178 lines
4.6 KiB
YAML
178 lines
4.6 KiB
YAML
apiVersion: helm.toolkit.fluxcd.io/v2
|
|
kind: HelmRelease
|
|
metadata:
|
|
name: zot
|
|
namespace: zot
|
|
spec:
|
|
interval: 15m
|
|
releaseName: zot
|
|
targetNamespace: zot
|
|
chart:
|
|
spec:
|
|
chart: zot
|
|
version: 0.1.128
|
|
sourceRef:
|
|
kind: HelmRepository
|
|
name: project-zot
|
|
namespace: flux-system
|
|
install:
|
|
remediation:
|
|
retries: 3
|
|
upgrade:
|
|
remediation:
|
|
retries: 3
|
|
values:
|
|
replicaCount: 1
|
|
image:
|
|
repository: ghcr.io/project-zot/zot-minimal
|
|
tag: v2.1.22@sha256:6704abd9c4c988398d77915549d79c5daa2a2c5731964833e31ca039c9ac4ed3
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
runAsNonRoot: true
|
|
runAsUser: 1000
|
|
runAsGroup: 1000
|
|
readOnlyRootFilesystem: true
|
|
serviceAccount:
|
|
create: false
|
|
name: zot
|
|
service:
|
|
type: ClusterIP
|
|
port: 5000
|
|
nodeSelector:
|
|
has-zfs: "true"
|
|
persistence: true
|
|
pvc:
|
|
storage: 50Gi
|
|
storageClassName: openebs-zfspv-1m-zstd
|
|
startupProbe:
|
|
initialDelaySeconds: 5
|
|
periodSeconds: 10
|
|
failureThreshold: 12
|
|
httpGet:
|
|
scheme: HTTPS
|
|
port: 5000
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 512Mi
|
|
limits:
|
|
memory: 2Gi
|
|
mountConfig: true
|
|
externalSecrets:
|
|
- secretName: zot-secrets
|
|
mountPath: /secret
|
|
- secretName: zot-tls
|
|
mountPath: /tls
|
|
env:
|
|
- name: SSL_CERT_FILE
|
|
value: /tls/ca.crt
|
|
- name: AWS_ACCESS_KEY_ID
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: zot-secrets
|
|
key: AWS_ACCESS_KEY_ID
|
|
- name: AWS_SECRET_ACCESS_KEY
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: zot-secrets
|
|
key: AWS_SECRET_ACCESS_KEY
|
|
extraVolumes:
|
|
- name: tmp
|
|
emptyDir:
|
|
sizeLimit: 10Gi
|
|
extraVolumeMounts:
|
|
- name: tmp
|
|
mountPath: /tmp
|
|
configFiles:
|
|
config.json: |-
|
|
{
|
|
"distSpecVersion": "1.1.1",
|
|
"storage": {
|
|
"rootDirectory": "/tmp/zot",
|
|
"dedupe": false,
|
|
"gc": true,
|
|
"gcDelay": "1h",
|
|
"storageDriver": {
|
|
"name": "s3",
|
|
"rootdirectory": "/zot",
|
|
"region": "us-east-1",
|
|
"bucket": "zot",
|
|
"regionendpoint": "https://s3.quorate.internal",
|
|
"forcepathstyle": true,
|
|
"secure": true,
|
|
"skipverify": false
|
|
}
|
|
},
|
|
"http": {
|
|
"address": "0.0.0.0",
|
|
"port": "5000",
|
|
"externalUrl": "https://zot.quorate.internal",
|
|
"tls": {
|
|
"cert": "/tls/tls.crt",
|
|
"key": "/tls/tls.key"
|
|
},
|
|
"compat": ["docker2s2"],
|
|
"auth": {
|
|
"htpasswd": {
|
|
"path": "/secret/htpasswd"
|
|
},
|
|
"failDelay": 3
|
|
},
|
|
"accessControl": {
|
|
"repositories": {
|
|
"olm/quay-operator": {
|
|
"policies": [
|
|
{
|
|
"users": ["quay-op"],
|
|
"actions": ["read", "create", "update"]
|
|
}
|
|
],
|
|
"anonymousPolicy": ["read"]
|
|
},
|
|
"olm/project-quay-catalog": {
|
|
"policies": [
|
|
{
|
|
"users": ["quay-op"],
|
|
"actions": ["read", "create", "update"]
|
|
}
|
|
],
|
|
"anonymousPolicy": ["read"]
|
|
},
|
|
"quay/quay": {
|
|
"policies": [
|
|
{
|
|
"users": ["quay-custom"],
|
|
"actions": ["read", "create", "update"]
|
|
}
|
|
],
|
|
"anonymousPolicy": ["read"]
|
|
},
|
|
"quorate/cnpg-postgresql": {
|
|
"policies": [
|
|
{
|
|
"users": ["pg-image"],
|
|
"actions": ["read", "create", "update"]
|
|
}
|
|
],
|
|
"anonymousPolicy": ["read"]
|
|
},
|
|
"**": {
|
|
"anonymousPolicy": ["read"],
|
|
"defaultPolicy": []
|
|
}
|
|
},
|
|
"adminPolicy": {
|
|
"users": ["********"],
|
|
"actions": ["read", "create", "update", "delete"]
|
|
}
|
|
}
|
|
},
|
|
"log": {
|
|
"level": "info"
|
|
}
|
|
}
|
|
test:
|
|
enabled: false
|