eindelijk weer eens een push

2026-05-31 16:07:30 +02:00
parent 01cff8e165
commit ff21c258e0
2747 changed files with 302316 additions and 131101 deletions
@@ -0,0 +1,90 @@
+#Installatie
+
+#eigen namespace:
+
+kubectl create ns quay
+
+#Redis:
+
+kubectl apply -f redis.yaml
+
+#Postgress13:
+
+is al geinstalleerd
+
+installeren van extensies:
+
+- inloggen incontainer:
+	kubectl exec -it postgres13-0 -n postgres
+- inloggen op dadabase quay:
+	psql -U quay --dbname=quay 
+- sql uitvoeren:
+	create extension if not exists pg_trgm;
+	
+#quay
+kubectl apply -f quay.yaml -n quay
+
+#SSL configureren:
+
+Mounten van een certificaat is helaas niet mogelijk omdat dit dezelfde directory in de container 
+is waar je ook al config.yaml mount vanaf de nfs-share.
+
+daarom: 
+
+- eerst letsencrypt-certificaat laten maken via certmanager:
+
+kubectl apply -f certificate.yaml
+
+Er ontstaat dan een secret: "quay-lp.allarddcs.nl"
+
+dan de ssl-cert en ssl.key extraheren:
+
+kubectl get secret quay-lp.allarddcs.nl -n quay -o json -o=jsonpath="{.data.tls\.crt}" | base64 -d > ssl.cert
+kubectl get secret quay-lp.allarddcs.nl -n quay -o json -o=jsonpath="{.data.tls\.key}" | base64 -d > ssl.key
+
+Vervolgens deze twee bestandjes kopieren naar /mnt/nfs-share/lp/quay/conf op de NFS-server.
+
+NIET VERGETEN ZE LEESBAAR TE MAKEN: chmod 777....
+
+#verdere configuratie:
+
+stop quay:
+	kubectl delete -f quay.yaml
+
+start quay in config mode:
+	kubectl apply -f quay-config.yaml
+
+op een of andere manier werkt de ingressroute nu niet meer, daarom moet je nodeport 
+gebruiken:
+
+ga naar: 
+	localhost:<nodeport>
+
+	LET OP: dit moet!! LOCALHOST zijn.
+log in met quay config enhet password uit de yamlfile: config01
+configureer quay
+download de config.yaml (die komt in /home/ubuntu/Downloads
+untar de config.yaml 
+	tar -zxf 
+kopieer de config.yaml naar de /mnt/nfs_share/quay/conf directory
+start de gewone quay weer op.
+	kubectl apply -f quay.yaml
+
+
+
+
+#autorisaties
+
+je kunt FEATURE_USER_CREATION: true zetten in de config.yaml en dan gebruiker opvoeren. 
+vervolgens  met pgadmin voor dit account "verified" op "true" zetten (via mail werkt nog niet). 
+
+Deze gebruiker kun je dan in de config.yaml bij SUPER_USER opvoeren. 
+Dan quay opnieuw opstarten en je bent administrator! 
+
+#integratie met Clair:
+
+Quay starten in config  mode:
+
+kubectl run --rm -it --name quay_config -p 8080:8080 \
+    -v /home/ubuntu:/conf/stack \
+    quay.io/projectquay/quay:v3.10.0 config Quay01@@
@@ -0,0 +1,11 @@
+apiVersion: backstage.io/v1alpha1
+kind: Component
+metadata:
+  name: lp-quay
+  title: Quay (lp)
+spec:
+  type: service
+  lifecycle: production
+  owner: platform-team
+  partOf:
+    - ../catalog-info.yaml
@@ -0,0 +1,16 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: quay-lp.allarddcs.nl
+  namespace: quay
+spec:
+  dnsNames:
