Drop cert-checker, move registry to localhost

.drone.yml

@@ -55,25 +55,6 @@ steps:
     event:
     - tag
 
-- name: docker-publish-cert-checker
-  image: plugins/docker
-  settings:
-    dockerfile: cert-checker/Dockerfile
-    password:
-      from_secret: docker_password
-    repo: "rancher/rio-cert-checker"
-    tag: "${DRONE_TAG}-amd64"
-    username:
-      from_secret: docker_username
-  when:
-    instance:
-    - drone-publish.rancher.io
-    ref:
-    - refs/head/master
-    - refs/tags/*
-    event:
-    - tag
-
 volumes:
 - name: docker
   host:
@@ -136,25 +117,6 @@ steps:
     event:
     - tag
 
-- name: docker-publish-cert-checker
-  image: plugins/docker
-  settings:
-    dockerfile: cert-checker/Dockerfile
-    password:
-      from_secret: docker_password
-    repo: "rancher/rio-cert-checker"
-    tag: "${DRONE_TAG}-arm64"
-    username:
-      from_secret: docker_username
-  when:
-    instance:
-    - drone-publish.rancher.io
-    ref:
-    - refs/head/master
-    - refs/tags/*
-    event:
-    - tag
-
 volumes:
 - name: docker
   host:
@@ -217,25 +179,6 @@ steps:
     event:
     - tag
 
-- name: docker-publish-cert-checker
-  image: plugins/docker
-  settings:
-    dockerfile: cert-checker/Dockerfile
-    password:
-      from_secret: docker_password
-    repo: "rancher/rio-cert-checker"
-    tag: "${DRONE_TAG}-arm"
-    username:
-      from_secret: docker_username
-  when:
-    instance:
-    - drone-publish.rancher.io
-    ref:
-    - refs/head/master
-    - refs/tags/*
-    event:
-    - tag
-
 volumes:
 - name: docker
   host:
@@ -272,28 +215,6 @@ steps:
     event:
     - tag
 
-- name: manifest-cert-checker
-  image: plugins/manifest:1.0.2
-  settings:
-    username:
-      from_secret: docker_username
-    password:
-      from_secret: docker_password
-    platforms:
-      - linux/amd64
-      - linux/arm64
-      - linux/arm
-    target: "rancher/rio-cert-checker:${DRONE_TAG}"
-    template: "rancher/rio-cert-checker:${DRONE_TAG}-ARCH"
-  when:
-    instance:
-    - drone-publish.rancher.io
-    ref:
-    - refs/head/master
-    - refs/tags/*
-    event:
-    - tag
-
 depends_on:
 - amd64
 - arm64

cert-checker/Dockerfile

-FROM alpine:3.9
-RUN apk add -U --no-cache openssl bash
-COPY cert-checker/init.sh /
-CMD ["/init.sh", "/etc/registry/tls.crt"]

cert-checker/init.sh

-#!/bin/bash
-while true; do
-    issuer=$(openssl x509 -in $1 -text -noout | grep Issuer)
-    if [[ $issuer =~ .*Encrypt.* ]]
-    then
-        exit 0
-    fi
-    sleep 1
-done

modules/build/controllers/build/controller.go

@@ -64,11 +64,11 @@ func (h handler) updateService(key string, build *v1alpha1.Build) (*v1alpha1.Bui
 	}
 
 	if con.IsTrue() {
-		imageName := service.ImageName(h.registry, h.systemNamespace, build.Spec.Source.Git.Revision, domain, svc)
+		imageName := service.PullImageName(h.registry, h.systemNamespace, build.Spec.Source.Git.Revision, domain, svc)
 		if svc.Spec.Image != imageName {
 			deepCopy := svc.DeepCopy()
 			v1.ServiceConditionImageReady.SetError(deepCopy, "", nil)
-			deepCopy.Spec.Image = service.ImageName(h.registry, h.systemNamespace, build.Spec.Source.Git.Revision, domain, deepCopy)
+			deepCopy.Spec.Image = service.PullImageName(h.registry, h.systemNamespace, build.Spec.Source.Git.Revision, domain, deepCopy)
 			if _, err := h.services.Update(deepCopy); err != nil {
 				return build, err
 			}

