-
-
Save ajbouh/91029469e98167ed1d5ae992da376cfb to your computer and use it in GitHub Desktop.
Create a private Docker registry on a fresh Kubernetes Cluster
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
set -ex | |
REGISTRY_INGRESS_IP=10.73.177.23 | |
REGISTRY_INGRESS_HOSTNAME=registry.$REGISTRY_INGRESS_IP.xip.io | |
REQ_CN=10.73.177.126 | |
# if [ ! -e $REGISTRY_INGRESS_HOSTNAME.key ]; then | |
# echo '{"CN":"'$REGISTRY_INGRESS_HOSTNAME'","hosts":[""],"key":{"algo":"rsa","size":2048}}' | cfssl gencert -config=ca-config.json -ca=ca.pem -ca-key=ca-key.pem -hostname="$REGISTRY_INGRESS_HOSTNAME" - | cfssljson -bare $REGISTRY_INGRESS_HOSTNAME | |
# fi | |
# Workaround until the following lands: https://github.com/juju-solutions/layer-easyrsa/issues/11 | |
juju run --application easyrsa -- "cd EasyRSA;./easyrsa --batch --req-cn=$REQ_CN --subject-alt-name=DNS:$REGISTRY_INGRESS_HOSTNAME,IP:$REGISTRY_INGRESS_IP build-server-full registry nopass" | |
TLSCERT=$(juju run --application easyrsa -- cat EasyRSA/pki/issued/registry.crt | base64 -w 0) | |
TLSKEY=$(juju run --application easyrsa -- cat EasyRSA/pki/private/registry.key | base64 -w 0) | |
DOCKERCFG=$(echo '{"{{domain}}": {"auth": "{{htpasswd-plain}}", "email": "root@localhost"}}' | \ | |
sed -e "s/{{domain}}/$REGISTRY_INGRESS_HOSTNAME/" \ | |
-e "s/{{htpasswd-plain}}/$(cat htpasswd-plain | base64 -w 0)/" | \ | |
base64 -w 0) | |
HTPASSWD=$(cat htpasswd | base64 -w 0) | |
SEDEXPRS=( | |
"-e" "s/{{tlscert}}/$TLSCERT/g" | |
"-e" "s/{{tlskey}}/$TLSKEY/g" | |
"-e" "s/{{htpasswd}}/$HTPASSWD/g" | |
"-e" "s/{{dockercfg}}/$DOCKERCFG/g" | |
"-e" "s/{{domain}}/$REGISTRY_INGRESS_HOSTNAME/g" | |
) | |
cat <<EOF | sed ${SEDEXPRS[*]} | kubectl replace -f - | |
apiVersion: v1 | |
kind: Secret | |
metadata: | |
name: registry-tls-data | |
type: Opaque | |
data: | |
tls.crt: {{tlscert}} | |
tls.key: {{tlskey}} | |
--- | |
apiVersion: v1 | |
kind: Secret | |
metadata: | |
name: registry-auth-data | |
type: Opaque | |
data: | |
htpasswd: {{htpasswd}} | |
--- | |
apiVersion: extensions/v1beta1 | |
kind: Deployment | |
metadata: | |
name: registry | |
spec: | |
replicas: 1 | |
template: | |
metadata: | |
labels: | |
app: registry | |
spec: | |
containers: | |
- name: registry | |
image: registry:2 | |
resources: | |
# keep request = limit to keep this container in guaranteed class | |
limits: | |
cpu: 100m | |
memory: 100Mi | |
requests: | |
cpu: 100m | |
memory: 100Mi | |
env: | |
- name: REGISTRY_HTTP_ADDR | |
value: :5000 | |
- name: REGISTRY_STORAGE_FILESYSTEM_ROOTDIRECTORY | |
value: /var/lib/registry | |
- name: REGISTRY_AUTH_HTPASSWD_REALM | |
value: basic_realm | |
- name: REGISTRY_AUTH_HTPASSWD_PATH | |
value: /auth/htpasswd | |
volumeMounts: | |
- name: image-store | |
mountPath: /var/lib/registry | |
- name: auth-dir | |
mountPath: /auth | |
ports: | |
- containerPort: 5000 | |
name: registry | |
protocol: TCP | |
volumes: | |
- name: image-store | |
hostPath: | |
path: /srv/registry | |
- name: auth-dir | |
secret: | |
secretName: registry-auth-data | |
--- | |
apiVersion: v1 | |
kind: Secret | |
metadata: | |
name: registry-access | |
data: | |
.dockercfg: {{dockercfg}} | |
type: kubernetes.io/dockercfg | |
--- | |
apiVersion: extensions/v1beta1 | |
kind: Ingress | |
metadata: | |
name: registry-ingress | |
spec: | |
tls: | |
- hosts: | |
- {{domain}} | |
secretName: registry-tls-data | |
rules: | |
- host: {{domain}} | |
http: | |
paths: | |
- backend: | |
serviceName: registry | |
servicePort: 5000 | |
path: / | |
EOF | |
kubectl patch cm nginx-load-balancer-conf -p '{"data":{"body-size":"1024m"}}' | |
kubectl expose deployment registry |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment