Skip to content

Commit 930efcb

Browse files
committed
Add cloud image registry implementation
1 parent 26f16a3 commit 930efcb

18 files changed

Lines changed: 1004 additions & 40 deletions

File tree

.github/workflows/build-matrix.json

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,13 @@
1313
"build-args": "COMPONENT=tenant-operator",
1414
"harbor-project": "crownlabs-core"
1515
},
16+
{
17+
"component": "cloudimg-registry",
18+
"context": "./operators",
19+
"dockerfile": "./operators/build/golang-common/Dockerfile",
20+
"build-args": "COMPONENT=cloudimg-registry",
21+
"harbor-project": "crownlabs-core"
22+
},
1623
{
1724
"component": "bastion-operator",
1825
"context": "./operators",

deploy/crownlabs/Chart.yaml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,10 @@ dependencies:
6565
repository: file://../../operators/deploy/instmetrics
6666
condition: instmetrics.enabled
6767

68+
- name: cloudimg-registry
69+
version: "0.1.0"
70+
repository: file://../../operators/deploy/cloudimg-registry
71+
6872
- name: policies
6973
version: "0.1.0"
7074
repository: file://../../policies

deploy/crownlabs/values.yaml

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -155,6 +155,17 @@ instmetrics:
155155
updatePeriod: 4s
156156
grpcPort: 9090
157157

158+
cloudimg-registry:
159+
replicaCount: 1
160+
configurations:
161+
volume:
162+
size: "100Gi"
163+
accessMode: "ReadWriteMany"
164+
storageClass: "rook-cephfs-primary"
165+
image:
166+
repository: crownlabs/cloudimg-registry
167+
pullPolicy: IfNotPresent
168+
158169
policies:
159170
ingressHostnamePattern: s??????.sandbox.crownlabs.polito.it
160171
namespaceSelector:

