diff --git a/site/content/docs/latest/howto/private-app-repository.md b/site/content/docs/latest/howto/private-app-repository.md index 5dc2a126052..c88842c7b23 100644 --- a/site/content/docs/latest/howto/private-app-repository.md +++ b/site/content/docs/latest/howto/private-app-repository.md @@ -1,220 +1,248 @@ # Using a Private Repository with Kubeapps -It is possible to use a private Helm repository to store your own Helm charts and deploy them using Kubeapps. In this guide we will show how you can do that with some of the solutions available right now: +## Table of Contents -- [ChartMuseum](#chartmuseum) -- [Harbor](#harbor) -- [Artifactory](#artifactory) (Pro) +1. [Introduction](#introduction) +2. [Harbor](#harbor) +3. [OCI registry](#oci-registry) +4. [ChartMuseum](#chartmuseum) +5. [Artifactory](#artifactory) -But first, a note about Kubeapps AppRepository resources: +## Introduction -## Per Namespace Package Repositories +It is possible to use a **private repository** to store your own packages and deploy them by using Kubeapps. -Previously, once an Package Repository was created in Kubeapps, the charts indexed by that repository were then available cluster-wide to all Kubeapps users. This was changed in Kubeapps 1.10 to allow creating Package Repositories that are available only in specific namespaces, which is more inline with the Kubernetes RBAC model where an account can have roles in specific namespaces. This change also enables Kubeapps to support deploying charts with images from private docker registries (more below). +This guide explains in detail the process to install and configure a private package repository with Kubeapps by using different registries like **Harbor**, any **OCI registry**, **ChartMuseum** or **Artifactory**. -A Kubeapps AppRepository can be created by anyone with the required RBAC for that namespace. If you have cluster-wide RBAC for creating AppRepositories, you can still create an Package Repository whose charts will be available to users in all namespaces by selecting "All Namespaces" when creating the repository. +> For detailed information on working with package repositories in Kubeapps, please review the following tutorial: [Managing Packaging Repositories with Kubeapps](../tutorials/managing-package-repositories.md). -To give a specific user `USERNAME` the ability to create Package Repositories in a specific namespace named `custom-namespace`, grant them both read and write RBAC for AppRepositories in that namespace: +## Harbor -```bash -kubectl -n custom-namespace create rolebinding username-apprepositories-read --user $USERNAME --clusterrole kubeapps:$KUBEAPPS_NAMESPACE:apprepositories-read -kubectl -n custom-namespace create rolebinding username-apprepositories-write --user $USERNAME --clusterrole kubeapps:$KUBEAPPS_NAMESPACE:apprepositories-write -``` +[Harbor](https://goharbor.io/) is an open source registry that secures artifacts with policies and role-based access control, ensures images are scanned and free from vulnerabilities, and signs images as trusted. Harbor, a [CNCF](https://cncf.io/) Graduated project, delivers compliance, performance, and interoperability to help you consistently and securely manage artifacts across cloud native compute platforms like Kubernetes. -or to allow other users the ability to deploy charts from Package Repositories in a specific namespace, grant the read access only. +This guide covers the installation of Harbor in the cluster, the addition of packages to the registry and the configuration, as a private repository, in Kubeapps. -## Associating docker image pull secrets to an AppRepository +1. [Installation](#harbor-installation) +2. [Add a package](#harbor-add-a-package-helm-chart) +3. [Configuration in Kubeapps](#harbor-configure-the-repository-in-kubeapps) -When creating an AppRepository in Kubeapps, you can now additionally choose (or create) an [imagePullSecret](https://kubernetes.io/docs/concepts/containers/images/#specifying-imagepullsecrets-on-a-pod) to be associated with the AppRepository: +### Harbor: Installation -![AppRepository with imagePullSecret](../img/app-repo-pull-secret.png) -![AppRepository with imagePullSecret](../img/app-repo-pull-secret-2.png) +> **NOTE**: This section can safely be skipped if you already have a Harbor registry accessible from your cluster. -When Kubeapps deploys any chart