+  - quay-lp.allarddcs.nl
+  issuerRef:
+    group: cert-manager.io
+    kind: ClusterIssuer
+    name: letsencrypt
+  secretName: quay-lp.allarddcs.nl
+  usages:
+  - digital signature
+  - key encipherment
@@ -0,0 +1,16 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRouteTCP
+metadata:
+  name: quay-tcp
+  namespace: quay
+spec:
+  entryPoints:
+  - websecure
+  routes:
+  - match: HostSNI(`quay-lp.allarddcs.nl`)
+    services:
+    - name: quay
+      port: 443
+  tls:
+    passthrough: true
+
@@ -0,0 +1,33 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: quay-pv
+spec:
+  storageClassName: ""
+  capacity:
+    storage: 5Gi
+  accessModes:
+    - ReadWriteMany
+  persistentVolumeReclaimPolicy: Retain
+  mountOptions:
+    - hard
+    - nfsvers=4.1
+  nfs:
+    server: 192.168.2.110
+    path: /mnt/nfs_share/lp/quay
+    readOnly: false
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: quay-pvc
+  namespace: quay
+spec:
+  storageClassName: ""
+  volumeName: quay-pv
+  accessModes:
+    - ReadWriteMany
+  volumeMode: Filesystem
+  resources:
+    requests:
+      storage: 5Gi
@@ -0,0 +1,55 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: quay
+  namespace: quay
+  labels:
+    app: quay
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: quay
+  template:
+    metadata:
+      labels:
+        app: quay
+    spec:
+      containers:
+      - name: quay
+        image: quay.io/projectquay/quay:latest
+        ports:
+        - containerPort: 8080
+          name: web
+        - containerPort: 8443
+          name: websecure
+        volumeMounts:
+        - mountPath: /quay-registry/conf/stack/
+          name: quay
+          subPath: conf
+        - mountPath: /quay-registry/datastorage/
+          name: quay
+          subPath: data
+      nodeSelector:
+        kubernetes.io/arch: amd64
+      volumes:
+      - name: quay
+        persistentVolumeClaim:
+          claimName: quay-pvc
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: quay
+  namespace: quay
+spec:
+  ports:
+  - name: http
+    targetPort: 8080
+    port: 8080
+  - name: https
+    targetPort: 8443
+    port: 443
+  selector:
+    app: quay
+  type: NodePort
@@ -0,0 +1,50 @@
+# Redis Deployment
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: quay-redis
+  namespace: quay
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: quay-redis
+  template:
+    metadata:
+      labels:
+        app: quay-redis
+    spec:
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+            - matchExpressions:
+              - key: kubernetes.io/hostname
+                operator: NotIn
+                values:
+                - pisvrwsv07
+      containers:
+        - name: redis
+          image: redis:7
+          ports:
+            - containerPort: 6379
+          resources:
+            requests:
+              memory: "64Mi"
