mirror-deployment.yaml

{{- if .Values.mirrors.enabled }}
apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ include "github-actions-runner.fullname" . }}-mirrors
  labels:
    {{- include "github-actions-runner.labels" . | nindent 4 }}
    app.kubernetes.io/component: mirrors
spec:
  replicas: 1
  selector:
    matchLabels:
      {{- include "github-actions-runner.selectorLabels" . | nindent 6 }}
      app.kubernetes.io/component: mirrors
  template:
    metadata:
      annotations:
        checksum/config: {{ toJson .Values.mirrors.registry | sha256sum }}
        prometheus.io/scrape: "true"
        prometheus.io/scheme: https
        prometheus.io/port: "8443"
      labels:
        {{- include "github-actions-runner.selectorLabels" . | nindent 8 }}
        app.kubernetes.io/component: mirrors
    spec:
      {{- if .Values.mirrors.serviceAccount.create }}
      serviceAccountName: {{ include "github-actions-runner.mirrors.serviceAccountName" . }}
      automountServiceAccountToken: true
      {{- else }}
      automountServiceAccountToken: false
      {{- end }}
      enableServiceLinks: false
      securityContext:
        runAsNonRoot: true
        runAsUser: 65534
        runAsGroup: 65534
        fsGroup: 65534
        fsGroupChangePolicy: "OnRootMismatch"
      terminationGracePeriodSeconds: 1
      containers:
        - name: {{ include "github-actions-runner.fullname" . }}-mirrors-registry
          securityContext:
            allowPrivilegeEscalation: false
            seccompProfile:
              type: RuntimeDefault
            capabilities:
              drop: ["ALL"]
          image: "{{ $.Values.mirrors.image.repository }}:{{ $.Values.mirrors.image.tag }}"
          imagePullPolicy: {{ $.Values.mirrors.image.pullPolicy }}
          ports:
            - name: https
              containerPort: 8443
          startupProbe:
            httpGet:
              path: /v2/
              port: https
              scheme: HTTPS
            initialDelaySeconds: 5
            timeoutSeconds: 3
            failureThreshold: 30
            periodSeconds: 5
          resources:
            {{- toYaml $.Values.mirrors.resources | nindent 12 }}
          volumeMounts:
            - name: data
              mountPath: /var/lib/registry
            - name: config
              mountPath: /etc/zot
            - name: credentials
              mountPath: /etc/credentials
            - name: tls
              mountPath: /etc/registry-tls
        - name: {{ include "github-actions-runner.fullname" . }}-redirect
          securityContext:
            allowPrivilegeEscalation: false
            seccompProfile:
              type: RuntimeDefault
            capabilities:
              drop: ["ALL"]
          image: ghcr.io/zalando/skipper:v0.21.223
          command: ['skipper']
          args:
            - -address=:8080
            - -routes-file=/etc/skipper/mirrors.eskip
            - -application-log-level=WARN
            - -metrics-listener=
          ports:
            - name: http
              containerPort: 8080
          startupProbe:
            httpGet:
              path: /healthz
              port: http
              scheme: HTTP
            initialDelaySeconds: 5
            timeoutSeconds: 3
            failureThreshold: 30
            periodSeconds: 5
          resources:
            requests:
              cpu: 50m
              memory: 32Mi
          volumeMounts:
            - name: config
              mountPath: /etc/skipper
      {{- with default .Values.nodeSelector .Values.mirrors.nodeSelector }}
      nodeSelector:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with default .Values.affinity .Values.mirrors.affinity }}
      affinity:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.mirrors.tolerations }}
      tolerations:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      volumes:
        - name: data
      {{- if not .Values.mirrors.persistence.enabled }}
          emptyDir: {}
      {{- else }}
          ephemeral:
            volumeClaimTemplate:
              metadata:
                {{- with .Values.mirrors.persistence.annotations }}
                annotations:
                  {{- toYaml . | nindent 18 }}
                {{- end }}
                labels:
                  {{- include "github-actions-runner.selectorLabels" . | nindent 18 }}
                  app.kubernetes.io/component: mirrors
              {{- include "volumeClaimTemplate.spec.render" .Values.mirrors.persistence | nindent 14 }}
      {{- end }}
        - name: config
          configMap:
            name: {{ include "github-actions-runner.fullname" . }}
            items:
              - key: mirrors.eskip
                path: mirrors.eskip
              - key: mirrors.json
                path: config.json
        - name: tls
          secret:
            secretName:  {{ include "github-actions-runner.fullname" . }}-server-tls
            defaultMode: 256
        - name: credentials
          secret:
            secretName:  {{ include "github-actions-runner.fullname" . }}-mirrors
            defaultMode: 256
{{- end }}