feat(docker-registry): add registry

apps/docker-registry/base/config.yml

@@ -0,0 +1,24 @@
+health:
+  storagedriver:
+    enabled: true
+    interval: 10s
+    threshold: 3
+http:
+  addr: :5000
+  debug:
+    addr: :5001
+    prometheus:
+      enabled: false
+      path: /metrics
+  headers:
+    X-Content-Type-Options:
+    - nosniff
+log:
+  fields:
+    service: registry
+storage:
+  cache:
+    blobdescriptor: inmemory
+version: 0.1
+
+

apps/docker-registry/base/cronjob.yaml

@@ -0,0 +1,85 @@
+---
+# Source: docker-registry/templates/cronjob.yaml
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: docker-registry-garbage-collector
+  namespace: gitops
+  labels:
+    app: docker-registry
+    chart: docker-registry-2.2.3
+    release: docker-registry
+    heritage: Helm
+spec:
+  schedule: "0 1 * * *"
+  jobTemplate:
+    metadata:
+      labels:
+        app: docker-registry
+        release: docker-registry
+      annotations:
+        checksum/config: 7768037b11264d8a85079c7389faa0b2846b55771ae7ea102d41f7ea868676fb
+        checksum/secret: cf8de4fbecd435bc3788328888b074e895540fd0a0681fa391ee2d3f42e1e599
+    spec:
+      template:
+        spec:
+          securityContext: 
+            fsGroup: 1000
+            runAsUser: 1000
+          containers:
+            - name: docker-registry
+              image: "registry:2.8.1"
+              imagePullPolicy: IfNotPresent
+              command:
+              - /bin/registry
+              - garbage-collect
+              - --delete-untagged=true
+              - /etc/docker/registry/config.yml
+              env: 
+                - name: REGISTRY_HTTP_SECRET
+                  valueFrom:
+                    secretKeyRef:
+                      name: docker-registry-secret
+                      key: haSharedSecret
+                - name: REGISTRY_AUTH
+                  value: "htpasswd"
+                - name: REGISTRY_AUTH_HTPASSWD_REALM
+                  value: "Registry Realm"
+                - name: REGISTRY_AUTH_HTPASSWD_PATH
+                  value: "/auth/htpasswd"
+                - name: REGISTRY_STORAGE_FILESYSTEM_ROOTDIRECTORY
+                  value: "/var/lib/registry"
+                - name: REGISTRY_PROXY_REMOTEURL
+                  value: https://registry-1.docker.io
+                - name: REGISTRY_PROXY_USERNAME
+                  valueFrom:
+                    secretKeyRef:
+                      name: docker-registry-secret
+                      key: proxyUsername
+                - name: REGISTRY_PROXY_PASSWORD
+                  valueFrom:
+                    secretKeyRef:
+                      name: docker-registry-secret
+                      key: proxyPassword
+              volumeMounts: 
+                - name: "docker-registry-config"
+                  mountPath: "/etc/docker/registry"
+                - name: auth
+                  mountPath: /auth
+                  readOnly: true
+                - name: data
+                  mountPath: /var/lib/registry/
+          restartPolicy: OnFailure
+          volumes: 
+            - name: docker-registry-config
+              configMap:
+                name: docker-registry-config
+            - name: auth
+              secret:
+                secretName: docker-registry-secret
+                items:
+                - key: htpasswd
+                  path: htpasswd
+            - name: data
+              emptyDir: {}
+

