Skip to content

Commit cc02dcd

Browse files
author
Vaughn Dice
authored
docs(configuring-registry.md): add examples (#779)
1 parent 55790eb commit cc02dcd

1 file changed

Lines changed: 78 additions & 10 deletions

File tree

‎src/installing-workflow/configuring-registry.md‎

Lines changed: 78 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,32 +1,99 @@
11
# Configuring Registry
22

3-
Deis Workflow's builder component relies on registry for storing the application docker images.
3+
Deis Workflow's builder component relies on a registry for storing application docker images.
44

55
Deis Workflow ships with a [registry][registry] component by default, which provides an in-cluster Docker registry backed by the platform-configured [object storage][storage]. Operators might want to use an off-cluster registry for performance or security reasons.
66

77
## Configuring Off-Cluster Private Registry
88

9-
Every component that relies on registry uses two inputs for configuration:
9+
Every component that relies on a registry uses two inputs for configuration:
1010

1111
1. Registry Location environment variable named `DEIS_REGISTRY_LOCATION`
1212
2. Access credentials stored as a Kubernetes secret named `registry-secret`
1313

14-
The Helm chart for Deis Workflow can be easily configured to connect Workflow components to off-cluster registry. Deis Workflow supports external registries which provide either short-lived tokens which are valid only for a specified amount of time or long-lived tokens (basic username/password) which are valid forever for authenticating to them. For those registries which provide short lived tokens for authentication, Deis Workflow will generate and refresh them such that the deployed apps will only have access to the short-lived tokens and not to the actual credentials for the registries.
14+
The Helm chart for Deis Workflow can be easily configured to connect Workflow components to off-cluster registry. Deis Workflow supports external registries which provide either short-lived tokens that are valid only for a specified amount of time or long-lived tokens (basic username/password) which are valid forever for authenticating to them. For those registries which provide short lived tokens for authentication, Deis Workflow will generate and refresh them such that the deployed apps will only have access to the short-lived tokens and not to the actual credentials for the registries.
15+
16+
When using a private registry the docker images are no longer pulled by Deis Workflow Controller but rather are managed by [Kubernetes][]. This will increase security and overall speed, however the `port` information can no longer be discovered. Instead the `port` information can be set via `deis config:set PORT=<port>` prior to deploying the application.
17+
18+
Deis Workflow currently supports:
1519

16-
When using a private registry the docker images are no longer pulled by Deis Workflow Controller but rather is managed by Kubernetes. This will increase security and overall speed, however the `port` information can no longer be discovered. Instead the `port` information can be set via `deis config:set PORT=<port>` prior to deploying the application.
17-
Deis Workflow currently supports
1820
1. Google Container Registry([gcr][gcr]).
19-
2. EC2 Container Registry([ecr][ecr]).
20-
3. off-cluster: Any provider which supports long-lived username/password authentication, such as [Azure Container Registry][acr], [Docker Hub][dockerhub], [quay.io][quay], or a self-hosted Docker registry.
21+
1. EC2 Container Registry([ecr][ecr]).
22+
1. off-cluster: Any provider which supports long-lived username/password authentication, such as [Azure Container Registry][acr], [Docker Hub][dockerhub], [quay.io][quay], or a self-hosted Docker registry.
23+
24+
## Configuration
2125

22-
* **Step 1:** If you haven't already fetched the values file, do so with `helm inspect values deis/workflow | sed -n '1!p' > values.yaml`
23-
* **Step 2:** Update registry location details by modifying the values file.
26+
1. If you haven't already fetched the values file, do so with `helm inspect values deis/workflow | sed -n '1!p' > values.yaml`
27+
1. Update registry location details by modifying the values file:
2428
* Update the `registry_location` parameter to reference the registry location you are using: `off-cluster`, `ecr`, `gcr`
2529
* Update the values in the section which corresponds to your registry location type.
26-
* Note: you do not need to base64 encode any of these values as Helm will handle encoding automatically
2730

2831
You are now ready to `helm install deis/workflow --namespace deis -f values.yaml` using your desired registry.
2932

33+
## Examples
34+
Here we show how the relevant parts of the fetched `values.yaml` file might look like after configuring for a particular off-cluster registry:
35+
36+
### ECR
37+
38+
```
39+
global:
40+
...
41+
registry_location: "ecr"
42+
...
43+
registry-token-refresher:
44+
# Time in minutes after which the token should be refreshed.
45+
# Leave it empty to use the default provider time.
46+
token_refresh_time: ""
47+
...
48+
ecr:
49+
# Your AWS access key. Leave it empty if you want to use IAM credentials.
50+
accesskey: "ACCESS_KEY"
51+
# Your AWS secret key. Leave it empty if you want to use IAM credentials.
52+
secretkey: "SECRET_KEY"
53+
# Any S3 region
54+
region: "us-west-2"
55+
registryid: ""
56+
hostname: ""
57+
...
58+
```
59+
**Note:** `registryid` and `hostname` should _not_ be set. See [this issue](https://github.com/deis/registry-token-refresher/issues/11) for more info.
60+
61+
### GCR
62+
63+
```
64+
global:
65+
...
66+
registry_location: "gcr"
67+
...
68+
registry-token-refresher:
69+
# Time in minutes after which the token should be refreshed.
70+
# Leave it empty to use the default provider time.
71+
token_refresh_time: ""
72+
...
73+
gcr:
74+
key_json: <base64-encoded JSON data>
75+
hostname: ""
76+
```
77+
78+
**Note:** `hostname` should be left empty.
79+
80+
### Quay.io
81+
82+
```
83+
global:
84+
...
85+
registry_location: "off-cluster"
86+
...
87+
registry-token-refresher:
88+
...
89+
off_cluster_registry:
90+
hostname: "quay.io"
91+
organization: "myorg"
92+
username: "myusername"
93+
password: "mypassword"
94+
...
95+
```
96+
3097
[registry]: ../understanding-workflow/components.md#registry
3198
[storage]: configuring-object-storage
3299
[ecr]: http://docs.aws.amazon.com/AmazonECR/latest/userguide/ECR_GetStarted.html
@@ -37,3 +104,4 @@ You are now ready to `helm install deis/workflow --namespace deis -f values.yaml
37104
[srvAccount]: https://support.google.com/cloud/answer/6158849#serviceaccounts
38105
[aws-iam]: https://aws.amazon.com/iam/
39106
[namespace]: https://docs.docker.com/registry/spec/api/#/overview
107+
[Kubernetes]: https://kubernetes.io

0 commit comments

Comments
 (0)