from this AppRepository, if a referenced docker image within the chart is from a docker registry server matching one of the secrets associated with the AppRepository, then Kubeapps with Helm 3 will automatically append the corresponding imagePullSecret so that image can be pulled from the private registry. Note that the user deploying the chart will need to be able to read secrets in that namespace, which is usually the case when deploying to a namespace. +To install a Harbor registry in the cluster: -There will be further work to enable private AppRepositories to be available in multiple namespaces. Details about the design can be read on the [design document](https://docs.google.com/document/d/1YEeKC6nPLoq4oaxs9v8_UsmxrRfWxB6KCyqrh2-Q8x0/edit?ts=5e2adf87). +1. Deploy the [Bitnami Harbor Helm chart](https://github.com/bitnami/charts/tree/master/bitnami/harbor) from the `bitnami` repository by using Kubeapps. -## Filter applications + Alternatively, you can deploy Harbor using [Harbor offline installer](https://goharbor.io/docs/2.6.0/install-config/download-installer/). -Since Kubeapps 2.3, it's possible to limit the number of packages that Kubeapps will expose to the users of an Application Repository. For doing so, edit the filter field of the form: + ![Harbor chart](../img/harbor-chart.png) -![AppRepository with filter](../img/apprepo-form-filter.png) +2. Update the following parameter in the deployment values: -- If "Exclude Packages" is marked, all the applications matching the given names will be excluded. -- If "Regular Expression" is marked, rather than treating the input as a comma-separated list of application names, it will be treated as a [PCRE regex](https://stedolan.github.io/jq/manual/#RegularexpressionsPCRE). This can be used when the name of the application is not known or when you want to filter different applications with the same name. +- `service.tls.enabled`: Set to `false` to deactivate the TLS settings. Alternatively, you can provide a valid TSL certificate (check [Bitnami Harbor Helm chart documentation](https://github.com/bitnami/charts/tree/master/bitnami/harbor#parameters) for more information). -### Advanced filtering + ![Harbor Deploy Form](../img/harbor-deploy-form.png) -> **NOTE**: This is not supported by the Kubeapps Dashboard. +3. Deploy the chart and wait for it to be ready. -In case you want to add a custom filter, based on a metadata field different than the name, it's possible to specify a [jq](https://stedolan.github.io/jq/) query to filter applications. This is only available when manually creating the AppRepository manifest. In this example, we are filtering applications that contain "Bitnami" as one of the maintainers: + ![Harbor chart ready](../img/harbor-ready.png) -```yaml -apiVersion: kubeapps.com/v1alpha1 -kind: AppRepository -metadata: - name: my-repo - namespace: kubeapps -spec: - url: https://my.charts.com/ - filterRule: - jq: .maintainers | any(.name == "Bitnami") -``` + > **Note**: By default, Harbor deploys ChartMuseum to store charts. If you deactivate it, you can still use the Harbor OCI registry to upload charts. Check out the [OCI](#oci-registry) section for more information. -> **Caveat**: Only the latest version of the chart is evaluated. +### Harbor: Add a package (Helm chart) -## ChartMuseum +> **NOTE**: This section can safely be skipped if you already have a Harbor registry accessible from your cluster with packages stored. -[ChartMuseum](https://chartmuseum.com) is an open-source Helm Chart Repository written in Go (Golang), with support for cloud storage backends, including Google Cloud Storage, Amazon S3, Microsoft Azure Blob Storage, Alibaba Cloud OSS Storage and OpenStack Object Storage. +1. First, create a Helm chart package: -To use ChartMuseum with Kubeapps, first deploy its Helm chart from the `stable` repository: +```console +$ helm package /path/to/my/chart +Successfully packaged chart and saved it to: /path/to/my/chart/my-chart-1.0.0.tgz +``` -![ChartMuseum Chart](../img/chartmuseum-chart.png) +2. Second, login into Harbor admin portal following the instructions in the chart notes: -In the deployment form we should change at least two things: +```console +1. Get the Harbor URL: -- `env.open.DISABLE_API`: We should set this value to `false` so we can use the ChartMuseum API to push new charts. -- `persistence.enabled`: We will