modules/build/controllers/proxy/controller.go

+package proxy
+
+import (
+	"context"
+
+	"github.com/rancher/rio/pkg/constructors"
+	"github.com/rancher/rio/types"
+	"github.com/rancher/wrangler/pkg/apply"
+	"github.com/rancher/wrangler/pkg/objectset"
+	v1 "k8s.io/api/apps/v1"
+	corev1 "k8s.io/api/core/v1"
+	v12 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+var (
+	proxyImage = "rancher/klipper-lb:v0.1.1"
+	T          = true
+)
+
+func Register(ctx context.Context, rContext *types.Context) error {
+	h := Handler{
+		namespace: rContext.Namespace,
+		apply:     rContext.Apply.WithCacheTypes(rContext.Apps.Apps().V1().DaemonSet()).WithStrictCaching(),
+	}
+
+	rContext.Core.Core().V1().Service().OnChange(ctx, "registry-proxy", h.onChange)
+	return nil
+}
+
+type Handler struct {
+	namespace string
+	apply     apply.Apply
+}
+
+func (h *Handler) onChange(key string, svc *corev1.Service) (*corev1.Service, error) {
+	if svc == nil {
+		return nil, nil
+	}
+
+	if svc.Namespace != h.namespace || svc.Name != "registry" {
+		return svc, nil
+	}
+
+	if svc.Spec.ClusterIP == "" {
+		return svc, nil
+	}
+
+	deploy := constructors.NewDaemonset(svc.Namespace, svc.Name+"-proxy", v1.Deployment{
+		ObjectMeta: v12.ObjectMeta{
+			OwnerReferences: []v12.OwnerReference{
+				{
+					Name:       svc.Name,
+					UID:        svc.UID,
+					Kind:       "Service",
+					APIVersion: "v1",
+				},
+			},
+		},
+		Spec: v1.DeploymentSpec{
+			Selector: &v12.LabelSelector{
+				MatchLabels: map[string]string{
+					"app": svc.Name + "-proxy",
+				},
+			},
+			Template: corev1.PodTemplateSpec{
+				ObjectMeta: v12.ObjectMeta{
+					Labels: map[string]string{
+						"app": svc.Name + "-proxy",
+					},
+				},
+				Spec: corev1.PodSpec{
+					Containers: []corev1.Container{
+						{
+							Name:  svc.Name + "-proxy",
+							Image: proxyImage,
+							Env: []corev1.EnvVar{
+								{Name: "SRC_PORT", Value: "80"},
+								{Name: "DEST_PROTO", Value: "TCP"},
+								{Name: "DEST_PORT", Value: "80"},
+								{Name: "DEST_IP", Value: svc.Spec.ClusterIP},
+							},
+							Ports: []corev1.ContainerPort{
+								{
+									HostPort:      5442,
+									ContainerPort: 80,
+									HostIP:        "127.0.0.1",
+									Protocol:      corev1.ProtocolTCP,
+								},
+							},
+							SecurityContext: &corev1.SecurityContext{
+								Privileged: &T,
+							},
+						},
+					},
+				},
+			},
+		},
+	})
+
+	os := objectset.NewObjectSet()
+	os.Add(deploy)
+	return svc, h.apply.WithSetID(svc.Name + "-proxy").WithOwner(svc).Apply(os)
+}

modules/build/controllers/service/controller.go

@@ -6,7 +6,6 @@ import (
 
 	"github.com/knative/build/pkg/apis/build/v1alpha1"
 	webhookv1 "github.com/rancher/gitwatcher/pkg/apis/gitwatcher.cattle.io/v1"
-	"github.com/rancher/rio/modules/istio/pkg/domains"
 	riov1 "github.com/rancher/rio/pkg/apis/rio.cattle.io/v1"
 	"github.com/rancher/rio/pkg/constants"
 	"github.com/rancher/rio/pkg/constructors"
@@ -184,11 +183,16 @@ func populateWebhookAndSecrets(webhookService *riov1.App, service *riov1.Service
 	os.Add(webhookReceiver)
 }
 
