Squashed 'cluster-config/' content from commit 654f2390
git-subtree-dir: cluster-config git-subtree-split: 654f23903bd1f9a27a4810bd289d165b6cfdbb0c
This commit is contained in:
@@ -0,0 +1 @@
|
||||
Note you need to manually generate the config bundle secret in the generate folder, at some point I'll fully gitops this process.
|
||||
File diff suppressed because one or more lines are too long
@@ -0,0 +1,31 @@
|
||||
EXTERNAL_TLS_TERMINATION: false
|
||||
SERVER_HOSTNAME: registry.apps.home.ocplab.com
|
||||
PREFERRED_URL_SCHEME: https
|
||||
DISTRIBUTED_STORAGE_CONFIG:
|
||||
# using Minio on QNAP NAS
|
||||
radosGWStorage:
|
||||
- RadosGWStorage
|
||||
- access_key: XXXXX
|
||||
secret_key: XXXX
|
||||
bucket_name: quay
|
||||
hostname: lab-nas.ocplab.com
|
||||
is_secure: true
|
||||
port: 9000
|
||||
storage_path: /datastorage/registry
|
||||
DISTRIBUTED_STORAGE_DEFAULT_LOCATIONS: []
|
||||
DISTRIBUTED_STORAGE_PREFERENCE:
|
||||
- radosGWStorage
|
||||
SSO_LOGIN_CONFIG:
|
||||
CLIENT_ID: quay
|
||||
CLIENT_SECRET: 723782ba-95d4-4d95-8b04-efebce0adf86
|
||||
OIDC_SERVER: https://sso-sso.apps.home.ocplab.com/auth/realms/openshift/
|
||||
LOGIN_SCOPES:
|
||||
- openid
|
||||
SERVICE_NAME: OpenShift
|
||||
SUPER_USERS:
|
||||
- admin
|
||||
- quayadmin
|
||||
FEATURE_DIRECT_LOGIN: true
|
||||
FEATURE_USER_INITIALIZE: true
|
||||
FEATURE_QUOTA_MANAGEMENT: true
|
||||
FEATURE_PROXY_CACHE: true
|
||||
@@ -0,0 +1,2 @@
|
||||
oc create secret generic --from-file config.yaml=./config-qnap-private.yaml config-bundle-secret --from-file=ssl.cert=fullchain.pem --from-file=ssl.key=key.pem -o yaml --dry-run=client -n quay > config-bundle-secret-qnap.yaml
|
||||
kubeseal --format yaml --cert ~/.bitnami/publickey.pem < config-bundle-secret-qnap.yaml
|
||||
@@ -0,0 +1,7 @@
|
||||
# Using Route53 with DNS challenge, source AWS creds (not in git repo but just sets access and secret key as env variables)
|
||||
. aws-creds
|
||||
mkdir -p qnap-tls
|
||||
acme.sh --force --issue --dns dns_aws --cert-file "./qnap-tls/cert.pem" --key-file "./qnap-tls/key.pem" --fullchain-file "./qnap-tls/fullchain.pem" --ca-file "./qnap-tls/ca.cer" -d registry.apps.home.ocplab.com
|
||||
|
||||
# Convert CA to crt
|
||||
openssl x509 -inform PEM -in ./qnap-tls/ca.cer -out ./qnap-tls/letsencrypt_ca.crt
|
||||
@@ -0,0 +1,83 @@
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: quay-init
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: quay-init
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: admin
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: quay-init
|
||||
---
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
name: quay-init
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-wave: "20"
|
||||
spec:
|
||||
template:
|
||||
spec:
|
||||
containers:
|
||||
- image: registry.redhat.io/ansible-automation-platform-21/ee-supported-rhel8:1.0
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: init-user-password
|
||||
command:
|
||||
- /bin/bash
|
||||
- -c
|
||||
- |
|
||||
#!/usr/bin/env bash
|
||||
|
||||
echo "Setup temporary OCP user to make ansible happy"
|
||||
|
||||
echo "tempuser:x:$(id -u):$(id -g):,,,:${HOME}:/bin/bash" >> /etc/passwd
|
||||
echo "tempuser:x:$(id -G | cut -d' ' -f 2)" >> /etc/group
|
||||
id
|
||||
|
||||
echo "Waiting for two minutes for quay to be ready"
|
||||
|
||||
sleep 120
|
||||
|
||||
git clone https://github.com/gnunn-gitops/quay-init
|
||||
|
||||
cd quay-init
|
||||
|
||||
ansible-galaxy collection install -r collections/requirements.yaml
|
||||
|
||||
ansible-playbook quay-init.yaml -e quay_init_password=$quay_init_password -e ansible_remote_tmp=/tmp
|
||||
|
||||
echo "Waiting for deploy/registry-clair-app to be available"
|
||||
until oc get deployment registry-clair-app
|
||||
do
|
||||
sleep 5;
|
||||
done
|
||||
oc scale deploy/registry-clair-app --replicas=1
|
||||
|
||||
echo "Waiting for deploy/registry-quay-app to be available"
|
||||
until oc get deployment registry-quay-app
|
||||
do
|
||||
sleep 5;
|
||||
done
|
||||
oc set resources deploy/registry-quay-app -c=quay-app --requests=cpu=1,memory=1Gi --limits=cpu=2,memory=4Gi
|
||||
oc scale deploy/registry-quay-app --replicas=1
|
||||
|
||||
echo "Waiting for deploy/registry-clair-postgres to be available"
|
||||
