Skip to content

Commit 1dc6409

Browse files
minmzzhangminmzzhang
committed
feat: BYO container registry support
Restructure registry configuration to support three deployment states: - Fresh install: No registry configured (both disabled by default) - Built-in Quay: quay.enabled=true uses hub/infra/quay/ vault path - External/BYO: externalRegistry.enabled=true uses hub/infra/registry/ path Changes: - Add externalRegistry.enabled flag to supply-chain and qtodo charts - Separate vault paths for built-in Quay vs external registry - Templates conditionally select vault path based on enabled flags - Update supply-chain.md with BYO registry setup instructions - Add helm template method and oc monitoring commands to supply-chain.md - Follow VP best practice: external registry secrets in local ~/values-secret.yaml To enable supply-chain: 1. Uncomment openshift-pipelines namespace and subscription 2. Uncomment supply-chain vault role (JWT auth) 3. Configure registry (BYO or built-in Quay) in application overrides - For BYO registry: - Set externalRegistry.enabled=true and configure registry settings - Add registry credentials to ~/values-secret.yaml - For built-in Quay: - Enable openshift-storage namespace - Enable ODF, NooBaa MCG - Enable Quay operator subscription, quay-registry application 4. RHTAS (signing): Enable rhtas-operator subscription and trusted-artifact-signer namespace 5. RHTPA (SBOM): Enable rhtpa-operator subscription, ODF, NooBaa, and trusted-profile-analyzer Signed-off-by: Min Zhang <minzhang@redhat.com>
1 parent 45c1bf9 commit 1dc6409

10 files changed

Lines changed: 366 additions & 65 deletions

File tree

‎charts/qtodo/templates/registry-external-secret.yaml‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -18,14 +18,19 @@ spec:
1818
.dockerconfigjson: |
1919
{
2020
"auths": {
21-
"{{ .Values.app.images.main.registry.domain | default (printf "quay-registry-quay-quay-enterprise.%s" .Values.global.hubClusterDomain) }}": {
21+
"{{ required "app.images.main.registry.domain is required when registry.auth is enabled" .Values.app.images.main.registry.domain }}": {
2222
"auth": "{{ `{{ printf "%s:%s" "` }}{{ .Values.app.images.main.registry.user }}{{ `" .password | b64enc }}` }}"
2323
}
2424
}
2525
}
2626
data:
2727
- secretKey: password
2828
remoteRef:
29-
key: {{ .Values.app.images.main.registry.vaultPath }}
30-
property: {{ .Values.app.images.main.registry.passwordVaultKey }}
29+
{{- if .Values.app.images.main.registry.builtinQuay.enabled }}
30+
key: {{ .Values.app.images.main.registry.builtinQuay.vaultPath }}
31+
property: {{ .Values.app.images.main.registry.builtinQuay.passwordVaultKey }}
32+
{{- else if .Values.app.images.main.registry.externalRegistry.enabled }}
33+
key: {{ .Values.app.images.main.registry.externalRegistry.vaultPath }}
34+
property: {{ .Values.app.images.main.registry.externalRegistry.passwordVaultKey }}
35+
{{- end }}
3136
{{- end }}

‎charts/qtodo/values.yaml‎

Lines changed: 18 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -15,13 +15,26 @@ app:
1515
# Modified to Always to force a pull so we can test changes to the container image without requiring manual deletion of images or restarts of argo
1616
pullPolicy: Always
1717
registry:
18+
# auth: controls whether to create registry auth secret
19+
# Set to true when using private registry (built-in Quay or external)
1820
auth: false
1921
secretName: qtodo-registry-auth
20-
user: quay-user
21-
# domain: quay-registry-quay-quay-enterprise.apps.example.com
22-
# Registry credentials - stored in quay path
23-
vaultPath: secret/data/hub/infra/quay/quay-users
24-
passwordVaultKey: quay-user-password
22+
user: registry-user
23+
# domain: registry.example.com # REQUIRED when auth is enabled
24+
25+
# Built-in Quay registry (optional)
26+
# When enabled, uses auto-generated credentials from Vault
27+
builtinQuay:
28+
enabled: false
29+
vaultPath: secret/data/hub/infra/quay/quay-users
30+
passwordVaultKey: quay-user-password
31+
32+
# External/BYO registry (optional)
33+
# When enabled, uses user-provided credentials from Vault
34+
externalRegistry:
35+
enabled: false
36+
vaultPath: secret/data/hub/infra/registry/registry-user
37+
passwordVaultKey: registry-password
2538
spiffeHelper:
2639
name: registry.redhat.io/zero-trust-workload-identity-manager/spiffe-helper-rhel9
2740
version: v0.10.0

