apiVersion: v1
data:
  config.yml: |
    version: 0.1
    log:
      fields:
        service: registry
      level: info
    http:
      debug:
        addr: ':5001'
        prometheus:
          enabled: false
          path: /metrics
      draintimeout: 0
      headers:
        X-Content-Type-Options: [nosniff]
      addr: :5000
      secret: "HTTP_SECRET"
      relativeurls: false
    health:
      storagedriver:
        enabled: false
        interval: 10s
        threshold: 3
    auth:
      token:
        realm: https://gitlab.example.com/jwt/auth
        service: container_registry
        issuer: "gitlab-issuer"
        # This is provided from the initContainer execution, at a known path.
        rootcertbundle: /etc/docker/registry/certificate.crt
        autoredirect: false
    compatibility:
      schema1:
        enabled: false
    validation:
      disabled: true
      manifests:
        referencelimit: 0
        payloadsizelimit: 0
        urls:
          allow:
          deny:

    notifications:
    reporting:
    profiling:
    storage:
      maintenance:
        readonly:
          enabled: false
        uploadpurging:
          enabled: true
          age: 168h
          interval: 24h
          dryrun: false
      s3:
        accesskey: "ACCESS_KEY"
        secretkey: "SECRET_KEY"
        region: us-east-1
        regionendpoint: http://RELEASE-NAME-minio-svc.default.svc:9000
        bucket: registry
        secure: true
        v4auth: true
        rootdirectory: /
      cache:
        blobdescriptor: 'inmemory'
      delete:
        enabled: true
      redirect:
        disable: true
    middleware:

    gc:
      disabled: true
    migration:
      enabled: false
  configure: |-
    if [ -e /config/accesskey ] ; then
      sed -e 's@ACCESS_KEY@'"$(cat /config/accesskey)"'@' -e 's@SECRET_KEY@'"$(cat /config/secretkey)"'@' /config/config.yml > /registry/config.yml
    else
      cp -v -r -L /config/config.yml  /registry/config.yml
    fi
    # Place the `http.secret` value from the kubernetes secret
    sed -i -e 's@HTTP_SECRET@'"$(cat /config/httpSecret)"'@' /registry/config.yml
    # Populate sensitive registry notification secrets in the config file
    if [ -d /config/notifications ]; then
      for i in /config/notifications/*; do
        filename=$(basename $i);
        sed -i -e 's@'"${filename}"'@'"$(cat $i)"'@' /registry/config.yml;
      done
    fi
    # Insert any provided `storage` block from kubernetes secret
    if [ -d /config/storage ]; then
      # Copy contents of storage secret(s)
      mkdir -p /registry/storage
      cp -v -r -L /config/storage/* /registry/storage/
      # Ensure there is a new line in the end
      echo '' >> /registry/storage/config
      # Default `delete.enabled: true` if not present.
      ## Note: busybox grep doesn't support multiline, so we chain `egrep`.
      if ! $(egrep -A1 '^delete:\s*$' /registry/storage/config | egrep -q '\s{2,4}enabled:') ; then
        echo 'delete:' >> /registry/storage/config
        echo '  enabled: true' >> /registry/storage/config
      fi
      # Indent /registry/storage/config 2 spaces before inserting into config.yml
      sed -i 's/^/  /' /registry/storage/config
      # Insert into /registry/config.yml after `storage:`
      sed -i '/^storage:/ r /registry/storage/config' /registry/config.yml
      # Remove the now extraneous `config` file
      rm /registry/storage/config
    fi
    # Copy any middleware.storage if present
    if [ -d /config/middleware.storage ]; then
      cp -v -r -L /config/middleware.storage  /registry/middleware.storage
    fi
    # Set to known path, to used ConfigMap
    cat /config/certificate.crt > /registry/certificate.crt
    # Copy the optional profiling keyfile to the expected location
    if [ -f /config/profiling-key.json ]; then
      cp /config/profiling-key.json /registry/profiling-key.json
    fi
    # Insert Database password, if enabled
    if [ -f /config/database_password ] ; then
      sed -i -e 's@DB_PASSWORD_FILE@'"$(cat /config/database_password)"'@' /registry/config.yml
    fi
    # Copy the database TLS connection files to the expected location and set permissions
    if [ -d /config/ssl ]; then
      cp -r /config/ssl/ /registry/ssl
      chmod 700 /registry/ssl
      chmod 600 /registry/ssl/*.pem
    fi
  migrations-config.yml: |
    version: 0.1
    log:
      fields:
        service: registry
      level: info
kind: ConfigMap
metadata:
  labels:
    app: registry
    chart: registry-0.7.0
    heritage: Helm
    release: RELEASE-NAME
  name: RELEASE-NAME-registry
  namespace: default