-func ImageName(customeRegistry, registryNamespace, rev, domain string, service *riov1.Service) string {
-	var registryAddr string
+func ImageName(customRegistry, registryNamespace, rev, domain string, service *riov1.Service) string {
+	if customRegistry == "" {
+		return fmt.Sprintf("registry.%s/%s:%s", registryNamespace, service.Namespace+"/"+service.Name, rev)
+	}
+	return fmt.Sprintf("%s/%s:%s", customRegistry, service.Namespace+"-"+service.Name, rev)
+}
+
+func PullImageName(customeRegistry, registryNamespace, rev, domain string, service *riov1.Service) string {
 	if customeRegistry == "" {
-		registryAddr = domains.GetExternalDomain("registry", registryNamespace, domain)
-		return fmt.Sprintf("%s/%s:%s", registryAddr, service.Namespace+"/"+service.Name, rev)
+		return fmt.Sprintf("localhost:5442/%s:%s", service.Namespace+"/"+service.Name, rev)
 	}
 	return fmt.Sprintf("%s/%s:%s", customeRegistry, service.Namespace+"-"+service.Name, rev)
 }

modules/build/feature/feature.go

@@ -3,6 +3,8 @@ package feature
 import (
 	"context"
 
+	"github.com/rancher/rio/modules/build/controllers/proxy"
+
 	"github.com/rancher/rio/modules/build/controllers/build"
 	"github.com/rancher/rio/modules/build/controllers/gitcommit"
 	"github.com/rancher/rio/modules/build/controllers/service"
@@ -27,6 +29,7 @@ func Register(ctx context.Context, rContext *types.Context) error {
 			service.Register,
 			build.Register,
 			gitcommit.Register,
+			proxy.Register,
 		},
 		FixedAnswers: map[string]string{
 			"NAMESPACE": rContext.Namespace,

