feat: Bootstrap Zot

bootstrap/registry/cert.tf

@@ -0,0 +1,24 @@
+resource "kubernetes_manifest" "certificate_cluster_wildcard_tls" {
+  depends_on = [kubernetes_namespace.namespace]
+
+  manifest = {
+    "apiVersion" = "cert-manager.io/v1"
+    "kind"       = "Certificate"
+    "metadata" = {
+      "name"      = local.cert_name
+      "namespace" = var.namespace
+    }
+    "spec" = {
+      "dnsNames" = [
+        var.hostname
+
+      ]
+
+      "issuerRef" = {
+        "kind" = "ClusterIssuer"
+        "name" = "letsencrypt-http01"
+      }
+      "secretName" = local.cert_name
+    }
+  }
+}

bootstrap/registry/configmap.tf

@@ -0,0 +1,65 @@
+resource "kubernetes_config_map" "config" {
+  depends_on = [kubernetes_namespace.namespace]
+
+  metadata {
+    namespace = var.namespace
+    name      = "telchar-config"
+  }
+
+  data = {
+    "config.json" = jsonencode({
+      storage : {
+        rootDirectory : "/tmp/zot",
+        dedupe : true
+        storageDriver : {
+          name : "s3"
+          region : var.aws_region
+          bucket : var.aws_bucket_name
+          secure : true
+          skipverify : false
+        }
+        cacheDriver : {
+          name : "dynamodb"
+          endpoint : "https://dynamodb.${var.aws_region}.amazonaws.com"
+          region : var.aws_region
+          cacheTablename : var.aws_dynamodb_table
+          repoMetaTablename : "ZotRepoMetadataTable"
+          manifestDataTablename : "ZotManifestDataTable"
+          versionTablename : "ZotVersion"
+          repoBlobsInfoTableName : "ZotRepoBlobsInfoTable"
+          imageMetaTableName : "ZotImageMetaTable"
+          apiKeyTableName : "ZotApiKeyTable"
+          userDataTableName : "ZotUserDataTable"
+        }
+      }
+      http : {
+        address : "0.0.0.0",
+        port : local.api_port,
+        tls : {
+          cert : "${local.certs_mount_path}/tls.crt",
+          key : "${local.certs_mount_path}/tls.key"
+        }
+      }
+      log : {
+        level : "debug"
+      }
+      extensions : {
+        search : {
+          enable : true
+        }
+        ui : {
+          enable : false
+        }
+        mgmt : {
+          enable : true
+        }
+        metrics : {
+          enable : true,
+          prometheus : {
+            path : "/metrics"
+          }
+        }
+      }
+    })
+  }
+}

bootstrap/registry/deployment.tf

@@ -0,0 +1,97 @@
+resource "kubernetes_deployment_v1" "telchar_registry" {
+  wait_for_rollout = false
+  depends_on       = [kubernetes_manifest.certificate_cluster_wildcard_tls]
+
+  metadata {
+    name      = local.name
+    namespace = var.namespace
+    labels    = local.labels
+  }
+  spec {
+    replicas = var.replicas
+    selector {
+      match_labels = local.labels
+    }
+    strategy {
+      rolling_update {
+        max_surge       = 2
+        max_unavailable = 0
+      }
+    }
+    template {
+      metadata {
+        name   = local.name
+        labels = local.labels
+      }
+      spec {
+        container {
+          name              = "main"
+          image             = var.image
+          image_pull_policy = "IfNotPresent"
+
+          resources {
+            limits = {
+              cpu    = var.resources.limits.cpu
+              memory = var.resources.limits.memory
+            }
+            requests = {
+              cpu    = var.resources.requests.cpu
+              memory = var.resources.requests.memory
+            }
+          }
+
+          port {
+            name           = "api"
+            container_port = local.api_port
+            protocol       = "TCP"
+          }
+
+          env {
+            name  = "AWS_ACCESS_KEY_ID"
+            value = aws_iam_access_key.telchar_registry.id
+          }
+
+          env {
+            name  = "AWS_SECRET_ACCESS_KEY"
+            value = aws_iam_access_key.telchar_registry.secret
+          }
+
+          volume_mount {
+            mount_path = "/etc/zot/"
+            name       = "config"
+          }
+
+          volume_mount {
+            mount_path = local.certs_mount_path
+            name       = "certs"
+          }
+        }
+
+        volume {
+          name = "config"
+          config_map {
+            name = kubernetes_config_map.config.metadata.0.name
+          }
+        }
+
+        volume {
+          name = "certs"
+          secret {
+            secret_name = local.cert_name
+          }
+        }
+
+        dynamic "toleration" {
+          for_each = var.tolerations
+
+          content {
+            effect   = toleration.value.effect
+            key      = toleration.value.key
+            operator = toleration.value.operator
+            value    = toleration.value.value
+          }
+        }
+      }
+    }
+  }
+}

