mirror of
https://github.com/labring/sealos.git
synced 2026-10-30 18:09:56 +08:00
Remove registry with no more needed. (#4910)
Signed-off-by: zzjin <tczzjin@gmail.com>
This commit is contained in:
zzjin
@@ -1,84 +0,0 @@
|
||||
# How to deploy the registry service
|
||||
|
||||
sealos registry design:
|
||||
```mermaid
|
||||
sequenceDiagram
|
||||
participant u as User
|
||||
participant sh as sealos Hub
|
||||
participant sa as sealos hub Auth
|
||||
par Login
|
||||
u->>sh: sealos login using '-k kubeconfig'
|
||||
sh->>sa: Check account
|
||||
sa->>sh: Have account
|
||||
sh->>sh: Create token
|
||||
sh->>u: Return token
|
||||
end
|
||||
par Push
|
||||
u->>sh: sealos push image
|
||||
sh->>sa: Check account and rbac
|
||||
sa->>sa: check image/repo/org access
|
||||
sa->>sh: Have access rights
|
||||
sh->>sh: Save image info and blobs
|
||||
sh->>u: Return push status
|
||||
end
|
||||
par Pull
|
||||
u->>sh: sealos pull image
|
||||
sh->>sa: Check account and rbac
|
||||
sa->>sa: check image/repo/org exists
|
||||
sa->>sh: Exists!
|
||||
sh->>sh: return image info and blobs meta
|
||||
sh->>u: Return pull status
|
||||
end
|
||||
|
||||
```
|
||||
|
||||
## Pre-Requirements
|
||||
|
||||
1. [Sealos Cloud](../cloud/README.md) for auth.
|
||||
2. [Sealos Cluster](./install_base_server.md) for registry.
|
||||
|
||||
### A running sealos kubernetes cluster
|
||||
|
||||
with at least svc(s) below:
|
||||
|
||||
1. kubernetes
|
||||
2. calico
|
||||
3. service-hub(@see [service-hub](../../service/hub/README.md))
|
||||
|
||||
### Base applications requirements
|
||||
|
||||
1. At least one storage Provider, here we use aliyun OSS and CDN. Or, you can use openebs.
|
||||
* `AliOSS`: read [this](https://distribution.github.io/distribution/storage-drivers/)
|
||||
* `openebs` : `sealos run labring/openebs:v1.9.0`
|
||||
|
||||
2. One Domain name with admin access
|
||||
* `ACMEDNS`, `Akamai`, `AzureDNS`, `CloudFlare`, `Google`, `Route53`, `DigitalOcean`, `RFC2136`
|
||||
* Any cert-manager supported `dns01` webhooks: [github-link](https://github.com/topics/cert-manager-webhook)
|
||||
|
||||
Articles below assume the usage of sealos cloud's [godaddy](https://github.com/snowdrop/godaddy-webhook) webhook as
|
||||
example.
|
||||
|
||||
*Please Prepare domain access key&secret for further usage*
|
||||
|
||||
### Choice what network gateway to use:
|
||||
|
||||
1. [Ingress-NGINX](../cloud-deprecated/manifests/ingress-nginx/README.md)
|
||||
|
||||
### Modification of config.yml
|
||||
|
||||
1. Example(@see [deploy.yaml](./manifests/deploy.yaml))
|
||||
|
||||
2. Read docker registry docs about [config](https://distribution.github.io/distribution/about/configuration/)
|
||||
|
||||
3. Edit `auth`, use your own auth server.
|
||||
|
||||
4. The image: [`registry:2`](https://hub.docker.com/_/registry) does not support `AliCDN`, if you need use image:
|
||||
`ghcr.dockerproxy.com/labring/registry:main` which is build
|
||||
from [distribution](https://github.com/distribution/distribution)
|
||||
|
||||
### Troublesome and Tips
|
||||
|
||||
1. registry config
|
||||
* **http.secret** If you are building a cluster of registries behind a load balancer, you MUST ensure the secret is
|
||||
the same for all
|
||||
registries.