stacks/bindata.go

@@ -77,7 +77,7 @@ func (fi bindataFileInfo) Sys() interface{} {
 	return nil
 }
 
-var _stacksBuildStackYaml = []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x00\xff\xbc\x59\x7f\x8f\xdb\x36\xd2\xfe\xdf\x9f\x82\x30\x0a\xa4\x0d\x56\xb6\x24\x5b\x96\x2c\x60\xf1\x76\xeb\x75\xdb\x7d\x93\xec\x2e\xd6\xee\x1d\x82\x22\x58\x50\xe4\xc8\xe6\x99\x12\x75\x24\xe5\x64\x2f\xcd\x77\x3f\x50\x12\x65\xf9\xd7\xe6\x90\xa4\x49\x80\xc0\xe2\x3c\x1c\xce\x3c\x9c\x19\x0e\x19\x22\xf2\x94\xad\x54\xdc\x43\x88\x8b\xd5\x8a\xe5\x2b\xf3\x13\x21\x22\x72\x0d\xb9\x8e\xd1\x5f\x4e\xf5\x5d\x89\x39\x6c\x81\x0f\x8c\x48\x0a\xce\x41\xc6\x88\xe5\xa9\x68\xe4\x5d\x84\x04\xaa\x1c\x96\x33\x7d\x0e\xb1\x62\xfa\x59\xf9\x7b\x48\xd6\x42\x6c\x0e\xc4\xff\xc1\x85\x63\xac\x04\xe9\xd4\x76\xc7\xe8\xaf\x56\x88\xd0\xc7\xce\x6f\x84\xfa\x95\xa6\x7e\x8c\xfa\x46\x47\xff\x62\x5f\x48\x8d\x50\x14\x19\xe4\xba\x1f\xa3\x14\x73\x05\x07\x08\x85\xb3\x82\xb3\x7c\xd5\x8f\x0f\x14\x23\xa3\x91\x69\x86\x8d\x72\xcf\x75\x2f\x0e\xa5\x7a\x0d\x12\x70\xaa\x41\xd6\x80\x3d\xf9\xa7\x83\x65\x44\xa9\x8b\x52\xdf\x63\xbd\x56\xfd\x18\xfd\xd9\x57\x9a\x8a\x52\xf7\xdf\x1d\xc0\x40\x4a\x21\xef\x8e\xb1\x20\xe5\x31\x36\x27\x82\xd6\x96\xf7\xff\xa5\x44\x7e\xe8\x7b\x25\x07\x39\xab\x28\x3c\xe5\x9e\x66\x19\xbc\x82\x27\x33\xbf\x7f\xe4\x5d\x45\x6b\x23\xad\x29\x3e\x82\xe4\xb8\x9d\x5f\x6f\xd7\x31\x84\x60\x13\x40\x0d\xa8\xfe\x38\x06\x65\xa0\x14\x5e\x59\x55\x99\x5a\x1d\x43\x94\xc6\x64\xa3\x25\x26\x16\xb5\x1b\x38\x61\x3a\xcb\x61\x9e\x5b\x6a\xce\xb8\x36\xaf\xd9\x39\x8d\x30\xcc\x3c\x0b\xa0\xa5\xc4\x9a\x89\xfc\x59\x50\xed\x6f\x17\xb2\x1f\x22\xbd\xee\xef\x9e\x02\xb9\x65\x04\xaa\x1c\x4d\x4a\xc6\xe9\x86\xe9\x3a\x49\x33\xfc\x61\x41\x30\x07\x13\x65\xf5\x00\xcb\xed\x80\xcd\x62\x52\x4a\x09\x39\x79\x8a\x51\x50\x0d\x15\x42\x6a\x55\x4f\x77\xd0\xd4\x75\xbd\xa1\x26\xc5\x85\xd5\x7b\xc1\x72\x0d\x32\xc7\xfc\x52\xcb\x12\x2a\x94\x7a\x52\x1a\xb2\x45\x01\x24\x6e\xec\x2a\x04\xed\x7e\xd6\xc5\x02\xb3\x1c\xa4\xda\x8d\x39\x88\x65\x78\x05\x31\xca\x44\xf2\x34\x6c\xed\xde\xba\x83\xd1\x60\xd4\x71\x10\xcb\x55\x67\x96\x99\xe7\x38\x98\x52\xb9\x37\xa4\x49\x11\x0f\x87\xee\xa0\xfa\x1b\x1b\xab\x3b\x62\x13\x6