Kubernetes

# Create registry — storage class and region as with Object Storage
entronyx registry create prod \
  --region fra1 --class standard --quota 250
 
# Robot account with read access only, for the nodes of the cluster
entronyx registry robot create ci-pull \
  --registry prod --scope "repo:*:pull" --ttl 90d
 
# Check rule: images with critical vulnerability are not delivered
entronyx registry policy set prod \
  --scan-on-push --block-severity critical --block-unscanned
 
# Retention: the last 10 versions per repository remain,
# untagged manifests are dropped after 7 days
entronyx registry retention set prod \
  --keep-latest 10 --keep-tagged "v*,release-*" \
  --purge-untagged-after 7d --archive-after 180d
 
# Mirror for a public registry — pulls run via us afterwards
entronyx registry mirror add prod \
  --upstream docker.io --cache-ttl 24h
 
# Store robot account credentials as imagePullSecret in the cluster
entronyx registry robot token ci-pull --registry prod --format docker \
  | kubectl create secret generic entronyx-registry \
      --namespace produktion --type kubernetes.io/dockerconfigjson \
      --from-file=.dockerconfigjson=/dev/stdin

apiVersion: v1
kind: Secret
metadata:
  name: entronyx-registry
  namespace: production
type: kubernetes.io/dockerconfigjson
stringData:
  # Generated with: entronyx registry robot token ci-pull --format docker
  .dockerconfigjson: |
    { "auths": { "prod.registry.entronyx.cloud": { "auth": "<base64>" } } }
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: default
  namespace: production
# The service account pulls the secret for all pods in the namespace,
# so that it does not have to be repeated in every deployment
imagePullSecrets:
  - name: entronyx-registry
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: web
  namespace: production
spec:
  template:
    spec:
      containers:
        - name: web
          image: prod.registry.entronyx.cloud/team/web:1.8.2
        # The mirror replaces the public registry: the same line,
        # different origin, no rate limiting in the rollout
        - name: cache
          image: prod.registry.entronyx.cloud/mirror/library/valkey:8