ms2k/quorate
SHA256
Watch
0
Code Releases Activity

ce7cb702218693d08ea6d83464d2457c9250027c

Browse source
This commit is contained in:
ms2k 2026-11-12 20:46:28 +09:00
commit 34c5f8963c
7 changed files with 145336 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

19
vendor/platform/zot/certificate.yaml vendored Normal file
View file

@ -0,0 +1,19 @@
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: zot
namespace: zot
spec:
secretName: zot-tls
issuerRef:
name: vault-internal
kind: ClusterIssuer
commonName: zot.quorate.internal
dnsNames:
- zot.quorate.internal
duration: 2160h
renewBefore: 360h
privateKey:
algorithm: ECDSA
size: 256
rotationPolicy: Always

178
vendor/platform/zot/helm-release.yaml vendored Normal file
View file

@ -0,0 +1,178 @@
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: zot
namespace: zot
spec:
interval: 15m
releaseName: zot
targetNamespace: zot
chart:
spec:
chart: zot
version: 0.1.128
sourceRef:
kind: HelmRepository
name: project-zot
namespace: flux-system
install:
remediation:
retries: 3
upgrade:
remediation:
retries: 3
values:
replicaCount: 1
image:
repository: ghcr.io/project-zot/zot-minimal
tag: v2.1.22@sha256:6704abd9c4c988398d77915549d79c5daa2a2c5731964833e31ca039c9ac4ed3
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
runAsNonRoot: true
runAsUser: 1000
runAsGroup: 1000
readOnlyRootFilesystem: true
serviceAccount:
create: false
name: zot
service:
type: ClusterIP
port: 5000
nodeSelector:
has-zfs: "true"
persistence: true
pvc:
storage: 50Gi
storageClassName: openebs-zfspv-1m-zstd
startupProbe:
initialDelaySeconds: 5
periodSeconds: 10
failureThreshold: 12
httpGet:
scheme: HTTPS
port: 5000
resources:
requests:
cpu: 100m
memory: 512Mi
limits:
memory: 2Gi
mountConfig: true
externalSecrets:
- secretName: zot-secrets
mountPath: /secret
- secretName: zot-tls
mountPath: /tls
env:
- name: SSL_CERT_FILE
value: /tls/ca.crt
- name: AWS_ACCESS_KEY_ID
valueFrom:
secretKeyRef:
name: zot-secrets
key: AWS_ACCESS_KEY_ID
- name: AWS_SECRET_ACCESS_KEY
valueFrom:
secretKeyRef:
name: zot-secrets
key: AWS_SECRET_ACCESS_KEY
extraVolumes:
- name: tmp
emptyDir:
sizeLimit: 10Gi
extraVolumeMounts:
- name: tmp
mountPath: /tmp
configFiles:
config.json: |-
{
"distSpecVersion": "1.1.1",
"storage": {
"rootDirectory": "/tmp/zot",
"dedupe": false,
"gc": true,
"gcDelay": "1h",
"storageDriver": {
"name": "s3",
"rootdirectory": "/zot",
"region": "us-east-1",
"bucket": "zot",
"regionendpoint": "https://s3.quorate.internal",
"forcepathstyle": true,
"secure": true,
"skipverify": false
}
},
"http": {
"address": "0.0.0.0",
"port": "5000",
"externalUrl": "https://zot.quorate.internal",
"tls": {
"cert": "/tls/tls.crt",
"key": "/tls/tls.key"
},
"compat": ["docker2s2"],
"auth": {
"htpasswd": {
"path": "/secret/htpasswd"
},
"failDelay": 3
},
"accessControl": {
"repositories": {
"olm/quay-operator": {
"policies": [
{
"users": ["quay-op"],
"actions": ["read", "create", "update"]
}
],
"anonymousPolicy": ["read"]
},
"olm/project-quay-catalog": {
"policies": [
{
"users": ["quay-op"],
"actions": ["read", "create", "update"]
}
],
"anonymousPolicy": ["read"]
},
"quay/quay": {
"policies": [
{
"users": ["quay-custom"],
"actions": ["read", "create", "update"]
}
],
"anonymousPolicy": ["read"]
},
"quorate/cnpg-postgresql": {
"policies": [
{
"users": ["pg-image"],
"actions": ["read", "create", "update"]
}
],
"anonymousPolicy": ["read"]
},
"**": {
"anonymousPolicy": ["read"],
"defaultPolicy": []
}
},
"adminPolicy": {
"users": ["********"],
"actions": ["read", "create", "update", "delete"]
}
}
},
"log": {
"level": "info"
}
}
test:
enabled: false

