apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: zot
  namespace: zot
spec:
  interval: 15m
  releaseName: zot
  targetNamespace: zot
  chart:
    spec:
      chart: zot
      version: 0.1.128
      sourceRef:
        kind: HelmRepository
        name: project-zot
        namespace: flux-system
  install:
    remediation:
      retries: 3
  upgrade:
    remediation:
      retries: 3
  values:
    replicaCount: 1
    image:
      repository: ghcr.io/project-zot/zot-minimal
      tag: v2.1.22@sha256:6704abd9c4c988398d77915549d79c5daa2a2c5731964833e31ca039c9ac4ed3
    securityContext:
      allowPrivilegeEscalation: false
      capabilities:
        drop:
          - ALL
      runAsNonRoot: true
      runAsUser: 1000
      runAsGroup: 1000
      readOnlyRootFilesystem: true
    serviceAccount:
      create: false
      name: zot
    service:
      type: ClusterIP
      port: 5000
    nodeSelector:
      has-zfs: "true"
    persistence: true
    pvc:
      storage: 50Gi
      storageClassName: openebs-zfspv-1m-zstd
    startupProbe:
      initialDelaySeconds: 5
      periodSeconds: 10
      failureThreshold: 12
    httpGet:
      scheme: HTTPS
      port: 5000
    resources:
      requests:
        cpu: 100m
        memory: 512Mi
      limits:
        memory: 2Gi
    mountConfig: true
    externalSecrets:
      - secretName: zot-secrets
        mountPath: /secret
      - secretName: zot-tls
        mountPath: /tls
    env:
      - name: SSL_CERT_FILE
        value: /tls/ca.crt
      - name: AWS_ACCESS_KEY_ID
        valueFrom:
          secretKeyRef:
            name: zot-secrets
            key: AWS_ACCESS_KEY_ID
      - name: AWS_SECRET_ACCESS_KEY
        valueFrom:
          secretKeyRef:
            name: zot-secrets
            key: AWS_SECRET_ACCESS_KEY
    extraVolumes:
      - name: tmp
        emptyDir:
          sizeLimit: 10Gi
    extraVolumeMounts:
      - name: tmp
        mountPath: /tmp
    configFiles:
      config.json: |-
        {
          "distSpecVersion": "1.1.1",
          "storage": {
            "rootDirectory": "/tmp/zot",
            "dedupe": false,
            "gc": true,
            "gcDelay": "1h",
            "storageDriver": {
              "name": "s3",
              "rootdirectory": "/zot",
              "region": "us-east-1",
              "bucket": "zot",
              "regionendpoint": "https://s3.quorate.internal",
              "forcepathstyle": true,
              "secure": true,
              "skipverify": false
            }
          },
          "http": {
            "address": "0.0.0.0",
            "port": "5000",
            "externalUrl": "https://zot.quorate.internal",
            "tls": {
              "cert": "/tls/tls.crt",
              "key": "/tls/tls.key"
            },
            "compat": ["docker2s2"],
            "auth": {
              "htpasswd": {
                "path": "/secret/htpasswd"
              },
              "failDelay": 3
            },
            "accessControl": {
              "repositories": {
                "olm/quay-operator": {
                  "policies": [
                    {
                      "users": ["quay-op"],
                      "actions": ["read", "create", "update"]
                    }
                  ],
                  "anonymousPolicy": ["read"]
                },
                "olm/project-quay-catalog": {
                  "policies": [
                    {
                      "users": ["quay-op"],
                      "actions": ["read", "create", "update"]
                    }
                  ],
                  "anonymousPolicy": ["read"]
                },
                "quay/quay": {
                  "policies": [
                    {
                      "users": ["quay-custom"],
                      "actions": ["read", "create", "update"]
                    }
                  ],
                  "anonymousPolicy": ["read"]
                },
                "quorate/cnpg-postgresql": {
                  "policies": [
                    {
                      "users": ["pg-image"],
                      "actions": ["read", "create", "update"]
                    }
                  ],
                  "anonymousPolicy": ["read"]
                },
                "**": {
                  "anonymousPolicy": ["read"],
                  "defaultPolicy": []
                }
              },
              "adminPolicy": {
                "users": ["********"],
                "actions": ["read", "create", "update", "delete"]
              }
            }
          },
          "log": {
            "level": "info"
          }
        }
    test:
      enabled: false