161 lines
3.7 KiB
YAML
161 lines
3.7 KiB
YAML
# 官方 chart 0.1.124 / zot v2.1.21；制品与 manifests 保存在 SeaweedFS S3。
|
|
# persistence=false 仅保留 chart 的 emptyDir，不创建 PVC。
|
|
# 首期关闭跨仓库 dedupe，不额外引入 Redis/DynamoDB 持久缓存。
|
|
replicaCount: 1
|
|
image:
|
|
repository: ghcr.io/project-zot/zot
|
|
tag: v2.1.21@sha256:8258443838e95989c13c891f78a02bc1c391b5a00591ffef24cb8c17cde28038
|
|
persistence: false
|
|
strategy:
|
|
type: Recreate
|
|
serviceAccount:
|
|
create: false
|
|
name: zot
|
|
service:
|
|
type: ClusterIP
|
|
port: 5000
|
|
mountConfig: true
|
|
mountSecret: false
|
|
secretFiles: {}
|
|
configFiles:
|
|
config.json: |
|
|
{
|
|
"distSpecVersion": "1.1.1",
|
|
"storage": {
|
|
"rootDirectory": "/var/lib/registry",
|
|
"dedupe": false,
|
|
"gc": true,
|
|
"gcDelay": "24h",
|
|
"gcInterval": "24h",
|
|
"storageDriver": {
|
|
"name": "s3",
|
|
"region": "us-east-1",
|
|
"regionendpoint": "https://s3.ad.ddupan.top",
|
|
"bucket": "zot",
|
|
"rootdirectory": "/registry",
|
|
"secure": true,
|
|
"skipverify": false,
|
|
"forcepathstyle": true
|
|
}
|
|
},
|
|
"http": {
|
|
"address": "0.0.0.0",
|
|
"port": "5000",
|
|
"externalUrl": "https://zot-push.ad.ddupan.top",
|
|
"compat": [
|
|
"docker2s2"
|
|
],
|
|
"auth": {
|
|
"bearer": {
|
|
"realm": "https://zot-push.ad.ddupan.top/zot/auth/token",
|
|
"service": "zot-push.ad.ddupan.top",
|
|
"oidc": [
|
|
{
|
|
"issuer": "https://spire-oidc.ad.ddupan.top",
|
|
"audiences": [
|
|
"zot"
|
|
],
|
|
"claimMapping": {
|
|
"username": "claims.sub",
|
|
"validations": [
|
|
{
|
|
"expression": "claims.sub.startsWith('spiffe://ddupan.top/')",
|
|
"message": "SPIFFE trust domain mismatch"
|
|
}
|
|
]
|
|
}
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"accessControl": {
|
|
"repositories": {
|
|
"**": {
|
|
"policies": [
|
|
{
|
|
"users": [
|
|
"spiffe://ddupan.top/dev/panxiao81"
|
|
],
|
|
"actions": [
|
|
"read",
|
|
"create",
|
|
"update",
|
|
"delete"
|
|
]
|
|
}
|
|
],
|
|
"defaultPolicy": [
|
|
"read"
|
|
]
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"log": {
|
|
"level": "info"
|
|
}
|
|
}
|
|
env:
|
|
- name: AWS_ACCESS_KEY_ID
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: zot-s3
|
|
key: access_key
|
|
- name: AWS_SECRET_ACCESS_KEY
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: zot-s3
|
|
key: secret_key
|
|
- name: AWS_EC2_METADATA_DISABLED
|
|
value: 'true'
|
|
podSecurityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 10001
|
|
runAsGroup: 10001
|
|
fsGroup: 10001
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
readOnlyRootFilesystem: true
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 128Mi
|
|
limits:
|
|
cpu: '1'
|
|
memory: 512Mi
|
|
extraVolumes:
|
|
- name: tmp
|
|
emptyDir:
|
|
sizeLimit: 128Mi
|
|
extraVolumeMounts:
|
|
- name: tmp
|
|
mountPath: /tmp
|
|
startupProbe:
|
|
initialDelaySeconds: 5
|
|
periodSeconds: 5
|
|
failureThreshold: 60
|
|
httproute:
|
|
enabled: true
|
|
parentRefs:
|
|
- name: eg
|
|
namespace: envoy-gateway-system
|
|
sectionName: https
|
|
hostnames:
|
|
- zot-push.ad.ddupan.top
|
|
rules:
|
|
- matches:
|
|
- path:
|
|
type: PathPrefix
|
|
value: /v2/
|
|
- path:
|
|
type: Exact
|
|
value: /zot/auth/token
|
|
timeouts:
|
|
request: 900s
|
|
backendRequest: 900s
|