Skip to content

[kots] Remove automated use of airgap registry #10664

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 3 commits into from
Closed

[kots] Remove automated use of airgap registry #10664

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
50a106b
[kots] Allow multiple docker pull secrets
corneliusludmann Jun 13, 2022
7dadc94
add changes
Jun 14, 2022
e1a18df
add cleaned up version
Jun 15, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
44 changes: 37 additions & 7 deletions install/kots/manifests/gitpod-installer-job.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ spec:
containers:
- name: installer
# This will normally be the release tag
image: "eu.gcr.io/gitpod-core-dev/build/installer:sje-registry-s3-fork.3"
image: eu.gcr.io/gitpod-core-dev/build/installer:clu-multiple-pull-secrets.5
volumeMounts:
- mountPath: /config-patch
name: config-patch
Expand Down Expand Up @@ -140,28 +140,27 @@ spec:
yq e -i ".database.inCluster = false" "${CONFIG_FILE}"
yq e -i ".database.external.certificate.kind = \"secret\"" "${CONFIG_FILE}"
yq e -i ".database.external.certificate.name = \"database\"" "${CONFIG_FILE}"

fi

if [ '{{repl HasLocalRegistry }}' = "true" ];
then
echo "Gitpod: configuring mirrored container registry"

yq e -i ".containerRegistry.inCluster = false" "${CONFIG_FILE}"
yq e -i ".containerRegistry.external.url = \"{{repl LocalRegistryAddress }}\"" "${CONFIG_FILE}"
yq e -i ".containerRegistry.external.certificate.kind = \"secret\"" "${CONFIG_FILE}"
yq e -i ".containerRegistry.external.certificate.name = \"{{repl ImagePullSecretName }}\"" "${CONFIG_FILE}"
yq e -i ".repository = \"{{repl LocalRegistryAddress }}\"" "${CONFIG_FILE}"
yq e -i ".imagePullSecrets[0].kind = \"secret\"" "${CONFIG_FILE}"
yq e -i ".imagePullSecrets[0].name = \"{{repl ImagePullSecretName }}\"" "${CONFIG_FILE}"
yq e -i '.dropImageRepo = true' "${CONFIG_FILE}"
elif [ '{{repl ConfigOptionEquals "reg_incluster" "0" }}' = "true" ];
fi

if [ '{{repl ConfigOptionEquals "reg_incluster" "0" }}' = "true" ];
then
echo "Gitpod: configuring external container registry"

yq e -i ".containerRegistry.inCluster = false" "${CONFIG_FILE}"
yq e -i ".containerRegistry.external.url = \"{{repl ConfigOption "reg_url" }}\"" "${CONFIG_FILE}"
yq e -i ".containerRegistry.external.certificate.kind = \"secret\"" "${CONFIG_FILE}"
yq e -i ".containerRegistry.external.certificate.name = \"container-registry\"" "${CONFIG_FILE}"

else
if [ '{{repl ConfigOptionEquals "reg_incluster_storage" "s3" }}' = "true" ];
then
Expand All @@ -175,6 +174,7 @@ spec:
fi
fi


if [ '{{repl ConfigOptionNotEquals "store_provider" "incluster" }}' = "true" ];
then
echo "Gitpod: configuring the storage"
Expand Down Expand Up @@ -273,6 +273,36 @@ spec:
'del(select(.kind == "StatefulSet" and .metadata.name == "openvsx-proxy").status)' \
"${GITPOD_OBJECTS}/templates/gitpod.yaml"

# If we have a airgap registry, cache it's credentials to be merged into whichever secret we use
# to access a registry for registry-facade
if [ '{{repl HasLocalRegistry }}' = "true" ]; then
echo "Gitpod: Found airgap registry information"
kubectl get secret "{{repl ImagePullSecretName }}" -o=jsonpath="{.data['\.dockerconfigjson']}" | base64 -d | yq -P - > registry-auth-airgap.yaml
fi

