gstykalin/kube-forge
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

update images for registry and cicd modules and add ability to set registry mirrors for orchestrator

Browse Source
This commit is contained in:
George Stykalin
2024-06-01 21:38:17 +03:00
parent 005f7bfbe9
commit cd368c7755
13 changed files with 275 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
.gitlab-ci.yml
View File

@@ -5,7 +5,7 @@ variables:
KANIKO_CONTEXT: ${CI_PROJECT_DIR}
RELEASE_CLI_IMAGE: harbor.kvazaric.ru/kube-forge/release-cli:v0.18.0
CICD_MULTITOOL: harbor.kvazaric.ru/postgres-tasks/cicd-multitool:2.4
BINARY_BUILDER_IMAGE: golang:alpine
BINARY_BUILDER_IMAGE: harbor.kvazaric.ru/mirror/library/golang:alpine
PREPARE_RELEASE:
options:

4
build/docker/Dockerfile
View File

@@ -1,5 +1,5 @@
## Install dependencies
FROM python:3.12 as deps
FROM harbor.kvazaric.ru/mirror/library/python:3.12 as deps
WORKDIR /application
COPY ./requirements.txt ./
@@ -9,7 +9,7 @@ RUN apt-get update -y && \
pip3 install -r requirements.txt
## Build executable
FROM golang:alpine as builder
FROM harbor.kvazaric.ru/mirror/library/golang:alpine as builder
WORKDIR /application
COPY go.mod go.sum ./

5
config.sample.yaml
View File

@@ -21,6 +21,11 @@ orchestrator:
ping_access_ip: true
auto_renew_certificates: true
pod_security_policy_enabled: true
registry_mirrors:
- host: https://mirror.gcr.io
skip_verify: false
- host: https://quay.io
skip_verify: false
modules:
admin_password: changeit

41
internal/config/modules_cicd.go
View File

@@ -28,16 +28,57 @@ type Cicd struct {
ChartRef string `yaml:"chart_ref" env-default:"kube-forge/service-ingress"`
ChartVersion string `yaml:"chart_version" env-default:"0.1.0"`
} `yaml:"service_ingress"`
Global struct {
Image string `yaml:"image" env-default:"quay.io/argoproj/argocd"`
Tag string `yaml:"tag" env-default:"latest"`
} `yaml:"global"`
Server struct {
Image string `yaml:"image" env-default:"quay.io/argoproj/argocd"`
Tag string `yaml:"tag" env-default:"latest"`
} `yaml:"server"`
Redis struct {
Image string `yaml:"image" env-default:"public.ecr.aws/docker/library/redis"`
Tag string `yaml:"tag" env-default:"7.2.4-alpine"`
Exporter struct {
Image string `yaml:"image" env-default:"public.ecr.aws/bitnami/redis-exporter"`
Tag string `yaml:"tag" env-default:"1.58.0"`
} `yaml:"exporter"`
} `yaml:"redis"`
ApplicationSet struct {
Image string `yaml:"image" env-default:"quay.io/argoproj/argocd"`
Tag string `yaml:"tag" env-default:"latest"`
} `yaml:"application_set"`
Dex struct {
Image string `yaml:"image" env-default:"ghcr.io/dexidp/dex"`
Tag string `yaml:"tag" env-default:"v2.38.0"`
} `yaml:"dex"`
RepoServer struct {
Image string `yaml:"image" env-default:"quay.io/argoproj/argocd"`
Tag string `yaml:"tag" env-default:"latest"`
} `yaml:"repo_server"`
Notifications struct {
Image string `yaml:"image" env-default:"quay.io/argoproj/argocd"`
Tag string `yaml:"tag" env-default:"latest"`
} `yaml:"notifications"`
Controller struct {
Image string `yaml:"image" env-default:"quay.io/argoproj/argocd"`
Tag string `yaml:"tag" env-default:"latest"`
} `yaml:"controller"`
} `yaml:"argo_cd"`
UpdatesOperator struct {
ChartRef string `yaml:"chart_ref" env-default:"kube-forge/keel"`
ChartVersion string `yaml:"chart_version" env-default:"1.0.3"`
Enabled bool `yaml:"enabled"`
Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/keelhq/keel"`
Tag string `yaml:"tag" env-default:"latest"`
} `yaml:"updates_operator"`
Rollouts struct {
ChartRef string `yaml:"chart_ref" env-default:"kube-forge/argo-rollouts"`
ChartVersion string `yaml:"chart_version" env-default:"2.35.1"`
Enabled bool `yaml:"enabled"`
Registry string `yaml:"registry" env-default:"quay.io"`
Repository string `yaml:"repository" env-default:"argoproj/argo-rollouts"`
Tag string `yaml:"tag" env-default:"latest"`
Ha struct {
Enabled bool `yaml:"enabled"`
} `yaml:"ha"`

