Kyma

Appearance

Docker Registry Custom Resource ​

The dockerregistries.operator.kyma-project.io CustomResourceDefinition (CRD) is a detailed description of the Docker Registry configuration that you want to install on your cluster. To get the up-to-date CRD and show the output in the YAML format, run this command:

bash
kubectl get crd dockerregistries.operator.kyma-project.io -o yaml

NOTE

Only one custom resource is supported, leading to an image registry being instantiated. Additional CRs are ignored.

Sample Custom Resource ​

The following Docker Registry custom resource (CR) shows the configuration of the Docker Registry.

yaml
apiVersion: operator.kyma-project.io/v1alpha1
kind: DockerRegistry
metadata:
  annotations:
    kubectl.kubernetes.io/last-applied-configuration: |
      {"apiVersion":"operator.kyma-project.io/v1alpha1","kind":"DockerRegistry","metadata":{"annotations":{},"name":"default","namespace":"kyma-system"},"spec":{}}
  creationTimestamp: "2024-05-16T10:18:25Z"
  finalizers:
  - dockerregistry-operator.kyma-project.io/deletion-hook
  generation: 1
  name: default
  namespace: kyma-system
  resourceVersion: "31542"
  uid: 30dbb8a0-2193-47b6-bdf7-358f78319eb8
spec: {}
status:
  conditions:
  - lastTransitionTime: "2024-05-16T10:18:25Z"
    message: Configuration ready
    reason: Configured
    status: "True"
    type: Configured
  - lastTransitionTime: "2024-05-16T10:18:45Z"
    message: DockerRegistry installed
    reason: Installed
    status: "True"
    type: Installed
  storage: filesystem
  externalAccess:
    enabled: "False"
  internalAccess:
    enabled: "True"
    pullAddress: localhost:32137
    pushAddress: dockerregistry.kyma-system.svc.cluster.local:5000
    secretName: dockerregistry-config
  served: "True"
  state: Ready

Custom Resource Parameters ​

For details, see the Docker Registry specification file.

dockerregistries.operator.kyma-project.io/v1alpha1 ​

Spec:

ParameterTypeDescription
externalAccessobjectContains configuration of the registry external access through the Istio Gateway.
externalAccess.enabledstringSpecifies if the registry is exposed.
externalAccess.gatewaystringSpecifies the name of the Istio Gateway CR in the NAMESPACE/NAME format. Defaults to the kyma-system/kyma-gateway.
externalAccess.hoststringSpecifies the host on which the registry will be exposed. It must fit into at least one server defined in the Gateway.
storageobjectContains configuration of the registry images storage.
storage.deleteEnabledstringSpecifies if registry supports deletion of image blobs and manifests by digest.
storage.azureobjectContains configuration of the Azure Storage.
storage.azure.secretName (required)stringSpecifies the name of the Secret that contains data needed to connect to the Azure Storage.
storage.s3objectContains configuration of the s3 storage.
storage.s3.bucket (required)stringSpecifies the name of the s3 bucket.
storage.s3.region (required)stringSpecifies the region of the s3 bucket.
storage.s3.regionEndpointstringSpecifies the endpoint of the s3 region.
storage.s3.encryptstringSpecifies if data in the bucket is encrypted.
storage.s3.securestringSpecifies if registry uses the TLS communication with the s3.
storage.s3.secretNamestringSpecifies the name of the Secret that contains data needed to connect to the s3 storage.
storage.gcs.bucket (required)stringSpecifies the name of the GCS bucket.
storage.gcs.secretNamestringA private service account key file in JSON format used for Service Account Authentication.
storage.gcs.rootdirectorystringThe root directory tree in which all registry files are stored. Defaults to the empty string (bucket root).
storage.gcs.chunksizestringThis is the chunk size used for uploading large blobs, must be a multiple of 256*1024. Defaults to 5242880.
storage.btpObjectStore.secretNamestringSpecifies the name of the Secret that contains data needed to connect to BTP Object Store.
storage.pvc.name (required)stringSpecifies the name of the PersistentVolumeClaim.

Status:

ParameterTypeDescription
conditions[]objectConditions associated with CustomStatus.
conditions.​lastTransitionTime (required)stringSpecifies the last time the condition transitioned from one status to another. This should be when the underlying condition changes. If that is not known, then using the time when the API field changed is acceptable.
conditions.​message (required)stringProvides a human-readable message indicating details about the transition. This may be an empty string.
conditions.​observedGenerationintegerRepresents .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.
conditions.​reason (required)stringContains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field and whether the values are considered a guaranteed API. The value should be a camelCase string. This field may not be empty.
conditions.​status (required)stringSpecifies the status of the condition. The value is either True, False, or Unknown.
conditions.​type (required)stringSpecifies the condition type in camelCase or in foo.example.com/CamelCase. Many .conditions.type values are consistent across resources like Available, but because arbitrary conditions can be useful (see .node.status.conditions), the ability to deconflict is important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt).
storagestringType of the used registry images storage.
internalAccessobjectContains installed internal access configuration.
internalAccess.enabledstringSpecifies if internal access is enabled.
internalAccess.secretNamestringName of the Secret with data needed for internal connection to Docker Registry.
internalAccess.pushAddressstringAddress that can be used to push images from inside the cluster.
internalAccess.pullAddressstringAddress that can be used by Kubernetes to make a communication with the registry.
externalAccessobjectContains installed external access configuration.
externalAccess.enabledstringSpecifies if external access is enabled.
externalAccess.gatewaystringSpecifies the name of the Istio Gateway CR.
externalAccess.secretNamestringName of the Secret with data needed for external connection to Docker Registry.
externalAccess.pushAddressstringAddress that can be used to push images from outside the cluster.
externalAccess.pullAddressstringAddress that can be used by Kubernetes to make a communication with the registry.
served (required)stringSignifies if the current Docker Registry is managed. Value can be True or False.
statestringSignifies the current state of Docker Registry. Value can be one of Ready, Processing, Error, or Deleting.

Status Reasons ​

Processing of a Docker Registry CR can succeed, continue, or fail for one of these reasons:

Docker Registry CR Conditions ​

This section describes the possible states of the Docker Registry CR. Three condition types, Installed, Configured and Deleted, are used.

NoCR StateCondition typeCondition statusCondition reasonRemark
1ProcessingConfiguredtrueConfiguredDocker Registry configuration verified
2ProcessingConfiguredunknownConfigurationDocker Registry configuration verification ongoing
3ErrorConfiguredfalseConfigurationErrDocker Registry configuration verification error
4ErrorConfiguredfalseDuplicatedOnly one Docker Registry CR is allowed
5ReadyInstalledtrueInstalledDocker Registry workloads deployed
6ProcessingInstalledunknownInstallationDeploying Docker Registry workloads
7ErrorInstalledfalseInstallationErrDeployment error
8DeletingDeletedunknownDeletionDeletion in progress
9DeletingDeletedtrueDeletedDocker Registry module deleted
10ErrorDeletedfalseDeletionErrDeletion failed