feat: deploy registry for preview images

[bo0tzz]

No description provided.

[github-actions]

--- kubernetes/apps Kustomization: flux-system/cluster-apps NetworkPolicy: actions-runners/deny-in-cluster

+++ kubernetes/apps Kustomization: flux-system/cluster-apps NetworkPolicy: actions-runners/deny-in-cluster

@@ -28,12 +28,22 @@

     - namespaceSelector:
         matchLabels:
           kubernetes.io/metadata.name: registry-cache
       podSelector:
         matchLabels:
           app.kubernetes.io/name: registry
+  - ports:
+    - port: 5000
+      protocol: TCP
+    to:
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: preview
+      podSelector:
+        matchLabels:
+          app.kubernetes.io/name: registry
   - to:
     - ipBlock:
         cidr: 0.0.0.0/0
         except:
         - 10.0.0.0/8
         - 172.16.0.0/12
--- kubernetes/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/preview-registry

+++ kubernetes/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/preview-registry

@@ -0,0 +1,24 @@

+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  labels:
+    kustomize.toolkit.fluxcd.io/name: cluster-apps
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+  name: preview-registry
+  namespace: flux-system
+spec:
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: preview-registry
+  interval: 30m
+  path: ./kubernetes/apps/preview/registry/app
+  prune: true
+  retryInterval: 1m
+  sourceRef:
+    kind: GitRepository
+    name: immich-kubernetes
+  targetNamespace: preview
+  timeout: 5m
+  wait: true
+
--- kubernetes/apps/preview/registry/app Kustomization: flux-system/preview-registry OnePasswordItem: preview/registry-auth

+++ kubernetes/apps/preview/registry/app Kustomization: flux-system/preview-registry OnePasswordItem: preview/registry-auth

@@ -0,0 +1,13 @@

+---
+apiVersion: onepassword.com/v1
+kind: OnePasswordItem
+metadata:
+  labels:
+    app.kubernetes.io/name: preview-registry
+    kustomize.toolkit.fluxcd.io/name: preview-registry
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+  name: registry-auth
+  namespace: preview
+spec:
+  itemPath: vaults/Kubernetes/items/preview-registry-secret
+
--- kubernetes/apps/preview/registry/app Kustomization: flux-system/preview-registry HelmRelease: preview/registry

+++ kubernetes/apps/preview/registry/app Kustomization: flux-system/preview-registry HelmRelease: preview/registry

@@ -0,0 +1,74 @@

+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  labels:
+    app.kubernetes.io/name: preview-registry
+    kustomize.toolkit.fluxcd.io/name: preview-registry
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+  name: registry
+  namespace: preview
+spec:
+  chart:
+    spec:
+      chart: app-template
+      interval: 15m
+      sourceRef:
+        kind: HelmRepository
+        name: bjw-s
+        namespace: flux-system
+      version: 2.6.0
+  install:
+    createNamespace: true
+    remediation:
+      retries: 3
+  interval: 5m
+  maxHistory: 2
+  uninstall:
+    keepHistory: false
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      retries: 3
+  values:
+    controllers:
+      main:
+        containers:
+          main:
+            env:
+              REGISTRY_DELETE_ENABLED: 'true'
+              REGISTRY_STORAGE_FILESYSTEM_ROOTDIRECTORY: /data
+            image:
+              repository: registry
+              tag: 2.8.3
+    ingress:
+      main:
+        annotations:
+          cert-manager.io/cluster-issuer: letsencrypt-production
+          nginx.ingress.kubernetes.io/auth-secret: registry-auth
+          nginx.ingress.kubernetes.io/auth-type: basic
+        className: nginx
+        enabled: true
+        hosts:
+        - host: preview-registry.internal.immich.cloud
+          paths:
+          - path: /
+            service:
+              name: main
+              port: http
+        tls:
+        - hosts:
+          - preview-registry.internal.immich.cloud
+          secretName: preview-registry-tls
+    persistence:
+      data:
+        accessMode: ReadWriteOnce
+        enabled: true
+        size: 100Gi
+        storageClass: zfs
+    service:
+      main:
+        ports:
+          http:
+            port: 5000
+