set this value to `true` to enable persistence for the charts we store. Note that this will create a [Kubernetes Persistent Volume Claim](https://kubernetes.io/docs/concepts/storage/persistent-volumes/#lifecycle-of-a-volume-and-claim) so depending on your Kubernetes provider you may need to manually allocate the required Persistent Volume to satisfy the claim. Some Kubernetes providers will automatically create PVs for you so setting this value to `true` will be enough. + echo "Harbor URL: https://127.0.0.1:8080/" + kubectl port-forward --namespace default svc/my-harbor 8080:80 & -![ChartMuseum Deploy Form](../img/chartmuseum-deploy-form.png) +2. Login with the following credentials to see your Harbor application -### ChartMuseum: Upload a Chart + echo Username: "admin" + echo Password: $(kubectl get secret --namespace default my-harbor-core-envvars -o jsonpath="{.data.HARBOR_ADMIN_PASSWORD}" | base64 --decode) +``` -Once ChartMuseum is deployed you will be able to upload a chart. In one terminal open a port-forward tunnel to the application: +3. Create a new Project named **my-helm-repo**. Each project will serve as a Package repository (in this example, a Helm chart repository). -```console -$ export POD_NAME=$(kubectl get pods --namespace default -l "app=chartmuseum" -l "release=my-chartrepo" -o jsonpath="{.items[0].metadata.name}") -$ kubectl port-forward $POD_NAME 8080:8080 --namespace default -Forwarding from 127.0.0.1:8080 -> 8080 -Forwarding from [::1]:8080 -> 8080 -``` +![Harbor new project](../img/harbor-new-project.png) -And in a different terminal you can push your chart: +- It is possible to configure Harbor to use HTTP basic authentication if you set the `Access Level` of the project to `non public`. This enforces authentication to access the packages in the repository from an external client (Helm CLI, Kubeapps or any other). -```console -$ helm package /path/to/my/chart -Successfully packaged chart and saved it to: /path/to/my/chart/my-chart-1.0.0.tgz -curl --data-binary "@my-chart-1.0.0.tgz" http://localhost:8080/api/charts -{"saved":true} -``` +4. Click the project name to view the project details page, then click **Helm Charts** tab to list all helm charts. -### ChartMuseum: Configure the repository in Kubeapps +![Harbor list charts](../img/harbor-list-charts.png) -To add your private repository to Kubeapps, select the Kubernetes namespace to which you want to add the repository (or "All Namespaces" if you want it available to users in all namespaces), go to `Configuration > Package Repositories` and click on "Add Package Repository". You will need to add your repository using the Kubernetes DNS name for the ChartMuseum service. This will be `-chartmuseum.:8080`: +5. Click **Upload** button to upload the Helm chart you previously created. You can also use the `helm` command to upload the chart too. -![ChartMuseum Package Repository](../img/chartmuseum-repository.png) +![Harbor upload chart](../img/harbor-upload-chart.png) -Once you create the repository you can click on the link for the specific repository and you will be able to deploy your own applications using Kubeapps. +> Please refer to ['Manage Helm Charts in Harbor'](https://goharbor.io/docs/2.6.0/working-with-projects/working-with-images/managing-helm-charts) for more details. -### ChartMuseum: Authentication/Authorization +### Harbor: Configure the repository in Kubeapps -It is possible to configure ChartMuseum to use authentication with two different mechanisms: +To add Harbor as a private chart repository in Kubeapps: -- Using HTTP [basic authentication](https://chartmuseum.com/docs/#basic-auth) (user/password). To use this feature, it's needed to: - - Specify the parameters `secret.AUTH_USER` and `secret.AUTH_PASS` when deploying the ChartMuseum. - - Select `Basic Auth` when adding the repository to Kubeapps specifying that user and password. -- Using a [JWT token](https://github.com/chartmuseum/auth-server-example). Once you obtain a valid token you can select `Bearer Token` in the form and add the token in the dedicated field. +1. Select the Kubernetes namespace to which you want to add the repository (or "All Namespaces" if you want it available to users in all namespaces). -## Harbor +2. Next, go to **Configuration > Package Repositories** and click on **Add Package Repository**. -[Harbor](https://github.com/goharbor/harbor) is