apps/docker-registry/base/deployment.yaml

@@ -0,0 +1,102 @@
+---
+# Source: docker-registry/templates/deployment.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: docker-registry
+  namespace: gitops
+  labels:
+    app: docker-registry
+    chart: docker-registry-2.2.3
+    release: docker-registry
+    heritage: Helm
+spec:
+  selector:
+    matchLabels:
+      app: docker-registry
+      release: docker-registry
+  replicas: 1
+  strategy: 
+    rollingUpdate:
+      maxSurge: 1
+      maxUnavailable: 0
+    type: RollingUpdate
+  minReadySeconds: 5
+  template:
+    metadata:
+      labels:
+        app: docker-registry
+        release: docker-registry
+      annotations:
+        updated-at/secret: 2024-10-16T14:38:25-04:00
+    spec:
+      securityContext: 
+        fsGroup: 1000
+        runAsUser: 1000
+      containers:
+        - name: docker-registry
+          image: "registry:2.8.1"
+          imagePullPolicy: IfNotPresent
+          command:
+          - /bin/registry
+          - serve
+          - /etc/docker/registry/config.yml
+          ports:
+            - containerPort: 5000
+          livenessProbe:
+            httpGet:
+              path: /
+              port: 5000
+          readinessProbe:
+            httpGet:
+              path: /
+              port: 5000
+          resources: 
+            {}
+          env: 
+            - name: REGISTRY_HTTP_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: docker-registry-secret
+                  key: haSharedSecret
+            - name: REGISTRY_AUTH
+              value: "htpasswd"
+            - name: REGISTRY_AUTH_HTPASSWD_REALM
+              value: "Registry Realm"
+            - name: REGISTRY_AUTH_HTPASSWD_PATH
+              value: "/auth/htpasswd"
+            - name: REGISTRY_STORAGE_FILESYSTEM_ROOTDIRECTORY
+              value: "/var/lib/registry"
+            - name: REGISTRY_PROXY_REMOTEURL
+              value: https://registry-1.docker.io
+            - name: REGISTRY_PROXY_USERNAME
+              valueFrom:
+                secretKeyRef:
+                  name: docker-registry-secret
+                  key: proxyUsername
+            - name: REGISTRY_PROXY_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: docker-registry-secret
+                  key: proxyPassword
+          volumeMounts: 
+            - name: "docker-registry-config"
+              mountPath: "/etc/docker/registry"
+            - name: auth
+              mountPath: /auth
+              readOnly: true
+            - name: data
+              mountPath: /var/lib/registry/
+      volumes: 
+        - name: docker-registry-config
+          configMap:
+            name: docker-registry-config
+        - name: auth
+          secret:
+            secretName: docker-registry-secret
+            items:
+            - key: htpasswd
+              path: htpasswd
+        - name: data
+          persistentVolumeClaim:
+            claimName: docker-registry

apps/docker-registry/base/ingress.yaml

@@ -0,0 +1,33 @@
+---
+# Source: docker-registry/templates/ingress.yaml
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: docker-registry
+  namespace: gitops
+  labels:
+    app: docker-registry
+    chart: docker-registry-2.2.3
+    release: docker-registry
+    heritage: Helm
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-issuer
+    nginx.ingress.kubernetes.io/whitelist-source-range: 192.168.1.1/16
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: registry.int.nc.landry.land
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: docker-registry
+                port:
+                  name: http
+  tls:
+    - hosts:
+      - registry.int.nc.landry.land
+      secretName: registry-tls
+

apps/docker-registry/base/kustomization.yaml

@@ -0,0 +1,15 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - deployment.yaml
+  - ingress.yaml
+  - pvc.yaml
+  - service.yaml
+  - pdb.yaml
+  - cronjob.yaml
+
+configMapGenerator:
+  - name: docker-registry-config
+    files:
+      - config.yml

apps/docker-registry/base/pdb.yaml

@@ -0,0 +1,19 @@
+---
+# Source: docker-registry/templates/poddisruptionbudget.yaml
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: docker-registry
+  namespace: gitops
+  labels:
+    app: docker-registry
+    chart: docker-registry-2.2.3
+    release: docker-registry
+    heritage: Helm
+spec:
+  selector:
+    matchLabels:
+      app: docker-registry
+      release: docker-registry
+  maxUnavailable: 1
+

apps/docker-registry/base/pvc.yaml

@@ -0,0 +1,19 @@
+---
+# Source: docker-registry/templates/pvc.yaml
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: docker-registry
+  namespace: gitops
+  labels:
+    app: docker-registry
+    chart: "docker-registry-2.2.3"
+    release: "docker-registry"
+    heritage: "Helm"
+spec:
+  accessModes:
+    - "ReadWriteOnce"
+  resources:
+    requests:
+      storage: "10Gi"
+

apps/docker-registry/base/service.yaml

@@ -0,0 +1,23 @@
+---
+# Source: docker-registry/templates/service.yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: docker-registry
+  namespace: gitops
+  labels:
+    app: docker-registry
+    chart: docker-registry-2.2.3
+    release: docker-registry
+    heritage: Helm
+spec:
+  type: ClusterIP
+  ports:
+    - port: 5000
+      protocol: TCP
+      name: http
+      targetPort: 5000
+  selector:
+    app: docker-registry
+    release: docker-registry
+