Parameters

The parent key for all of the following parameters is registry_cache.

namespace

type

string
default

syn-${_instance}

The namespace in which to deploy this component.

fqdn

type

string
default

dockerhub.vshn.net

FQDN under which the registry will be served

expose_type

type

string
default

ingress
possible values

ingress or route

Whether to use an Ingress or Route object to expose the registry.

htpasswd

type

string
default

null

The content of the htpasswd file, used to secure the registry-cache.

The component will raise an error if more than one of htpasswd, externalHtpasswdSecret and projectsynHtpasswd.enabled are non-null or true.

externalHtpasswdSecret

type

string
default

null

The name of an externally managed secret which holds a htpasswd file that should be used to secure the registry cache.

The component will raise an error if more than one of htpasswd, externalHtpasswdSecret and projectsynHtpasswd.enabled are non-null or true.

projectsynHtpasswd

type

dict

This parameter allows users to configure a Project Syn-aware htpasswd secret for the registry.

When enabled, the Project Syn-aware htpasswd file is rendered by a combination of External Secrets Operator resources and an Espejote ManagedResource. When enabled, the component configures the registry to mount the secret containing the Project Syn-aware htpasswd file. The Espejote ManagedResource renders the htpasswd file from the secret managed by External Secrets Operator and adds an annotation to the registry deployment to ensure the registry restarts and loads the updated htpasswd if there are any changes.

The Project Syn-aware htpasswd file contains a username and password pair for each Project Syn cluster registered on each Lieutenant instance defined in parameter projectsynHtpasswd.lieutenantInstances.

The username for each htpasswd entry is the cluster’s Project Syn ID with the provided userPrefix associated with the cluster’s Lieutenant instance. If field userPrefix is omitted, the user name is the cluster’s Project Syn ID. We recommend setting field userPrefix if there’s a chance that the configured Lieutenant instances could contain colliding cluster IDs.

The password for each htpasswd entry is the SHA-256 sum of the cluster’s Steward token.

projectsynHtpasswd.enabled

type

boolean
default

false

This parameter controls whether the Project Syn-aware htpasswd is rendered and configured in the registry deployment.

The component will raise an error if more than one of htpasswd, externalHtpasswdSecret and projectsynHtpasswd.enabled are non-null or true.

projectsynHtpasswd.secretName

type

string
default

projectsyn-htpasswd

The name of the secret which holds the Project Syn-aware htpasswd.

The component also derives the name of most other resources that are part of the Project Syn-aware htpasswd logic from the value of this parameter.

projectsynHtpasswd.lieutenantInstances

type

dict

default

{}

The component expects the value of each entry of this parameter to have fields kubernetesUrl and token. Additionally, the component supports optional fields userPrefix and lieutenantNamespace for entries of this parameter.

The component creates an External Secrets Operator SecretStore for each Lieutenant cluster specified in this parameter. The token provided in field token must be a Kubernetes service account token bound to a service account which is able to list all secrets in namespace lieutenantNamespace (or namespace lieutenant if this optional field isn’t provided) on the cluster specified in kubernetesUrl.

We recommend defining the token as a Vault reference.

`projectsynHtpasswd.clusterTokenRefreshInterval

type

string
default

1h

This parameter configures how frequently the cluster Steward token secrets are fetched from the configured Lieutenant instances.

If you require that the registry htpasswd is updated quickly after a cluster is registered on a configured Lieutenant instance, we recommend lowering this parameter from its default value of 1h.

The parameter must be specified as a Golang Duration string. Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".

externalProxyCredentialsSecret

type

string
default

null

The name of an externally managed secret which holds username and password used to authenticate to the upstream (proxied) registry.

The component will raise an error if both registry.config.proxy.username and registry.config.proxy.password and externalProxyCredentialsSecret are non-null.

imagePullSecretName

type

string
default

registry-pull-secret

The name of an image pull secret to use, if not null. The secret is configured for both the Registry and the Redis deployments.

imagePullSecret

type

dict
default 
imagePullSecret:
  type: 'kubernetes.io/dockerconfigjson'
  stringData:
    .dockerconfigjson: '?{vaultkv:${cluster:tenant}/${cluster:name}/registry-cache/image_pull_secret}'

The image pull secret for pulling from docker.io.

This creates a secret of type kubernetes.io/dockerconfigjson.

stringData:
  .dockerconfigjson: |
    {
      "auths": {
        "docker.io": { xxx }
      }
    }

redis

Configuration of the Redis component.

redis.enabled

type

bool
default

true

Whether or not to deploy and use redis as a Blob descriptor cache.

redis.resources

type: dict default: See class/defaults.yml

Configure resource requests and limits for Redis component.

Memory limit must be specified in the redis resources limits, as Redis is used as a LRU cache.

redis.config

type: dict default: See class/defaults.yml

Redis configuration.

registry

Configuration of the Registry component.

Component-visible changes to registry.config will trigger a restart of the registry deployment pods.

Notably, updating a secret in Vault won’t trigger a restart of the registry deployment pods, since Vault updates aren’t visible in the component.

registry.replicas

type: integer default:: 2

Configures how many replicas of the Registry component to deploy.

registry.config.storage.s3.bucket, registry.config.storage.s3.regionendpoint

type

strings
mandatory

yes
example 
s3:
  bucket: example-harbor-instance-data
  endpoint: https://s3.example.com/

S3 configuration for the image store

registry.config.storage.s3.accesskey, registry.config.storage.s3.secretkey

type

strings
default

Vault reference

S3 credentials for storing image blobs.

registry.config.proxy.username, registry.config.proxy.password

type

string
default

Vault reference

Vault references to the username and password for the upstream (proxied) registry.

The component will raise an error if both registry.config.proxy.username and registry.config.proxy.password and externalProxyCredentialsSecret are non-null.

http_secret

type

string
default

Vault reference

HTTP Session secret. Must be set but is only used internally.

rules

type

dict
default

{}
example 
rules:
  generic-rules:
    "alert:RegistryHighRequestDuration":
      expr: |
        registry_http_request_duration_seconds_sum > 0.1
      labels:
        severity: warning

This parameter allows users to configure Prometheus rules to deploy for the registry-cache.

Each key-value pair in the dictionary is transformed into a PrometheusRule object by the component.

The component expects that values are dicts themselves and expects that keys in those dicts are prefixed with record: or alert: to indicate whether the rule is a recording or alerting rule. The component will transform the keys into fields in the resulting rule by taking the prefix as the field name and the rest of the key as the field value. For example, key "record:sum:some:metric:5m" would be transformed into record: sum:some:metric:5m which should define a recording rule with name sum:some:metric:5m. This field is then merged into the provided value which should be a valid rule definition.

See the Prometheus docs for supported configurations for recording and alerting rules.

Vault secrets

# Adjust to your environment
key="clusters/kv/${TENANT_ID}/${CLUSTER_ID}/registry-cache"

# Query for existing secrets first
vault kv get "${key}"

# If there are existing secrets, add your instance secrets:
vault kv patch "${key}" \
  http_secret=$(pwgen 32 1) \
  proxy_username=DOCKER_HUB_USERNAME \
  proxy_password=DOCKER_HUB_PASSWORD \
  s3_accesskey=S3_ACCESS_KEY \
  s3_secretkey=S3_SECRET_KEY

# If there is no pre-existing secret, create new:
vault kv put "${key}" \
  http_secret=$(pwgen 32 1) \
  proxy_username=DOCKER_HUB_USERNAME \
  proxy_password=DOCKER_HUB_PASSWORD \
  s3_accesskey=S3_ACCESS_KEY \
  s3_secretkey=S3_SECRET_KEY