diff --git a/deploy/registry/README.md b/deploy/registry/README.md deleted file mode 100644 index f6216fb4a..000000000 --- a/deploy/registry/README.md +++ /dev/null @@ -1,84 +0,0 @@ -# How to deploy the registry service - -sealos registry design: -```mermaid -sequenceDiagram - participant u as User - participant sh as sealos Hub - participant sa as sealos hub Auth - par Login - u->>sh: sealos login using '-k kubeconfig' - sh->>sa: Check account - sa->>sh: Have account - sh->>sh: Create token - sh->>u: Return token - end - par Push - u->>sh: sealos push image - sh->>sa: Check account and rbac - sa->>sa: check image/repo/org access - sa->>sh: Have access rights - sh->>sh: Save image info and blobs - sh->>u: Return push status - end - par Pull - u->>sh: sealos pull image - sh->>sa: Check account and rbac - sa->>sa: check image/repo/org exists - sa->>sh: Exists! - sh->>sh: return image info and blobs meta - sh->>u: Return pull status - end - -``` - -## Pre-Requirements - -1. [Sealos Cloud](../cloud/README.md) for auth. -2. [Sealos Cluster](./install_base_server.md) for registry. - -### A running sealos kubernetes cluster - -with at least svc(s) below: - -1. kubernetes -2. calico -3. service-hub(@see [service-hub](../../service/hub/README.md)) - -### Base applications requirements - -1. At least one storage Provider, here we use aliyun OSS and CDN. Or, you can use openebs. - * `AliOSS`: read [this](https://distribution.github.io/distribution/storage-drivers/) - * `openebs` : `sealos run labring/openebs:v1.9.0` - -2. One Domain name with admin access - * `ACMEDNS`, `Akamai`, `AzureDNS`, `CloudFlare`, `Google`, `Route53`, `DigitalOcean`, `RFC2136` - * Any cert-manager supported `dns01` webhooks: [github-link](https://github.com/topics/cert-manager-webhook) - - Articles below assume the usage of sealos cloud's [godaddy](https://github.com/snowdrop/godaddy-webhook) webhook as - example. - - *Please Prepare domain access key&secret for further usage* - -### Choice what network gateway to use: - -1. [Ingress-NGINX](../cloud-deprecated/manifests/ingress-nginx/README.md) - -### Modification of config.yml - -1. Example(@see [deploy.yaml](./manifests/deploy.yaml)) - -2. Read docker registry docs about [config](https://distribution.github.io/distribution/about/configuration/) - -3. Edit `auth`, use your own auth server. - -4. The image: [`registry:2`](https://hub.docker.com/_/registry) does not support `AliCDN`, if you need use image: - `ghcr.dockerproxy.com/labring/registry:main` which is build - from [distribution](https://github.com/distribution/distribution) - -### Troublesome and Tips - -1. registry config - * **http.secret** If you are building a cluster of registries behind a load balancer, you MUST ensure the secret is - the same for all - registries. diff --git a/deploy/registry/install_base_server.md b/deploy/registry/install_base_server.md deleted file mode 100644 index f6af7e97c..000000000 --- a/deploy/registry/install_base_server.md +++ /dev/null @@ -1,64 +0,0 @@ -# Install sealos and pre-requirements for hub - -## For masters access nodes - -* Make sure masters can access nodes each other, using: - 1. password - 2. ssh key(recommended) - ```bash - ssh-keygen -t ed25519 -C "master0@hub.sealos.cn" - ``` - Copy `~/.ssh/id_ed25519.pub` to all masters&nodes root `~/.ssh/authorized_keys` - 3. custom port(optional) - ```bash - vim /etc/ssh/sshd_config - ``` - *change Port to custom* - ```config - Port 4238 - ``` - ```bash - sudo service sshd restart - ``` - **Also: needs to check custom port are allowed in network acls** - -## For cluster init - -### Init sealos cluster -```bash -wget https://github.com/labring/sealos/releases/download/v4.1.3/sealos_4.1.3_linux_amd64.tar.gz && tar -zxvf sealos_4.1.3_linux_amd64.tar.gz sealos && chmod +x sealos && mv sealos /usr/bin -sealos run labring/kubernetes:v1.24.0 labring/calico:v3.22.1 labring/metrics-server:v0.6.4 --masters xxx.xxx.xxx.xxx --nodes xxx.xxx.xxx.xxx --port 4238 -i ~/.ssh/id_ed25519 -``` - -### Install base packages -```bash -sealos run labring/helm:v3.8.2 labring/cert-manager:v1.8.0 -``` - -### Install DNS proxy (Optional) -When cloud infra pod cannot access outbound network, install this package. -```bash -sealos run labring/coredns:v0.0.1 -``` - -### Install network -```bash -sealos run labring/ingress-nginx:4.1.0 -``` -```bash -kubectl taint node NODE_NAME node-role.kubernetes.io/master- -kubectl taint node NODE_NAME node-role.kubernetes.io/control-plane:NoSchedule- -``` - -* If we are using ingress-nginx bare-metal mode, we needs to change things described below: -```bash -# goto sealos rootfs dir -cd /var/lib/sealos/data/default/rootfs -helm upgrade ingress-nginx ingress-nginx --namespace ingress-nginx --set controller.hostNetwork=true,controller.kind=DaemonSet -``` - -https://cert-manager.io/docs/tutorials/zerossl/zerossl/ - -## Note for aliyun usage: -By default, sealos's calico image use cidr `100.64.0.0/10` witch will conflict with aliyun's internal oss services. -We need to update this cidr before install kubernetes as documented here: https://github.com/labring/sealos/issues/1119#issuecomment-1166756114 diff --git a/deploy/registry/manifests/deploy.yaml b/deploy/registry/manifests/deploy.yaml deleted file mode 100644 index 16c2bdf97..000000000 --- a/deploy/registry/manifests/deploy.yaml +++ /dev/null @@ -1,141 +0,0 @@ -apiVersion: v1 -kind: Namespace -metadata: - name: docker-registry-system ---- -apiVersion: v1 -kind: ConfigMap -metadata: - labels: - app: docker-registry - name: docker-registry-config - namespace: docker-registry-system -data: - config.yml: | - version: 0.1 - log: - accesslog: - disabled: true - level: debug - formatter: json - fields: - service: registry - environment: staging - storage: - oss: # TODO edit it - accesskeyid: ... - accesskeysecret: ... - region: ... - bucket: ... - delete: - enabled: true - cache: - blobdescriptor: inmemory - middleware: - storage: # TODO edit it - - name: alicdn - options: - baseurl: ... - authtype: ... - privatekey: ... - auth: - token: # TODO DON'T edit it if - realm: https://hubauth.login.sealos.io/auth - service: token-service - issuer: registry-token-issuer - rootcertbundle: /etc/docker/registry/authserver.crt - http: - addr: :5000 - secret: ... # TODO edit it, If you are building a cluster of registries behind a load balancer, - # you MUST ensure the secret is the same for all registries. - headers: - X-Content-Type-Options: [nosniff] - http2: - disabled: false - health: - storagedriver: - enabled: true - interval: 10s - threshold: 3 - authserver.crt: | - -----BEGIN CERTIFICATE----- - ... - -----END CERTIFICATE----- ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - labels: - app: docker-registry - name: docker-registry - namespace: docker-registry-system -spec: - replicas: 2 - revisionHistoryLimit: 5 - selector: - matchLabels: - app: docker-registry - template: - metadata: - labels: - app: docker-registry - spec: - securityContext: - runAsUser: 0 - containers: - - name: docker-registry # nosemgrep - image: ghcr.dockerproxy.com/labring/registry:main - imagePullPolicy: Always - ports: - - containerPort: 5000 - name: web - protocol: TCP - resources: - requests: - memory: "2048Mi" - cpu: "1500m" - terminationMessagePath: /dev/termination-log - terminationMessagePolicy: File - volumeMounts: - - mountPath: /etc/docker/registry - name: docker-registry-config - tolerations: - - key: node-role.kubernetes.io/control-plane - operator: Exists - effect: NoSchedule - - key: node-role.kubernetes.io/master - operator: Exists - effect: NoSchedule - affinity: - podAntiAffinity: - preferredDuringSchedulingIgnoredDuringExecution: - - podAffinityTerm: - labelSelector: - matchExpressions: - - key: app - operator: In - values: - - docker-registry - namespaces: - - default - topologyKey: kubernetes.io/hostname - weight: 100 - volumes: - - name: docker-registry-config - configMap: - name: docker-registry-config ---- -apiVersion: v1 -kind: Service -metadata: - name: docker-registry-service - namespace: docker-registry-system -spec: - ports: - - name: port-name - port: 5000 - protocol: TCP - targetPort: 5000 - selector: - app: docker-registry - sessionAffinity: ClientIP \ No newline at end of file diff --git a/deploy/registry/manifests/ingress.yaml b/deploy/registry/manifests/ingress.yaml deleted file mode 100644 index 0f9dac7cc..000000000 --- a/deploy/registry/manifests/ingress.yaml +++ /dev/null @@ -1,58 +0,0 @@ -apiVersion: cert-manager.io/v1 -kind: ClusterIssuer -metadata: - name: cluster-issuer-docker-registry - namespace: docker-registry-system -spec: - acme: - server: https://acme-v02.api.letsencrypt.org/directory - email: admin@sealos.io - privateKeySecretRef: - name: letsencrypt-prod - solvers: - - http01: - ingress: - class: nginx ---- -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: hub-sealos-cn - namespace: docker-registry-system -spec: - secretName: hub-sealos-cn-cert - dnsNames: - - hub.sealos.cn - issuerRef: - name: cluster-issuer-docker-registry - kind: ClusterIssuer ---- -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: docker-registry-ingress - namespace: docker-registry-system - labels: - app: hub-service - annotations: - kubernetes.io/ingress.class: nginx - nginx.ingress.kubernetes.io/backend-protocol: "HTTP" - nginx.ingress.kubernetes.io/proxy-body-size: 4096m - nginx.ingress.kubernetes.io/ssl-redirect: "false" - nginx.ingress.kubernetes.io/use-forwarded-headers: "true" -spec: - rules: - - host: hub.sealos.cn - http: - paths: - - pathType: Prefix - path: / - backend: - service: - name: docker-registry-service - port: - number: 5000 - tls: - - hosts: - - hub.sealos.cn - secretName: hub-sealos-cn-cert \ No newline at end of file