an open source trusted cloud native registry project that stores, signs, and scans content, e.g. Docker images. Harbor is hosted by the [Cloud Native Computing Foundation](https://cncf.io/). Since version 1.6.0, Harbor is a composite cloud native registry which supports both container image management and Helm chart management. Harbor integrates [ChartMuseum](https://chartmuseum.com) to provide the Helm chart repository functionality. The access to Helm Charts in a Harbor Chart Repository can be controlled via Role-Based Access Control. +3. Complete the configuration form displayed: -To use Harbor with Kubeapps, first deploy the [Bitnami Harbor Helm Chart](https://github.com/bitnami/charts/tree/master/bitnami/harbor) from the `bitnami` repository (alternatively you can deploy Harbor using [Harbor offline installer](https://goharbor.io/docs/2.5.0/install-config/download-installer/)): +- `Name`: Repository name in Kubeapps. +- `URL`: Harbor repository URL (in this example: `http://harbor.default.svc.cluster.local/chartrepo/my-helm-repo`). +- `Description`: Info displayed in Kubeapps for details about the repository. +- `Packaging format`: Select the format of packages in the repository (Helm, Helm via Flux, Carvel) +- `Scope`: may be either **global** (cluster﹣wide) or **namespace﹣scoped**, in which case only users with access to that namespace will have access to the repository. +- `Package storage type`: Helm repository or OCI registry. -![Harbor Chart](../img/harbor-chart.png) +For private repositories, the Authentication method must be provided. In this case select: -In the deployment form we should change the parameter below: +- `Basic Auth` (for `Repository Authorization` field under the `Authorization` tab) and specify the username and password for Harbor. -- `service.tls.enabled`: We should set this value to `false` so we don't need to configure the TLS settings. Alternatively, you can provide valid TSL certificates (check [Bitnami Harbor Helm Chart documentation](https://github.com/bitnami/charts/tree/master/bitnami/harbor#parameters) for more information). +![Harbor private registry](../img/harbor-private-registry.png) -![Harbor Deploy Form](../img/harbor-deploy-form.png) +Once configured, you will be able to browse and deploy your own applications from the private Harbor registry by using Kubeapps (and see the chart you uploaded in the previous step). -Deploy the chart and wait for it to be ready. +## OCI Registry + +It is also possible to use an [OCI compliant registry](https://github.com/opencontainers/distribution-spec) to store packages. -![Harbor Chart Ready](../img/harbor-ready.png) +Cloud Providers like [Amazon ECR](https://aws.amazon.com/blogs/containers/oci-artifact-support-in-amazon-ecr/), [Google Artifact Registry](https://cloud.google.com/artifact-registry/docs/supported-formats) or [Azure ACR](https://docs.microsoft.com/en-us/azure/container-registry/container-registry-image-formats) have also added support for OCI artifacts. + +You can add an OCI registry like any other repository. For example, for a [Harbor registry](https://goharbor.io/docs/2.5.0/working-with-projects/working-with-images/managing-helm-charts/#manage-helm-charts-with-the-oci-compatible-registry-of-harbor): -**Note**: By default, Harbor deploys ChartMuseum to store charts. If you deactivate it, you can still use the Harbor OCI registry to upload charts. Check out the [OCI](#oci-registry) section for more information. +![OCI registry](../img/oci-registry.png) -### Harbor: Upload a Chart +**NOTE:** There is one caveat though. It is necessary to specify the list of applications (repositories) that the registry contains. This is because the OCI specification doesn't have an endpoint to discover artifacts (unlike the index.yaml file of a Helm repository). -First create a Helm chart package: +In any case, it's possible to use the registry provider API to retrieve this list. For example, for Harbor, it's possible to query its API to retrieve the list: ```console -$ helm package /path/to/my/chart -Successfully packaged chart and saved it to: /path/to/my/chart/my-chart-1.0.0.tgz +curl -X GET "https://harbor.domain/api/v2.0/projects/my-oci-registry/repositories" -H "accept: application/json" | jq 'map(.name) | join(", ")' ``` -Second login Harbor admin portal following the instructions in the chart notes: +> **Note**: Substitute the domain `harbor.domain` and the project name `my-oci-registry` with your own. +> Also, if the repository is not public, you can use `-u username:password` to retrieve the same list. -```console -1. Get the Harbor URL: +## ChartMuseum - echo "Harbor URL: https://127.0.0.1:8080/" - kubectl port-forward --namespace default svc/my-harbor 8080:80 & +[ChartMuseum](https://chartmuseum.com) is an open-source Helm chart repository written in Go (Golang), with support for cloud storage backends, including Google Cloud Storage, Amazon S3, Microsoft Azure Blob Storage, Alibaba Cloud OSS Storage and OpenStack Object Storage. -2. Login with the following credentials to see your Harbor application +This guide covers the installation of ChartMuseum in the cluster, the addition of packages to the registry and the configuration as a private repository in Kubeapps. - echo Username: "admin" - echo Password: $(kubectl get secret --namespace default my-harbor-core-envvars -o jsonpath="{.data.HARBOR_ADMIN_PASSWORD}" | base64 --decode) -``` +1. [Installation](#chartmuseum-installation) +2. [Upload a chart](#chartmuseum-upload-a-chart) +3. [Authentication/Authorization](#chartmuseum-authenticationauthorization) +4. [Configuration in Kubeapps](#chartmuseum-configure-the-repository-in-kubeapps) -Create a new Project named 'my-helm-repo' with public access. Each project will serve as a Helm chart repository. +### ChartMuseum: Installation -![Harbor new project](../img/harbor-new-project.png) +> **NOTE**: This section can safely be skipped if you already have ChartMuseum installed and accessible from your cluster. -Click the project name to view the project details page, then click 'Helm Charts' tab to list all helm charts. +To use ChartMuseum with Kubeapps: -![Harbor list charts](../img/harbor-list-charts.png) +1. First configure a public repo in Kubeapps to deploy its Helm chart from the `stable` repository: -Click 'UPLOAD' button to upload the Helm chart you previously created. You can also use helm command to upload the chart too. +![ChartMuseum chart](../img/chartmuseum-chart.png) -![Harbor upload chart](../img/harbor-upload-chart.png) +2. Deploy last version by using Kubeapps. Update the following parameters in the deployment values: -Please refer to ['Manage Helm Charts in Harbor'](https://goharbor.io/docs/2.5.0/working-with-projects/working-with-images/managing-helm-charts) for more details. +- `env.open.DISABLE_API`: Set to `false` to use the ChartMuseum API to push new charts. +- `persistence.enabled`: Set to `true` to enable persistence for the stored charts. -### Harbor: Configure the repository in Kubeapps + > Note that this will create a [Kubernetes Persistent Volume Claim](https://kubernetes.io/docs/concepts/storage/persistent-volumes/#lifecycle-of-a-volume-and-claim) so depending on your Kubernetes provider you may need to manually allocate the required Persistent Volume to satisfy the claim. Some Kubernetes providers will automatically create PVs for you so setting this value to `true` will be enough. -To add Harbor as the private chart repository in Kubeapps, select the Kubernetes namespace to which you want to add the repository (or "All Namespaces" if you want it available to users in all namespaces), go to `Configuration > Package Repositories` and click on "Add Package Repository" and use the Harbor helm repository URL `http://harbor.default.svc.cluster.local/chartrepo/my-helm-repo` +![ChartMuseum Deploy Form](../img/chartmuseum-deploy-form.png) -Once you create the repository you can click on the link for the specific repository and you will be able to deploy your own applications using Kubeapps. +### ChartMuseum: Upload a chart -### Harbor: Authentication/Authorization +> **NOTE**: This section can safely be skipped if you already have a ChartMuseum instance accessible from your cluster with charts stored. -It is possible to configure Harbor to use HTTP basic authentication: +Once ChartMuseum is deployed you will be able to upload a chart. -- When creating a new project for serving as the helm chart repository in Harbor, set the `Access Level` of the project to non public. This enforces authentication to access the charts in the chart repository via Helm CLI or other clients. -- When `Adding Package Repository` in Kubeapps, select `Basic Auth` for `Authorization` and specify the username