|
||||
@@ -1,64 +0,0 @@
|
||||
# Install sealos and pre-requirements for hub
|
||||
|
||||
## For masters access nodes
|
||||
|
||||
* Make sure masters can access nodes each other, using:
|
||||
1. password
|
||||
2. ssh key(recommended)
|
||||
```bash
|
||||
ssh-keygen -t ed25519 -C "master0@hub.sealos.cn"
|
||||
```
|
||||
Copy `~/.ssh/id_ed25519.pub` to all masters&nodes root `~/.ssh/authorized_keys`
|
||||
3. custom port(optional)
|
||||
```bash
|
||||
vim /etc/ssh/sshd_config
|
||||
```
|
||||
*change Port to custom*
|
||||
```config
|
||||
Port 4238
|
||||
```
|
||||
```bash
|
||||
sudo service sshd restart
|
||||
```
|
||||
**Also: needs to check custom port are allowed in network acls**
|
||||
|
||||
## For cluster init
|
||||
|
||||
### Init sealos cluster
|
||||
```bash
|
||||
wget https://github.com/labring/sealos/releases/download/v4.1.3/sealos_4.1.3_linux_amd64.tar.gz && tar -zxvf sealos_4.1.3_linux_amd64.tar.gz sealos && chmod +x sealos && mv sealos /usr/bin
|
||||
sealos run labring/kubernetes:v1.24.0 labring/calico:v3.22.1 labring/metrics-server:v0.6.4 --masters xxx.xxx.xxx.xxx --nodes xxx.xxx.xxx.xxx --port 4238 -i ~/.ssh/id_ed25519
|
||||
```
|
||||
|
||||
### Install base packages
|
||||
```bash
|
||||
sealos run labring/helm:v3.8.2 labring/cert-manager:v1.8.0
|
||||
```
|
||||
|
||||
### Install DNS proxy (Optional)
|
||||
When cloud infra pod cannot access outbound network, install this package.
|
||||
```bash
|
||||
sealos run labring/coredns:v0.0.1
|
||||
```
|
||||
|
||||
### Install network
|
||||
```bash
|
||||
sealos run labring/ingress-nginx:4.1.0
|
||||
```
|
||||
```bash
|
||||
kubectl taint node NODE_NAME node-role.kubernetes.io/master-
|
||||
kubectl taint node NODE_NAME node-role.kubernetes.io/control-plane:NoSchedule-
|
||||
```
|
||||
|
||||
* If we are using ingress-nginx bare-metal mode, we needs to change things described below:
|
||||
```bash
|
||||
# goto sealos rootfs dir
|
||||
cd /var/lib/sealos/data/default/rootfs
|
||||
helm upgrade ingress-nginx ingress-nginx --namespace ingress-nginx --set controller.hostNetwork=true,controller.kind=DaemonSet
|
||||
```
|
||||
|
||||
https://cert-manager.io/docs/tutorials/zerossl/zerossl/
|
||||
|
||||
## Note for aliyun usage:
|
||||
By default, sealos's calico image use cidr `100.64.0.0/10` witch will conflict with aliyun's internal oss services.
|
||||
We need to update this cidr before install kubernetes as documented here: https://github.com/labring/sealos/issues/1119#issuecomment-1166756114
|
||||
@@ -1,141 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: docker-registry-system
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
labels:
|
||||
app: docker-registry
|
||||
name: docker-registry-config
|
||||
namespace: docker-registry-system
|
||||
data:
|
||||
config.yml: |
|
||||
version: 0.1
|
||||
log:
|
||||
accesslog:
|
||||
disabled: true
|
||||
level: debug
|
||||
formatter: json
|
||||
fields:
|
||||
service: registry
|
||||
environment: staging
|
||||
storage:
|
||||
oss: # TODO edit it
|
||||
accesskeyid: ...
|
||||
accesskeysecret: ...
|
||||
region: ...
|
||||
bucket: ...
|
||||
delete:
|
||||
enabled: true
|
||||
cache:
|
||||
blobdescriptor: inmemory
|
||||
middleware:
|
||||
storage: # TODO edit it
|
||||
- name: alicdn
|
||||
options:
|
||||
baseurl: ...
|
||||
authtype: ...
|
||||
privatekey: ...
|
||||
auth:
|
||||
token: # TODO DON'T edit it if
|
||||
realm: https://hubauth.login.sealos.io/auth
|
||||
service: token-service
|
||||
issuer: registry-token-issuer
|
||||
rootcertbundle: /etc/docker/registry/authserver.crt
|
||||
http:
|
||||
addr: :5000
|
||||
secret: ... # TODO edit it, If you are building a cluster of registries behind a load balancer,
|
||||
# you MUST ensure the secret is the same for all registries.
|
||||
headers:
|
||||
X-Content-Type-Options: [nosniff]
|
||||
http2:
|
||||
disabled: false
|
||||
health:
|
||||
storagedriver:
|
||||
enabled: true
|
||||
interval: 10s
|
||||
threshold: 3
|
||||
authserver.crt: |
|
||||
-----BEGIN CERTIFICATE-----
|
||||
...
