ce7cb702218693d08ea6d83464d2457c9250027c
This commit is contained in:
commit
34c5f8963c
1 changed files with 145336 additions and 0 deletions
220
vendor/platform/quay/vso.yaml
vendored
Normal file
220
vendor/platform/quay/vso.yaml
vendored
Normal file
|
|
@ -0,0 +1,220 @@
|
|||
---
|
||||
apiVersion: secrets.hashicorp.com/v1beta1
|
||||
kind: VaultAuth
|
||||
metadata:
|
||||
name: default
|
||||
namespace: quay
|
||||
spec:
|
||||
method: kubernetes
|
||||
mount: kubernetes
|
||||
kubernetes:
|
||||
role: quay
|
||||
serviceAccount: quay-vso
|
||||
vaultConnectionRef: vault/vault
|
||||
---
|
||||
apiVersion: secrets.hashicorp.com/v1beta1
|
||||
kind: VaultStaticSecret
|
||||
metadata:
|
||||
name: quay-config-bundle
|
||||
namespace: quay
|
||||
spec:
|
||||
type: kv-v2
|
||||
mount: secret
|
||||
path: quay/secrets
|
||||
destination:
|
||||
name: quay-config-bundle
|
||||
create: true
|
||||
overwrite: true
|
||||
transformation:
|
||||
excludeRaw: true
|
||||
excludes:
|
||||
- .*
|
||||
templates:
|
||||
config.yaml:
|
||||
text: |
|
||||
AUTHENTICATION_TYPE: OIDC
|
||||
BROWSER_API_CALLS_XHR_ONLY: false
|
||||
DATABASE_SECRET_KEY: "{{ get .Secrets "database_secret_key" }}"
|
||||
DB_URI: "postgresql://********@main-rw.postgres.svc.cluster.local:5432/quay?sslmode=require"
|
||||
BUILDLOGS_REDIS:
|
||||
host: quay.dragonfly.svc.cluster.local
|
||||
password: "{{ get .Secrets "redis_password" }}"
|
||||
port: 6379
|
||||
DISTRIBUTED_STORAGE_CONFIG:
|
||||
default:
|
||||
- RadosGWStorage
|
||||
- access_key: quay
|
||||
secret_key: "{{ get .Secrets "s3_secret_key" }}"
|
||||
bucket_name: quay-registry
|
||||
hostname: s3.quorate.internal
|
||||
is_secure: true
|
||||
signature_version: v4
|
||||
storage_path: /datastorage/registry
|
||||
server_side_assembly: false
|
||||
DISTRIBUTED_STORAGE_DEFAULT_LOCATIONS: []
|
||||
DISTRIBUTED_STORAGE_PREFERENCE: ["default"]
|
||||
EXTERNAL_TLS_TERMINATION: false
|
||||
FEATURE_SECURITY_NOTIFICATIONS: true
|
||||
FEATURE_SECURITY_SCANNER: true
|
||||
FEATURE_SECURITY_SCANNER_NOTIFY_ON_NEW_INDEX: true
|
||||
FEATURE_PROXY_CACHE: false
|
||||
FEATURE_USER_CREATION: true
|
||||
FEATURE_USER_INITIALIZE: true
|
||||
PREFERRED_URL_SCHEME: https
|
||||
SECRET_KEY: "{{ get .Secrets "secret_key" }}"
|
||||
SECURITY_SCANNER_INDEXING_INTERVAL: 30
|
||||
SECURITY_SCANNER_V4_ENDPOINT: http://quay-registry-clair-app.quay.svc.cluster.local
|
||||
SECURITY_SCANNER_V4_INDEX_MAX_LAYER_SIZE: 8G
|
||||
SECURITY_SCANNER_V4_MANIFEST_CLEANUP: true
|
||||
SECURITY_SCANNER_V4_PSK: "{{ get .Secrets "clair_psk" }}"
|
||||
SERVER_HOSTNAME: registry.quorate.internal
|
||||
SUPER_USERS: ["********"]
|
||||
USER_EVENTS_REDIS:
|
||||
host: quay.dragonfly.svc.cluster.local
|
||||
password: "{{ get .Secrets "redis_password" }}"
|
||||
port: 6379
|
||||
ZITADEL_LOGIN_CONFIG:
|
||||
CLIENT_ID: "{{ get .Secrets "oidc_client_id" }}"
|
||||
CLIENT_SECRET: "{{ get .Secrets "oidc_client_secret" }}"
|
||||
LOGIN_SCOPES: ["openid", "email", "profile"]
|
||||
OIDC_ISSUER: https://auth.quorate.dev
|
||||
OIDC_SERVER: https://auth.quorate.dev/
|
||||
PREFERRED_GROUP_CLAIM_NAME: groups
|
||||
PREFERRED_USERNAME_CLAIM_NAME: preferred_username
|
||||
SERVICE_NAME: Zitadel
|
||||
clair-config.yaml:
|
||||
text: |
|
||||
http_listen_addr: :8080
|
||||
introspection_addr: :8089
|
||||
log_level: info
|
||||
indexer:
|
||||
connstring: "host=main-rw.postgres.svc.cluster.local port=5432 dbname=quay_clair user=******** sslmode=require"
|
||||
scanlock_retry: 10
|
||||
