FOUND) -f -
160+
$(KUSTOMIZE) build config/default-zot-https | $(KUBECTL) delete --ignore-not-found=$(IGNORE_NOT_FOUND) -f -
149161

150162
##@ Dependencies
151163

@@ -167,6 +179,14 @@ CONTROLLER_TOOLS_VERSION ?= v0.16.0
167179
ENVTEST_VERSION ?= release-0.18
168180
GOLANGCI_LINT_VERSION ?= v1.61.0
169181

182+
## ZOT OCI Registry
183+
ZOT_VERSION ?= v2.1.2
184+
ZOT_IMG ?= ghcr.io/project-zot/zot-minimal:$(ZOT_VERSION)
185+
186+
## cert-manager
187+
CERT-MANAGER_VERSION ?= v1.16.3
188+
CERT-MANAGER_YAML ?= https://github.com/cert-manager/cert-manager/releases/download/$(CERT-MANAGER_VERSION)/cert-manager.yaml
189+
170190
.PHONY: kustomize
171191
kustomize: $(KUSTOMIZE) ## Download kustomize locally if necessary.
172192
$(KUSTOMIZE): $(LOCALBIN)
@@ -182,6 +202,17 @@ envtest: $(ENVTEST) ## Download setup-envtest locally if necessary.
182202
$(ENVTEST): $(LOCALBIN)
183203
$(call go-install-tool,$(ENVTEST),sigs.k8s.io/controller-runtime/tools/setup-envtest,$(ENVTEST_VERSION))
184204

205+
.PHONY: deploy-cert-manager
206+
deploy-cert-manager: ## Deploy cert-manager to the K8s cluster specified in ~/.kube/config.
207+
$(KUBECTL) apply -f $(CERT-MANAGER_YAML)
208+
$(KUBECTL) wait --for=condition=Available=True Deployment/cert-manager -n cert-manager --timeout=60s
209+
$(KUBECTL) wait --for=condition=Available=True Deployment/cert-manager-webhook -n cert-manager --timeout=60s
210+
$(KUBECTL) wait --for=condition=Available=True Deployment/cert-manager-cainjector -n cert-manager --timeout=60s
211+
212+
.PHONY: undeploy-cert-manager
213+
undeploy-cert-manager: ## Undeploy cert-manager from the K8s cluster specified in ~/.kube/config.
214+
$(KUBECTL) delete --ignore-not-found=$(IGNORE_NOT_FOUND) -f $(CERT-MANAGER_YAML)
215+
185216
.PHONY: golangci-lint
186217
golangci-lint: $(GOLANGCI_LINT) ## Download golangci-lint locally if necessary.
187218
$(GOLANGCI_LINT): $(LOCALBIN)
@@ -200,3 +231,10 @@ GOBIN=$(LOCALBIN) go install $${package} ;\
200231
mv "$$(echo "$(1)" | sed "s/-$(3)$$//")" $(1) ;\
201232
}
202233
endef
234+
235+
# set-images will set use kustomize to set the specified images for the controller and zot registry
236+
define set-images
237+
set -e
238+
cd config/manager && $(KUSTOMIZE) edit set image controller=${IMG}
239+
cd config/zot && $(KUSTOMIZE) edit set image zot-minimal=${ZOT_IMG}
240+
endef

‎config/default-zot-https/certificate.yaml

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
apiVersion: cert-manager.io/v1
2+
kind: ClusterIssuer
3+
metadata:
4+
name: ocm-k8s-toolkit-bootstrap-issuer
5+
namespace: ocm-k8s-toolkit-system
6+
spec:
7+
selfSigned: {}
8+
---
9+
apiVersion: cert-manager.io/v1
10+
kind: Certificate
11+
metadata:
12+
name: ocm-k8s-toolkit-bootstrap-certificate
13+
namespace: ocm-k8s-toolkit-system
14+
spec:
15+
# this is discouraged but required by ios
16+
commonName: cert-manager-ocm-tls
17+
isCA: true
18+
secretName: ocm-k8s-toolkit-registry-tls-certs
19+
subject:
20+
organizations:
21+
- ocm.software
22+
dnsNames:
23+
- ocm-k8s-toolkit-zot-registry.ocm-k8s-toolkit-system.svc.cluster.local
24+
- localhost
25+
ipAddresses:
26+
- 127.0.0.1
27+
- ::1
28+
privateKey:
29+
algorithm: RSA
30+
encoding: PKCS8
31+
size: 2048
32+
issuerRef:
33+
name: ocm-k8s-toolkit-bootstrap-issuer
34+
kind: ClusterIssuer
35+
group: cert-manager.io
36+
---
37+
apiVersion: cert-manager.io/v1
38+
kind: ClusterIssuer
39+
metadata:
40+
name: ocm-k8s-toolkit-certificate-issuer
41+
namespace: ocm-k8s-toolkit-system
42+
spec:
43+
ca:
44+
secretName: ocm-k8s-toolkit-registry-tls-certs

‎config/default-zot-https/configmap-patch.yaml

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
apiVersion: v1
2+
kind: ConfigMap
3+
metadata:
4+
name: zot-config
5+
data:
6+
config.json: |
7+
{
8+
"storage": {
9+
"rootDirectory": "/tmp/zot",
10+
"commit": true,
11+
"dedupe": true,
12+
"gc": true,
13+
"gcDelay": "1h",
14+
"gcInterval": "24h"
15+
},
16+
"http": {
17+
"address":"0.0.0.0",
18+
"port": "5000",
19+
"tls": {
20+
"cert":"/etc/zot/tls/tls.crt",
21+
"key":"/etc/zot/tls/tls.key"
22+
}
23+
},
24+
"log": {
25+
"level": "debug"
26+
}
27+
}

