Skip to content

Commit 7cc5ee3

Browse files
serngawyserngawy
authored
✨ Add cluster registry config (#5132)
* Add cluster registry config Signed-off-by: melserngawy <melserng@redhat.com> * Fix mocks function updates Signed-off-by: melserngawy <melserng@redhat.com> --------- Signed-off-by: melserngawy <melserng@redhat.com>
1 parent 06dd716 commit 7cc5ee3

File tree

12 files changed

+1231
-72
lines changed

12 files changed

+1231
-72
lines changed

‎config/crd/bases/controlplane.cluster.x-k8s.io_rosacontrolplanes.yaml‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -82,6 +82,75 @@ spec:
8282
rule: self == oldSelf
8383
- message: billingAccount must be a valid AWS account ID
8484
rule: self.matches('^[0-9]{12}$')
85+
clusterRegistryConfig:
86+
description: ClusterRegistryConfig represents registry config used
87+
with the cluster.
88+
properties:
89+
additionalTrustedCAs:
90+
additionalProperties:
91+
type: string
92+
description: |-
93+
AdditionalTrustedCAs containing the registry hostname as the key, and the PEM-encoded certificate as the value,
94+
for each additional registry CA to trust.
95+
type: object
96+
allowedRegistriesForImport:
97+
description: |-
98+
AllowedRegistriesForImport limits the container image registries that normal users may import
99+
images from. Set this list to the registries that you trust to contain valid Docker
100+
images and that you want applications to be able to import from.
101+
items:
102+
description: RegistryLocation contains a location of the registry
103+
specified by the registry domain name.
104+
properties:
105+
domainName:
106+
description: |-
107+
domainName specifies a domain name for the registry. The domain name might include wildcards, like '*' or '??'.
108+
In case the registry use non-standard (80 or 443) port, the port should be included in the domain name as well.
109+
type: string
110+
insecure:
111+
default: false
112+
description: insecure indicates whether the registry is
113+
secure (https) or insecure (http), default is secured.
114+
type: boolean
115+
type: object
116+
type: array
117+
registrySources:
118+
description: |-
119+
RegistrySources contains configuration that determines how the container runtime
120+
should treat individual registries when accessing images. It does not contain configuration
121+
for the internal cluster registry. AllowedRegistries, BlockedRegistries are mutually exclusive.
122+
properties:
123+
allowedRegistries:
124+
description: |-
125+
AllowedRegistries are the registries for which image pull and push actions are allowed.
126+
To specify all subdomains, add the asterisk (*) wildcard character as a prefix to the domain name,
127+
For example, *.example.com.
128+
You can specify an individual repository within a registry, For example: reg1.io/myrepo/myapp:latest.
129+
All other registries are blocked.
130+
items:
131+
type: string
132+
type: array
133+
blockedRegistries:
134+
description: |-
135+
BlockedRegistries are the registries for which image pull and push actions are denied.
136+
To specify all subdomains, add the asterisk (*) wildcard character as a prefix to the domain name,
137+
For example, *.example.com.
138+
You can specify an individual repository within a registry, For example: reg1.io/myrepo/myapp:latest.
139+
All other registries are allowed.
140+
items:
141+
type: string
142+
type: array
143+
insecureRegistries:
144+
description: |-
145+
InsecureRegistries are registries which do not have a valid TLS certificate or only support HTTP connections.
146+
To specify all subdomains, add the asterisk (*) wildcard character as a prefix to the domain name,
147+
For example, *.example.com.
148+
You can specify an individual repository within a registry, For example: reg1.io/myrepo/myapp:latest.
149+
items:
150+
type: string
151+
type: array
152+
type: object
153+
type: object
85154
controlPlaneEndpoint:
86155
description: ControlPlaneEndpoint represents the endpoint used to
87156
communicate with the control plane.