d\x71\xcb\x0c\xed\x48\x3a\xbe\x5a\x4d\xad\xa9\xf7\x42\xea\x18\x1d\xa8\x52\x40\x4a\xc9\xf4\xd3\xcc\x54\xbf\x0f\x3a\xde\xdb\x96\x42\xb2\x2d\xe3\xb0\x02\x1a\xa3\x86\x1d\x09\x2b\xa6\xb4\x7c\xaa\x81\x8d\xc3\xed\xa0\x5f\x8d\x72\x9c\x00\x6f\xad\x90\xf0\xef\x12\x94\x76\x54\x99\x50\x91\x61\x96\xc7\xe8\x85\x51\xf6\xa2\xd7\xac\x2f\x61\xb7\x3d\x92\x09\xe7\x3d\xe3\x94\x60\x49\xe3\x21\x68\x32\xb4\xba\x2b\x00\xe4\x5b\x8b\x7c\x98\xff\x76\xb3\x58\x3e\xbc\x7d\xfc\x7d\xb9\xbc\x7f\xbc\xba\xbe\x7e\xb8\xb4\x6c\x8d\xc7\xa3\x93\xa0\xe5\xeb\xc5\xe3\x6c\xfe\xb0\xbc\xf9\xf5\x66\x76\xb5\x9c\x5f\xee\xe9\x1f\x6a\xae\x06\x44\xea\xb3\x33\x5f\xcd\xdf\x9e\x98\xb1\x81\xa7\xe3\x20\x1b\x8f\x47\xc6\x88\x2a\xce\xf6\xec\xdf\x0a\x5e\x66\xd0\xe2\x94\x16\x12\xaf\xc0\x69\xf9\x1b\x6e\xb1\x1c\x72\x96\xec\x7b\x7d\x18\x6c\x4e\x13\x00\x04\xa4\x76\xc8\x1a\xc8\x06\x6c\xf0\xd4\x27\x4c\x1b\xc9\xbb\x1d\xc2\x39\x59\x83\x1c\x1a\x7e\xbb\xd3\x4c\x74\x7a\x03\xd7\x91\x24\xec\x4e\xb8\x2f\x39\xbf\x17\x9c\x99\x24\xba\xe2\xef\xf1\x93\xea\xb5\xe1\xb2\xdb\xae\xcf\x6e\x98\x3d\xd3\x2a\xf4\x8a\x8b\x04\xf3\xc7\x02\x64\xc6\x94\x62\x22\x6f\xbd\xe9\xbf\x44\x2b\xa6\xdf\x63\x6d\x4c\x1c\x10\xac\x35\x87\x01\x13\xc3\xdd\xa0\xea\x7f\x1e\x4a\x44\x96\x31\xdd\x22\x5f\xbc\x44\xf5\x89\x99\xe1\x42\xbd\xd8\x0d\xc2\x16\x72\xdd\x0e\x34\xfe\xf4\x4e\x50\xb5\x5b\xc7\x90\xe4\x0f\xea\xd8\xde\x25\xaf\xd3\xb1\xa4\x67\xf3\x98\x33\xa5\x21\xaf\xd2\x19\x94\x6a\x86\xe3\xc8\x9d\xba\xbd\x93\xe4\xe2\x1d\xb9\x7b\x11\x64\x66\x54\xe1\xb3\xd6\xba\x70\x1a\x1e\x59\x8e\xb5\x90\xb6\x26\x3a\x9d\xae\xe4\x33\x04\xbf\x78\x69\x2a\x58\x97\x05\x13\x40\xaa\xc0\x04\xba\x83\x0d\x19\x67\xc9\xaa\x20\x55\x65\xc6\x84\x88\x72\x5f\x72\x9a\xec\x0f\xa6\xa5\x32\xa6\x0c\x29\x14\x5c\x3c\x65\x7b\xfa\x88\x04\xac\xe1\x62\x05\xfa\xc2\x10\x77\x51\xb1\x79\x51\x54\xff\x96\x05\x35\x32\x0a\x1c\x34\xd4\x1e\x0f\x36\x39\xd6\x6c\x0b\x03\x0a\xdb\xba\xbe\x7e\x4b\x55\x43\xa5\xb1\x2e\xbf\xa1\x46\x0d\x59\xc1\xb1\x86\x6f\xa3\x92\xf0\x52\x69\x90\x67\x34\xbf\x44\x04\x93\x35\xcb\x57\x03\x7b\x9c\xed\x4d\xae\xe2\xae\x8b\xc6\x05\xab\xf6\xa6\x0a\x93\xc1\x26\x52\x26\x89\x48\xa9\xb4\xc8\x24\x28\x51\x4a\x02\x14\xd2\xaa\xe9\x13\x79\x33\xb1\xc9\x8f\x15\x91\x06\xdc\xa8\x77\x24\x70\xc0\x0a\x94\xc9\x97\x75\x99\x0c\x88\xc8\xac\xac\xa6\x61\x48\x32\x3a\xdc\xc5\xea\xcf\x6a\x8d\xfd\x60\x12\x87\x61\x12\x45\xa3\x14\x48\x18\xf9\x6e\x42\x47\xbe\x37\x25\xae\xe7\x85\xd3\x49\x1a\x04\x7e\xea\x05\x41\xe8\x63\x77\x14\x46\xd3\x20\x4d\x20\xc4\x21\x09\x23\x12\x8e\xfc\x28\xa5\xd3\x89\x17\x85\xb6\x32\xda\x5e\xde\x38\xd6\xf4\xf3\x43\xdb\xca\x57\xf5\xa8\xc6\x38\x8d\xec\xf0\x18\x59\xbc\x5d\x2c\xe7\x6f\x1e\x6f\xaf\xde\xcc\x17\xf7\x57\xb3\xf9\xe5\x0f\x1f\xdb\xdf\x9f\x8e\x32\xde\x68\xd1\xa2\x6e\x42\xed\x50\xfd\xa5\xd7\x12\xd4\x5a\x70\xda\x0c\xdf\xdc\xfe\x7a\x67\x11\xcd\xe5\xc0\xd0\x67\x2b\xc7\x17\x71\xd8\xde\x31\x2c\x87\x90\xa4\x41\x94\x46\xe3\x88\x4c\x02\x12\xb8\x38\xf4\x82\x08\x7b\x41\x40\x93\x10\xdc\x51\x34\x26\xa3\xf1\xc8\xf5\x7d\x2f\x98\x8c\xc9\x38\x49\x70\x1a\x8d\x20\x4a\x13\x0a\x51\x1a\x06\x93\xd4\x5a\xe3\x54\x77\x93\xaf\x35\xcf\x5e\x70\xac\x71\xee\x34\xf5\xfd\xa9\x37\xf5\x83\x49\x82\xc7\x69\x38\x0e\x3c\x18\x43\x30\x0d\x7c\x3f\x4c\x93\x28\xf0\x13\x17\x07\x01\x04\xe0\xc1\x78\x32\x1d\x93\x24\xa4\x69\x90\x60\x17\xd3\x70\xec\x27\xbe\x3d\xc2\x9d\x5c\x14\x5f\x6f\x5c\x2e\x0a\x6b\x17\x1e\x79\x11\x40\xe8\x47\x34\xf0\x26\x69\x1a\x8e\x7c\xf0\xa3\x89\x47\x5c\x9f\xd2\x34\x9a\x78\xd3\x10\x02\x9f\x4c\xfc\x28\x72\xc7\xd3\xc9\x34\x08\x23\x0f\x93\x24\x0c\x3d\x97\x44\x63\x8f\x8e\x7b\xbd\xde\xa6\x4c\x40\xe6\xa0\xeb\x93\x3c\xc3\x39\x4b\x41\xed\x6e\x8e\xb8\x60\xff\x00\x69\x52\x2b\x3e\x9d\x68\x5b\x2f\x01\x8d\xeb\x36\x6c\xc3\x72\x1a\xa3\x59\x95\x7a\x0f\x4d\xea\x5d\xb7\xa9\x57\xf7\xb8\xa0\x31\xc5\x1a\xdb\x53\x77\xbf\xbf\x42\x68\xaf\x4c\x48\xea\xb0\x5c\x69\xcc\x79\x8c\xfa\xa6\x11\xb0\x9d\x76\xa7\x69\x54\x83\xa3\xfa\x52\x37\x63\x9d\x1e\x17\x53\x5a\x59\x80\xf9\xbd\xac\x6a\xca\xcc\xf4\x2e\x79\xe7\xe8\xff\xff\xc5\xdd\xad\xb9\x99\xc5\x68\x50\x97\x4e\x73\x4f\xae\x27\xa9\x3f\xff\xef\xc7\x9f\x07\xfa\xa9\x80\xcb\xcb\xfe\xa2\x24\x04\x80\x02\xed\xff\xf4\xae\x41\xb6\xa6\xd7\x46\xb5\x88\x76\xdc\x4c\x8d\x91\xd2\xd2\xa6\xec\x17\x2f\x28\x01\xab\x86\xc7\xdd\x82\x0f\xfb\x83\xff\xe3\x6a\x4a\x63\xa9\x97\x2c\x83\x43\xf3\x8f\xc6\x6b\x85\xa6\xa0\x3f\x6b\x7c\x56\x70\x30\xd6\x9f\xd0\x39\x3b\x