From e35a87e3eb903027cae0fcc8f007926a772ae4c8 Mon Sep 17 00:00:00 2001
From: zhengtianbao <china.zhengtianbao@gmail.com>
Date: Mon, 22 Nov 2021 04:45:09 -0600
Subject: [PATCH] Update registry template (#8198)
* Add registry replica setting
* Add registry liveness and readiness probe
* Set the security context for registry
* Add registry pvc access mode option
* registry add replica requirement check
* docs: add registry replicas setting note
* Update docs/kubernetes-apps/registry.md
Co-authored-by: Cristian Calin <6627509+cristicalin@users.noreply.github.com>
Co-authored-by: Cristian Calin <6627509+cristicalin@users.noreply.github.com>
---
docs/kubernetes-apps/registry.md | 2 ++
roles/kubernetes-apps/registry/defaults/main.yml | 2 ++
.../registry/templates/registry-pvc.yml.j2 | 2 +-
.../registry/templates/registry-rs.yml.j2 | 15 +++++++++++++++
4 files changed, 20 insertions(+), 1 deletion(-)
diff --git a/docs/kubernetes-apps/registry.md b/docs/kubernetes-apps/registry.md
index 77ff08caf..6ca814013 100644
--- a/docs/kubernetes-apps/registry.md
+++ b/docs/kubernetes-apps/registry.md
@@ -140,6 +140,8 @@ spec:
```
<!-- END MUNGE: EXAMPLE registry-rc.yaml -->
+*Note:* that if you have set multiple replicas, make sure your CSI driver has support for the `ReadWriteMany` accessMode.
+
## Expose the registry in the cluster
Now that we have a registry `Pod` running, we can expose it as a Service:
diff --git a/roles/kubernetes-apps/registry/defaults/main.yml b/roles/kubernetes-apps/registry/defaults/main.yml
index 6c7900d52..f3f55e2d7 100644
--- a/roles/kubernetes-apps/registry/defaults/main.yml
+++ b/roles/kubernetes-apps/registry/defaults/main.yml
@@ -1,5 +1,7 @@
---
registry_namespace: "kube-system"
registry_storage_class: ""
+registry_storage_access_mode: "ReadWriteOnce"
registry_disk_size: "10Gi"
registry_port: 5000
+registry_replica_count: 1
diff --git a/roles/kubernetes-apps/registry/templates/registry-pvc.yml.j2 b/roles/kubernetes-apps/registry/templates/registry-pvc.yml.j2
index 30b707460..dc3fa5a8c 100644
--- a/roles/kubernetes-apps/registry/templates/registry-pvc.yml.j2
+++ b/roles/kubernetes-apps/registry/templates/registry-pvc.yml.j2
@@ -8,7 +8,7 @@ metadata:
addonmanager.kubernetes.io/mode: Reconcile
spec:
accessModes:
- - ReadWriteOnce
+ - {{ registry_storage_access_mode }}
storageClassName: {{ registry_storage_class }}
resources:
requests:
diff --git a/roles/kubernetes-apps/registry/templates/registry-rs.yml.j2 b/roles/kubernetes-apps/registry/templates/registry-rs.yml.j2
index b3e46ff0e..9470db46d 100644
--- a/roles/kubernetes-apps/registry/templates/registry-rs.yml.j2
+++ b/roles/kubernetes-apps/registry/templates/registry-rs.yml.j2
@@ -9,7 +9,11 @@ metadata:
version: v{{ registry_image_tag }}
addonmanager.kubernetes.io/mode: Reconcile
spec:
+{% if registry_storage_class != "" and registry_storage_access_mode == "ReadWriteMany" %}
+ replicas: {{ registry_replica_count }}
+{% else %}
replicas: 1
+{% endif %}
selector:
matchLabels:
k8s-app: registry
@@ -22,6 +26,9 @@ spec:
spec:
priorityClassName: {% if registry_namespace == 'kube-system' %}system-cluster-critical{% else %}k8s-cluster-critical{% endif %}{{''}}
serviceAccountName: registry
+ securityContext:
+ fsGroup: 1000
+ runAsUser: 1000
containers:
- name: registry
image: {{ registry_image_repo }}:{{ registry_image_tag }}
@@ -38,6 +45,14 @@ spec:
- containerPort: {{ registry_port }}
name: registry
protocol: TCP
+ livenessProbe:
+ httpGet:
+ path: /
+ port: {{ registry_port }}
+ readinessProbe:
+ httpGet:
+ path: /
+ port: {{ registry_port }}
volumes:
- name: registry-pvc
{% if registry_storage_class != "" %}
--
GitLab