layer_scan_concurrency: 5
|
||||
migrations: true
|
||||
scanner:
|
||||
package:
|
||||
java:
|
||||
api: https://central.sonatype.com/solrsearch/select
|
||||
matcher:
|
||||
connstring: "host=main-rw.postgres.svc.cluster.local port=5432 dbname=quay_clair user=******** sslmode=require"
|
||||
migrations: true
|
||||
notifier:
|
||||
connstring: "host=main-rw.postgres.svc.cluster.local port=5432 dbname=quay_clair user=******** sslmode=require"
|
||||
delivery_interval: 1m
|
||||
migrations: true
|
||||
poll_interval: 5m
|
||||
webhook:
|
||||
callback: http://quay-registry-clair-app/notifier/api/v1/notifications
|
||||
target: https://registry.quorate.internal/secscan/notification
|
||||
auth:
|
||||
psk:
|
||||
key: "{{ get .Secrets "clair_psk" }}"
|
||||
iss: ["quay", "clairctl"]
|
||||
updaters:
|
||||
config:
|
||||
rhel-vex:
|
||||
ignore_unpatched: true
|
||||
sets:
|
||||
- alpine
|
||||
- clair.cvss
|
||||
- debian
|
||||
- oracle
|
||||
- photon
|
||||
- rhcc
|
||||
- rhel-vex
|
||||
- suse
|
||||
- ubuntu
|
||||
metrics:
|
||||
name: prometheus
|
||||
extra_ca_cert_internal-ca.crt:
|
||||
text: |
|
||||
{{- get .Secrets "internal_ca_cert" -}}
|
||||
refreshAfter: 1h
|
||||
rolloutRestartTargets:
|
||||
- kind: Deployment
|
||||
name: quay-registry-quay-app
|
||||
- kind: Deployment
|
||||
name: quay-registry-clair
|
||||
vaultAuthRef: default
|
||||
---
|
||||
apiVersion: secrets.hashicorp.com/v1beta1
|
||||
kind: VaultDynamicSecret
|
||||
metadata:
|
||||
name: quay-db
|
||||
namespace: quay
|
||||
spec:
|
||||
mount: database
|
||||
path: static-creds/quay
|
||||
allowStaticCreds: true
|
||||
destination:
|
||||
name: quay-db
|
||||
create: true
|
||||
overwrite: true
|
||||
transformation:
|
||||
excludeRaw: true
|
||||
excludes:
|
||||
- .*
|
||||
templates:
|
||||
username:
|
||||
text: '{{ get .Secrets "username" }}'
|
||||
password:
|
||||
text: '{{ get .Secrets "password" }}'
|
||||
refreshAfter: 1h
|
||||
rolloutRestartTargets:
|
||||
- kind: Deployment
|
||||
name: quay-registry-quay-app
|
||||
vaultAuthRef: default
|
||||
---
|
||||
apiVersion: secrets.hashicorp.com/v1beta1
|
||||
kind: VaultDynamicSecret
|
||||
metadata:
|
||||
name: clair-db
|
||||
namespace: quay
|
||||
spec:
|
||||
mount: database
|
||||
path: static-creds/quay_clair
|
||||
allowStaticCreds: true
|
||||
destination:
|
||||
name: clair-db
|
||||
create: true
|
||||
overwrite: true
|
||||
transformation:
|
||||
excludeRaw: true
|
||||
excludes:
|
||||
- .*
|
||||
templates:
|
||||
username:
|
||||
text: '{{ get .Secrets "username" }}'
|
||||
password:
|
||||
text: '{{ get .Secrets "password" }}'
|
||||
refreshAfter: 1h
|
||||
rolloutRestartTargets:
|
||||
- kind: Deployment
|
||||
name: quay-registry-clair
|
||||
vaultAuthRef: default
|
||||
|
||||
---
|
||||
apiVersion: secrets.hashicorp.com/v1beta1
|
||||
kind: VaultStaticSecret
|
||||
metadata:
|
||||
name: quay-cluster-pull
|
||||
namespace: quay
|
||||
spec:
|
||||
type: kv-v2
|
||||
mount: secret
|
||||
path: quay/robots/cluster_pull
|
||||
refreshAfter: 1h
|
||||
destination:
|
||||
name: quay-cluster-pull
|
||||
create: true
|
||||
overwrite: true
|
||||
type: kubernetes.io/dockerconfigjson
|
||||
transformation:
|
||||
excludeRaw: true
|
||||
excludes: [.*]
|
||||
templates:
|
||||
.dockerconfigjson:
|
||||
text: >-
|
||||
{"auths":{"registry.quorate.internal":{"auth":"{{ printf "%s:%s" (get .Secrets "username") (get .Secrets "token") | b64enc }}"}}}
|
||||
vaultAuthRef: default
|
||||
Loading…
Reference in a new issue