2d\x3c\x52\xbc\x92\xa2\x2c\xe2\xe3\xf3\xa2\xb3\xe9\x9d\x48\x21\x58\xc3\x4a\x48\x06\x7b\xd7\x16\xcc\x79\xe7\xab\x51\xb2\x8b\xae\x2a\x40\x7f\x31\x0b\xb4\x63\x05\x2f\x25\xe6\x36\x9a\x6c\x6f\x48\x84\x31\xee\xd6\xb6\x16\x16\xae\xca\xc4\x9e\x29\x9d\x65\x6b\x12\x62\xf4\xd1\xde\xfd\xb6\x36\x65\xb6\x1e\xe6\xc5\xba\x49\x0f\xc7\x39\xce\xa9\x67\x8f\xba\xbd\xd9\xb5\xed\x37\x6d\xf5\x38\xcc\xa4\xa6\x8f\x6e\x0b\x6b\x97\x35\xe3\x42\x8c\x8e\x8e\x83\x6e\x8e\x7c\xd5\x89\xf8\x37\x55\xf3\xef\xc0\x97\xad\xf4\xdf\x91\xad\xbf\xe7\x70\xf9\x1e\x5c\x11\xe5\xa4\xb0\xbb\x24\x7c\x29\x5d\x84\x8b\x92\x3a\x15\x21\x20\xd5\xf0\x50\xed\xf7\x70\x25\x17\xc5\x77\xdc\xf1\x6f\x79\x62\x9f\x63\xe8\xb8\xcb\x3e\x41\xcb\xac\x6e\xbc\xab\x02\xb8\x6c\x1a\xef\x67\x58\xb2\xaf\x32\x47\x64\x14\x58\xe2\x0c\x74\xe7\xc9\xc8\xde\xe3\x6f\xde\x5c\xfd\x36\x6f\x0b\x23\x05\x45\x24\x2b\x74\x65\xe1\x3f\xd7\x20\x01\x69\x81\x8a\x32\xe1\x4c\xad\x91\x5e\x03\x92\xa0\x4a\xae\x59\xbe\x42\xbb\xbe\x68\xa7\xed\xfa\x6e\xf6\x6a\xfe\xf0\xeb\xcd\xeb\x33\x2a\x97\x6b\xa8\x90\x48\xa4\x95\xb6\x6b\x41\x36\x20\x53\xc6\xa1\x83\x4f\x71\xc9\x75\x8c\xfa\x3b\x61\xff\x60\x99\xfb\x3f\x16\xbf\x9f\xb5\x59\xaf\x41\xa2\xa2\x54\x6b\x24\x24\xca\x85\x3e\xa1\xb9\xdb\x9a\xb4\xa6\xdf\x3c\xcc\x67\xcb\xbb\x87\xb7\xe7\x2d\xa7\x4c\x02\xd1\x42\x3e\xd9\x57\x11\x43\x83\x71\x03\x17\xc5\x89\x55\x86\xef\x85\xdc\x54\xa1\x7a\xb8\xd6\x2f\x7f\xdc\xbc\xbe\x7e\x75\xb3\x7c\x9c\xbd\xbe\x99\xdf\x2e\x1f\x9f\xd9\x84\x43\xc6\xaa\x50\x78\xc5\x34\x22\x9c\x41\xae\xd1\x8f\xd5\x9e\x13\xcd\x7f\xda\xdb\x90\xae\x1d\x27\x9e\x04\x3d\x47\x0a\xa1\x39\x28\x65\xe3\xdc\x1f\xbb\x21\x21\x61\xea\x8f\xc1\x0b\xc6\x38\x4c\x26\xd3\xe9\x34\x9c\x92\x90\x00\x8d\xa2\x49\xe4\x06\x04\x93\x49\x38\xf5\x5d\x6f\x32\xa5\x04\x12\x42\xf0\xd4\x9b\x4c\xc6\xd3\x11\x80\x9f\x4c\xce\xba\x78\x7d\x35\x7f\x73\x77\x5b\x3d\x92\xcd\x17\x8b\xf3\x4e\x36\xcf\x16\x47\x7e\x52\x0c\x99\xc8\x1b\x3f\x37\x4c\xd3\x9f\xec\x43\xc0\xa9\x8d\xad\x5e\x2e\x5b\x68\xec\xf9\xa3\xb1\xb5\x4c\x69\x28\x8e\xc2\xbf\x7e\xcd\xc0\x39\x75\x4c\xc4\xb4\x1a\x9b\xe2\xf1\xc3\x0f\x1f\x4f\x6e\xd5\xee\xc9\xd8\x6c\x31\xcb\x57\xd7\x4c\x56\xe8\x36\x88\x76\x08\x22\xb2\x0c\x9b\x5c\xfe\xb3\x6f\