9c0d25f349
The approach of having the proxy serve the local data as well as the remote wasn't working -- it seems that the proxy would always check upstream and prefer that data even if it had been pushed locally. To correct this, separate the data stores of the two registries, and add both of them to the registry_mirror setting for the docker daemon. Now we will pull from our buildset registry first, and fall back on the proxy to talk to upstream if an image is not found locally. The proxy is still required in order to mask out the username and password which dockerd will otherwise use when talking to upstream. Change-Id: Iab11954a4b5431d3b1a4d4753f519b6b71f64094
112 lines
3.4 KiB
YAML
112 lines
3.4 KiB
YAML
- name: Install packages
|
|
become: yes
|
|
package:
|
|
name:
|
|
- python-docker
|
|
- python-openssl
|
|
- python-passlib
|
|
- python-bcrypt
|
|
state: present
|
|
when: "'python3' not in ansible_python_interpreter"
|
|
- name: Install packages
|
|
become: yes
|
|
package:
|
|
name:
|
|
- python3-docker
|
|
- python3-openssl
|
|
- python3-passlib
|
|
- python3-bcrypt
|
|
state: present
|
|
when: "'python3' in ansible_python_interpreter"
|
|
- name: Ensure Docker registry volume directories exists
|
|
file:
|
|
state: directory
|
|
path: "{{ buildset_registry_root}}/{{ item }}"
|
|
loop:
|
|
- certs
|
|
- auth
|
|
# TODO: use password lookup after allowing access to it in Zuul
|
|
- name: Generate registry password
|
|
set_fact:
|
|
registry_password: "{{ (ansible_date_time.iso8601_micro | password_hash('sha256'))[-20:] }}"
|
|
- name: Write htpassword file
|
|
htpasswd:
|
|
create: true
|
|
crypt_scheme: bcrypt
|
|
path: "{{ buildset_registry_root}}/auth/htpasswd"
|
|
name: "zuul"
|
|
password: "{{ registry_password }}"
|
|
- name: Generate a TLS key for the Docker registry
|
|
openssl_privatekey:
|
|
path: "{{ buildset_registry_root}}/certs/domain.key"
|
|
- name: Generate a TLS CSR for the Docker registry
|
|
openssl_csr:
|
|
path: "{{ buildset_registry_root}}/certs/domain.csr"
|
|
privatekey_path: "{{ buildset_registry_root}}/certs/domain.key"
|
|
common_name: "{{ ansible_host }}"
|
|
subject_alt_name: "DNS:{{ ansible_host }},IP:{{ ansible_host }}"
|
|
- name: Generate a TLS cert for the Docker registry
|
|
openssl_certificate:
|
|
path: "{{ buildset_registry_root}}/certs/domain.crt"
|
|
csr_path: "{{ buildset_registry_root}}/certs/domain.csr"
|
|
privatekey_path: "{{ buildset_registry_root}}/certs/domain.key"
|
|
provider: selfsigned
|
|
register: generated_cert
|
|
- name: Read TLS certificate
|
|
slurp:
|
|
src: "{{ generated_cert.filename }}"
|
|
register: certificate
|
|
- name: Decode TLS certificate
|
|
set_fact:
|
|
certificate: "{{ certificate.content | b64decode }}"
|
|
- name: Start a docker registry
|
|
docker_container:
|
|
name: buildset_registry
|
|
image: registry:2
|
|
state: started
|
|
restart_policy: always
|
|
ports:
|
|
- "5000:5000"
|
|
env:
|
|
REGISTRY_HTTP_TLS_CERTIFICATE: /certs/domain.crt
|
|
REGISTRY_HTTP_TLS_KEY: /certs/domain.key
|
|
REGISTRY_AUTH: htpasswd
|
|
REGISTRY_AUTH_HTPASSWD_PATH: /auth/htpasswd
|
|
REGISTRY_AUTH_HTPASSWD_REALM: Registry Realm
|
|
volumes:
|
|
- "{{ buildset_registry_root}}/certs:/certs"
|
|
- "{{ buildset_registry_root}}/auth:/auth"
|
|
- name: Start a docker proxy
|
|
docker_container:
|
|
name: buildset_proxy
|
|
image: registry:2
|
|
state: started
|
|
restart_policy: always
|
|
ports:
|
|
- "5001:5000"
|
|
env:
|
|
REGISTRY_HTTP_TLS_CERTIFICATE: /certs/domain.crt
|
|
REGISTRY_HTTP_TLS_KEY: /certs/domain.key
|
|
REGISTRY_AUTH: htpasswd
|
|
REGISTRY_AUTH_HTPASSWD_PATH: /auth/htpasswd
|
|
REGISTRY_AUTH_HTPASSWD_REALM: Registry Realm
|
|
REGISTRY_PROXY_REMOTEURL: https://registry-1.docker.io
|
|
REGISTRY_PROXY_USERNAME: ''
|
|
REGISTRY_PROXY_PASSWORD: ''
|
|
volumes:
|
|
- "{{ buildset_registry_root}}/certs:/certs"
|
|
- "{{ buildset_registry_root}}/auth:/auth"
|
|
- name: Set registry information fact
|
|
set_fact:
|
|
buildset_registry:
|
|
host: "{{ ansible_host }}"
|
|
port: 5000
|
|
proxy_port: 5001
|
|
username: zuul
|
|
password: "{{ registry_password }}"
|
|
cert: "{{ certificate }}"
|
|
- name: Return registry information to Zuul
|
|
zuul_return:
|
|
data:
|
|
buildset_registry: "{{ buildset_registry }}"
|