35
internal/config/modules_registry.go
View File

@@ -6,7 +6,6 @@ type Registry struct {
Enabled bool `yaml:"enabled"`
AdminPassword string
Namespace string `yaml:"namespace" env-default:"registry"`
Version string `yaml:"version" env-default:"v2.10.1"`
Expose struct {
Type string `yaml:"type" env-default:"nodePort"`
Domain string `yaml:"domain" env-default:""`
@@ -30,4 +29,38 @@ type Registry struct {
TrivySize string `yaml:"trivy_size" env-default:"5Gi"`
} `yaml:"persistence"`
EnabledScanner bool `yaml:"enabled_scanner"`
Portal struct {
Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/goharbor/harbor-portal"`
Tag string `yaml:"tag" env-default:"v2.10.1"`
} `yaml:"portal"`
Core struct {
Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/goharbor/harbor-core"`
Tag string `yaml:"tag" env-default:"v2.10.1"`
} `yaml:"core"`
Jobservice struct {
Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/goharbor/harbor-jobservice"`
Tag string `yaml:"tag" env-default:"v2.10.1"`
} `yaml:"jobservice"`
Registry struct {
Registry struct {
Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/goharbor/registry-photon"`
Tag string `yaml:"tag" env-default:"v2.10.1"`
} `yaml:"registry"`
Controller struct {
Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/goharbor/harbor-registryctl"`
Tag string `yaml:"tag" env-default:"v2.10.1"`
} `yaml:"controller"`
} `yaml:"registry"`
Trivy struct {
Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/goharbor/trivy-adapter-photon"`
Tag string `yaml:"tag" env-default:"v2.10.1"`
} `yaml:"trivy"`
Database struct {
Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/goharbor/harbor-db"`
Tag string `yaml:"tag" env-default:"v2.10.1"`
} `yaml:"database"`
Redis struct {
Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/goharbor/redis-photon"`
Tag string `yaml:"tag" env-default:"v2.10.1"`
} `yaml:"redis"`
}

6
internal/config/orchestrator.go
View File

@@ -5,6 +5,11 @@ type Dns struct {
DisableHostNameservers bool `yaml:"disable_host_nameservers"`
}
type RegistryMirror struct {
Host string `yaml:"host"`
SkipVerify bool `yaml:"skip_verify"`
}
type Orchestrator struct {
Version string `yaml:"version" env-default:"v1.29.0"`
ClusterName string `yaml:"cluster_name" env-default:"k8s-cluster.local"`
@@ -28,4 +33,5 @@ type Orchestrator struct {
ServiceAddresses string `yaml:"service_addresses" env-default:"10.233.0.0/18"`
PodsSubnet string `yaml:"pods_subnet" env-default:"10.233.64.0/18"`
} `yaml:"network"`
RegistryMirrors []RegistryMirror `yaml:"registry_mirrors"`
}

30
internal/resources/templates/helm-apps/releases/cicd/argo-cd.yml.tmpl
View File