+              cpu: "50m"
+            limits:
+              memory: "128Mi"
+              cpu: "200m"
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: quay-redis
+  namespace: quay
+spec:
+  selector:
+    app: quay-redis
+  ports:
+    - port: 6379
+      targetPort: 6379
+
@@ -0,0 +1,58 @@
+-----BEGIN CERTIFICATE-----
+MIIFATCCA+mgAwIBAgISBuBb9o8eTb12iiZc4Ny98kSnMA0GCSqGSIb3DQEBCwUA
+MDMxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQD
+EwNSMTIwHhcNMjYwNDAxMTYwMjU2WhcNMjYwNjMwMTYwMjU1WjAfMR0wGwYDVQQD
+ExRxdWF5LWxwLmFsbGFyZGRjcy5ubDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC
+AQoCggEBANAbwddfzRGP9Lanwag2rNWEcDomKuQMqxlJaUjRv60o3EKHnr2GvfyH
+fLYQIaEi5SD2cP9gh5+GUhPWUdSNB5ft7K7/MoLeGDTbjTVMP6HAqLWFs2VgP7Be
+AvKG+iVDpxlYxVYQOPEURYt2oj0TptwnslXUzbOG+NRJuF6TPchbAfLacP2KIyTh
+Vk4fYBo/SI0B1Qw7P5Q7cVBjbZtffZzYJNxIt0w/FOnE6Bfv7ETZdSjIUx1mpJGT
+w4JFEXHksCffI3O1UCGsLU5GxlinStrbaMRCNCyKdQLM96Yi+st7R6UZ2bBQxrZE
+tFUOBXgMJr7qie0jxUjJkNRpTehWw6UCAwEAAaOCAiEwggIdMA4GA1UdDwEB/wQE
+AwIFoDATBgNVHSUEDDAKBggrBgEFBQcDATAMBgNVHRMBAf8EAjAAMB0GA1UdDgQW
+BBQK2lI2o8weTkM9UsloQCHPdj0KujAfBgNVHSMEGDAWgBQAtSnyLY5vMeibTK14
+Pvrc6QzR0jAzBggrBgEFBQcBAQQnMCUwIwYIKwYBBQUHMAKGF2h0dHA6Ly9yMTIu
+aS5sZW5jci5vcmcvMB8GA1UdEQQYMBaCFHF1YXktbHAuYWxsYXJkZGNzLm5sMBMG
+A1UdIAQMMAowCAYGZ4EMAQIBMC4GA1UdHwQnMCUwI6AhoB+GHWh0dHA6Ly9yMTIu
+Yy5sZW5jci5vcmcvNDAuY3JsMIIBCwYKKwYBBAHWeQIEAgSB/ASB+QD3AHYADleU
+vPOuqT4zGyyZB7P3kN+bwj1xMiXdIaklrGHFTiEAAAGdSf4p8AAABAMARzBFAiAk
+J48BlY/UI2gnwTuU7xduW7DFaS/iOlcxWTh3fE5q5QIhAKvV8nvvBa4ZpKKJWmvG
+CpppKbHNtM0/yS+M+hxNmopCAH0AbP5QGUOoXqkWvFLRM+TcyR7xQRx9JYQg0XOA
+nhgY6zoAAAGdSf4q7wAIAAAFAAVPAdYEAwBGMEQCID24AKSTRWka81jcFKz6YMZ6
+r2xMK1S+3esTWV82wVr2AiBdiAeEE7GNiMDc3OmOTTaZtKBT/wgyYnqPp4vBCxCG
+EzANBgkqhkiG9w0BAQsFAAOCAQEAWcGVS1NZjlAJ4pp+3fH5v4/mk4HieEkxJvnO
+q8XlAUai6R+rF32FSOZN6aOrzN/bI7Qf38K64DnMEB3HAZFN79UrswnjJpuhHaoY
+0Ocj01a0AyLbEiddDrRQ8UrbEm6cVZGhgen0h8IOEskwSQF+lWwcSvf2tMJ3eD1h
+FU8einO0K3lgEgJ0URHiN8VcGdDf4vum0HSKS/E0QpOkU7JobFrZZ0xv3Gmd2+bh
+NHMw9pqppoJmsEoEYTCxCBNboFnavIbCOT8fVXNsmn7PJKa3FvoMaILYIPCRPOYI
+sse2uZbd90Dmitgr45lbKUSqluAwCbnoY2+v8yacUeAsN7118w==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIFBjCCAu6gAwIBAgIRAMISMktwqbSRcdxA9+KFJjwwDQYJKoZIhvcNAQELBQAw
+TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh
+cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMjQwMzEzMDAwMDAw
+WhcNMjcwMzEyMjM1OTU5WjAzMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3Mg
+RW5jcnlwdDEMMAoGA1UEAxMDUjEyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
+CgKCAQEA2pgodK2+lP474B7i5Ut1qywSf+2nAzJ+Npfs6DGPpRONC5kuHs0BUT1M
+5ShuCVUxqqUiXXL0LQfCTUA83wEjuXg39RplMjTmhnGdBO+ECFu9AhqZ66YBAJpz
+kG2Pogeg0JfT2kVhgTU9FPnEwF9q3AuWGrCf4yrqvSrWmMebcas7dA8827JgvlpL
+Thjp2ypzXIlhZZ7+7Tymy05v5J75AEaz/xlNKmOzjmbGGIVwx1Blbzt05UiDDwhY
+XS0jnV6j/ujbAKHS9OMZTfLuevYnnuXNnC2i8n+cF63vEzc50bTILEHWhsDp7CH4