‎config/default-zot-https/deployment-patch.yaml

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: zot-registry
5+
spec:
6+
template:
7+
spec:
8+
containers:
9+
- name: zot-registry
10+
volumeMounts:
11+
- name: zot-tls
12+
mountPath: /etc/zot/tls
13+
readOnly: true
14+
volumes:
15+
- name: zot-tls
16+
secret:
17+
secretName: ocm-k8s-toolkit-registry-tls-certs
18+
# Registry is accessible in-cluster under:
19+
# https://ocm-k8s-toolkit-zot-registry.ocm-k8s-toolkit-system.svc.cluster.local:5000/v2/_catalog

‎config/default-zot-https/get_secret.sh

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
#!/usr/bin/env bash
2+
3+
# Hack: extract secret from cluster to local dir, e.g. for testing or debugging
4+
kubectl get secret ocm-k8s-toolkit-registry-tls-certs -n ocm-k8s-toolkit-system -o jsonpath="{.data['tls\.crt']}" | base64 -d > config/zot-https/rootCA.pem
5+
6+
# Alternatively `curl` can be used (https://curl.se/docs/sslcerts.html):
7+
# curl -k -w %{certs} https://localhost:31000/v2/_catalog > config/zot-https/rootCA.pem
8+
# curl --cacert config/zot-https/rootCA.pem https://localhost:31000/v2/_catalog
9+
10+
# The pem file can be added to the system trust store (https://github.com/FiloSottile/mkcert):
11+
# CAROOT=config/zot-https mkcert -install

‎config/default-zot-https/kustomization.yaml

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
apiVersion: kustomize.config.k8s.io/v1beta1
2+
kind: Kustomization
3+
resources:
4+
- certificate.yaml
5+
- ../default
6+
patches:
7+
- path: configmap-patch.yaml
8+
- path: deployment-patch.yaml

‎config/default/kustomization.yaml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ namePrefix: ocm-k8s-toolkit-
1717
resources:
1818
- ../crd
1919
- ../rbac
20+
- ../zot
2021
- ../manager
2122
# [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix including the one in
2223
# crd/kustomization.yaml

‎config/zot/configmap.yaml

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
apiVersion: v1
2+
kind: ConfigMap
3+
metadata:
4+
name: zot-config
5+
data:
6+
# for docker compatibility, add '"http": { "compat": "docker2s2" }'
7+
config.json: |
8+
{
9+
"storage": {
10+
"rootDirectory": "/tmp/zot",
11+
"commit": true,
12+
"dedupe": true,
13+
"gc": true,
14+
"gcDelay": "1h",
15+
"gcInterval": "24h"
16+
},
17+
"http": {
18+
"address":"0.0.0.0",
19+
"port": "5000"
20+
},
21+
"log": {
22+
"level": "debug"
23+
}
24+
}

‎config/zot/deployment.yaml

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: zot-registry
5+
spec:
6+
replicas: 1
7+
selector:
8+
matchLabels:
9+
app: zot
10+
template:
11+
metadata:
12+
labels:
13+
app: zot
14+
spec:
15+
containers:
16+
- name: zot-registry
17+
image: zot-minimal:latest
18+
ports:
19+
- containerPort: 5000
20+
volumeMounts:
21+
- name: zot-config-volume
22+
mountPath: /etc/zot/config.json
23+
subPath: config.json
24+
- name: zot-storage
25+
mountPath: /tmp/zot
26+
volumes:
27+
- name: zot-config-volume
28+
configMap:
29+
name: zot-config
30+
- name: zot-storage
31+
emptyDir: {}
32+
# Manual test if the registry is running:
33+
# % kubectl run -i --tty --rm debug --image=busybox --restart=Never -- /bin/sh
34+
# # wget -qO- http://ocm-k8s-toolkit-zot-registry.ocm-k8s-toolkit-system.svc.cluster.local:5000/v2/_catalog
35+
# {"repositories":[]}
36+
# # exit

‎config/zot/kustomization.yaml

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
apiVersion: kustomize.config.k8s.io/v1beta1
2+
kind: Kustomization
3+
resources:
4+
- configmap.yaml
5+
- deployment.yaml
6+
- service.yaml
7+
images:
8+
- name: zot-minimal
9+
newName: ghcr.io/project-zot/zot-minimal
10+
newTag: latest

‎config/zot/service.yaml

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
apiVersion: v1
2+
kind: Service
3+
metadata:
4+
name: zot-registry
5+
spec:
6+
type: ClusterIP
7+
ports:
8+
- port: 5000
9+
targetPort: 5000
10+
selector:
11+
app: zot
12+
# ---
13+
# Uncomment if you need an external port to the image registry
14+
# Can be reached e.g. from the host with 'localhost:31000'
15+
# apiVersion: v1
16+
# kind: Service
17+
# metadata:
18+
# name: zot-registry-external
19+
# spec:
20+
# type: NodePort
21+
# ports:
22+
# - port: 5000
23+
# targetPort: 5000
24+
# nodePort: 31000
25+
# selector:
26+
# app: zot

0 commit comments

Comments
 (0)