@@ -12,7 +12,14 @@
crds:
install: true
global:
repository: {{ .Modules.Cicd.ArgoCd.Global.Image }}
tag: {{ .Modules.Cicd.ArgoCd.Global.Tag }}
server:
image:
repository: {{ .Modules.Cicd.ArgoCd.Server.Image }}
tag: {{ .Modules.Cicd.ArgoCd.Server.Tag }}
certificateSecret:
enabled: false
{{- if eq .Modules.Cicd.ArgoCd.Expose.Type "NodePort" }}
@@ -37,12 +44,23 @@
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
redis:
image:
repository: {{ .Modules.Cicd.ArgoCd.Redis.Image }}
tag: {{ .Modules.Cicd.ArgoCd.Redis.Tag }}
exporter:
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
image:
repository: {{ .Modules.Cicd.ArgoCd.Redis.Exporter.Image }}
tag: {{ .Modules.Cicd.ArgoCd.Redis.Exporter.Tag }}
metrics:
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
serviceMonitor:
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
controller:
image:
repository: {{ .Modules.Cicd.ArgoCd.Controller.Image }}
tag: {{ .Modules.Cicd.ArgoCd.Controller.Tag }}
replicas: 1
metrics:
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
@@ -50,6 +68,9 @@
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
applicationSet:
image:
repository: {{ .Modules.Cicd.ArgoCd.ApplicationSet.Image }}
tag: {{ .Modules.Cicd.ArgoCd.ApplicationSet.Tag }}
{{- if .Modules.Cicd.ArgoCd.Ha.Enabled }}
replicas: 2
{{- end }}
@@ -59,6 +80,9 @@
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
dex:
image:
repository: {{ .Modules.Cicd.ArgoCd.Dex.Image }}
tag: {{ .Modules.Cicd.ArgoCd.Dex.Tag }}
metrics:
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
## check later
@@ -66,6 +90,9 @@
enabled: false
repoServer:
image:
repository: {{ .Modules.Cicd.ArgoCd.RepoServer.Image }}
tag: {{ .Modules.Cicd.ArgoCd.RepoServer.Tag }}
{{- if .Modules.Cicd.ArgoCd.Ha.Enabled }}
{{- if .Modules.Cicd.ArgoCd.Ha.Autoscaling }}
autoscaling:
@@ -81,6 +108,9 @@
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
notifications:
image:
repository: {{ .Modules.Cicd.ArgoCd.Notifications.Image }}
tag: {{ .Modules.Cicd.ArgoCd.Notifications.Tag }}
metrics:
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
serviceMonitor:

6
internal/resources/templates/helm-apps/releases/cicd/argo-rollouts.yml.tmpl
View File

@@ -77,11 +77,11 @@
{{- end }}
image:
# -- Registry to use
registry: quay.io
registry: {{ .Modules.Cicd.Rollouts.Registry }}
# -- Repository to use
repository: argoproj/argo-rollouts
repository: {{ .Modules.Cicd.Rollouts.Repository }}
# -- Overrides the image tag (default is the chart appVersion)
tag: ""
tag: {{ .Modules.Cicd.Rollouts.Tag }}
# -- Image pull policy
pullPolicy: IfNotPresent

4
internal/resources/templates/helm-apps/releases/cicd/keel.yml.tmpl
View File

@@ -9,8 +9,8 @@
{{- end }}
values:
image:
repository: keelhq/keel
tag: null
repository: {{ .Modules.Cicd.UpdatesOperator.Image }}
tag: {{ .Modules.Cicd.UpdatesOperator.Tag }}
pullPolicy: Always
# Enable insecure registries

32
internal/resources/templates/helm-apps/releases/registry/harbor.yml.tmpl
View File

@@ -134,8 +134,8 @@
portal:
image:
repository: harbor.kvazaric.ru/kube-forge/harbor-portal
tag: {{ .Modules.Registry.Version }}
repository: {{ .Modules.Registry.Portal.Image }}
tag: {{ .Modules.Registry.Portal.Tag }}
serviceAccountName: ""
automountServiceAccountToken: false
replicas: 1
@@ -149,8 +149,8 @@
core:
image:
repository: goharbor/harbor-core
tag: {{ .Modules.Registry.Version }}
repository: {{ .Modules.Registry.Core.Image }}
tag: {{ .Modules.Registry.Portal.Tag }}
serviceAccountName: ""
automountServiceAccountToken: false
replicas: 1
@@ -187,8 +187,8 @@
jobservice:
image:
repository: goharbor/harbor-jobservice
tag: {{ .Modules.Registry.Version }}
repository: {{ .Modules.Registry.Jobservice.Image }}
tag: {{ .Modules.Registry.Jobservice.Tag }}
serviceAccountName: ""
automountServiceAccountToken: false
replicas: 1
@@ -216,13 +216,13 @@
registry:
registry:
image:
repository: goharbor/registry-photon
tag: {{ .Modules.Registry.Version }}
repository: {{ .Modules.Registry.Registry.Registry.Image }}
tag: {{ .Modules.Registry.Registry.Registry.Tag }}
extraEnvVars: []
controller:
image:
repository: goharbor/harbor-registryctl
tag: {{ .Modules.Registry.Version }}
repository: {{ .Modules.Registry.Registry.Controller.Image }}
tag: {{ .Modules.Registry.Registry.Controller.Tag }}
extraEnvVars: []
serviceAccountName: ""
automountServiceAccountToken: false
@@ -265,8 +265,8 @@
trivy:
enabled: {{ .Modules.Registry.EnabledScanner }}
image:
repository: goharbor/trivy-adapter-photon
tag: {{ .Modules.Registry.Version }}
repository: {{ .Modules.Registry.Trivy.Image }}
tag: {{ .Modules.Registry.Trivy.Tag }}
serviceAccountName: ""
automountServiceAccountToken: false
resources:
@@ -284,8 +284,8 @@
type: internal
internal:
image:
repository: goharbor/harbor-db
tag: {{ .Modules.Registry.Version }}
repository: {{ .Modules.Registry.Database.Image }}
tag: {{ .Modules.Registry.Database.Tag }}
serviceAccountName: ""
automountServiceAccountToken: false
livenessProbe:
@@ -343,8 +343,8 @@
type: internal
internal:
image:
repository: goharbor/redis-photon
tag: {{ .Modules.Registry.Version }}
repository: {{ .Modules.Registry.Redis.Image }}
tag: {{ .Modules.Registry.Redis.Tag }}
serviceAccountName: ""
automountServiceAccountToken: false
extraEnvVars: []

