Skip to content

Commit 87969b7

Browse files
supershalsupershal
committed
feat: global image registry mirror variable
1 parent 4c53a9c commit 87969b7

21 files changed

+390
-368
lines changed

‎.markdownlint.json

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,5 +2,6 @@
22
"heading-style": { "style": "atx" },
33
"ul-style": { "style": "dash" },
44
"line-length": { "line_length": 120, "stern": true },
5-
"hr-style": { "style": "---" }
5+
"hr-style": { "style": "---" },
6+
"MD013": false
67
}

‎api/v1alpha1/clusterconfig_types.go

Lines changed: 21 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -89,6 +89,9 @@ type GenericClusterConfig struct {
8989
// +optional
9090
ImageRegistries ImageRegistries `json:"imageRegistries,omitempty"`
9191

92+
// +optional
93+
GlobalImageRegistryMirror *GlobalImageRegistryMirror `json:"globalImageRegistryMirror,omitempty"`
94+
9295
// +optional
9396
Addons *Addons `json:"addons,omitempty"`
9497
}
@@ -107,7 +110,8 @@ func (s GenericClusterConfig) VariableSchema() clusterv1.VariableSchema { //noli
107110
"",
108111
).VariableSchema().
109112
OpenAPIV3Schema,
110-
"imageRegistries": ImageRegistries{}.VariableSchema().OpenAPIV3Schema,
113+
"imageRegistries": ImageRegistries{}.VariableSchema().OpenAPIV3Schema,
114+
"globalImageRegistryMirror": GlobalImageRegistryMirror{}.VariableSchema().OpenAPIV3Schema,
111115
},
112116
},
113117
}
@@ -239,7 +243,7 @@ func (ExtraAPIServerCertSANs) VariableSchema() clusterv1.VariableSchema {
239243

240244
type ImageCredentials struct {
241245
// The Secret containing the registry credentials and CA certificate
242-
// The Secret should have keys 'username', 'password' and 'caCert'
246+
// The Secret should have keys 'username', 'password' and 'ca.crt'
243247
// This credentials Secret is not required for some registries, e.g. ECR.
244248
// +optional
245249
SecretRef *corev1.ObjectReference `json:"secretRef,omitempty"`
@@ -252,7 +256,7 @@ func (ImageCredentials) VariableSchema() clusterv1.VariableSchema {
252256
Properties: map[string]clusterv1.JSONSchemaProps{
253257
"secretRef": {
254258
Description: "The Secret containing the registry credentials. " +
255-
"The Secret should have keys 'username', 'password'. " +
259+
"The Secret should have keys 'username', 'password' and 'ca.crt' " +
256260
"This credentials Secret is not required for some registries, e.g. ECR.",
257261
Type: "object",
258262
Properties: map[string]clusterv1.JSONSchemaProps{
@@ -273,37 +277,28 @@ func (ImageCredentials) VariableSchema() clusterv1.VariableSchema {
273277
}
274278
}
275279

276-
type RegistryMirror struct {
277-
// The secret containing CA certificate for the registry mirror.
278-
// The secret should have 'ca.crt' key
280+
// GlobalImageRegistryMirror sets default mirror configuration for all the image registries.
281+
type GlobalImageRegistryMirror struct {
282+
// Registry URL.
283+
URL string `json:"url"`
284+
285+
// Credentials and CA certificate for the image registry mirror
279286
// +optional
280-
SecretRef *corev1.ObjectReference `json:"secretRef,omitempty"`
287+
Credentials *ImageCredentials `json:"credentials,omitempty"`
281288
}
282289

283-
func (RegistryMirror) VariableSchema() clusterv1.VariableSchema {
290+
func (GlobalImageRegistryMirror) VariableSchema() clusterv1.VariableSchema {
284291
return clusterv1.VariableSchema{
285292
OpenAPIV3Schema: clusterv1.JSONSchemaProps{
286293
Type: "object",
287294
Properties: map[string]clusterv1.JSONSchemaProps{
288-
"secretRef": {
289-
Description: "The Secret containing the registry CA certificate. " +
290-
"The Secret should have keys 'ca.crt'. " +
291-
"This credentials Secret is not required for public registries.",
292-
Type: "object",
293-
Properties: map[string]clusterv1.JSONSchemaProps{
294-
"name": {
295-
Description: "The name of the Secret containing the registry CA certificate.",
296-
Type: "string",
297-
},
298-
"namespace": {
299-
Description: "The namespace of the Secret containing the registry CA certificate. " +
300-
"Defaults to the namespace of the KubeadmControlPlaneTemplate and KubeadmConfigTemplate" +
301-
" that reference this variable.",
302-
Type: "string",
303-
},
304-
},
295+
"url": {
296+
Description: "Registry mirror URL.",
297+
Type: "string",
305298
},
299+
"credentials": ImageCredentials{}.VariableSchema().OpenAPIV3Schema,
306300
},
301+
Required: []string{"url"},
307302
},
308303
}
309304
}
@@ -312,13 +307,9 @@ type ImageRegistry struct {
312307
// Registry URL.
313308
URL string `json:"url"`
314309