# if we successfully cached the airgap registry key, append it to the credentials we use for built in or external registry
if [ -f ./registry-auth-airgap.yaml ] && [ '{{repl ConfigOptionEquals "reg_incluster" "0" }}' = "true" ]; then
echo "Gitpod: Appending airgap registry to external registry list"
kubectl get secret "container-registry" -o=jsonpath="{.data['\.dockerconfigjson']}" | base64 -d | yq -P - > registry-auth-external.yaml
yq -o=json eval-all 'select(fi == 0) * select(filename == "registry-auth-airgap.yaml")' registry-auth-external.yaml registry-auth-airgap.yaml > merged-registry-auths.json

kubectl create secret generic container-registry \
--save-config --dry-run=client \
--from-file=.dockerconfigjson=./merged-registry-auths.json \
-o yaml | kubectl apply -f -

elif [ -f ./registry-auth-airgap.yaml ]; then
echo "Gitpod: Appending airgap registry to internal registry list"
yq eval 'select(.kind == "Secret" and .metadata.name == "builtin-registry-auth").data.".dockerconfigjson"' \
"${GITPOD_OBJECTS}/templates/gitpod.yaml" | base64 -d | yq -P - > registry-auth-builtin.yaml

yq -o=json eval-all 'select(fi == 0) * select(filename == "registry-auth-airgap.yaml")' registry-auth-builtin.yaml registry-auth-airgap.yaml > merged-registry-auths.json

export NEW_SECRETS=$(base64 -w 0 merged-registry-auths.json)
yq e -i "select(.kind == \"Secret\" and .metadata.name == \"builtin-registry-auth\").data.\".dockerconfigjson\" = \"${NEW_SECRETS}\"" \
"${GITPOD_OBJECTS}/templates/gitpod.yaml"
fi

echo "Gitpod: Escape any Golang template values"
sed -i -r 's/(.*\{\{.*)/{{`\1`}}/' "${GITPOD_OBJECTS}/templates/gitpod.yaml"

Expand Down
9 changes: 4 additions & 5 deletions install/kots/manifests/kots-config.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,6 @@ spec:
- name: reg_incluster
title: Use in-cluster container registry
type: bool
when: '{{repl eq HasLocalRegistry false }}'
default: "1"
help_text: You may either use an in-cluster container registry or configure your own external container registry for better performance. This container registry must be accessible from your Kubernetes cluster.
recommended: false
Expand Down Expand Up @@ -85,27 +84,27 @@ spec:
- name: reg_url
title: Container registry URL
type: text
when: '{{repl and (eq HasLocalRegistry false) (ConfigOptionEquals "reg_incluster" "0") }}'
when: '{{repl (ConfigOptionEquals "reg_incluster" "0") }}'
required: true
help_text: The container registry URL. This will usually be the fully qualified domain of your registry.

- name: reg_server
title: Container registry server
type: text
when: '{{repl and (eq HasLocalRegistry false) (ConfigOptionEquals "reg_incluster" "0") }}'
when: '{{repl (ConfigOptionEquals "reg_incluster" "0") }}'
help_text: The container registry server. This is used when [generating your credentials](https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/#create-a-secret-by-providing-credentials-on-the-command-line). Depending upon your provider, this may or may not be the same as the registry URL. If not specified, the URL will be used.

- name: reg_username
title: Container registry username
type: text
when: '{{repl and (eq HasLocalRegistry false) (ConfigOptionEquals "reg_incluster" "0") }}'
when: '{{repl (ConfigOptionEquals "reg_incluster" "0") }}'
required: true
help_text: The username for your container registry.

- name: reg_password
title: Container registry password
type: password
when: '{{repl and (eq HasLocalRegistry false) (ConfigOptionEquals "reg_incluster" "0") }}'
when: '{{repl (ConfigOptionEquals "reg_incluster" "0") }}'
required: true
help_text: The password for your container registry.

Expand Down