66
internal/resources/templates/kubespray/inventory/group_vars/k8s_cluster/k8s-cluster.yml.tmpl
View File

@@ -231,6 +231,72 @@ dns_domain: {{ `"{{ cluster_name }}"` }}
## Default: containerd
container_manager: {{ .Orchestrator.ContainerEngine.Type }}
{{- if .Orchestrator.RegistryMirrors }}
containerd_registries_mirrors:
- prefix: docker.io
mirrors:
{{- range $index, $registryData := .Orchestrator.RegistryMirrors }}
- host: {{ $registryData.Host }}
capabilities: ["pull", "resolve"]
skip_verify: {{ $registryData.SkipVerify }}
{{- end }}
{{- else }}
containerd_registries_mirrors:
- prefix: docker.io
mirrors:
- host: https://mirror.gcr.io
capabilities: ["pull", "resolve"]
skip_verify: false
- host: https://quay.io
capabilities: ["pull", "resolve"]
skip_verify: false
- host: https://registry.redhat.io
capabilities: ["pull", "resolve"]
skip_verify: false
{{- end }}
## CRI-O registry mirrors setup
{{- if .Orchestrator.RegistryMirrors }}
crio_registries:
- prefix: docker.io
insecure: false
blocked: false
location: registry-1.docker.io
unqualified: false
mirrors:
{{- range $index, $registryData := .Orchestrator.RegistryMirrors }}
- location: {{ $registryData.Host }}
insecure: {{ $registryData.SkipVerify }}
{{- end }}
{{- else }}
crio_registries:
- prefix: docker.io
insecure: false
blocked: false
location: registry-1.docker.io
unqualified: false
mirrors:
- location: https://mirror.gcr.io
insecure: false
- location: https://quay.io
insecure: false
- location: https://registry.redhat.io
insecure: false
{{- end }}
## Docker registry mirrors setup
{{- if .Orchestrator.RegistryMirrors }}
docker_registry_mirrors:
{{- range $index, $registryData := .Orchestrator.RegistryMirrors }}
- {{ $registryData.Host }}
{{- end }}
{{- else }}
docker_registry_mirrors:
- https://mirror.gcr.io
- https://quay.io
- https://registry.redhat.io
{{- end }}
# Additional container runtimes
kata_containers_enabled: false

