mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-10 06:24:09 +09:00
fix(platform): remove the dead registries value and patch-containerd Secret (#5190)
Nothing reads the `patch-containerd` Secret: the kubeadm certs.d mount it fed is gone, and the v1.6.0 changelog already says the passthrough is removed. The `registries` value stayed in the Package spec and takes mirrors that do nothing, which is worse than no knob for someone setting up an air-gapped cluster. Removed both. A Package that still sets `registries` keeps installing, the platform chart has no values schema so the key is ignored. On upgrade the Secret in `cozy-system` is deleted by the release. Mirrors for tenant workers are the per-pool `talos.registryMirrors` of KubernetesNodes. I checked that nothing is left: `git grep` for `.Values.registries` and for `patch-containerd` outside the changelogs finds nothing but the kubernetes README sentence that says the Secret was removed. Full `make unit-tests` passes. Fixes https://github.com/cozystack/cozystack/issues/4006 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> <!-- coderabbit-ai-generated:v1 --> ## Summary by CodeRabbit * **Configuration Changes** * The platform chart no longer supports the `registries` configuration option or generates containerd registry secrets. Mirror endpoint settings, including credentials and TLS verification options, are no longer applied through this chart. * Registry mirrors can be configured per worker pool using `talos.registryMirrors` on `KubernetesNodes`. Existing packages that set `registries` continue to install, but the setting is ignored. * **Documentation** * Updated guidance for configuring registry mirrors on worker pools. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
This commit is contained in:
3 files changed
+1
-67
No files matched your search
@@ -87,7 +87,7 @@ See the reference for components utilized in this service:
|
||||
|
||||
- **`ephemeralStorage` renamed to `diskSize`** (v1.4): The `nodeGroups[name].ephemeralStorage` field has been renamed to `nodeGroups[name].diskSize`. Existing clusters are migrated transparently by platform migration 41 during the pre-upgrade hook — no manual action is required. Newly written values should use `diskSize`. Existing VMs are rolling-updated via CAPI when the new values are applied. With the Talos worker rollover in this release the field now sizes the **single system disk** (Talos OS image streamed from `factory.talos.dev`, kubelet state, containerd image cache, local-path PVCs) — the pre-Talos `disk-kubelet` PVC layout was removed. State on that single disk persists across same-VM reboots (virt-launcher restart, guest reboot, node failure); VM replacement by CAPI (e.g. nodeGroup field change, MachineHealthCheck remediation) provisions a fresh disk.
|
||||
|
||||
- **Air-gapped tenant workers (Phase 1 Talos rollover)**: tenant worker bootstrap moves from Ubuntu containerDisk + kubeadm to a Talos OS disk image fetched over HTTP by CDI and a `.../installer/...` installer reference. Both sources are now overridable — set `talos.imageFactoryURL` (default `https://factory.talos.dev`) to a self-hosted Image Factory, a caching mirror, or an internal HTTP file server, and `talos.installerRepository` (default `factory.talos.dev/installer`) to a mirrored registry. The Helm-rendered `*-patch-containerd` Secret that previously plumbed the platform-wide `registries.mirrors` config to tenant workers (via the kubeadm template's containerd certs.d mount) has no consumer in the Talos machineconfig and was removed in this release; **in-guest container-image pulls** (pods pulling from registries inside the tenant cluster) still honour no per-tenant `registries.mirrors` override until Phase 2 restores it via `machine.registries.mirrors` knobs. So a strict-egress tenant can now mirror the Talos OS image and installer, but rate-limited in-guest registry pulls remain a Phase 2 follow-up — file an issue if you depend on this and it is not yet landed.