infrastructure/certificate-provisioning/README.md

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -113,12 +113,13 @@ labels:
113113
```
114114
115115
## Synchronize digital certificates between namespaces
116+
❗❗ `Kubed is no longer available and has been superseded by ConfigSyncer`
116117

117118
In different scenarios, it may happen to have different `Ingress` resources in different namespaces which refer to the same domain (with different paths). Unfortunately, annotating all these ingresses with the `cert-manager.io/cluster-issuer` annotation soon leads to hitting the Let's Encrypt rate limits. Hence, it is necessary to introduce some mechanism to synchronize the secret generated between multiple namespaces. One of the projects currently providing a solution to this problem is [kubed](https://github.com/appscode/kubed).
118119

119120
### Install kubed
120121

121-
Kubed can be easily installed with helm [[5]](https://appscode.com/products/kubed/v0.12.0/setup/install/).
122+
Kubed can be easily installed with helm [[5]](https://web.archive.org/web/20230605163413/https://appscode.com/products/kubed/v0.12.0/setup/install/).
122123

123124
```bash
124125
helm repo add appscode https://charts.appscode.com/stable/
Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
// Copyright 2020-2025 Politecnico di Torino
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
// Package main contains the entrypoint for the cloud image registry.
16+
package main
17+
18+
import (
19+
"context"
20+
"flag"
21+
"net/http"
22+
"os"
23+
"os/signal"
24+
"syscall"
25+
"time"
26+
27+
"k8s.io/klog/v2"
28+
29+
"github.com/netgroup-polito/CrownLabs/operators/pkg/ciregistry"
30+
)
31+
32+
var (
33+
dataRoot = flag.String("data-root", "/data", "Root data path for the server")
34+
listenerAddr = flag.String("listener-addr", ":8080", "Address for the server to listen on")
35+
readHeaderTimeoutSeconds = flag.Int("read-header-timeout-secs", 2, "Number of seconds allowed to read request headers")
36+
)
37+
38+
func main() {
39+
// Initialize klog
40+
klog.InitFlags(nil)
41+
defer klog.Flush()
42+
43+
// Parse flags
44+
flag.Parse()
45+
46+
// Update ciregistry configuration
47+
ciregistry.DataRoot = *dataRoot
48+
49+
// Start the server
50+
server := initializeServer(*listenerAddr, *readHeaderTimeoutSeconds)
51+
52+
// Graceful shutdown setup
53+
stop := make(chan os.Signal, 1)
54+
signal.Notify(stop, os.Interrupt, syscall.SIGTERM)
55+
56+
go func() {
57+
klog.Infof("Starting server on %s", server.Addr)
58+
klog.Infof("API documentation available at http://localhost%s/docs", server.Addr)
59+
60+
if err := server.ListenAndServe(); err != nil && err != http.ErrServerClosed {
61+
klog.Fatalf("Server failed: %v", err)
62+
}
63+
}()
64+
65+
<-stop
66+
klog.Info("Shutting down server gracefully...")
67+
68+
ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
69+
defer cancel()
70+
71+
if err := server.Shutdown(ctx); err != nil {
72+
klog.Fatalf("Server forced to shutdown: %v", err)
73+
}
74+
75+
klog.Info("Server gracefully stopped")
76+
}
77+
78+
func initializeServer(addr string, readTimeoutSeconds int) *http.Server {
79+
handler := ciregistry.NewRouter()
80+
server := &http.Server{
81+
Addr: addr,
82+
Handler: handler,
83+
ReadHeaderTimeout: time.Duration(readTimeoutSeconds) * time.Second,
84+
}
85+
86+
return server
87+
}
Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# Patterns to ignore when building packages.
2+
# This supports shell glob matching, relative path matching, and
3+
# negation (prefixed with !). Only one pattern per line.
4+
.DS_Store
5+
# Common VCS dirs
6+
.git/
7+
.gitignore
8+
.bzr/
9+
.bzrignore
10+
.hg/
11+
.hgignore
12+
.svn/
13+
# Common backup files
14+
*.swp
15+
*.bak
16+
*.tmp
17+
*.orig
18+
*~
19+
# Various IDEs
20+
.project
21+
.idea/
22+
*.tmproj
23+
.vscode/
Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
apiVersion: v2
2+
name: cloudimg-registry
3+
description: The CrownLabs Cloud Image Registry
4+
5+
# A chart can be either an 'application' or a 'library' chart.
6+
#
7+
# Application charts are a collection of templates that can be packaged into versioned archives
8+
# to be deployed.
9+
#
10+
# Library charts provide useful utilities or functions for the chart developer. They're included as
11+
# a dependency of application charts to inject those utilities and functions into the rendering
12+
# pipeline. Library charts do not define any templates and therefore cannot be deployed.
13+
type: application
14+
15+
# This is the chart version. This version number should be incremented each time you make changes
16+
# to the chart and its templates, including the app version.
17+
# Versions are expected to follow Semantic Versioning (https://semver.org/)
18+
version: 0.1.0
19+
20+
icon: https://crownlabs.polito.it/images/logo.svg
Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
{{/* vim: set filetype=mustache: */}}
2+
{{/*
3+
Expand the name of the chart.
4+
*/}}
5+
{{- define "cloudimg-registry.name" -}}
6+
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
7+
{{- end }}
8+
9+
{{/*
10+
Create a default fully qualified app name.
11+
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
12+
If the release name contains the chart name, it will be used as a full name.
13+
*/}}
14+
{{- define "cloudimg-registry.fullname" -}}
15+
{{- if .Values.fullnameOverride }}
16+
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
17+
{{- else }}
18+
{{- $name := default .Chart.Name .Values.nameOverride }}
19+
{{- if contains $name .Release.Name }}
20+
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
21+
{{- else }}
22+
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
23+
{{- end }}
24+
{{- end }}
25+
{{- end }}
26+
27+
{{/*
28+
The version of the application to be deployed
29+
*/}}
30+
{{- define "cloudimg-registry.version" -}}
31+
{{- if .Values.global }}
32+
{{- .Values.image.tag | default .Values.global.version | default .Chart.AppVersion }}
33+
{{- else }}
34+
{{- .Values.image.tag | default .Chart.AppVersion }}
35+
{{- end }}
36+
{{- end }}
37+
38+
{{/*
39+
Create chart name and version as used by the chart label.
40+
*/}}
41+
{{- define "cloudimg-registry.chart" -}}
42+
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
43+
{{- end }}
44+
45+
{{/*
46+
Common labels
47+
*/}}
48+
{{- define "cloudimg-registry.labels" -}}
49+
helm.sh/chart: {{ include "cloudimg-registry.chart" . }}
50+
{{ include "cloudimg-registry.selectorLabels" . }}
51+
app.kubernetes.io/version: {{ include "cloudimg-registry.version" . | quote }}
52+
app.kubernetes.io/managed-by: {{ .Release.Service }}
53+
{{- end }}
54+
55+
{{/*
56+
Selector labels
57+
*/}}
58+
{{- define "cloudimg-registry.selectorLabels" -}}
59+
app.kubernetes.io/name: {{ include "cloudimg-registry.name" . }}
60+
app.kubernetes.io/instance: {{ .Release.Name }}
61+
{{- end }}
Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: {{ include "cloudimg-registry.fullname" . }}
5+
labels:
6+
{{ include "cloudimg-registry.labels" . | nindent 4 }}
7+
{{- with .Values.deploymentAnnotations }}
8+
annotations:
9+
{{- toYaml . | nindent 4 }}
10+
{{- end }}
11+
spec:
12+
replicas: {{ .Values.replicaCount }}
13+
selector:
14+
matchLabels:
15+
{{ include "cloudimg-registry.selectorLabels" . | nindent 6 }}
16+
template:
17+
metadata:
18+
{{- with .Values.podAnnotations }}
19+
annotations:
20+
{{- toYaml . | nindent 8 }}
21+
{{- end }}
22+
labels:
23+
{{- include "cloudimg-registry.selectorLabels" . | nindent 8 }}
24+
spec:
25+
{{- with .Values.imagePullSecrets }}
26+
imagePullSecrets:
27+
{{- toYaml . | nindent 8 }}
28+
{{- end }}
29+
initContainers:
30+
- name: fix-permissions
31+
image: busybox:1.36.1
32+
command: ["sh", "-c", "chown -R {{ .Values.podSecurityContext.fsGroup }}:{{ .Values.podSecurityContext.fsGroup }} {{ .Values.configurations.dataRoot }}"]
33+
resources:
34+
{{- toYaml .Values.resources | nindent 10 }}
35+
volumeMounts:
36+
- name: "{{ include "cloudimg-registry.fullname" . }}-storage"
37+
mountPath: {{ .Values.configurations.dataRoot }}
38+
containers:
39+
- name: {{ .Chart.Name }}
40+
image: "{{ .Values.image.repository }}:{{ include "cloudimg-registry.version" . }}"
41+
imagePullPolicy: {{ .Values.image.pullPolicy }}
42+
args:
43+
- "--data-root={{ .Values.configurations.dataRoot }}"
44+
- "--read-header-timeout-secs={{ .Values.configurations.readHeaderTimeoutSeconds }}"
45+
- "--listener-addr=:8080"
46+
ports:
47+
- name: http
48+
containerPort: 8080
49+
protocol: TCP
50+
readinessProbe:
51+
httpGet:
52+
path: /healthz
53+
port: http
54+
initialDelaySeconds: 3
55+
periodSeconds: 3
56+
resources:
57+
{{- toYaml .Values.resources | nindent 12 }}
58+
volumeMounts:
59+
- name: "{{ include "cloudimg-registry.fullname" . }}-storage"
60+
mountPath: {{ .Values.configurations.dataRoot }}
61+
securityContext:
62+
{{- toYaml .Values.securityContext | nindent 12 }}
63+
securityContext:
64+
{{- toYaml .Values.podSecurityContext | nindent 8 }}
65+
volumes:
66+
- name: "{{ include "cloudimg-registry.fullname" . }}-storage"
67+
persistentVolumeClaim:
68+
claimName: "{{ include "cloudimg-registry.fullname" . }}-pvc"
Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
apiVersion: v1
2+
kind: PersistentVolumeClaim
3+
metadata:
4+
name: "{{ include "cloudimg-registry.fullname" . }}-pvc"
5+
labels:
6+
{{ include "cloudimg-registry.labels" . | nindent 4 }}
7+
spec:
8+
accessModes:
9+
- {{ .Values.configurations.volume.accessMode }}
10+
resources:
11+
requests:
12+
storage: {{ .Values.configurations.volume.size }}
13+
storageClassName: {{ .Values.configurations.volume.storageClass }}

0 commit comments

Comments
 (0)