Container registry add-on

Status: Implemented Issue: none Parent: GitLab components

Goal

An administrator turns on the GitLab container registry for an instance, in the resource or in the Bridge UI, with the storage and the metadata database it needs to work, and without writing chart values. For the design, see ADR 40.

Requirements

  • spec.components.registry.enabled turns the container registry on. Leaving the entry out keeps the registry off, unless spec.chart.values turn it on.
  • spec.components.registry.storage.secretRef references the Secret holding the storage configuration of the registry, in the format of the chart. It is required while the registry is on.
  • spec.components.registry.database is the connection to the metadata database of the registry: a host, a port that defaults to 5432, a database and a username that default to registry, and a password Secret. It is required while the registry is on, and so are its host and its password Secret.
  • No storage configuration, password, or connection is stored in the resource.
  • The Operator creates neither the database nor its role.
  • The form shows the registry as the Container Registry add-on. Its enable switch unlocks a storage group and a metadata database group, each all-or-nothing and reported before any request is sent.

Out of scope

  • Provisioning the storage bucket, the database, or its role.
  • TLS to the metadata database, the registry Redis cache, and every other registry setting. They stay reachable through spec.chart.values.
  • Migrating an existing registry to the metadata database.

FAQ

  • Why is the metadata database required? The requester asked for it. GitLab recommends the metadata database for new registries, and some registry features need it.
  • Why a connection of its own, rather than the instance’s PostgreSQL server? The requester asked for a full connection. It also keeps the registry from inheriting a password it does not share.
  • Why is the registry an add-on rather than a component switch? A switch alone deploys a registry with no storage, which does not work. The registry needs settings of its own.
  • Is this the Artifact Central add-on? No. Artifact Central is a separate product, and its add-on stays a disabled placeholder.