commit 9b861200856f79877ea4924f432f59edfb864674
parent 106f71871350bd2ec5f0c9e072cb6c1a7bed07fe
Author: MTRNord <MTRNord@users.noreply.github.com>
Date: Wed, 25 Mar 2026 19:39:06 +0100
install zot
Signed-off-by: MTRNord <MTRNord@users.noreply.github.com>
Diffstat:
10 files changed, 197 insertions(+), 0 deletions(-)
diff --git a/apps/talos_cluster/envoy-gateway/gateway_settings.yaml b/apps/talos_cluster/envoy-gateway/gateway_settings.yaml
@@ -821,6 +821,18 @@ spec:
certificateRefs:
- kind: Secret
name: opencost.k8s.midnightthoughts.space-tls
+ - name: https-registry-midnightthoughts
+ protocol: HTTPS
+ hostname: "registry.midnightthoughts.space"
+ port: 443
+ allowedRoutes:
+ namespaces:
+ from: "All"
+ tls:
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: registry.midnightthoughts.space-tls
- name: http
protocol: HTTP
port: 80
diff --git a/apps/talos_cluster/kustomization.yaml b/apps/talos_cluster/kustomization.yaml
@@ -39,4 +39,5 @@ resources:
- ./opencost
- ./k6-operator
- ./stalwart
+ - ./zot
#- ./proxmox-ccm
diff --git a/apps/talos_cluster/zot/httproute.yaml b/apps/talos_cluster/zot/httproute.yaml
@@ -0,0 +1,15 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+ name: zot
+ namespace: zot
+spec:
+ parentRefs:
+ - name: envoy-gateway
+ namespace: envoy-gateway
+ hostnames:
+ - registry.midnightthoughts.space
+ rules:
+ - backendRefs:
+ - name: zot
+ port: 5000
diff --git a/apps/talos_cluster/zot/kustomization.yaml b/apps/talos_cluster/zot/kustomization.yaml
@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+ - httproute.yaml
diff --git a/infrastructure_talos/controllers/kustomization.yaml b/infrastructure_talos/controllers/kustomization.yaml
@@ -8,3 +8,4 @@ resources:
- cert-manager.yaml
- longhorn.yaml
- ./velero
+ - ./zot
diff --git a/infrastructure_talos/controllers/zot/kustomization.yaml b/infrastructure_talos/controllers/zot/kustomization.yaml
@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+ - namespace.yaml
+ - repository.yaml
+ - secret.yaml
+ - release.yaml
diff --git a/infrastructure_talos/controllers/zot/namespace.yaml b/infrastructure_talos/controllers/zot/namespace.yaml
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+ name: zot
diff --git a/infrastructure_talos/controllers/zot/release.yaml b/infrastructure_talos/controllers/zot/release.yaml
@@ -0,0 +1,115 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+ name: zot
+ namespace: zot
+spec:
+ interval: 30m
+ chart:
+ spec:
+ chart: zot
+ version: "0.1.x"
+ sourceRef:
+ kind: HelmRepository
+ name: zot
+ namespace: zot
+ interval: 24h
+ install:
+ remediation:
+ retries: 3
+ upgrade:
+ remediation:
+ retries: 3
+ values:
+ replicaCount: 1
+
+ image:
+ # Multi-arch image supports arm64 natively
+ repository: ghcr.io/project-zot/zot-linux-arm64
+ pullPolicy: IfNotPresent
+
+ service:
+ type: ClusterIP
+ port: 5000
+
+ priorityClassName: system-cluster-critical
+
+ resources:
+ requests:
+ cpu: 50m
+ memory: 64Mi
+ limits:
+ cpu: "1"
+ memory: 512Mi
+
+ # Zot config — S3_ACCESS_KEY and S3_SECRET_KEY are substituted from env vars at startup
+ configFiles:
+ config.json: |
+ {
+ "distSpecVersion": "1.1.0",
+ "storage": {
+ "rootDirectory": "/var/lib/registry",
