Page MenuHomePhabricator

Set up docker-registry (harbor) in toolsbeta
Open, In Progress, HighPublic

Description

For testing and building out the CD pipeline in toolsbeta, we need to have a separate docker-registry hosted by harbor.

Event Timeline

Mentioned in SAL (#wikimedia-cloud) [2020-11-10T18:27:06Z] <legoktm> creating toolsbeta-docker-imagebuilder-01 (T267616)

Andrew triaged this task as Medium priority.Dec 8 2020, 5:38 PM
Andrew moved this task from Inbox to Doing on the cloud-services-team (Kanban) board.

Change 707572 had a related patch set uploaded (by Bstorm; author: Bstorm):

[operations/puppet@production] toolforge harbor: puppetize experimental base server for harbor

https://gerrit.wikimedia.org/r/707572

Change 707572 merged by Bstorm:

[operations/puppet@production] toolforge harbor: puppetize experimental base server for harbor

https://gerrit.wikimedia.org/r/707572

Ok, so I have a very nice https://goharbor.io server running in toolsbeta (using independent database auth for testing) https://harbor.toolsbeta.wmflabs.org
It has APIs for adding just about everything and has robot auth, etc. It grant plenty of flexibility for image management (even quotas).

It hooks up to LDAP, but that's not necessarily helpful here. I think to do this right, users need to not have direct push rights. That needs to be handled by another build service. However, with this, that service can easily run in k8s.

Bstorm raised the priority of this task from Medium to High.Sep 15 2021, 4:25 PM

In order to deploy this to tools soon, I'm proposing replacing tools-docker-registry with harbor running in k8s. However, unless we deploy cinder for k8s, we'll be doing that with NFS storage.

I've deployed harbor in toolsbeta, however, I want to modify the deployment a bit before replacing docker-registry with it or putting it in tools.

Change 722664 had a related patch set uploaded (by Bstorm; author: Bstorm):

[operations/puppet@production] toolforge harbor: install clients for redis and postgres

https://gerrit.wikimedia.org/r/722664

Change 722664 merged by Bstorm:

[operations/puppet@production] toolforge harbor: install clients for redis and postgres

https://gerrit.wikimedia.org/r/722664

Change 725048 had a related patch set uploaded (by Bstorm; author: Bstorm):

[operations/puppet@production] toolforge harbor: add external postgres db

https://gerrit.wikimedia.org/r/725048

Using trove for Postgres in the most recent iteration is terrible. You cannot control it much, and it doesn't actually allow you access to the Postgres account to create a database. This means you can have exactly one database and user. I doubt the replication still works as well. Maybe it will be improved as they settle in to their more containerized setup.

Change 725048 merged by Bstorm:

[operations/puppet@production] toolforge harbor: add external postgres db

https://gerrit.wikimedia.org/r/725048

Change 726723 had a related patch set uploaded (by Bstorm; author: Bstorm):

[operations/puppet@production] toolforge postgres: drop database tuning

https://gerrit.wikimedia.org/r/726723

Change 726723 merged by Bstorm:

[operations/puppet@production] toolforge postgres: drop database tuning

https://gerrit.wikimedia.org/r/726723

Change 727638 had a related patch set uploaded (by Bstorm; author: Bstorm):

[operations/puppet@production] toolforge harbor: dockerize the config file and such

https://gerrit.wikimedia.org/r/727638

Change 727638 merged by Bstorm:

[operations/puppet@production] toolforge harbor: puppetize the install/compose config file and such

https://gerrit.wikimedia.org/r/727638

Change 728560 had a related patch set uploaded (by Bstorm; author: Bstorm):

[operations/puppet@production] toolforge harbor: change the permissions a bit on the dir

https://gerrit.wikimedia.org/r/728560

Change 728560 merged by Bstorm:

[operations/puppet@production] toolforge harbor: change the permissions a bit on the dir

https://gerrit.wikimedia.org/r/728560

Change 728566 had a related patch set uploaded (by Bstorm; author: Bstorm):

[operations/puppet@production] toolforge harbor: install docker-compose with puppet

https://gerrit.wikimedia.org/r/728566

Change 728566 merged by Bstorm:

[operations/puppet@production] toolforge harbor: install docker-compose with puppet

https://gerrit.wikimedia.org/r/728566

Change 728578 had a related patch set uploaded (by Bstorm; author: Bstorm):

[operations/puppet@production] toolforge harbor: add small customization to prepare script here

https://gerrit.wikimedia.org/r/728578

Change 728578 abandoned by Bstorm:

[operations/puppet@production] toolforge harbor: add small customization to prepare script here

Reason:

changing approach

https://gerrit.wikimedia.org/r/728578

Change 728581 had a related patch set uploaded (by Bstorm; author: Bstorm):

[operations/puppet@production] toolforge harbor: clean up the certs setup a bit better

https://gerrit.wikimedia.org/r/728581

Change 728581 merged by Bstorm:

[operations/puppet@production] toolforge harbor: clean up the certs setup a bit better

https://gerrit.wikimedia.org/r/728581

Change 728629 had a related patch set uploaded (by Bstorm; author: Bstorm):

[operations/puppet@production] toolforge harbor: update certs with acmechief

https://gerrit.wikimedia.org/r/728629

dcaro renamed this task from Set up docker-registry and image builder infra in toolsbeta to Set up docker-registry (harbor) in toolsbeta.Oct 18 2021, 2:13 PM
dcaro claimed this task.
dcaro edited projects, added Toolforge Build Service; removed Toolforge.
dcaro updated the task description. (Show Details)
dcaro added a subscriber: Bstorm.
dcaro changed the task status from Open to In Progress.Apr 14 2022, 8:37 AM
dcaro moved this task from To refine to Doing on the User-dcaro board.