defenseunicorns / uds-bundle-software-factory-nutanix

A UDS Bundle
Apache License 2.0
2 stars 0 forks source link

Support configuring multiple image registries in Nexus #186

Open jacobbmay opened 3 weeks ago

jacobbmay commented 3 weeks ago

Initially I was only thinking about Nexus requiring a port per image registry. But since we are supporting Nexus pro, we should be able to set this up via subdomain routing that Nexus supports for the pro version.

### Tasks
- [x] Get multiple sub-domain registries working in bundle
- [ ] Push updated UDS configs to 1password
- [x] Update docs and reference UDS Config
- [ ] Get PR merged
JoeHCQ1 commented 4 days ago

Customer value: segmented access control is eased with the multiple registries.

Note from Slack:

Nexus supports creating multiple image registries the same way you might have multiple rpm repos or multiple pypi repos. The difference is registries require either separate ports per registry or subdomain routing so Nexus serves each to a different subdomain (registry1.your.nexus.domain, registry2.your.nexus.domain). Non image repositories in Nexus are served via path routing using the default nexus host and port so we don't need to do anything special to support that.

For supporting multiple registries in Nexus we either need to configure our bundle so that they can pass in a list of subdomains to nexus in a variable for image registries so that istio routing can be configured to route traffic for them to Nexus, or we need to support providing multiple ports so that networking can be setup for each port. The preferred solution is probably the subdomain routing which I think is what mission hero currently uses with their Artifactory.

If you look at what is currently being passed to the nexus package in our bundle, we are only configuring port 5000 for a single image registry. Ideally we get rid of the custom ports and have a variable that allows setting multiple registry domains that all route to nexus on port 443.

Then Nexus can use its built in subdomain routing and we don't need to worry about them knowing to configure a port per registry in addition to subdomains for istio routing.

JoeHCQ1 commented 4 days ago
JoeHCQ1 commented 3 days ago

This work is about done afaik so I've moved this up a milestone and changed the predicted end-date.