mirror of
https://github.com/hanzoai/registry.git
synced 2026-10-30 18:23:19 +00:00
zeekay
92ce9c81bf
Two movers declared this workload and disagreed. Live is universe's: the
Deployment carries apps.hanzo.ai/installation-id=hanzo-cd and managed-by=Helm,
CD Application hanzo-registry is Synced/Healthy, and its env matches
charts/app/values/hanzo/registry.yaml exactly — oci.hanzo.ai, S3 storage,
config from the registry-config ConfigMap.
The k8s/ lane could not have won even if it fired. `kubectl apply -f
k8s/deployment.yaml --dry-run=server` is rejected outright:
spec.selector: Invalid value: ... field is immutable
and the PVC it mounts, registry-data, does not exist in the cluster. It also
declared filesystem storage and a token service the live registry refuses.
So k8s/, the deploy workflow that applied it, and `make deploy` are gone.
Dockerfile and config.yml go with them: nothing builds that image and no pod
runs it — the live config is the registry-config ConfigMap. Keeping a second
copy of the config meant one live value and one that only looked live.
Fixes make status/logs, which selected app=registry — a label from the deleted
manifest that no running pod carries, so both returned nothing.
66 lines
3.5 KiB
Makefile
66 lines
3.5 KiB
Makefile
.PHONY: help build test lint clean status logs restart generate-cert create-secret
|
|
|
|
CONTEXT ?= do-sfo3-hanzo-k8s
|
|
NAMESPACE ?= hanzo
|
|
|
|
help: ## Show this help
|
|
@grep -E '^[a-zA-Z_-]+:.*?## .*$$' $(MAKEFILE_LIST) | sort | awk 'BEGIN {FS = ":.*?## "}; {printf "\033[36m%-20s\033[0m %s\n", $$1, $$2}'
|
|
|
|
# The registry is upstream `registry:2`, configured through REGISTRY_* env in
|
|
# hanzoai/universe — so this repo publishes no image and hanzo.yml declares no
|
|
# `images:`.
|
|
build: ## Nothing to build — the registry is upstream registry:2.
|
|
@echo "nothing to build. the pod runs upstream registry:2, configured by REGISTRY_* env in universe."
|
|
|
|
# The whole repo is YAML, so "does it parse" is the only check there is to run,
|
|
# and it is both the test and the lint. Stated once here; test is the alias.
|
|
# python3 because it is already on every box this runs on, where yq is not.
|
|
#
|
|
# The file list comes from git, not from a literal: a hardcoded list names files
|
|
# that move, and the target then fails on the absence rather than on a parse
|
|
# error — a red gate that says nothing about the YAML.
|
|
#
|
|
# `set -e` is load-bearing: recipe lines joined with `;` report the status of the
|
|
# LAST command, so without it a parse failure followed by `echo` exits 0 and the
|
|
# gate is green over a broken file.
|
|
lint: ## Parse every YAML this repo tracks.
|
|
@set -e; \
|
|
files=$$(git ls-files '*.yml' '*.yaml'); \
|
|
[ -n "$$files" ] || { echo ">> no YAML tracked"; exit 0; }; \
|
|
python3 -c 'import sys,yaml;[list(yaml.safe_load_all(open(f))) for f in sys.argv[1:]]' $$files; \
|
|
echo ">> parsed: $$(echo $$files | tr "\n" " ")"
|
|
|
|
test: lint ## Alias for lint.
|
|
|
|
# Nothing to remove. The only files this Makefile ever writes are signing.key and
|
|
# signing.crt from generate-cert, and those are KEY MATERIAL, not build output:
|
|
# the deployed registry-signing-key secret is made from that keypair and the
|
|
# registry trusts the cert as its rootcertbundle, so deleting the private key
|
|
# would silently orphan a live secret nobody can regenerate a match for.
|
|
clean: ## Nothing to remove — this repo generates no build artifacts.
|
|
@echo "nothing to clean. generate-cert writes signing.key/signing.crt — key material, delete those by hand if you mean to."
|
|
|
|
# Read and roll the live workload. None of these DECLARE it: the Deployment is
|
|
# charts/app/values/hanzo/registry.yaml in universe, applied by Hanzo CD, which
|
|
# reconciles the same spec after a restart.
|
|
status: ## Show registry status
|
|
kubectl --context $(CONTEXT) -n $(NAMESPACE) get deployment registry
|
|
kubectl --context $(CONTEXT) -n $(NAMESPACE) get pods -l app.kubernetes.io/name=registry
|
|
|
|
logs: ## Tail registry logs
|
|
kubectl --context $(CONTEXT) -n $(NAMESPACE) logs -l app.kubernetes.io/name=registry -f --tail=50
|
|
|
|
restart: ## Roll the registry pods
|
|
kubectl --context $(CONTEXT) -n $(NAMESPACE) rollout restart deployment registry
|
|
|
|
generate-cert: ## Generate a self-signed signing certificate for token auth
|
|
openssl req -x509 -newkey rsa:4096 -keyout signing.key -out signing.crt -days 3650 -nodes -subj "/CN=hanzo-registry"
|
|
@echo "Created signing.key and signing.crt"
|
|
@echo "Create k8s secret: kubectl --context $(CONTEXT) -n $(NAMESPACE) create secret generic registry-signing-key --from-file=signing.crt=signing.crt --from-file=signing.key=signing.key"
|
|
|
|
create-secret: ## Create signing key secret from local files
|
|
kubectl --context $(CONTEXT) -n $(NAMESPACE) create secret generic registry-signing-key \
|
|
--from-file=signing.crt=signing.crt \
|
|
--from-file=signing.key=signing.key \
|
|
--dry-run=client -o yaml | kubectl --context $(CONTEXT) apply -f -
|