64 lines
3.3 KiB
Markdown
64 lines
3.3 KiB
Markdown
# Quay Helm chart
|
|
|
|
This chart runs the official Project Quay image and owns the registry
|
|
Deployment, repository-mirror Deployment, Service, Ingress, and probes. It can
|
|
also deploy PostgreSQL and Valkey through optional Bitnami subcharts. It does
|
|
not create a second container image.
|
|
|
|
An S3-compatible object store and bucket are required. Provision them outside
|
|
this chart, then create a private `config.yaml` using
|
|
[`config.yaml.example`](config.yaml.example). The file includes the database
|
|
URI, S3 credentials, Redis credentials, and two persistent Quay encryption
|
|
keys. Keep all of those out of Helm values and public Git. Store the file in a
|
|
Secret in the release namespace (here, `quay`):
|
|
|
|
```sh
|
|
kubectl -n quay create secret generic quay-config --from-file=config.yaml
|
|
```
|
|
|
|
Set `quay.configSecretName` to that Secret name. For an existing installation,
|
|
preserve its `SECRET_KEY`, `DATABASE_SECRET_KEY`, bucket, and database records.
|
|
The chart never creates or deletes S3 objects or buckets.
|
|
|
|
Choose exactly one database arrangement:
|
|
|
|
- **Embedded PostgreSQL:** set `postgresql.enabled=true`. Use a durable storage
|
|
class and stable `postgresql.auth.existingSecret`; the `database-password`
|
|
key must match the password in Quay's `DB_URI`.
|
|
- **CloudNativePG:** set `cloudNativePG.enabled=true` and install the operator
|
|
and its CRDs first. With `cloudNativePG.create=true`, this chart creates a
|
|
`Cluster` named by `cloudNativePG.name`; configure its storage and the
|
|
`DB_URI` to use `<name>-rw` in the release namespace. With `create=false`,
|
|
manage that Cluster independently (useful for database-first migrations).
|
|
The operator's generated `<name>-app` Secret contains the application
|
|
username and password. Put the same credentials in the private Quay config.
|
|
For a fresh operator-managed installation, first install with
|
|
`quay.enabled=false`, `repomirror.enabled=false`, and `ingress.enabled=false`;
|
|
wait for the Cluster and generated app Secret, create the private Quay config
|
|
Secret, then enable Quay and its Ingress in a second upgrade.
|
|
- **External/shared PostgreSQL:** leave both switches false and point the
|
|
`DB_URI` at your own server. The chart does not manage its data or users.
|
|
|
|
Never enable both embedded PostgreSQL and CloudNativePG. No database password
|
|
is placed in Helm values. The chart does not migrate an existing database;
|
|
perform a stopped-writer dump and restore before changing Quay's `DB_URI`.
|
|
Likewise, `valkey.enabled=true` installs a cache; keep the Redis hosts and
|
|
password in `config.yaml` aligned with either that subchart or your external
|
|
cache. Both dependencies are independently optional.
|
|
|
|
Published releases are available from the indexed Helm repository:
|
|
|
|
```sh
|
|
helm repo add brunner.ninja https://brunner.ninja/charts
|
|
helm repo update brunner.ninja
|
|
helm upgrade --install quay brunner.ninja/quay --namespace quay --create-namespace \
|
|
--values values.yaml --wait --timeout 15m
|
|
```
|
|
|
|
For local development, add the Bitnami chart repository, run
|
|
`helm dependency build chart/quay`, then `bash chart/test.sh`. Chart package
|
|
versions derive from the actual Quay Git
|
|
release tag with `git describe`; `Chart.yaml.appVersion` is the tested upstream
|
|
image version. Homelab-specific values are in
|
|
[`homelab-gitops/apps/quay`](https://code.brunner.ninja/feedc0de/homelab-gitops/src/branch/main/apps/quay).
|