+WRt/uTp8n1wBnWIEwii9Cq08yhDsGwIDAQABo4H4MIH1MA4GA1UdDwEB/wQEAwIB
+hjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwEwEgYDVR0TAQH/BAgwBgEB
+/wIBADAdBgNVHQ4EFgQUALUp8i2ObzHom0yteD763OkM0dIwHwYDVR0jBBgwFoAU
+ebRZ5nu25eQBc4AIiMgaWPbpm24wMgYIKwYBBQUHAQEEJjAkMCIGCCsGAQUFBzAC
+hhZodHRwOi8veDEuaS5sZW5jci5vcmcvMBMGA1UdIAQMMAowCAYGZ4EMAQIBMCcG
+A1UdHwQgMB4wHKAaoBiGFmh0dHA6Ly94MS5jLmxlbmNyLm9yZy8wDQYJKoZIhvcN
+AQELBQADggIBAI910AnPanZIZTKS3rVEyIV29BWEjAK/duuz8eL5boSoVpHhkkv3
+4eoAeEiPdZLj5EZ7G2ArIK+gzhTlRQ1q4FKGpPPaFBSpqV/xbUb5UlAXQOnkHn3m
+FVj+qYv87/WeY+Bm4sN3Ox8BhyaU7UAQ3LeZ7N1X01xxQe4wIAAE3JVLUCiHmZL+
+qoCUtgYIFPgcg350QMUIWgxPXNGEncT921ne7nluI02V8pLUmClqXOsCwULw+PVO
+ZCB7qOMxxMBoCUeL2Ll4oMpOSr5pJCpLN3tRA2s6P1KLs9TSrVhOk+7LX28NMUlI
+usQ/nxLJID0RhAeFtPjyOCOscQBA53+NRjSCak7P4A5jX7ppmkcJECL+S0i3kXVU
+y5Me5BbrU8973jZNv/ax6+ZK6TM8jWmimL6of6OrX7ZU6E2WqazzsFrLG3o2kySb
+zlhSgJ81Cl4tv3SbYiYXnJExKQvzf83DYotox3f0fwv7xln1A2ZLplCb0O+l/AK0
+YE0DS2FPxSAHi0iwMfW2nNHJrXcY3LLHD77gRgje4Eveubi2xxa+Nmk/hmhLdIET
+iVDFanoCrMVIpQ59XWHkzdFmoHXHBV7oibVjGSO7ULSQ7MJ1Nz51phuDJSgAIU7A
+0zrLnOrAj/dfrlEWRhCvAgbuwLZX1A2sjNjXoPOHbsPiy+lO1KF8/XY7
+-----END CERTIFICATE-----
@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEowIBAAKCAQEA0BvB11/NEY/0tqfBqDas1YRwOiYq5AyrGUlpSNG/rSjcQoee
+vYa9/Id8thAhoSLlIPZw/2CHn4ZSE9ZR1I0Hl+3srv8ygt4YNNuNNUw/ocCotYWz
+ZWA/sF4C8ob6JUOnGVjFVhA48RRFi3aiPROm3CeyVdTNs4b41Em4XpM9yFsB8tpw
+/YojJOFWTh9gGj9IjQHVDDs/lDtxUGNtm199nNgk3Ei3TD8U6cToF+/sRNl1KMhT
+HWakkZPDgkURceSwJ98jc7VQIawtTkbGWKdK2ttoxEI0LIp1Asz3piL6y3tHpRnZ
+sFDGtkS0VQ4FeAwmvuqJ7SPFSMmQ1GlN6FbDpQIDAQABAoIBADzh8fq1X0QlDl2l
+hGVW4YdxwHdylRe0kRXLwU55do8NJiscjBc8ZTaM2LJW08/Vap0THAnKTsMfw8Fj
+8Pqy66bKB3VG2ZspqIFGPfB6xx7mQzUf0VT2LIvHZStYy7O9MBSdQNYl1tLIsHPV
+mC8wIZ/EyUqNAETmVsOccaDRiMClQD+b0wYqsPAN3DHEMTFQId/ZQ3JbExjqKRur
+dE3c3gG0t3wY5ZA8oeucumw4/KiFu1uy0KL9FwjcuAJCC1U1e3r78mgIsZDP9QH7
+tSN6ERgjTsFSyvrYnKAe3OGAN61kIRp2UzrA6yyuVLs8gwA4X0J2U9gL8mCJJrhz
+LiGW6ECgYEA4mWjAKX3I16pSDzM5DYVkhR2dCUR68Vfd32dnqCP9NMwn04iR180
+fjdh12fJYxsiHjdz6H8KwAaeirJA1TFlKypBTA/skb7YQtQWyZZr26+ZSsznKU/f
+0JTfh/JIZxPlpWtSsdacbUdX4Ki8tJisFkPW647icsvC21EVHCA08y0CgYEA61Hu
+peXDvwvyRgSbF+CRH1NDdcpvIEu2H1F9dCr0wwI0SlrAtkbD0gRYz2/eNYFT117y
+wTJAJZF2svU91Ba4ynSa2GQ1yElbvGnO5wu0wdsZpfL0mdrDPnMWlmfMg85/0rZw
+3Xb6HXYCIZ167meCJVoyJpute2SO3tRoMY++vVkCgYEA0IfHfVhha/3MNRJzsxyx
+/6zDcrWWbTGOfpSAs1S3ZE2GcqXYYx8pTbybbXpWf+fFJEn1hEhIUZmHPL91gimO
+QxUXsgTU5WYA8oVCPApGbMKwkrprjZzZzdjij+i1keQ82YIiWFYSHYHiSreBoWMi
+1xtDghNJN23BnJtxs0djHj0CgYAx1aUbnwAIWohRSbJqqRUytBhqPpewGDiWg1R1
+II+7KKFYScXcFDpuJJuGOqOtYxkVWDdCsNii3B5uIb+ZRcKWpYERaI93Pgneae32
+QiVilHrnCP/CAXEtrYPQEGVgWH/7aMWYMRUg3hfvdIFPMb5/GI3cXUWtBwu2pvb1
+4AI96QKBgHGx8uxpMaYHNVKQxNFp5XcqlEAtEiUIpmefamzZdr5E1Ons2qfX9s0i
+u1fzyK3ZWGWrOZ06h5nHMJtZE4624dgXMFHcfH2Zwttr6hpC9vcChYfuJlZ81eec
+t6ZXEQbQ7J8azRy7TdhlJk/GterbOq5/KZisQ+9k/DM4D+/ZmEgh
+-----END RSA PRIVATE KEY-----