42 lines
1.8 KiB
Markdown
42 lines
1.8 KiB
Markdown
# ctrl/registry.sh
|
|
|
|
## Registry modes
|
|
|
|
Registry plumbing. This is the seam — not a tool. Four modes, selected by
|
|
`REGISTRY_MODE` in the active profile:
|
|
|
|
- **none** — Tilt builds straight into the node. No registry at all, and so no
|
|
guard against an outward push: an unqualified image name means
|
|
`docker.io/library/<name>`, and only Tilt's kind detection stands between that
|
|
and a real push. Throwaway use only; every profile here now defaults to `local`
|
|
instead.
|
|
- **local** — a `registry:2` container wired into the cluster.
|
|
- **mirror** — the same container, but configured as a pull-through cache of the
|
|
corporate registry. This is what a locked-down client actually looks like:
|
|
images originate from corp, you don't hammer it, and you keep working when the
|
|
VPN drops.
|
|
- **remote** — no local container; pull straight from the corporate registry
|
|
using an imagePullSecret.
|
|
|
|
## Why a script rather than ctlptl
|
|
|
|
Deliberately a script rather than a tool. ctlptl collapses the `local` wiring
|
|
into one line, but its Registry spec only accepts name/port/image/listenAddress —
|
|
there is no way to set `REGISTRY_PROXY_REMOTEURL`, so it cannot express `mirror`
|
|
at all. Keeping the seam here is what keeps the corporate registry swappable.
|
|
|
|
## CA trust (install_ca_into_nodes)
|
|
|
|
A corporate registry is almost always fronted by an internal CA, and trust has to
|
|
reach three separate places. Nothing does this for you, and the symptom when it's
|
|
missing is an opaque:
|
|
|
|
x509: certificate signed by unknown authority
|
|
|
|
1. the host docker daemon — `/etc/docker/certs.d/<host>/ca.crt` (needs root)
|
|
2. every kind node's containerd — nodes do NOT inherit host trust
|
|
3. anything doing HTTPS from inside the cluster, in its own trust store
|
|
|
|
`registry.sh` handles (2) because it's ours to handle. (1) is reported by
|
|
`check.sh` since it needs root. (3) belongs to the workload.
|