315-
// Credentials for the image registry
310+
// Credentials and CA certificate for the image registry
316311
// +optional
317312
Credentials *ImageCredentials `json:"credentials,omitempty"`
318-
319-
// Use this registry as a mirror
320-
// +optional
321-
Mirror *RegistryMirror `json:"mirror,omitempty"`
322313
}
323314

324315
func (ImageRegistry) VariableSchema() clusterv1.VariableSchema {
@@ -331,7 +322,6 @@ func (ImageRegistry) VariableSchema() clusterv1.VariableSchema {
331322
Type: "string",
332323
},
333324
"credentials": ImageCredentials{}.VariableSchema().OpenAPIV3Schema,
334-
"mirror": RegistryMirror{}.VariableSchema().OpenAPIV3Schema,
335325
},
336326
Required: []string{"url"},
337327
},

‎api/v1alpha1/zz_generated.deepcopy.go

Lines changed: 25 additions & 25 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎docs/content/customization/generic/global-mirror.md

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
+++
2+
title = "Global Image Registry Mirror"
3+
+++
4+
5+
Add containerd image registry mirror configuration to all Nodes in the cluster.
6+
7+
When the `globalImageRegistryMirror` variable is set, `files` with configurations for [Containerd default mirror](https://github.com/containerd/containerd/blob/main/docs/hosts.md#setup-default-mirror-for-all-registries) will be added.
8+
9+
This customization will be available when the
10+
[provider-specific cluster configuration patch]({{< ref "..">}}) is included in the `ClusterClass`.
11+
12+
## Example
13+
14+
To provide image registry mirror with CA certificate, specify the following configuration:
15+
16+
If your registry mirror requires self signed CA certifate, create a Kubernetes Secret with keys for `ca.crt`:
17+
18+
```shell
19+
kubectl create secret generic my-mirror-ca-cert-secret \
20+
--from-file=ca.crt=registry-ca.crt
21+
```
22+
23+
```yaml
24+
apiVersion: cluster.x-k8s.io/v1beta1
25+
kind: Cluster
26+
metadata:
27+
name: <NAME>
28+
spec:
29+
topology:
30+
variables:
31+
- name: clusterConfig
32+
value:
33+
globalImageRegistryMirror:
34+
url: https://my-mirror.io
35+
credentials:
36+
secretRef:
37+
name: my-mirror-ca-cert-secret
38+
```
39+
40+
Applying this configuration will result in following new files on the
41+
`KubeadmControlPlaneTemplate` and `KubeadmConfigTemplate`
42+
43+
- `/etc/containerd/certs.d/_default/hosts.toml`
44+
- `/etc/certs/mirror.pem`
45+
46+
To use a public hosted image registry (ex. ECR) as mirror, specify the following configuration:
47+
48+
```yaml
49+
apiVersion: cluster.x-k8s.io/v1beta1
50+
kind: Cluster
51+
metadata:
52+
name: <NAME>
53+
spec:
54+
topology:
55+
variables:
56+
- name: clusterConfig
57+
value:
58+
globalImageRegistryMirror:
59+
url: https://123456789.dkr.ecr.us-east-1.amazonaws.com
60+
```
61+
62+
Applying this configuration will result in following new files on the
63+
`KubeadmControlPlaneTemplate` and `KubeadmConfigTemplate`
64+
65+
- `/etc/containerd/certs.d/_default/hosts.toml`

‎docs/content/customization/generic/image-registries.md

Lines changed: 0 additions & 60 deletions
Original file line numberDiff line numberDiff line change
@@ -41,63 +41,3 @@ spec:
4141
4242
Applying this configuration will result in new files and preKubeadmCommands
4343
on the `KubeadmControlPlaneTemplate` and `KubeadmConfigTemplate`.
44-
45-
To use a image registry as mirror with CA certificate, specify the following configuration:
46-
47-
If your registry mirror requires self signed CA certifate, create a Kubernetes Secret with keys for `ca.crt`:
48-
49-
```shell
50-
kubectl create secret generic my-mirror-ca-cert-secret \
51-
--from-file=ca.crt=registry-ca.crt
52-
```
53-
54-
```yaml
55-
apiVersion: cluster.x-k8s.io/v1beta1
56-
kind: Cluster
57-
metadata:
58-
name: <NAME>
59-
spec:
60-
topology:
61-
variables:
62-
- name: clusterConfig
63-
value:
64-
imageRegistries:
65-
- url: https://my-registry.io
66-
credentials:
67-
secretRef:
68-
name: my-registry-credentials
69-
mirror:
70-
secretRef:
71-
name: my-mirror-ca-cert-secret
72-
```
73-
74-
Applying this configuration will result in following new files on the
75-
`KubeadmControlPlaneTemplate` and `KubeadmConfigTemplate`
76-
77-
- `/etc/containerd/certs.d/_default/hosts.toml`
78-
- `/etc/certs/mirror.pem`
79-
80-
To use a public hosted image registry (ex. ECR) as mirror, specify the following configuration:
81-
82-
```yaml
83-
apiVersion: cluster.x-k8s.io/v1beta1
84-
kind: Cluster
85-
metadata:
86-
name: <NAME>
87-
spec:
88-
topology:
89-
variables:
90-
- name: clusterConfig
91-
value:
92-
imageRegistries:
93-
- url: https://123456789.dkr.ecr.us-east-1.amazonaws.com
94-
credentials:
95-
secretRef:
96-
name: my-registry-credentials
97-
mirror: {}
98-
```
99-
100-
Applying this configuration will result in following new files on the
101-
`KubeadmControlPlaneTemplate` and `KubeadmConfigTemplate`
102-
103-
- `/etc/containerd/certs.d/_default/hosts.toml`

