feat: registry mirror

apps/oci/registry-mirrors/app/helmrelease.yaml

@@ -0,0 +1,52 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: registry-mirrors
+spec:
+  interval: 60h
+
+  maxHistory: 2
+  driftDetection:
+    mode: enabled
+
+  chart:
+    spec:
+      chart: registry-mirrors
+      version: 2.0.0
+      sourceRef:
+        kind: HelmRepository
+        name: sergelogvinov
+        namespace: flux-system
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      retries: 3
+
+  values:
+    auth:
+      tls: true
+
+    ingress:
+      enabled: true
+      className: ${CLUSTER_INGRESS_CLASS}
+
+      hosts:
+        - host: mirrors.${CLUSTER_DOMAIN}
+          path: /
+      tls:
+        - secretName: ${CLUSTER_DOMAIN}-tls
+          hosts:
+            - mirrors.${CLUSTER_DOMAIN}
+
+    tolerations:
+      - key: node-role.kubernetes.io/control-plane
+        effect: NoSchedule
+
+  valuesFrom:
+    - kind: ConfigMap
+      name: registry-mirrors-helm-values
+      optional: true

apps/oci/registry-mirrors/app/kustomization.yaml

@@ -0,0 +1,8 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+generatorOptions:
+  disableNameSuffixHash: true
+resources:
+  - ./helmrelease.yaml

apps/oci/registry-mirrors/fluxcd.yaml

@@ -0,0 +1,26 @@
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app registry-mirrors
+  namespace: flux-system
+spec:
+  dependsOn:
+    - name: cluster
+    - name: cert-manager
+  targetNamespace: registry
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  path: ./apps/ingress/registry-mirrors/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: gitops-clusters
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+  wait: true
+  interval: 72h
+  retryInterval: 5m

apps/oci/registry-mirrors/kustomization.yaml

@@ -0,0 +1,7 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./fluxcd.yaml
+  - ./namespace.yaml

apps/oci/registry-mirrors/namespace.yaml

@@ -0,0 +1,11 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: registry
+  annotations:
+    kustomize.toolkit.fluxcd.io/prune: disabled
+  labels:
+    pod-security.kubernetes.io/enforce: baseline
+    pod-security.kubernetes.io/audit: baseline
+    pod-security.kubernetes.io/warn: baseline