helm-charts-hardened/examples/bottom-turtle-ha/zot-values.yaml

# zot registry with a SPIRE issued serving certificate.

image:
  tag: v2.1.20

initContainers:
  - name: spiffe-helper-init
    image: ghcr.io/spiffe/spiffe-helper:0.11.0
    args: ["-config", "/etc/spiffe-helper.conf", "-daemon-mode=false"]
    securityContext:
      allowPrivilegeEscalation: false
      runAsNonRoot: true
      readOnlyRootFilesystem: true
      capabilities:
        drop: [ALL]
      seccompProfile:
        type: RuntimeDefault
    volumeMounts:
      - name: spiffe-workload-api
        mountPath: /spiffe-workload-api
        readOnly: true
      - name: zot-config
        mountPath: /etc/spiffe-helper.conf
        subPath: spiffe-helper.conf
        readOnly: true
      - name: spire-svid
        mountPath: /svid

extraContainers:
  - name: spiffe-helper
    image: ghcr.io/spiffe/spiffe-helper:0.11.0
    args: ["-config", "/etc/spiffe-helper.conf"]
    securityContext:
      allowPrivilegeEscalation: false
      runAsNonRoot: true
      readOnlyRootFilesystem: true
      capabilities:
        drop: [ALL]
      seccompProfile:
        type: RuntimeDefault
    volumeMounts:
      - name: spiffe-workload-api
        mountPath: /spiffe-workload-api
        readOnly: true
      - name: zot-config
        mountPath: /etc/spiffe-helper.conf
        subPath: spiffe-helper.conf
        readOnly: true
      - name: spire-svid
        mountPath: /svid

extraVolumes:
  - name: spire-svid
    emptyDir: {}
  - name: spiffe-workload-api
    csi:
      driver: csi.spiffe.io
      readOnly: true

extraVolumeMounts:
  - name: spire-svid
    mountPath: /svid
    readOnly: true

podSecurityContext:
  fsGroupChangePolicy: OnRootMismatch
  runAsUser: 1000
  runAsGroup: 1000
  fsGroup: 1000

securityContext:
  allowPrivilegeEscalation: false
  runAsNonRoot: true
  capabilities:
    drop: [ALL]
  seccompProfile:
    type: RuntimeDefault

resources: {}

httpGet:
  scheme: HTTPS
  port: 5000

startupProbe:
  initialDelaySeconds: 5
  periodSeconds: 10
  failureThreshold: 30

mountConfig: true
configFiles:
  spiffe-helper.conf: |-
    agent_address = "/spiffe-workload-api/spire-agent.sock"
    cert_dir = "/svid"
    svid_file_name = "tls.crt"
    svid_key_file_name = "tls.key"
    svid_bundle_file_name = "ca.pem"
  config.json: |-
    {
      "storage": { "rootDirectory": "/var/lib/registry" },
      "http": {
        "address": "0.0.0.0",
        "port": "5000",
        "compat": ["docker2s2"],
        "tls": { "cert": "/svid/tls.crt", "key": "/svid/tls.key" },
        "realm": "zot",
        "auth": {
          "bearer": {
            "realm": "https://zot.production.other/zot/auth/token",
            "service": "https://zot.production.other",
            "oidc": [
              {
                "issuer": "https://oidc-discovery.production.other",
                "audiences": ["zot"],
                "certificateAuthorityFile": "/svid/ca.pem",
                "claimMapping": { "username": "claims.sub" }
              }
            ]
          }
        },
        "accessControl": {
          "repositories": {
            "**": {
              "policies": [
                {
                  "users": ["spiffe://production.other/image-push"],
                  "actions": ["read", "create", "update", "delete"]
                },
                {
                  "users": ["spiffe://production.other/image-pull"],
                  "actions": ["read"]
                }
              ]
            }
          }
        }
      },
      "log": { "level": "debug" }
    }

service:
  type: ClusterIP

ingress:
  enabled: true
  className: nginx
  pathtype: Prefix
  annotations:
    nginx.ingress.kubernetes.io/ssl-passthrough: "true"
    nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
  hosts:
    - host: zot.production.other
      paths:
        - path: /