Bottom turtle ha registry tests (#929)

* Bottom turtle ha registry tests Signed-off-by: Kevin Fox <[email protected]> * Fix test because of spire-ha-agent Signed-off-by: Kevin Fox <[email protected]> * Fix config options Signed-off-by: Kevin Fox <[email protected]> * Fix yq issue and log better Signed-off-by: Kevin Fox <[email protected]> * Fix some things Signed-off-by: Kevin Fox <[email protected]> * Change timeout and fix image Signed-off-by: Kevin Fox <[email protected]> * Bump up zot version. Signed-off-by: Kevin Fox <[email protected]> * More debugging stuff Signed-off-by: Kevin Fox <[email protected]> * More debugging stuff Signed-off-by: Kevin Fox <[email protected]> * More fixes Signed-off-by: Kevin Fox <[email protected]> * More logging Signed-off-by: Kevin Fox <[email protected]> * More logging Signed-off-by: Kevin Fox <[email protected]> * More logging Signed-off-by: Kevin Fox <[email protected]> * More logging Signed-off-by: Kevin Fox <[email protected]> * More logging Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Log less Signed-off-by: Kevin Fox <[email protected]> * Cleanup Signed-off-by: Kevin Fox <[email protected]> * Make test less different then real deployment Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: kfox1111 <[email protected]>
2026-09-04 12:50:34 -07:00
parent bb4c73febf
commit 2a8c1b63c4
23 changed files with 1082 additions and 28 deletions
@@ -0,0 +1,154 @@
+# zot registry with a SPIRE issued serving certificate.
+
+image:
+  tag: v2.1.20
+
+initContainers:
+  - name: spiffe-helper-init
+    image: ghcr.io/spiffe/spiffe-helper:0.11.0
+    args: ["-config", "/etc/spiffe-helper.conf", "-daemon-mode=false"]
+    securityContext:
+      allowPrivilegeEscalation: false
+      runAsNonRoot: true
+      readOnlyRootFilesystem: true
+      capabilities:
+        drop: [ALL]
+      seccompProfile:
+        type: RuntimeDefault
+    volumeMounts:
+      - name: spiffe-workload-api
+        mountPath: /spiffe-workload-api
+        readOnly: true
+      - name: zot-config
+        mountPath: /etc/spiffe-helper.conf
+        subPath: spiffe-helper.conf
+        readOnly: true
+      - name: spire-svid
+        mountPath: /svid
+
+extraContainers:
+  - name: spiffe-helper
+    image: ghcr.io/spiffe/spiffe-helper:0.11.0
+    args: ["-config", "/etc/spiffe-helper.conf"]
+    securityContext:
+      allowPrivilegeEscalation: false
+      runAsNonRoot: true
+      readOnlyRootFilesystem: true
+      capabilities:
+        drop: [ALL]
+      seccompProfile:
+        type: RuntimeDefault
+    volumeMounts:
+      - name: spiffe-workload-api
+        mountPath: /spiffe-workload-api
+        readOnly: true
+      - name: zot-config
+        mountPath: /etc/spiffe-helper.conf
+        subPath: spiffe-helper.conf
+        readOnly: true
+      - name: spire-svid
+        mountPath: /svid
+
+extraVolumes:
+  - name: spire-svid
+    emptyDir: {}
+  - name: spiffe-workload-api
+    csi:
+      driver: csi.spiffe.io
+      readOnly: true
+
+extraVolumeMounts:
+  - name: spire-svid
+    mountPath: /svid
+    readOnly: true
+
+podSecurityContext:
+  fsGroupChangePolicy: OnRootMismatch
+  runAsUser: 1000
+  runAsGroup: 1000
+  fsGroup: 1000
+
+securityContext:
+  allowPrivilegeEscalation: false
+  runAsNonRoot: true
+  capabilities:
+    drop: [ALL]
+  seccompProfile:
+    type: RuntimeDefault
+
+resources: {}
+
+httpGet:
+  scheme: HTTPS
+  port: 5000
+
+startupProbe:
+  initialDelaySeconds: 5
+  periodSeconds: 10
+  failureThreshold: 30
+
+mountConfig: true
+configFiles:
+  spiffe-helper.conf: |-
+    agent_address = "/spiffe-workload-api/spire-agent.sock"
+    cert_dir = "/svid"
+    svid_file_name = "tls.crt"
+    svid_key_file_name = "tls.key"
+    svid_bundle_file_name = "ca.pem"
+  config.json: |-
+    {
+      "storage": { "rootDirectory": "/var/lib/registry" },
+      "http": {
+        "address": "0.0.0.0",
+        "port": "5000",
+        "compat": ["docker2s2"],
+        "tls": { "cert": "/svid/tls.crt", "key": "/svid/tls.key" },
+        "realm": "zot",
+        "auth": {
+          "bearer": {
+            "realm": "https://zot.production.other/zot/auth/token",
+            "service": "https://zot.production.other",
+            "oidc": [
+              {
+                "issuer": "https://oidc-discovery.production.other",
+                "audiences": ["zot"],
+                "certificateAuthorityFile": "/svid/ca.pem",
+                "claimMapping": { "username": "claims.sub" }
+              }
+            ]
+          }
+        },
+        "accessControl": {
+          "repositories": {
+            "**": {
+              "policies": [
+                {
+                  "users": ["spiffe://production.other/image-push"],
+                  "actions": ["read", "create", "update", "delete"]
+                },
+                {
+                  "users": ["spiffe://production.other/image-pull"],
+                  "actions": ["read"]
+                }
+              ]
+            }
+          }
+        }
+      },
+      "log": { "level": "debug" }
+    }
+
+service:
+  type: ClusterIP
+
+ingress:
+  enabled: true
+  className: nginx
+  pathtype: Prefix
+  annotations:
+    nginx.ingress.kubernetes.io/ssl-passthrough: "true"
+    nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
+  hosts:
+    - host: zot.production.other
+      paths:
+        - path: /