‎charts/supply-chain/templates/pipeline-qtodo.yaml‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,12 @@
1+
{{- /* Determine registry domain: auto-construct for built-in Quay, require for external */ -}}
2+
{{- $registryDomain := "" -}}
3+
{{- if .Values.registry.domain -}}
4+
{{- $registryDomain = .Values.registry.domain -}}
5+
{{- else if .Values.quay.enabled -}}
6+
{{- $registryDomain = printf "quay-registry-quay-quay-enterprise.%s" .Values.global.hubClusterDomain -}}
7+
{{- else -}}
8+
{{- fail "registry.domain is required for external registry" -}}
9+
{{- end -}}
110
---
211
apiVersion: tekton.dev/v1beta1
312
kind: Pipeline
@@ -25,7 +34,7 @@ spec:
2534
- name: image-target
2635
type: string
2736
description: qtodo image push destination (e.g. quay.io/ztvp/qtodo:latest)
28-
default: {{ .Values.registry.domain | default (printf "quay-registry-quay-quay-enterprise.%s" .Values.global.hubClusterDomain) }}/{{ .Values.registry.org }}/{{ .Values.registry.repo }}:{{ .Values.qtodo.tag }}
37+
default: {{ $registryDomain }}/{{ .Values.registry.org }}/{{ .Values.registry.repo }}:{{ .Values.qtodo.tag }}
2938
- name: image-tls-verify
3039
type: string
3140
description: Whether to verify TLS when pushing to the OCI registry

‎charts/supply-chain/templates/pipelinerun-qtodo.yaml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
{{- if .Values.pipelinerun.enabled }}
2+
---
3+
apiVersion: tekton.dev/v1beta1
4+
kind: PipelineRun
5+
metadata:
6+
generateName: qtodo-supply-chain-
7+
namespace: {{ .Values.global.namespace }}
8+
annotations:
9+
argocd.argoproj.io/hook: PostSync
10+
argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
11+
spec:
12+
pipelineRef:
13+
name: qtodo-supply-chain
14+
workspaces:
15+
- name: qtodo-source
16+
persistentVolumeClaim:
17+
claimName: qtodo-workspace-source
18+
- name: registry-auth-config
19+
secret:
20+
secretName: {{ .Values.registry.authSecretName }}
21+
{{- end }}

charts/supply-chain/templates/secrets/qtodo-registry-pass.yaml renamed to charts/supply-chain/templates/secrets/qtodo-quay-pass.yaml

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,10 @@
1+
{{/*
2+
Quay User Provisioner Secret
3+
Purpose: Provides password for the Quay user provisioner job to create/update users in built-in Quay
4+
Used by: quay-user-job.yaml (CronJob that provisions Quay users)
5+
Only created when: quay.enabled=true (built-in Quay registry)
6+
Not used for: BYO/external registry (use qtodo-registry-auth.yaml instead)
7+
*/}}
18
{{- if eq .Values.quay.enabled true }}
29
---
310
apiVersion: "external-secrets.io/v1beta1"
@@ -19,6 +26,6 @@ spec:
1926
data:
2027
- secretKey: password
2128
remoteRef:
22-
key: {{ .Values.registry.vaultPath }}
23-
property: {{ .Values.registry.passwordVaultKey }}
29+
key: {{ .Values.quay.vaultPath }}
30+
property: {{ .Values.quay.passwordVaultKey }}
2431
{{- end }}