9
vendor/platform/zot/kustomization.yaml vendored Normal file
View file

@ -0,0 +1,9 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- namespace.yaml
- vso.yaml
- certificate.yaml
- helm-release.yaml
- service.yaml
- network-policies.yaml

23
vendor/platform/zot/namespace.yaml vendored Normal file
View file

@ -0,0 +1,23 @@
apiVersion: v1
kind: Namespace
metadata:
name: zot
labels:
pod-security.kubernetes.io/enforce: baseline
pod-security.kubernetes.io/enforce-version: latest
pod-security.kubernetes.io/audit: restricted
pod-security.kubernetes.io/audit-version: latest
pod-security.kubernetes.io/warn: restricted
pod-security.kubernetes.io/warn-version: latest
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: zot
namespace: zot
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: zot-vso
namespace: zot

117
vendor/platform/zot/network-policies.yaml vendored Normal file
View file

@ -0,0 +1,117 @@
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: zot
namespace: zot
spec:
endpointSelector:
matchLabels:
app.kubernetes.io/name: zot
app.kubernetes.io/instance: zot
ingress:
# Kubelet probes, local port-forwarding, and same-node LoadBalancer backend flows.
- fromEntities:
- host
toPorts:
- ports:
- port: "5000"
protocol: TCP
# Cross-node kubelet image pulls arrive with Cilium's remote-node identity.
- fromEntities:
- remote-node
toPorts:
- ports:
- port: "5000"
protocol: TCP
# Direct LAN/WireGuard clients reach Zot through zot-direct LoadBalancer.
- fromCIDR:
- 10.115.187.218/24
- 10.63.81.107/24
- 10.162.8.60/24
toPorts:
- ports:
- port: "5000"
protocol: TCP
egress:
- toEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: kube-system
k8s-app: kube-dns
toPorts:
- ports:
- port: "53"
protocol: UDP
- port: "53"
protocol: TCP
- toEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: versitygw
app.kubernetes.io/name: versitygw
app.kubernetes.io/instance: versitygw
toPorts:
- ports:
- port: "7070"
protocol: TCP
# In-cluster clients reach S3 through versitygw-direct BGP LoadBalancer (socket-LB VIP).
- toCIDR:
- 10.66.127.81/32
toPorts:
- ports:
- port: "443"
protocol: TCP
---
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
name: versitygw-ingress-zot
spec:
endpointSelector:
matchLabels:
k8s:io.kubernetes.pod.namespace: versitygw
app.kubernetes.io/name: versitygw
app.kubernetes.io/instance: versitygw
ingress:
- fromEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: zot
app.kubernetes.io/name: zot
app.kubernetes.io/instance: zot
toPorts:
- ports:
- port: "7070"
protocol: TCP
---
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
name: host-egress-zot
spec:
nodeSelector: {}
egress:
- toEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: zot
app.kubernetes.io/name: zot
app.kubernetes.io/instance: zot
toPorts:
- ports:
- port: "5000"
protocol: TCP
---
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
name: host-ingress-zot-replies
spec:
nodeSelector: {}
ingress:
- fromEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: zot
app.kubernetes.io/name: zot
app.kubernetes.io/instance: zot
toPorts:
- ports:
- port: "32768"
endPort: 60999
protocol: TCP

27
vendor/platform/zot/service.yaml vendored Normal file
View file

@ -0,0 +1,27 @@
apiVersion: v1
kind: Service
metadata:
name: zot-direct
namespace: zot
labels:
app.kubernetes.io/name: zot
app.kubernetes.io/instance: zot
io.cilium/bgp-announce: "true"
annotations:
lbipam.cilium.io/ips: "172.28.129.182"
spec:
type: LoadBalancer
externalTrafficPolicy: Local
loadBalancerSourceRanges:
- 10.115.187.218/24
- 10.63.81.107/24
- 10.162.8.60/24
selector:
app.kubernetes.io/name: zot
app.kubernetes.io/instance: zot
ports:
- name: https
port: 443
targetPort: zot
protocol: TCP
appProtocol: https

28
vendor/platform/zot/vso.yaml vendored Normal file
View file

@ -0,0 +1,28 @@
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultAuth
metadata:
name: default
namespace: zot
spec:
method: kubernetes
mount: kubernetes
kubernetes:
role: zot
serviceAccount: zot-vso
vaultConnectionRef: vault/vault
---
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
name: zot-config
namespace: zot
spec:
type: kv-v2
mount: secret
path: zot/config
destination:
name: zot-secrets
create: true
overwrite: true
refreshAfter: 1h
vaultAuthRef: default