and password for Harbor. +1. In one terminal open a port-forward tunnel to the application: -## OCI Registry +```console +$ export POD_NAME=$(kubectl get pods --namespace default -l "app=chartmuseum" -l "release=my-chartrepo" -o jsonpath="{.items[0].metadata.name}") +$ kubectl port-forward $POD_NAME 8080:8080 --namespace default +Forwarding from 127.0.0.1:8080 -> 8080 +Forwarding from [::1]:8080 -> 8080 +``` -Since Helm v3, the project is pushing towards the idea that using an [OCI compliant registry](https://github.com/opencontainers/distribution-spec) to store Helm charts is the future. Since Kubeapps 2.2, it's also possible to use these registries to consume Helm charts. Cloud Providers like [Amazon ECR](https://aws.amazon.com/blogs/containers/oci-artifact-support-in-amazon-ecr/), [Google Artifact Registry](https://cloud.google.com/artifact-registry/docs/supported-formats) or [Azure ACR](https://docs.microsoft.com/en-us/azure/container-registry/container-registry-image-formats) have also added support for OCI artifacts. +2. In a different terminal you can push your chart: -You can add an OCI registry like any other repository. For example, for a [Harbor registry](https://goharbor.io/docs/2.5.0/working-with-projects/working-with-images/managing-helm-charts/#manage-helm-charts-with-the-oci-compatible-registry-of-harbor): +```console +$ helm package /path/to/my/chart +Successfully packaged chart and saved it to: /path/to/my/chart/my-chart-1.0.0.tgz +curl --data-binary "@my-chart-1.0.0.tgz" http://localhost:8080/api/charts +{"saved":true} +``` -![OCI registry](../img/oci-registry.png +### ChartMuseum: Authentication/Authorization -There is one caveat though. It's necessary to specify the list of applications (repositories) that the registry contains. This is because the OCI specification doesn't have an endpoint to discover artifacts (unlike the index.yaml file of a Helm repository). In any case, it's possible to use the registry provider API to retrieve this list. +It is possible to configure ChartMuseum to use authentication with two different mechanisms: -For example, for Harbor, it's possible to query its API to retrieve the list: +- Using HTTP [basic authentication](https://chartmuseum.com/docs/#basic-auth) (user/password). To use this feature, it is needed to: + - Specify the parameters `secret.AUTH_USER` and `secret.AUTH_PASS` when deploying the ChartMuseum. + - Select `Basic Auth` when adding the repository to Kubeapps specifying that user and password. +- Using a [JWT token](https://github.com/chartmuseum/auth-server-example). Once you obtain a valid token you can select `Bearer Token` in the form and add the token in the dedicated field. -```console -curl -X GET "https://harbor.domain/api/v2.0/projects/my-oci-registry/repositories" -H "accept: application/json" | jq 'map(.name) | join(", ")' -``` +### ChartMuseum: Configure the repository in Kubeapps -> **Note**: Substitute the domain `harbor.domain` and the project name `my-oci-registry` with your own. -> Also, if the repository is not public, you can use `-u username:password` to retrieve the same list. +To add ChartMuseum as a private chart repository in Kubeapps: + +1. Select the Kubernetes namespace to which you want to add the repository (or "All Namespaces" if you want it available to users in all namespaces). + +2. Next, go to **Configuration > Package Repositories** and click on **Add Package Repository**. + +3. Complete the configuration form displayed by using the following parameters: + +- `Name`: Repository name in Kubeapps. +- `URL`: Add your repository using the Kubernetes DNS name for the ChartMuseum service. This will be `http://-chartmuseum.:8080`. +- `Description`: Displayed in Kubeapps for details about the repository. +- `Packaging format`: Select the format of packages in the repository (Helm or Helm via Flux) +- `Scope`: may be either **global** (cluster﹣wide) or **namespace﹣scoped**, in which case only users with access to that namespace will have access to the repository. +- `Package storage type`: Helm repository. + +![ChartMuseum Package Repository](../img/chartmuseum-repository.png) + +Once configured, you will be able to browse and deploy your own applications from the private ChartMuseum registry by using Kubeapps (and see the chart you uploaded in the previous step). ## Artifactory JFrog Artifactory is a