1.8 KiB
1.8 KiB
ctrl/registry.sh
Registry modes
Registry plumbing. This is the seam — not a tool. Four modes, selected by
REGISTRY_MODE in the active profile:
- none — Tilt builds straight into the node. No registry at all, and so no
guard against an outward push: an unqualified image name means
docker.io/library/<name>, and only Tilt's kind detection stands between that and a real push. Throwaway use only; every profile here now defaults tolocalinstead. - local — a
registry:2container wired into the cluster. - mirror — the same container, but configured as a pull-through cache of the corporate registry. This is what a locked-down client actually looks like: images originate from corp, you don't hammer it, and you keep working when the VPN drops.
- remote — no local container; pull straight from the corporate registry using an imagePullSecret.
Why a script rather than ctlptl
Deliberately a script rather than a tool. ctlptl collapses the local wiring
into one line, but its Registry spec only accepts name/port/image/listenAddress —
there is no way to set REGISTRY_PROXY_REMOTEURL, so it cannot express mirror
at all. Keeping the seam here is what keeps the corporate registry swappable.
CA trust (install_ca_into_nodes)
A corporate registry is almost always fronted by an internal CA, and trust has to reach three separate places. Nothing does this for you, and the symptom when it's missing is an opaque:
x509: certificate signed by unknown authority
- the host docker daemon —
/etc/docker/certs.d/<host>/ca.crt(needs root) - every kind node's containerd — nodes do NOT inherit host trust
- anything doing HTTPS from inside the cluster, in its own trust store
registry.sh handles (2) because it's ours to handle. (1) is reported by
check.sh since it needs root. (3) belongs to the workload.