|
||||
- **Air-gapped tenant workers (Phase 1 Talos rollover)**: tenant worker bootstrap moves from Ubuntu containerDisk + kubeadm to a Talos OS disk image fetched over HTTP by CDI and a `.../installer/...` installer reference. Both sources are now overridable — set `talos.imageFactoryURL` (default `https://factory.talos.dev`) to a self-hosted Image Factory, a caching mirror, or an internal HTTP file server, and `talos.installerRepository` (default `factory.talos.dev/installer`) to a mirrored registry. The Helm-rendered `*-patch-containerd` Secret that previously plumbed the platform-wide `registries.mirrors` config to tenant workers (via the kubeadm template's containerd certs.d mount) has no consumer in the Talos machineconfig, so the Secret is removed together with the platform `registries` value that fed it. A Package that still sets `registries` keeps installing, the key is ignored. Registry mirrors for tenant workers, **in-guest container-image pulls** (pods pulling from registries inside the tenant cluster) included, are configured per worker pool through `talos.registryMirrors` of the `KubernetesNodes` resource.
|
||||
|
||||
- **Worker MachineHealthCheck remediation is now enabled by default** (Phase 1 Talos rollover): the worker MHC `maxUnhealthy` moved from a hard-coded `0` (remediation effectively **off**) to a configurable `nodeHealthCheck.maxUnhealthy` defaulting to `"50%"`. CAPI now auto-remediates (deletes and replaces) unhealthy worker Machines while at least 50% of a group stays healthy. `"50%"` deliberately leaves headroom for transient unhealthy nodes during the kubeadm→Talos rollover and slow first boots from `factory.talos.dev`; set `nodeHealthCheck.maxUnhealthy: "0%"` to keep the previous remediation-off behaviour until your fleet is stable on Talos workers.
|
||||
|
||||
|
||||
@@ -1,35 +0,0 @@
|
||||
{{- if .Values.registries.mirrors }}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: patch-containerd
|
||||
namespace: cozy-system
|
||||
type: Opaque
|
||||
stringData:
|
||||
{{- range $registry, $mirror := .Values.registries.mirrors }}
|
||||
{{- if $mirror.endpoints }}
|
||||
{{ $registry }}.toml: |
|
||||
server = "https://{{ $registry }}"
|
||||
{{- range $endpoint := $mirror.endpoints }}
|
||||
[host."{{ $endpoint }}"]
|
||||
capabilities = ["pull", "resolve"]
|
||||
{{- $endpointConfig := index $.Values.registries.config $endpoint }}
|
||||
{{- if $endpointConfig }}
|
||||
{{- if $endpointConfig.tls }}
|
||||
{{- if $endpointConfig.tls.insecureSkipVerify }}
|
||||
skip_verify = true
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if $endpointConfig.auth }}
|
||||
[host."{{ $endpoint }}".auth]
|
||||
username = "{{ $endpointConfig.auth.username }}"
|
||||
password = "{{ $endpointConfig.auth.password }}"
|
||||
{{- end }}
|
||||
{{- else }}
|
||||
skip_verify = true
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
@@ -768,37 +768,6 @@ scheduling:
|
||||
# loginTheme: acme
|
||||
# loginThemeImage: registry.example.com/acme-keycloak-theme:v1
|
||||
branding: {}
|
||||
# Container registry mirrors configuration
|
||||
#
|
||||
# Example:
|
||||
# registries:
|
||||
# mirrors:
|
||||
# docker.io:
|
||||
# endpoints:
|
||||
# - http://10.0.0.1:8082
|
||||
# ghcr.io:
|
||||
# endpoints:
|
||||
# - http://10.0.0.1:8083
|
||||
# gcr.io:
|
||||
# endpoints:
|
||||
# - http://10.0.0.1:8084
|
||||
# registry.k8s.io:
|
||||
# endpoints:
|
||||
# - http://10.0.0.1:8085
|
||||
# quay.io:
|
||||
# endpoints:
|
||||
# - http://10.0.0.1:8086
|
||||
# cr.fluentbit.io:
|
||||
# endpoints:
|
||||
# - http://10.0.0.1:8087
|
||||
# docker-registry3.mariadb.com:
|
||||
# endpoints:
|
||||
# - http://10.0.0.1:8088
|
||||
# config:
|
||||
# "10.0.0.1:8082":
|
||||
# tls:
|
||||
# insecureSkipVerify: true
|
||||
registries: {}
|
||||
# Resource allocation ratios
|
||||
resources:
|
||||
cpuAllocationRatio: 10
|
||||
|
||||
Reference in new issue
Block a user