bootstrap/registry/main.tf

@@ -0,0 +1,98 @@
+locals {
+  service_account = "telchar-registry"
+  name            = "telchar-registry"
+  labels = {
+    role : local.name
+  }
+  api_port         = 5000
+  cert_name        = "telchar-registry"
+  certs_mount_path = "/etc/certs"
+}
+
+provider "aws" {
+  region = var.aws_region
+}
+
+variable "namespace" {
+  type    = string
+  default = "telchar"
+}
+
+variable "aws_region" {
+  type    = string
+  default = "us-west-2"
+}
+
+variable "aws_bucket_name" {
+  type = string
+}
+
+variable "aws_dynamodb_table" {
+  type    = string
+  default = "ZotBlobTable"
+}
+
+variable "replicas" {
+  type    = number
+  default = 2
+}
+
+variable "image" {
+  type = string
+}
+
+variable "resources" {
+  type = object({
+    limits = object({
+      cpu    = string
+      memory = string
+    })
+    requests = object({
+      cpu    = string
+      memory = string
+    })
+  })
+  default = {
+    limits : {
+      cpu : "2",
+      memory : "512Mi"
+    }
+    requests : {
+      cpu : "50m",
+      memory : "512Mi"
+    }
+  }
+}
+
+variable "tolerations" {
+  type = list(object({
+    effect   = string
+    key      = string
+    operator = string
+    value    = optional(string)
+  }))
+  default = [
+    {
+      effect   = "NoSchedule"
+      key      = "demeter.run/compute-profile"
+      operator = "Equal"
+      value    = "general-purpose"
+    },
+    {
+      effect   = "NoSchedule"
+      key      = "demeter.run/compute-arch"
+      operator = "Equal"
+      value    = "arm64"
+    },
+    {
+      effect   = "NoSchedule"
+      key      = "demeter.run/availability-sla"
+      operator = "Equal"
+      value    = "consistent"
+    }
+  ]
+}
+
+variable "hostname" {
+  type = string
+}

bootstrap/registry/monitor.tf

@@ -0,0 +1,27 @@
+resource "kubernetes_manifest" "telchar_registry_monitor" {
+  depends_on = [kubernetes_namespace.namespace]
+
+  manifest = {
+    apiVersion = "monitoring.coreos.com/v1"
+    kind       = "PodMonitor"
+    metadata = {
+      labels = {
+        "app.kubernetes.io/component" = "o11y"
+        "app.kubernetes.io/part-of"   = "telchar"
+      }
+      name      = local.name
+      namespace = var.namespace
+    }
+    spec = {
+      selector = {
+        matchLabels = local.labels
+      }
+      podMetricsEndpoints = [
+        {
+          port = "api",
+          path = "/metrics"
+        }
+      ]
+    }
+  }
+}

bootstrap/registry/namespace.tf

@@ -0,0 +1,5 @@
+resource "kubernetes_namespace" "namespace" {
+  metadata {
+    name = var.namespace
+  }
+}

bootstrap/registry/rbac.tf

@@ -0,0 +1,63 @@
+resource "aws_iam_policy" "telchar_registry_policy" {
+  depends_on = [
+    aws_s3_bucket.this,
+  ]
+
+  name        = "TelcharRegistryPolicy"
+  path        = "/"
+  description = "Allows full access to Telchar S3 Bucket."
+  policy = jsonencode({
+    Version = "2012-10-17",
+    Statement = [
+      {
+        Effect = "Allow",
+        Action = [
+          "s3:ListBucket",
+          "s3:GetBucketLocation",
+          "s3:ListBucketMultipartUploads"
+        ],
+        Resource = [
+          aws_s3_bucket.this.arn,
+        ],
+      },
+      {
+        Effect = "Allow",
+        Action = [
+          "s3:PutObject",
+          "s3:GetObject",
+          "s3:DeleteObject",
+          "s3:ListMultipartUploadParts",
+          "s3:AbortMultipartUpload"
+        ],
+        Resource = [
+          "${aws_s3_bucket.this.arn}/*",
+        ],
+      },
+      {
+        Effect = "Allow"
+        Action = [
+          "dynamodb:CreateTable",
+          "dynamodb:DeleteItem",
+          "dynamodb:DescribeTable",
+          "dynamodb:GetItem",
+          "dynamodb:UpdateItem",
+          "dynamodb:Scan",
+        ]
+        Resource : "*"
+      }
+    ],
+  })
+}
+
+resource "aws_iam_user" "telchar_registry" {
+  name = local.name
+}
+
+resource "aws_iam_user_policy_attachment" "this" {
+  user       = aws_iam_user.telchar_registry.name
+  policy_arn = aws_iam_policy.telchar_registry_policy.arn
+}
+
+resource "aws_iam_access_key" "telchar_registry" {
+  user = aws_iam_user.telchar_registry.name
+}