Repository Manager supporting all major packaging formats, build tools and CI servers. -> **Note**: In order to use the Helm repository feature, it's necessary to use an Artifactory Pro account. +> **Note**: In order to use the Helm repository feature, it is necessary to use an Artifactory Pro account. -To install Artifactory with Kubeapps first add the JFrog repository to Kubeapps. Go to `Configuration > Package Repositories` and add their repository: +This guide covers the installation of Artifactiory in the cluster, the addition of packages to the registry and the configuration as a private repository in Kubeapps. + +1. [Installation](#artifactory-installation) +2. [Upload a chart](#artifactory-upload-a-chart) +3. [Authentication/Authorization](#artifactory-authenticationauthorization) +4. [Configuration in Kubeapps](#artifactory-configure-the-repository-in-kubeapps) + +### Artifactory: Installation + +> **NOTE**: This section can safely be skipped if you already have an Artifactory registry accessible from your cluster. + +To install Artifactory by using Kubeapps first add the JFrog public repository to Kubeapps. Go to **Configuration > Package Repositories** and add their repository: ![JFrog repository](../img/jfrog-repository.png) -Then click on the JFrog repository and deploy Artifactory. For detailed installation instructions, check its [README](https://github.com/jfrog/charts/tree/master/stable/artifactory). If you don't have any further requirements, the default values will work. +Then browse the JFrog repository in Kubeapps and deploy Artifactory. For detailed installation instructions, check its [README](https://github.com/jfrog/charts/tree/master/stable/artifactory). If you don't have any further requirements, the default values will work. When deployed, in the setup wizard, select "Helm" to initialize a repository: @@ -224,7 +252,9 @@ By default, Artifactory creates a chart repository called `helm`. That is the on ### Artifactory: Upload a chart -First, you will need to obtain the user and password of the Helm repository. To do so, click on the `helm` repository and in the `Set Me Up` menu enter your password. After that you will be able to see the repository user and password. +> **NOTE**: This section can safely be skipped if you already have an Artifactory registry accessible from your cluster with available packages. + +First, you will need to obtain the user and password of the Helm repository. To do so, click on the **helm** repository and in the **Set Me Up** menu enter your password. After that you will be able to see the repository user and password. Once you have done that, you will be able to upload a chart: @@ -232,7 +262,7 @@ Once you have done that, you will be able to upload a chart: curl -u{USER}:{PASSWORD} -T /path/to/chart.tgz "http://{REPO_URL}/artifactory/helm/" ``` -### Artifactory: Configure the repository in Kubeapps +### Artifactory: Authentication/Authorization To be able to access private charts with Kubeapps first you need to generate a token. You can do that with the Artifactory API: @@ -245,50 +275,29 @@ curl -u{USER}:{PASSWORD} -XPOST "http://{REPO_URL}/artifactory/api/security/toke } ``` -The above command creates a token with read-only permissions. Now you can select the namespace to which you want to add the repository (or "All Namespaces" if you want it available to users in all namespaces), go to the `Configuration > Package Repositories` menu and add your personal repository: +The above command creates a token with read-only permissions. -![JFrog custom repository](../img/jfrog-custom-repo.png) +### Artifactory: Configure the repository in Kubeapps -After submitting the repository, you will be able to click on the new repository and see the chart you uploaded in the previous step. - -## Modifying the synchronization job - -Kubeapps runs a periodic job (CronJob) to populate and synchronize the charts existing in each repository. Since Kubeapps v1.4.0, it's possible to modify the spec of this job. This is useful if you need to run the Pod in a certain Kubernetes node, or set some environment variables. To do so you can edit (or create) an AppRepository and specify the `syncJobPodTemplate` field. For example: - -```yaml -apiVersion: kubeapps.com/v1alpha1 -kind: AppRepository -metadata: - name: my-repo - namespace: kubeapps -spec: - syncJobPodTemplate: - metadata: - labels: - my-repo: "isPrivate" - spec: - containers: - - env: - - name: FOO - value: BAR - url: https://my.charts.com/ -``` +To add Artifactory as a private chart repository in Kubeapps: -The above will generate a Pod with the label `my-repo: isPrivate` and the environment variable `FOO=BAR`. +1. Select the Kubernetes namespace to which you want to add the repository (or "All Namespaces" if you want it available to users in all namespaces). -### Running the synchronization jobs behind a proxy +2. Next, go to **Configuration > Package Repositories** and click on **Add Package Repository**. -If you are behind a proxy and need to run the sync jobs, you can specify the proxy URLs as environment variables of the sync job's pods; namely `https_proxy`, `http_proxy` and `no_proxy`. However, this configuration can be easily set by modifying the `apprepository.initialReposProxy` configuration object. For instance: +3. Complete the configuration form displayed by using the following parameters: -```yaml -apprepository: - initialReposProxy: - enabled: true - httpProxy: "http://192.168.10.10:8080/" - httpsProxy: "http://192.168.10.10:8080/" - noProxy: "10.0.0.0/8,172.16.0.0/16,192.168.0.0/16,localhost,127.0.0.1.svc,.svc.cluster.local" -``` +- `Name`: Repository name in Kubeapps. +- `URL`: Add your repository using the Kubernetes DNS name for the ChartMuseum service. This will be `http:///artifactory/helm`. +- `Description`: Displayed in Kubeapps for details about the repository. +- `Packaging format`: Select the format of packages in the repository (Helm or Helm via Flux) +- `Scope`: may be either **global** (cluster﹣wide) or **namespace﹣scoped**, in which case only users with access to that namespace will have access to the repository. +- `Package storage type`: Helm repository. -Please mind the `noProxy` section, otherwise, you might not be able to access the charts. +For private repositories, the Authentication method must be provided. In this case select: + +- `Bearer Token` (for `Repository Authorization` field under the `Authorization` tab) and specify the token previously created. + +![JFrog custom repository](../img/jfrog-custom-repo.png) -> **NOTE**: this configuration is only available for the Helm repositories. +Once configured, you will be able to browse and deploy your own applications from the private Artifactory registry by using Kubeapps (and see the chart you uploaded in the previous step). diff --git a/site/content/docs/latest/img/chartmuseum-repository.png b/site/content/docs/latest/img/chartmuseum-repository.png index e38adaccf6b..acbcb0046f2 100644 Binary files a/site/content/docs/latest/img/chartmuseum-repository.png and b/site/content/docs/latest/img/chartmuseum-repository.png differ diff --git a/site/content/docs/latest/img/harbor-chart.png b/site/content/docs/latest/img/harbor-chart.png index e6abe03446e..56aae1fe2b1 100644 Binary files a/site/content/docs/latest/img/harbor-chart.png and b/site/content/docs/latest/img/harbor-chart.png differ diff --git a/site/content/docs/latest/img/harbor-private-registry.png b/site/content/docs/latest/img/harbor-private-registry.png new file mode 100644 index 00000000000..b47b64ab75f Binary files /dev/null and b/site/content/docs/latest/img/harbor-private-registry.png differ diff --git a/site/content/docs/latest/img/harbor-ready.png b/site/content/docs/latest/img/harbor-ready.png index 04b5dfa566f..2a42d0768ff 100644 Binary files a/site/content/docs/latest/img/harbor-ready.png and b/site/content/docs/latest/img/harbor-ready.png differ diff --git a/site/content/docs/latest/img/jfrog-custom-repo.png b/site/content/docs/latest/img/jfrog-custom-repo.png index cef9a608b4b..b1adce154d7 100644 Binary files a/site/content/docs/latest/img/jfrog-custom-repo.png and b/site/content/docs/latest/img/jfrog-custom-repo.png differ diff --git a/site/content/docs/latest/img/jfrog-repository.png b/site/content/docs/latest/img/jfrog-repository.png index b2405b6d7d2..c16db2de894 100644 Binary files a/site/content/docs/latest/img/jfrog-repository.png and b/site/content/docs/latest/img/jfrog-repository.png differ diff --git a/site/content/docs/latest/img/oci-registry.png b/site/content/docs/latest/img/oci-registry.png index 0074f072395..76ce4dc6674 100644 Binary files a/site/content/docs/latest/img/oci-registry.png and b/site/content/docs/latest/img/oci-registry.png differ