‎charts/supply-chain/templates/secrets/qtodo-registry-auth.yaml‎

Lines changed: 31 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,25 @@
1+
{{/*
2+
Pipeline Registry Auth Secret
3+
Purpose: Provides dockerconfigjson for pipeline to push/pull images
4+
Used by: Tekton pipeline tasks (build-image, sign-image, verify-image)
5+
Created when: quay.enabled=true OR externalRegistry.enabled=true
6+
Vault path: Automatically selects based on which registry is enabled
7+
- Built-in Quay: quay.vaultPath (auto-generated credentials)
8+
- BYO Registry: externalRegistry.vaultPath (user-provided credentials)
9+
Registry domain:
10+
- Built-in Quay: auto-constructed as quay-registry-quay-quay-enterprise.<hubClusterDomain>
11+
- BYO Registry: must be explicitly set via registry.domain
12+
*/}}
13+
{{- if or .Values.quay.enabled .Values.externalRegistry.enabled }}
14+
{{- /* Determine registry domain: auto-construct for built-in Quay, require for external */ -}}
15+
{{- $registryDomain := "" -}}
16+
{{- if .Values.registry.domain -}}
17+
{{- $registryDomain = .Values.registry.domain -}}
18+
{{- else if .Values.quay.enabled -}}
19+
{{- $registryDomain = printf "quay-registry-quay-quay-enterprise.%s" .Values.global.hubClusterDomain -}}
20+
{{- else -}}
21+
{{- fail "registry.domain is required for external registry" -}}
22+
{{- end -}}
123
---
224
apiVersion: "external-secrets.io/v1beta1"
325
kind: ExternalSecret
@@ -17,13 +39,19 @@ spec:
1739
.dockerconfigjson: |
1840
{
1941
"auths": {
20-
"{{ .Values.registry.domain | default (printf "quay-registry-quay-quay-enterprise.%s" .Values.global.hubClusterDomain) }}": {
42+
"{{ $registryDomain }}": {
2143
"auth": "{{ `{{ printf "%s:%s" "` }}{{ .Values.registry.user }}{{ `" .password | b64enc }}` }}"
2244
}
2345
}
2446
}
2547
data:
2648
- secretKey: password
2749
remoteRef:
28-
key: {{ .Values.registry.vaultPath }}
29-
property: {{ .Values.registry.passwordVaultKey }}
50+
{{- if .Values.quay.enabled }}
51+
key: {{ .Values.quay.vaultPath }}
52+
property: {{ .Values.quay.passwordVaultKey }}
53+
{{- else if .Values.externalRegistry.enabled }}
54+
key: {{ .Values.externalRegistry.vaultPath }}
55+
property: {{ .Values.externalRegistry.passwordVaultKey }}
56+
{{- end }}
57+
{{- end }}

‎charts/supply-chain/values.yaml‎

Lines changed: 33 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -26,26 +26,50 @@ qtodo:
2626
buildCmd: "./mvnw -s settings.xml package -DskipTests -Dquarkus.package.jar.type=uber-jar"
2727
containerfile: "./Containerfile"
2828

29-
# quay registry configuration
30-
# used to create a new user in quay. Generic registry configuration is below.
29+
# ===========================================================================
30+
# BUILT-IN QUAY REGISTRY (optional)
31+
# When enabled, deploys internal Quay registry with auto-generated credentials
32+
# ===========================================================================
3133
quay:
3234
enabled: true
3335
email: "quay-user@example.com"
36+
# Vault path for auto-generated Quay credentials
37+
vaultPath: "secret/data/hub/infra/quay/quay-users"
38+
passwordVaultKey: "quay-user-password"
39+
# User provisioner job settings
3440
job:
3541
image: registry.access.redhat.com/ubi9/ubi:9.7-1764794285
3642
schedule: "*/5 * * * *"
3743

38-
# container registry configuration
44+
# ===========================================================================
45+
# EXTERNAL/BYO REGISTRY (optional)
46+
# User-provided credentials for external registry (quay.io, ghcr.io, etc.)
47+
# Enable this when using an external registry instead of built-in Quay
48+
# ===========================================================================
49+
externalRegistry:
50+
enabled: false
51+
# Vault path for user-provided credentials
52+
vaultPath: "secret/data/hub/infra/registry/registry-user"
53+
passwordVaultKey: "registry-password"
54+
55+
# ===========================================================================
56+
# COMMON REGISTRY SETTINGS (shared by both built-in Quay and external registry)
57+
# ===========================================================================
3958
registry:
40-
# Commented to generate it dynamically
41-
# domain: "quay-registry-quay-quay-enterprise.hub.example.com"
59+
# For built-in Quay: domain is auto-constructed from hubClusterDomain
60+
# For external registry: REQUIRED - set explicitly (e.g., quay.io, ghcr.io)
61+
# domain: "registry.example.com"
4262
org: "ztvp"
4363
repo: "qtodo"
4464
tlsVerify: "true"
45-
user: "quay-user"
46-
passwordVaultKey: "quay-user-password"
47-
# Infrastructure secrets - stored in quay path
48-
vaultPath: "secret/data/hub/infra/quay/quay-users"
65+
user: "registry-user"
66+
# Secret name for registry auth (dockerconfigjson)
67+
authSecretName: "qtodo-registry-auth"
68+
69+
# pipeline run configuration
70+
pipelinerun:
71+
# Set to true to automatically trigger a pipeline run on ArgoCD sync
72+
enabled: false
4973

5074
# spire configuration
5175
spire:

0 commit comments

Comments
 (0)