[github-actions]

--- HelmRelease: preview/registry PersistentVolumeClaim: preview/registry-data

+++ HelmRelease: preview/registry PersistentVolumeClaim: preview/registry-data

@@ -0,0 +1,17 @@

+---
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: registry-data
+  labels:
+    app.kubernetes.io/instance: registry
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: registry
+spec:
+  accessModes:
+  - ReadWriteOnce
+  resources:
+    requests:
+      storage: 100Gi
+  storageClassName: zfs
+
--- HelmRelease: preview/registry Service: preview/registry

+++ HelmRelease: preview/registry Service: preview/registry

@@ -0,0 +1,22 @@

+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: registry
+  labels:
+    app.kubernetes.io/instance: registry
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: registry
+    app.kubernetes.io/service: registry
+spec:
+  type: ClusterIP
+  ports:
+  - port: 5000
+    targetPort: 5000
+    protocol: TCP
+    name: http
+  selector:
+    app.kubernetes.io/component: main
+    app.kubernetes.io/instance: registry
+    app.kubernetes.io/name: registry
+
--- HelmRelease: preview/registry Deployment: preview/registry

+++ HelmRelease: preview/registry Deployment: preview/registry

@@ -0,0 +1,71 @@

+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: registry
+  labels:
+    app.kubernetes.io/component: main
+    app.kubernetes.io/instance: registry
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: registry
+spec:
+  revisionHistoryLimit: 3
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: main
+      app.kubernetes.io/name: registry
+      app.kubernetes.io/instance: registry
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/component: main
+        app.kubernetes.io/instance: registry
+        app.kubernetes.io/name: registry
+    spec:
+      enableServiceLinks: true
+      serviceAccountName: default
+      automountServiceAccountToken: true
+      hostIPC: false
+      hostNetwork: false
+      hostPID: false
+      dnsPolicy: ClusterFirst
+      containers:
+      - env:
+        - name: REGISTRY_DELETE_ENABLED
+          value: 'true'
+        - name: REGISTRY_STORAGE_FILESYSTEM_ROOTDIRECTORY
+          value: /data
+        image: registry:2.8.3
+        livenessProbe:
+          failureThreshold: 3
+          initialDelaySeconds: 0
+          periodSeconds: 10
+          tcpSocket:
+            port: 5000
+          timeoutSeconds: 1
+        name: main
+        readinessProbe:
+          failureThreshold: 3
+          initialDelaySeconds: 0
+          periodSeconds: 10
+          tcpSocket:
+            port: 5000
+          timeoutSeconds: 1
+        startupProbe:
+          failureThreshold: 30
+          initialDelaySeconds: 0
+          periodSeconds: 5
+          tcpSocket:
+            port: 5000
+          timeoutSeconds: 1
+        volumeMounts:
+        - mountPath: /data
+          name: data
+      volumes:
+      - name: data
+        persistentVolumeClaim:
+          claimName: registry-data
+
--- HelmRelease: preview/registry Ingress: preview/registry

+++ HelmRelease: preview/registry Ingress: preview/registry

@@ -0,0 +1,31 @@

+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: registry
+  labels:
+    app.kubernetes.io/instance: registry
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: registry
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-production
+    nginx.ingress.kubernetes.io/auth-secret: registry-auth
+    nginx.ingress.kubernetes.io/auth-type: basic
+spec:
+  ingressClassName: nginx
+  tls:
+  - hosts:
+    - preview-registry.internal.immich.cloud
+    secretName: preview-registry-tls
+  rules:
+  - host: preview-registry.internal.immich.cloud
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: registry
+            port:
+              number: 5000
+