Overview
Deployed and supported. The fields and commands described here are stable within version v1alpha1.
Each tenant has a private OCI image registry, at <cluster>.registry.dev.stackngo.fr: the host carries the name of the cluster where your
tenant lives (for example ovh-gra-0.registry.dev.stackngo.fr), the one sng config use-cluster selects. Each cluster has
its own registry: there is no replication, an image is pushed to the registry of every cluster
that deploys it, and an App only pulls from the registry of its own cluster.
You push your applications' images there with docker, sng registry or any
OCI client, and your App resources pull them from the same registry.
In short
sng registry create web # 1. declare the repository (RegistryRepository manifest)
sng registry login # 2. docker uses your session, without a password
docker build -t ovh-gra-0.registry.dev.stackngo.fr/acme/web:1.0.0 .
docker push ovh-gra-0.registry.dev.stackngo.fr/acme/web:1.0.0
The image can then be addressed as ovh-gra-0.registry.dev.stackngo.fr/acme/web:1.0.0, where acme is
your tenant.
The notions
| Notion | What it is | Where it is described |
|---|---|---|
| Image | ovh-gra-0.registry.dev.stackngo.fr/<tenant>/<repository>:<tag> | Push and pull |
| Repository | A name declared by a RegistryRepository manifest. Without a declaration, the registry refuses all access, even with all rights | Repositories and retention |
| Rights | Actions registry:pull, registry:push, registry:delete on repository/<repository>, granted by the tenant's policies | Identity and access |
| Access key | A machine credential (RegistryAccessKey) limited to repositories and to pull / push, so that your App resources pull your private images; with ci: true, readable by an application of the tenant (a CI job, for example) | Registry access keys |
| Retention | The tags to keep (last N, N days, patterns); the rest is erased automatically | Repositories and retention |
Three ways to authenticate
| Who | Username | Password | Typical use |
|---|---|---|---|
| You, on your machine | managed by sng registry login | your tenant session, renewed automatically | docker push, docker pull, sng registry |
| An access key | accesskey/<tenant>/<name> | generated and renewed by the platform | imagePullSecrets of an App; environment variables of an App if ci: true |
| Nobody | none | none | pull from a repository declared public: true |
There is no registry-specific password: an sng session is enough, and its rights
are those of your policies.
Who can do what
The tenant's managed policies cover the common cases:
| Policy | registry:pull | registry:push | registry:delete |
|---|---|---|---|
readonly | yes | no | no |
readwrite | yes | yes | yes |
admin | yes | yes | yes |
For finer-grained settings (for example push on a single repository), write a policy with the
resource repository/<repository>; see Identity and access.
Declaring a repository or an access key goes through sng apply, hence through the deploy:write action.
Limitations of this version
- A repository is a single name under the tenant:
acme/webis valid,acme/web/cacheis not. - No web interface for the registry.
- The registry does not scan images for vulnerabilities yet;
sng registry buildscans them on your machine withtrivy(seesng registry build). - Immediate rotation of an access key is not available yet; periodic rotation is (Registry access keys).