‎pkg/handlers/aws/mutation/metapatch_handler_test.go

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,8 @@ import (
3838
imageregistrycredentialstests "github.com/d2iq-labs/capi-runtime-extensions/pkg/handlers/generic/mutation/imageregistries/credentials/tests"
3939
"github.com/d2iq-labs/capi-runtime-extensions/pkg/handlers/generic/mutation/kubernetesimagerepository"
4040
kubernetesimagerepositorytests "github.com/d2iq-labs/capi-runtime-extensions/pkg/handlers/generic/mutation/kubernetesimagerepository/tests"
41+
"github.com/d2iq-labs/capi-runtime-extensions/pkg/handlers/generic/mutation/mirrors"
42+
globalimageregistrymirrortests "github.com/d2iq-labs/capi-runtime-extensions/pkg/handlers/generic/mutation/mirrors/tests"
4143
"github.com/d2iq-labs/capi-runtime-extensions/pkg/handlers/generic/workerconfig"
4244
)
4345

@@ -156,12 +158,12 @@ func TestGeneratePatches(t *testing.T) {
156158
imageregistries.VariableName,
157159
)
158160

159-
imageregistrycredentialstests.TestGenerateMirrorPatches(
161+
globalimageregistrymirrortests.TestGeneratePatches(
160162
t,
161163
metaPatchGeneratorFunc(mgr),
162164
mgr.GetClient(),
163165
clusterconfig.MetaVariableName,
164-
imageregistries.VariableName,
166+
mirrors.GlobalMirrorVariableName,
165167
)
166168

167169
amitests.TestControlPlaneGeneratePatches(

‎pkg/handlers/docker/mutation/metapatch_handler_test.go

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,8 @@ import (
2828
imageregistrycredentialstests "github.com/d2iq-labs/capi-runtime-extensions/pkg/handlers/generic/mutation/imageregistries/credentials/tests"
2929
"github.com/d2iq-labs/capi-runtime-extensions/pkg/handlers/generic/mutation/kubernetesimagerepository"
3030
kubernetesimagerepositorytests "github.com/d2iq-labs/capi-runtime-extensions/pkg/handlers/generic/mutation/kubernetesimagerepository/tests"
31+
"github.com/d2iq-labs/capi-runtime-extensions/pkg/handlers/generic/mutation/mirrors"
32+
globalimageregistrymirrortests "github.com/d2iq-labs/capi-runtime-extensions/pkg/handlers/generic/mutation/mirrors/tests"
3133
"github.com/d2iq-labs/capi-runtime-extensions/pkg/handlers/generic/workerconfig"
3234
)
3335

@@ -113,11 +115,11 @@ func TestGeneratePatches(t *testing.T) {
113115
imageregistries.VariableName,
114116
)
115117

116-
imageregistrycredentialstests.TestGenerateMirrorPatches(
118+
globalimageregistrymirrortests.TestGeneratePatches(
117119
t,
118120
metaPatchGeneratorFunc(mgr),
119121
mgr.GetClient(),
120122
clusterconfig.MetaVariableName,
121-
imageregistries.VariableName,
123+
mirrors.GlobalMirrorVariableName,
122124
)
123125
}

‎pkg/handlers/generic/mutation/handlers.go

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ import (
1414
"github.com/d2iq-labs/capi-runtime-extensions/pkg/handlers/generic/mutation/httpproxy"
1515
"github.com/d2iq-labs/capi-runtime-extensions/pkg/handlers/generic/mutation/imageregistries/credentials"
1616
"github.com/d2iq-labs/capi-runtime-extensions/pkg/handlers/generic/mutation/kubernetesimagerepository"
17+
"github.com/d2iq-labs/capi-runtime-extensions/pkg/handlers/generic/mutation/mirrors"
1718
)
1819

1920
// MetaMutators returns all generic patch handlers.
@@ -25,6 +26,7 @@ func MetaMutators(mgr manager.Manager) []mutation.MetaMutator {
2526
httpproxy.NewPatch(mgr.GetClient()),
2627
kubernetesimagerepository.NewPatch(),
2728
credentials.NewPatch(mgr.GetClient()),
29+
mirrors.NewPatch(mgr.GetClient()),
2830
calico.NewPatch(),
2931
}
3032
}

0 commit comments

Comments
 (0)