until oc get deployment registry-clair-postgres
|
||||
do
|
||||
sleep 5;
|
||||
done
|
||||
oc set resources deploy/registry-clair-postgres -c=postgres --limits=memory=3Gi
|
||||
|
||||
name: init-quay
|
||||
dnsPolicy: ClusterFirst
|
||||
restartPolicy: Never
|
||||
terminationGracePeriodSeconds: 30
|
||||
serviceAccount: quay-init
|
||||
serviceAccountName: quay-init
|
||||
@@ -0,0 +1,15 @@
|
||||
apiVersion: bitnami.com/v1alpha1
|
||||
kind: SealedSecret
|
||||
metadata:
|
||||
name: init-user-password
|
||||
namespace: quay
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-wave: "0"
|
||||
spec:
|
||||
encryptedData:
|
||||
quay_init_password: AgCFXt2+UWeWWgNO2EwPk10Vv07D8kXOYlVSPTi1AizSTJ35725eautJzhDSd1McS7A+VymUk6fdFDagx5oXJU7+Cr2V7n8sb+sQWQwiyaWuM4017PYHllCpMoU0Q5CF5yyZ11OyPPBi5Ucz391/TxgIZww9PGGXy2KolrL97fuvrVVgPdUdNw8SAG+6TlGTGiMuzg5VngLz8wKfNpQDdPum98DVRVvbzJHEp9Nu+rtglaCdLgsMcgTpWw59MKYsl7Slw7oZIxTZvRlu8m3DqGu+AqiFRGoLJpNhJ9aDMyH5QiQ+sf59VQILdTwTdPvC/wMAETKYqJ/PqEkTkYTsAdhS1AJDcMO2OoYGx7EheKNMRotjHSYor4DHedFqvVaA+X6ZjTU1so1Z5ToFW3tofnLXfrunuzUgU4Ld7pTl297Jyqy3J0kNF2vmsb0RExN8kbW+Rsk5rqHmYKm68lw28s+FI0Cejy29lk23j3V8m+WVY4ANtez1QTS0vU79+iauSVZx9Ab2hrD0IWLdU+18R+k1Mjd/ARBgxT/H6x4cGwhh32GF+46XPQpcNKrXeN0JsyDksllFHp6uXy6BYvDNxwm3eMVefOBdMkYr/z7pUqIYBtpQm9oyIEtr/j0f19CPmVX+glFsArVeCGizRrajtkLOb66x/OfoToZpwQzRalSwtHEHClLLXe8Y/HNm7vqx4golRYn3E3TiVOT0
|
||||
template:
|
||||
metadata:
|
||||
name: init-user-password
|
||||
namespace: quay
|
||||
type: Opaque
|
||||
@@ -0,0 +1,15 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
commonAnnotations:
|
||||
argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
|
||||
|
||||
namespace: quay
|
||||
|
||||
resources:
|
||||
- github.com/redhat-cop/gitops-catalog/quay-operator/operator/overlays/stable-3.8
|
||||
- init-user-password-secret.yaml
|
||||
- init-quay-job.yaml
|
||||
- registry-config-bundle-secret.yaml
|
||||
- registry.yaml
|
||||
- registry-app-route.yaml
|
||||
@@ -0,0 +1,59 @@
|
||||
kind: Route
|
||||
apiVersion: route.openshift.io/v1
|
||||
metadata:
|
||||
name: registry-quay-app
|
||||
labels:
|
||||
app: quay
|
||||
quay-component: quay-app
|
||||
quay-operator/quayregistry: registry
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-wave: "0"
|
||||
spec:
|
||||
host: registry.apps.home.ocplab.com
|
||||
to:
|
||||
kind: Service
|
||||
name: registry-quay-app
|
||||
weight: 100
|
||||
port:
|
||||
targetPort: https
|
||||
tls:
|
||||
termination: passthrough
|
||||
wildcardPolicy: None
|
||||
---
|
||||
apiVersion: route.openshift.io/v1
|
||||
kind: Route
|
||||
metadata:
|
||||
name: registry-quay-builder
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-wave: "0"
|
||||
spec:
|
||||
host: registry-builder.apps.home.ocplab.com
|
||||
port:
|
||||
targetPort: grpc
|
||||
tls:
|
||||
insecureEdgeTerminationPolicy: Redirect
|
||||
termination: reencrypt
|
||||
to:
|
||||
kind: Service
|
||||
name: registry-quay-app
|
||||
weight: 100
|
||||
wildcardPolicy: None
|
||||
---
|
||||
apiVersion: route.openshift.io/v1
|
||||
kind: Route
|
||||
metadata:
|
||||
name: registry-quay-config-editor
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-wave: "0"
|
||||
spec:
|
||||
host: registry-config-editor.apps.home.ocplab.com
|
||||
port:
|
||||
targetPort: http
|
||||
tls:
|
||||
insecureEdgeTerminationPolicy: Redirect
|
||||
termination: edge
|
||||
to:
|
||||
kind: Service
|
||||
name: registry-quay-config-editor
|
||||
weight: 100
|
||||
wildcardPolicy: None
|
||||
File diff suppressed because one or more lines are too long
@@ -0,0 +1,27 @@
|
||||
apiVersion: quay.redhat.com/v1
|
||||
kind: QuayRegistry
|
||||
metadata:
|
||||
name: registry
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-wave: "10"
|
||||
spec:
|
||||
components:
|
||||
- managed: false
|
||||
kind: tls
|
||||
- managed: false
|
||||
kind: horizontalpodautoscaler
|
||||
- kind: route
|
||||
managed: false
|
||||
- kind: postgres
|
||||
managed: true
|
||||
- kind: clair
|
||||
managed: true
|
||||
- kind: redis
|
||||
managed: true
|
||||
- kind: mirror
|
||||
managed: true
|
||||
- kind: monitoring
|
||||
managed: false
|
||||
- kind: objectstorage
|
||||
managed: false
|
||||
configBundleSecret: config-bundle-secret
|
||||
Reference in New Issue
Block a user