The module lifecycle stage: Preview

The module has requirements for installation

PVC configuration example

apiVersion: deckhouse.io/v1alpha1
kind: ModuleConfig
metadata:
  name: payload-registry
spec:
  version: 1
  enabled: true
  settings:
    persistence:
      storageClass: network-ssd # Immutable parameter
      size: 10Gi

Example Role for Kubernetes token authorization

For more details, see the section Authentication with Kubernetes tokens.

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: payload-registry-full
rules:
- apiGroups: ["payload-registry.deckhouse.io"]
  resources: ["payloadrepositoryaccesses"]
  resourceNames: 
    - "dist/*"
    - "app/**"
  verbs: 
    - "get"     # Pull image and get tag info via Kubernetes API Extension.
    - "list"    # Get list of tags in namespace repositories via Kubernetes API Extension.
    - "create"  # Push images.
    - "delete"  # Delete tags, including via Kubernetes API Extension.

GC configuration example

During the GC operation, the registry transitions to “read-only” mode. In this state, push operations are unavailable, while pull operations continue to work.

apiVersion: deckhouse.io/v1alpha1
kind: ModuleConfig
metadata:
  name: payload-registry
spec:
  version: 1
  enabled: true
  settings:
    gc:
      enabled: true
      # Every Monday at 20:00
      # https://crontab.guru/#0_20_*_*_1
      schedule: "0 20 * * 1"
apiVersion: deckhouse.io/v1alpha1
kind: ModuleConfig
metadata:
  name: payload-registry
spec:
  version: 1
  enabled: true
  settings:
    gc:
      enabled: true
      # Every day at 03:05
      # https://crontab.guru/#5_3_*_*_*
      schedule: "5 3 * * *"