|
||||
-----END CERTIFICATE-----
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
labels:
|
||||
app: docker-registry
|
||||
name: docker-registry
|
||||
namespace: docker-registry-system
|
||||
spec:
|
||||
replicas: 2
|
||||
revisionHistoryLimit: 5
|
||||
selector:
|
||||
matchLabels:
|
||||
app: docker-registry
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: docker-registry
|
||||
spec:
|
||||
securityContext:
|
||||
runAsUser: 0
|
||||
containers:
|
||||
- name: docker-registry # nosemgrep
|
||||
image: ghcr.dockerproxy.com/labring/registry:main
|
||||
imagePullPolicy: Always
|
||||
ports:
|
||||
- containerPort: 5000
|
||||
name: web
|
||||
protocol: TCP
|
||||
resources:
|
||||
requests:
|
||||
memory: "2048Mi"
|
||||
cpu: "1500m"
|
||||
terminationMessagePath: /dev/termination-log
|
||||
terminationMessagePolicy: File
|
||||
volumeMounts:
|
||||
- mountPath: /etc/docker/registry
|
||||
name: docker-registry-config
|
||||
tolerations:
|
||||
- key: node-role.kubernetes.io/control-plane
|
||||
operator: Exists
|
||||
effect: NoSchedule
|
||||
- key: node-role.kubernetes.io/master
|
||||
operator: Exists
|
||||
effect: NoSchedule
|
||||
affinity:
|
||||
podAntiAffinity:
|
||||
preferredDuringSchedulingIgnoredDuringExecution:
|
||||
- podAffinityTerm:
|
||||
labelSelector:
|
||||
matchExpressions:
|
||||
- key: app
|
||||
operator: In
|
||||
values:
|
||||
- docker-registry
|
||||
namespaces:
|
||||
- default
|
||||
topologyKey: kubernetes.io/hostname
|
||||
weight: 100
|
||||
volumes:
|
||||
- name: docker-registry-config
|
||||
configMap:
|
||||
name: docker-registry-config
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: docker-registry-service
|
||||
namespace: docker-registry-system
|
||||
spec:
|
||||
ports:
|
||||
- name: port-name
|
||||
port: 5000
|
||||
protocol: TCP
|
||||
targetPort: 5000
|
||||
selector:
|
||||
app: docker-registry
|
||||
sessionAffinity: ClientIP
|
||||
@@ -1,58 +0,0 @@
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: ClusterIssuer
|
||||
metadata:
|
||||
name: cluster-issuer-docker-registry
|
||||
namespace: docker-registry-system
|
||||
spec:
|
||||
acme:
|
||||
server: https://acme-v02.api.letsencrypt.org/directory
|
||||
email: admin@sealos.io
|
||||
privateKeySecretRef:
|
||||
name: letsencrypt-prod
|
||||
solvers:
|
||||
- http01:
|
||||
ingress:
|
||||
class: nginx
|
||||
---
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: hub-sealos-cn
|
||||
namespace: docker-registry-system
|
||||
spec:
|
||||
secretName: hub-sealos-cn-cert
|
||||
dnsNames:
|
||||
- hub.sealos.cn
|
||||
issuerRef:
|
||||
name: cluster-issuer-docker-registry
|
||||
kind: ClusterIssuer
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: docker-registry-ingress
|
||||
namespace: docker-registry-system
|
||||
labels:
|
||||
app: hub-service
|
||||
annotations:
|
||||
kubernetes.io/ingress.class: nginx
|
||||
nginx.ingress.kubernetes.io/backend-protocol: "HTTP"
|
||||
nginx.ingress.kubernetes.io/proxy-body-size: 4096m
|
||||
nginx.ingress.kubernetes.io/ssl-redirect: "false"
|
||||
nginx.ingress.kubernetes.io/use-forwarded-headers: "true"
|
||||
spec:
|
||||
rules:
|
||||
- host: hub.sealos.cn
|
||||
http:
|
||||
paths:
|
||||
- pathType: Prefix
|
||||
path: /
|
||||
backend:
|
||||
service:
|
||||
name: docker-registry-service
|
||||
port:
|
||||
number: 5000
|
||||
tls:
|
||||
- hosts:
|
||||
- hub.sealos.cn
|
||||
secretName: hub-sealos-cn-cert
|
||||
Reference in New Issue
Block a user