feat: deploy registry for preview images

kubernetes/apps/actions-runner/netpol.yaml

@@ -30,6 +30,16 @@ spec:
       ports:
         - port: 5000
           protocol: TCP
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: preview
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: registry
+      ports:
+        - port: 5000
+          protocol: TCP
     - to:
       - ipBlock:
           cidr: 0.0.0.0/0

kubernetes/apps/preview/kustomization.yaml

@@ -7,3 +7,4 @@ resources:
   - ./snapshot/ks.yaml
   - ./flux-operator/ks.yaml
   - ./github-prs/ks.yaml
+  - ./registry/ks.yaml

kubernetes/apps/preview/registry/app/helmrelease.yaml

@@ -0,0 +1,70 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: registry
+  namespace: preview
+spec:
+  interval: 5m
+  chart:
+    spec:
+      chart: app-template
+      version: 2.6.0
+      interval: 15m
+      sourceRef:
+        kind: HelmRepository
+        name: bjw-s
+        namespace: flux-system
+  maxHistory: 2
+  install:
+    createNamespace: true
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      retries: 3
+  uninstall:
+    keepHistory: false
+  values:
+    controllers:
+      main:
+        containers:
+          main:
+            image:
+              repository: registry
+              tag: 2.8.3
+            env:
+              REGISTRY_STORAGE_FILESYSTEM_ROOTDIRECTORY: /data
+              # Default TTL is 7 days
+              REGISTRY_DELETE_ENABLED: "true"
+    service:
+      main:
+        ports:
+          http:
+            port: 5000
+    persistence:
+      data:
+        enabled: true
+        storageClass: zfs
+        size: 100Gi
+        accessMode: ReadWriteOnce
+    ingress:
+      main:
+        enabled: true
+        className: nginx
+        annotations:
+          cert-manager.io/cluster-issuer: letsencrypt-production
+          nginx.ingress.kubernetes.io/auth-type: basic
+          nginx.ingress.kubernetes.io/auth-secret: registry-auth
+        hosts:
+          - host: &host preview-registry.internal.immich.cloud
+            paths:
+              - path: /
+                service:
+                  name: main
+                  port: http
+        tls:
+          - hosts:
+              - *host
+            secretName: preview-registry-tls

kubernetes/apps/preview/registry/app/kustomization.yaml

@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - secret.yaml
+  - helmrelease.yaml

kubernetes/apps/preview/registry/app/secret.yaml

@@ -0,0 +1,7 @@
+apiVersion: onepassword.com/v1
+kind: OnePasswordItem
+metadata:
+  name: registry-auth
+  namespace: preview
+spec:
+  itemPath: "vaults/Kubernetes/items/preview-registry-secret"

kubernetes/apps/preview/registry/ks.yaml

@@ -0,0 +1,19 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app preview-registry
+  namespace: flux-system
+spec:
+  targetNamespace: preview
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  path: ./kubernetes/apps/preview/registry/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: immich-kubernetes
+  wait: true
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m

tf/deployment/modules/1password/account/config.tf

@@ -17,5 +17,9 @@ terraform {
       source  = "hashicorp/tls"
       version = "4.0.6"
     }
+    htpasswd = {
+      source  = "loafoe/htpasswd"
+      version = "1.2.1"
+    }
   }
 }

tf/deployment/modules/1password/account/k8s-secrets.tf

@@ -303,3 +303,40 @@ resource "onepassword_item" "outline_secret" {
     }
   }
 }
+
+resource "random_password" "preview_registry_password" {
+  length  = 30
+  special = false
+}
+
+resource "random_password" "preview_registry_salt" {
+  length  = 8
+  special = false
+}
+
+resource "htpasswd_password" "preview_registry_secret" {
+  password = random_password.preview_registry_password.result
+  salt     = random_password.preview_registry_salt.result
+}
+
+locals {
+  preview_registry_user = "immich"
+}
+
+resource "onepassword_item" "preview_registry_secret" {
+  vault    = data.onepassword_vault.kubernetes.uuid
+  title    = "preview-registry-secret"
+  category = "secure_note"
+
+  username = local.preview_registry_user
+  password = random_password.preview_registry_password.result
+
+  section {
+    label = "htpasswd"
+
+    field {
+      label = "auth"
+      value = "${local.preview_registry_user}:${htpasswd_password.preview_registry_secret.apr1}"
+    }
+  }
+}

tf/deployment/modules/github/org/secrets.tf

@@ -85,3 +85,20 @@ resource "github_actions_organization_secret" "docker_hub_write_token" {
   plaintext_value = data.terraform_remote_state.docker_org_state.outputs.write_token
   visibility      = "all"
 }
+
+data "onepassword_item" "preview_registry_secret" {
+  title = "preview-registry-secret"
+  vault = data.onepassword_vault.kubernetes.name
+}
+
+resource "github_actions_organization_secret" "preview_registry_user" {
+  secret_name     = "PREVIEW_REGISTRY_USER"
+  plaintext_value = data.onepassword_item.preview_registry_secret.username
+  visibility      = "all"
+}
+
+resource "github_actions_organization_secret" "preview_registry_password" {
+  secret_name     = "PREVIEW_REGISTRY_PASSWORD"
+  plaintext_value = data.onepassword_item.preview_registry_secret.password
+  visibility      = "all"
+}