The Kubernetes-native platform (v2).
The Package manager for Kubernetes.
The Kubernetes-native Service Broker.
Deis Workflow's builder component relies on a registry for storing application docker images.
Deis Workflow ships with a registry component by default, which provides an in-cluster Docker registry backed by the platform-configured object storage. Operators might want to use an off-cluster registry for performance or security reasons.
Every component that relies on a registry uses two inputs for configuration:
The Helm chart for Deis Workflow can be easily configured to connect Workflow components to off-cluster registry. Deis Workflow supports external registries which provide either short-lived tokens that are valid only for a specified amount of time or long-lived tokens (basic username/password) which are valid forever for authenticating to them. For those registries which provide short lived tokens for authentication, Deis Workflow will generate and refresh them such that the deployed apps will only have access to the short-lived tokens and not to the actual credentials for the registries.
When using a private registry the docker images are no longer pulled by Deis Workflow Controller but rather are managed by Kubernetes. This will increase security and overall speed, however the
port information can no longer be discovered. Instead the
port information can be set via
deis config:set PORT=<port> prior to deploying the application.
Deis Workflow currently supports:
helm inspect values deis/workflow > values.yaml
registry_locationparameter to reference the registry location you are using:
You are now ready to
helm install deis/workflow --namespace deis -f values.yaml using your desired registry.
Here we show how the relevant parts of the fetched
values.yaml file might look like after configuring for a particular off-cluster registry:
global: ... registry_location: "ecr" ... registry-token-refresher: # Time in minutes after which the token should be refreshed. # Leave it empty to use the default provider time. token_refresh_time: "" ... ecr: # Your AWS access key. Leave it empty if you want to use IAM credentials. accesskey: "ACCESS_KEY" # Your AWS secret key. Leave it empty if you want to use IAM credentials. secretkey: "SECRET_KEY" # Any S3 region region: "us-west-2" registryid: "" hostname: "" ...
hostname should not be set. See this issue for more info.
global: ... registry_location: "gcr" ... registry-token-refresher: # Time in minutes after which the token should be refreshed. # Leave it empty to use the default provider time. token_refresh_time: "" ... gcr: key_json: <base64-encoded JSON data> hostname: ""
hostname should be left empty.
After following the docs and creating a registry, e.g.
myregistry, with its corresponding login server of
myregistry.azurecr.io, the following values should be supplied:
global: ... registry_location: "off-cluster" ... registry-token-refresher: ... off_cluster_registry: hostname: "myregistry.azurecr.io" organization: "myorg" username: "myusername" password: "mypassword" ...
Note: The mandatory organization field (here
myorg) will be created as an ACR repository if it does not already exist.
global: ... registry_location: "off-cluster" ... registry-token-refresher: ... off_cluster_registry: hostname: "quay.io" organization: "myorg" username: "myusername" password: "mypassword" ...