+ "storageDriver": {
+ "name": "s3",
+ "region": "hel1",
+ "regionEndpoint": "https://hel1.your-objectstorage.com",
+ "bucket": "midnightthoughts-registry",
+ "forcepathstyle": true,
+ "secure": true,
+ "accesskey": "$S3_ACCESS_KEY",
+ "secretkey": "$S3_SECRET_KEY"
+ }
+ },
+ "http": {
+ "address": "0.0.0.0",
+ "port": "5000",
+ "auth": {
+ "htpasswd": {
+ "path": "/htpasswd/htpasswd"
+ }
+ }
+ },
+ "log": {
+ "level": "info"
+ },
+ "extensions": {
+ "search": {
+ "enable": true
+ },
+ "ui": {
+ "enable": true
+ },
+ "metrics": {
+ "enable": true,
+ "prometheus": {
+ "path": "/metrics"
+ }
+ }
+ },
+ "accessControl": {
+ "anonymousPolicy": ["read"],
+ "adminPolicy": {
+ "users": ["admin"],
+ "actions": ["read", "create", "update", "delete"]
+ }
+ }
+ }
+
+ # Inject S3 credentials as env vars for config substitution
+ extraEnvFrom:
+ - secretRef:
+ name: zot-secret
+
+ # Mount htpasswd from Secret
+ extraVolumes:
+ - name: htpasswd
+ secret:
+ secretName: zot-secret
+ items:
+ - key: htpasswd
+ path: htpasswd
+
+ extraVolumeMounts:
+ - name: htpasswd
+ mountPath: /htpasswd
+ readOnly: true
diff --git a/infrastructure_talos/controllers/zot/repository.yaml b/infrastructure_talos/controllers/zot/repository.yaml
@@ -0,0 +1,9 @@
+apiVersion: source.toolkit.fluxcd.io/v1beta2
+kind: HelmRepository
+metadata:
+ name: zot
+ namespace: zot
+spec:
+ interval: 24h
+ type: oci
+ url: oci://ghcr.io/project-zot/helm-zot
diff --git a/infrastructure_talos/controllers/zot/secret.yaml b/infrastructure_talos/controllers/zot/secret.yaml
@@ -0,0 +1,29 @@
+apiVersion: v1
+kind: Secret
+metadata:
+ name: zot-secret
+ namespace: zot
+stringData:
+ S3_ACCESS_KEY: ENC[AES256_GCM,data:ayFtIkZV23p3dZ+VcddNQMV131I=,iv:YzYKjwNMjLV5APThdt2idXJlvfZ0+HdoK5gEGY0M858=,tag:qOlFOEk2pTnRu0aZzKsVng==,type:str]
+ S3_SECRET_KEY: ENC[AES256_GCM,data:IFshZzzZZFW17GdCOPsVTvD3T+rwjTdIxtKigGC0akQzEHdZtss6Ug==,iv:9DADsIj8Z7DbKuUnej3Wp9xRtNEFqfVWNGrZBXTpLeI=,tag:cushbfNW+z6dEPFiUnGcgg==,type:str]
+ htpasswd: ENC[AES256_GCM,data:cQFylOYHl3SUMFqze2vsii+hTx67i4aKQWdiDbweNgH3A6wIHk5M8/VNethg5MVS8gffDHDoBBQTm7RxkiJGGQmV/Q==,iv:anJh0qpyv/TnjqKl/guo156+g8g55AYChPnuw96kQtg=,tag:Bd/BLua4F8qqTRkOh+J3aA==,type:str]
+sops:
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBuSFVYY3pKajR3NGs1TXE0
+ Z0N4K2Y5NVNCWG9Ya0Z6SHJRQnhEcFV0WDN3CnZ2R05xY2xKalhrbExjdGlFVzJj
+ bEE3U2MxaHFzUGxtVy9KYVRIK01ZRkEKLS0tIFQvOW5jV1hhMzAxb2pTVVV1S3Bo
+ a1pmM3JrQnlKdnZReUE2MkxKREx1ekUK8O48IXf57lslwHG+sCDQXRenJ9bZw6DR
+ RDNwVoortk0cBV5EFj74a//L9j9zLldm3SsJooJ/AKLc7mW1GQZJ5w==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2026-03-25T18:31:29Z"
+ mac: ENC[AES256_GCM,data:6SvE/Q59oArOLtkO2O9x2OzGv6UZvTjigtB2v3+42wQfoj7Ul5RNaLEYsufRY2nmKLwFxqSRvBxBkY4PTf7sVJRrLK71SOJJTxoeSHyjhulbnjYqvf0V5tketnebSg53xAyujX2gtaALZy+3RqcbP5Hj/Lw9f1qC7HhKEWsO6DQ=,iv:bbfodl/8cYFTq4vIVlcXf4wA7GUkm662zSyMuP8LrFg=,tag:Qo1P1ETqRf+jGGEXdntiFQ==,type:str]
+ pgp: []
+ encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|smtp_auth_password|addresses|smtp_auth_username|authorization_credentials|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|integration_key|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
+ version: 3.9.1
