support image registries with authentication

Based on spec in openstack-helm repo,
support-OCI-image-registry-with-authentication-turned-on.rst

Each Helm chart can configure an OCI image registry and
credentials to use. A Kubernetes secret is then created with these
info. Service Accounts then specify an imagePullSecret specifying
the Secret with creds for the registry. Then any pod using one
of these ServiceAccounts may pull images from an authenticated
container registry.

Change-Id: Iebda4c7a861aa13db921328776b20c14ba346269

Author: Brian Haley

calico/Chart.yaml

@@ -15,7 +15,7 @@ apiVersion: v1
 appVersion: v3.4.0
 description: OpenStack-Helm Calico
 name: calico
-version: 0.1.4
+version: 0.1.5
 home: https://github.com/projectcalico/calico
 icon: https://camo.githubusercontent.com/64c8b5ed6ac97553ae367348e8a59a24e2ed5bdc/687474703a2f2f646f63732e70726f6a65637463616c69636f2e6f72672f696d616765732f66656c69782e706e67
 sources:

calico/templates/secret-registry.yaml

@@ -0,0 +1,17 @@
+{{/*
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+   http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/}}
+
+{{- if and .Values.manifests.secret_registry .Values.endpoints.oci_image_registry.auth.enabled }}
+{{ include "helm-toolkit.manifests.secret_registry" ( dict "envAll" . "registryUser" .Chart.Name ) }}
+{{- end }}

calico/values.yaml

@@ -166,6 +166,10 @@ dependencies:
         - endpoint: internal
           service: local_image_registry
 
+secrets:
+  oci_image_registry:
+    calico: calico-oci-image-registry
+
 endpoints:
   cluster_domain_suffix: cluster.local
   local_image_registry:
@@ -180,6 +184,21 @@ endpoints:
     port:
       registry:
         node: 5000
+  oci_image_registry:
+    name: oci-image-registry
+    namespace: oci-image-registry
+    auth:
+      enabled: false
+      calico:
+        username: calico
+        password: password
+    hosts:
+      default: localhost
+    host_fqdn_override:
+      default: null
+    port:
+      registry:
+        default: null
   etcd:
     auth:
       client:
@@ -572,4 +591,5 @@ manifests:
   job_calico_settings: true
   service_calico_etcd: true
   secret_certificates: true
+  secret_registry: true
 ...

ceph-client/Chart.yaml

@@ -15,6 +15,6 @@ apiVersion: v1
 appVersion: v1.0.0
 description: OpenStack-Helm Ceph Client
 name: ceph-client
-version: 0.1.36
+version: 0.1.37
 home: https://github.com/ceph/ceph-client
 ...

ceph-client/templates/secret-registry.yaml

@@ -0,0 +1,17 @@
+{{/*
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+   http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/}}
+
+{{- if and .Values.manifests.secret_registry .Values.endpoints.oci_image_registry.auth.enabled }}
+{{ include "helm-toolkit.manifests.secret_registry" ( dict "envAll" . "registryUser" .Chart.Name ) }}
+{{- end }}

ceph-client/values.yaml

@@ -188,6 +188,8 @@ secrets:
     rgw: ceph-bootstrap-rgw-keyring
     mgr: ceph-bootstrap-mgr-keyring
     admin: ceph-client-admin-keyring
+  oci_image_registry:
+    ceph-client: ceph-client-oci-image-registry
 
 network:
   public: 192.168.0.0/16
@@ -517,6 +519,21 @@ endpoints:
     port:
       registry:
         node: 5000
+  oci_image_registry:
+    name: oci-image-registry
+    namespace: oci-image-registry
+    auth:
+      enabled: false
+      ceph-client:
+        username: ceph-client
+        password: password
+    hosts:
+      default: localhost
+    host_fqdn_override:
+      default: null
+    port:
+      registry:
+        default: null
   ceph_mon:
     namespace: null
     hosts:
@@ -564,4 +581,5 @@ manifests:
   helm_tests: true
   cronjob_checkPGs: true
   cronjob_defragosds: true
+  secret_registry: true
 ...

ceph-mon/Chart.yaml

@@ -15,6 +15,6 @@ apiVersion: v1
 appVersion: v1.0.0
 description: OpenStack-Helm Ceph Mon
 name: ceph-mon
-version: 0.1.25
+version: 0.1.26
 home: https://github.com/ceph/ceph
 ...

ceph-mon/templates/secret-registry.yaml

@@ -0,0 +1,17 @@
+{{/*
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+   http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/}}
+
+{{- if and .Values.manifests.secret_registry .Values.endpoints.oci_image_registry.auth.enabled }}
+{{ include "helm-toolkit.manifests.secret_registry" ( dict "envAll" . "registryUser" .Chart.Name ) }}
+{{- end }}

ceph-mon/values.yaml

@@ -215,6 +215,8 @@ secrets:
     osd: ceph-bootstrap-osd-keyring
     mgr: ceph-bootstrap-mgr-keyring
     admin: ceph-client-admin-keyring
+  oci_image_registry:
+    ceph-mon: ceph-mon-oci-image-registry-key
 
 network:
   public: 192.168.0.0/16
@@ -424,6 +426,21 @@ endpoints:
     port:
       registry:
         node: 5000
+  oci_image_registry:
+    name: oci-image-registry
+    namespace: oci-image-registry
+    auth:
+      enabled: false
+      ceph-mon:
+        username: ceph-mon
+        password: password
+    hosts:
+      default: localhost
+    host_fqdn_override:
+      default: null
+    port:
+      registry:
+        default: null
   ceph_mon:
     namespace: null
     hosts:
@@ -473,4 +490,5 @@ manifests:
   service_mgr: true
   service_mon_discovery: true
   job_storage_admin_keys: true
+  secret_registry: true
 ...

ceph-osd/Chart.yaml

@@ -15,6 +15,6 @@ apiVersion: v1
 appVersion: v1.0.0
 description: OpenStack-Helm Ceph OSD
 name: ceph-osd
-version: 0.1.41
+version: 0.1.42
 home: https://github.com/ceph/ceph
 ...