‎controlplane/rosa/api/v1beta2/rosacontrolplane_types.go‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -180,6 +180,69 @@ type RosaControlPlaneSpec struct { //nolint: maligned
180180
// ControlPlaneEndpoint represents the endpoint used to communicate with the control plane.
181181
// +optional
182182
ControlPlaneEndpoint clusterv1.APIEndpoint `json:"controlPlaneEndpoint"`
183+
184+
// ClusterRegistryConfig represents registry config used with the cluster.
185+
// +optional
186+
ClusterRegistryConfig *RegistryConfig `json:"clusterRegistryConfig,omitempty"`
187+
}
188+
189+
// RegistryConfig for ROSA-HCP cluster
190+
type RegistryConfig struct {
191+
// AdditionalTrustedCAs containing the registry hostname as the key, and the PEM-encoded certificate as the value,
192+
// for each additional registry CA to trust.
193+
// +optional
194+
AdditionalTrustedCAs map[string]string `json:"additionalTrustedCAs,omitempty"`
195+
196+
// AllowedRegistriesForImport limits the container image registries that normal users may import
197+
// images from. Set this list to the registries that you trust to contain valid Docker
198+
// images and that you want applications to be able to import from.
199+
// +optional
200+
AllowedRegistriesForImport []RegistryLocation `json:"allowedRegistriesForImport,omitempty"`
201+
202+
// RegistrySources contains configuration that determines how the container runtime
203+
// should treat individual registries when accessing images. It does not contain configuration
204+
// for the internal cluster registry. AllowedRegistries, BlockedRegistries are mutually exclusive.
205+
// +optional
206+
RegistrySources *RegistrySources `json:"registrySources,omitempty"`
207+
}
208+
209+
// RegistryLocation contains a location of the registry specified by the registry domain name.
210+
type RegistryLocation struct {
211+
// domainName specifies a domain name for the registry. The domain name might include wildcards, like '*' or '??'.
212+
// In case the registry use non-standard (80 or 443) port, the port should be included in the domain name as well.
213+
// +optional
214+
DomainName string `json:"domainName,omitempty"`
215+
216+
// insecure indicates whether the registry is secure (https) or insecure (http), default is secured.
217+
// +kubebuilder:default=false
218+
// +optional
219+
Insecure bool `json:"insecure,omitempty"`
220+
}
221+
222+
// RegistrySources contains registries configuration.
223+
type RegistrySources struct {
224+
// AllowedRegistries are the registries for which image pull and push actions are allowed.
225+
// To specify all subdomains, add the asterisk (*) wildcard character as a prefix to the domain name,
226+
// For example, *.example.com.
227+
// You can specify an individual repository within a registry, For example: reg1.io/myrepo/myapp:latest.
228+
// All other registries are blocked.
229+
// +optional
230+
AllowedRegistries []string `json:"allowedRegistries,omitempty"`
231+
232+
// BlockedRegistries are the registries for which image pull and push actions are denied.
233+
// To specify all subdomains, add the asterisk (*) wildcard character as a prefix to the domain name,
234+
// For example, *.example.com.
235+
// You can specify an individual repository within a registry, For example: reg1.io/myrepo/myapp:latest.
236+
// All other registries are allowed.
237+
// +optional
238+
BlockedRegistries []string `json:"blockedRegistries,omitempty"`
239+
240+
// InsecureRegistries are registries which do not have a valid TLS certificate or only support HTTP connections.
241+
// To specify all subdomains, add the asterisk (*) wildcard character as a prefix to the domain name,
242+
// For example, *.example.com.
243+
// You can specify an individual repository within a registry, For example: reg1.io/myrepo/myapp:latest.
244+
// +optional
245+
InsecureRegistries []string `json:"insecureRegistries,omitempty"`
183246
}
184247

185248
// NetworkSpec for ROSA-HCP.

‎controlplane/rosa/api/v1beta2/rosacontrolplane_webhook.go‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,10 @@ func (r *ROSAControlPlane) ValidateCreate() (warnings admission.Warnings, err er
4242
allErrs = append(allErrs, err)
4343
}
4444

45+
if err := r.validateClusterRegistryConfig(); err != nil {
46+
allErrs = append(allErrs, err)
47+
}
48+
4549
allErrs = append(allErrs, r.validateNetwork()...)
4650
allErrs = append(allErrs, r.Spec.AdditionalTags.Validate()...)
4751

@@ -56,6 +60,18 @@ func (r *ROSAControlPlane) ValidateCreate() (warnings admission.Warnings, err er
5660
)
5761
}
5862

63+
func (r *ROSAControlPlane) validateClusterRegistryConfig() *field.Error {
64+
if r.Spec.ClusterRegistryConfig != nil {
65+
if r.Spec.ClusterRegistryConfig.RegistrySources != nil {
66+
if len(r.Spec.ClusterRegistryConfig.RegistrySources.AllowedRegistries) > 0 && len(r.Spec.ClusterRegistryConfig.RegistrySources.BlockedRegistries) > 0 {
67+
return field.Invalid(field.NewPath("spec.clusterRegistryConfig.registrySources"), r.Spec.ClusterRegistryConfig.RegistrySources, "allowedRegistries and blockedRegistries are mutually exclusive fields")
68+
}
69+
}
70+
}
71+
72+
return nil
73+
}
74+
5975
// ValidateUpdate implements admission.Validator.
6076
func (r *ROSAControlPlane) ValidateUpdate(old runtime.Object) (warnings admission.Warnings, err error) {
6177
var allErrs field.ErrorList

‎controlplane/rosa/api/v1beta2/zz_generated.deepcopy.go‎

Lines changed: 82 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)