54
kubespray/inventory/group_vars/k8s_cluster/addons.yml
View File

@@ -4350,7 +4350,7 @@ releases:
portal:
image:
repository: harbor.kvazaric.ru/kube-forge/harbor-portal
repository: harbor.kvazaric.ru/kube-forge/goharbor/harbor-portal
tag: v2.10.1
serviceAccountName: ""
automountServiceAccountToken: false
@@ -4365,7 +4365,7 @@ releases:
core:
image:
repository: goharbor/harbor-core
repository: harbor.kvazaric.ru/kube-forge/goharbor/harbor-core
tag: v2.10.1
serviceAccountName: ""
automountServiceAccountToken: false
@@ -4403,7 +4403,7 @@ releases:
jobservice:
image:
repository: goharbor/harbor-jobservice
repository: harbor.kvazaric.ru/kube-forge/goharbor/harbor-jobservice
tag: v2.10.1
serviceAccountName: ""
automountServiceAccountToken: false
@@ -4432,12 +4432,12 @@ releases:
registry:
registry:
image:
repository: goharbor/registry-photon
repository: harbor.kvazaric.ru/kube-forge/goharbor/registry-photon
tag: v2.10.1
extraEnvVars: []
controller:
image:
repository: goharbor/harbor-registryctl
repository: harbor.kvazaric.ru/kube-forge/goharbor/harbor-registryctl
tag: v2.10.1
extraEnvVars: []
serviceAccountName: ""
@@ -4481,7 +4481,7 @@ releases:
trivy:
enabled: true
image:
repository: goharbor/trivy-adapter-photon
repository: harbor.kvazaric.ru/kube-forge/goharbor/trivy-adapter-photon
tag: v2.10.1
serviceAccountName: ""
automountServiceAccountToken: false
@@ -4500,7 +4500,7 @@ releases:
type: internal
internal:
image:
repository: goharbor/harbor-db
repository: harbor.kvazaric.ru/kube-forge/goharbor/harbor-db
tag: v2.10.1
serviceAccountName: ""
automountServiceAccountToken: false
@@ -4559,7 +4559,7 @@ releases:
type: internal
internal:
image:
repository: goharbor/redis-photon
repository: harbor.kvazaric.ru/kube-forge/goharbor/redis-photon
tag: v2.10.1
serviceAccountName: ""
automountServiceAccountToken: false
@@ -4607,7 +4607,14 @@ releases:
crds:
install: true
global:
repository: quay.io/argoproj/argocd
tag: latest
server:
image:
repository: quay.io/argoproj/argocd
tag: latest
certificateSecret:
enabled: false
@@ -4617,12 +4624,23 @@ releases:
enabled: true
redis:
image:
repository: public.ecr.aws/docker/library/redis
tag: 7.2.4-alpine
exporter:
enabled: true
image:
repository: public.ecr.aws/bitnami/redis-exporter
tag: 1.58.0
metrics:
enabled: true
serviceMonitor:
enabled: true
controller:
image:
repository: quay.io/argoproj/argocd
tag: latest
replicas: 1
metrics:
enabled: true
@@ -4630,12 +4648,18 @@ releases:
enabled: true
applicationSet:
image:
repository: quay.io/argoproj/argocd
tag: latest
metrics:
enabled: true
serviceMonitor:
enabled: true
dex:
image:
repository: ghcr.io/dexidp/dex
tag: v2.38.0
metrics:
enabled: true
## check later
@@ -4643,12 +4667,18 @@ releases:
enabled: false
repoServer:
image:
repository: quay.io/argoproj/argocd
tag: latest
metrics:
enabled: true
serviceMonitor:
enabled: true
notifications:
image:
repository: quay.io/argoproj/argocd
tag: latest
metrics:
enabled: true
serviceMonitor:
@@ -4659,7 +4689,7 @@ releases:
server.insecure: true
secret:
argocdServerAdminPassword: $2a$10$HDBhVHGtL0vBIcjuOybKzuTkc/HVVuQhZ0QHa38ljyjjZPmAESxrW
argocdServerAdminPassword: $2a$10$Nlkv3tEZauAtWk8BUbloqujTETrG7n1rlJmRXJAxz4xiZRRRtgfO6
repositories:
# add default helm-repository from harbor
@@ -4783,7 +4813,7 @@ releases:
# -- Repository to use
repository: argoproj/argo-rollouts
# -- Overrides the image tag (default is the chart appVersion)
tag: ""
tag: latest
# -- Image pull policy
pullPolicy: IfNotPresent
@@ -5132,8 +5162,8 @@ releases:
release_state: "present"
values:
image:
repository: keelhq/keel
tag: null
repository: harbor.kvazaric.ru/kube-forge/keelhq/keel
tag: latest
pullPolicy: Always
# Enable insecure registries

27
kubespray/inventory/group_vars/k8s_cluster/k8s-cluster.yml
View File

@@ -226,6 +226,33 @@ dns_domain: "{{ cluster_name }}"
## docker for docker, crio for cri-o and containerd for containerd.
## Default: containerd
container_manager: containerd
containerd_registries_mirrors:
- prefix: docker.io
mirrors:
- host: https://mirror.gcr.io
capabilities: ["pull", "resolve"]
skip_verify: false
- host: https://quay.io
capabilities: ["pull", "resolve"]
skip_verify: false
## CRI-O registry mirrors setup
crio_registries:
- prefix: docker.io
insecure: false
blocked: false
location: registry-1.docker.io
unqualified: false
mirrors:
- location: https://mirror.gcr.io
insecure: false
- location: https://quay.io
insecure: false
## Docker registry mirrors setup
docker_registry_mirrors:
- https://mirror.gcr.io
- https://quay.io
# Additional container runtimes
kata_containers_enabled: false