xb7\xaa\x7f\x81\xfa\xf5\xb3\xeb\x65\x77\x85\x7d\xa6\x3e\x19\x54\x35\xe3\xe8\x45\xdb\xfc\xe9\x3b\x4e\x21\xc5\xca\x50\x76\x59\x70\xcc\x0e\xff\xdb\xa1\x45\xa5\xb2\xba\x90\xd2\x4b\xda\xa6\xd3\x60\xeb\x7e\x0e\xed\x88\x42\x1b\x03\x0c\xdc\x30\x65\x0c\xdd\x25\xf7\xa7\x73\xd3\xb9\x20\xb8\x72\x8f\xd4\x4f\xba\x97\x83\xda\xd7\x76\x7c\x67\x84\x11\x9d\x56\x02\x1f\x0a\x21\x35\xc8\xcb\x6a\x17\x6a\x05\x76\xcc\xda\x65\x6d\xaa\xb7\xe3\x34\xc6\xec\xa8\xc1\x98\x6a\xf1\xa9\xff\xae\xf7\xdf\x00\x00\x00\xff\xff\xb9\x16\x71\xee\x7d\x1b\x00\x00")
+var _stacksBuildStackYaml = []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x00\xff\xbc\x58\x6d\x6f\xdc\x36\x12\xfe\xee\x5f\x21\x08\x05\xda\x06\xd6\xae\xa4\x5d\xad\x5e\x00\xe3\x9a\xda\xdb\xd6\x97\xc6\x36\x6c\xf7\x0e\x45\x10\x18\x14\x39\xd2\xf2\x4c\x89\x02\x49\x6d\xe2\x4b\xf3\xdf\x0f\xa4\x44\xad\xf6\xcd\x39\x24\x69\x12\xc0\xd8\x9d\x79\x38\x9c\x79\x38\x33\x9c\x25\xe6\x75\x41\x4b\x99\x9d\x38\x0e\xe3\x65\x49\xeb\x52\x7f\x74\x1c\xcc\x6b\x05\xb5\xca\x9c\xbf\x3c\xf3\xdd\xa8\x19\xac\x81\x4d\xb4\x4a\x70\xc6\x40\x64\x0e\xad\x0b\xde\xeb\xc7\x08\x01\x44\x7a\xb4\xa6\xea\x18\xa2\xa4\xea\x59\xfd\x3b\xc8\x57\x9c\x3f\xee\xa8\xff\x8b\x1a\x4f\x7b\x09\xc2\xeb\xfc\xce\x9c\xbf\x06\xa5\xe3\x7c\x18\x7d\x76\x1c\xd7\x58\x72\x33\xc7\xd5\x36\xdc\xd3\x6d\x25\xd1\x4a\xde\x54\x50\x2b\x37\x73\x0a\xc4\x24\xec\x20\x24\xaa\x1a\x46\xeb\xd2\xcd\x76\x0c\x3b\xda\x22\x55\x14\x69\xe3\x81\xef\x9f\xee\x6a\xd5\x0a\x04\xa0\x42\x81\xe8\x00\x5b\xfa\x8f\x3b\xdb\xf0\x56\x35\xad\xba\x41\x6a\x25\xdd\xcc\x79\xe3\x4a\x45\x78\xab\xdc\xb7\x3b\x30\x10\x82\x8b\xeb\x7d\x2c\x08\xb1\x8f\xad\x31\x27\x9d\xe7\xee\x7f\x24\xaf\x77\x63\x37\x7a\x10\xe7\x86\xc2\x43\xe1\x29\x5a\xc1\x2b\x78\xd2\xeb\xdd\xbd\xe8\x0c\xad\xbd\xb6\xa3\x78\x0f\x52\xa3\x61\x7d\x77\x5c\xfb\x10\x8c\x74\x02\xf5\xa0\xee\xcb\x3e\xa8\x02\x29\x51\x69\x4d\x55\xb2\xdc\x87\x48\x85\xf0\xa3\x12\x08\x5b\xd4\x46\x70\xc0\x75\x5a\xc3\xb2\xb6\xd4\x1c\x09\x6d\xd9\xb1\x73\x18\xa1\x99\x79\x16\x40\x5a\x81\x14\xe5\xf5\xb3\xa0\x2e\xde\x31\x64\x3b\x45\x4e\xc6\x9f\x4f\x24\x88\x35\xc5\x60\x6a\x34\x6f\x29\x23\x8f\x54\x75\x45\x5a\xa1\xf7\x77\x18\x31\xd0\x59\xd6\x09\x68\x6d\x05\xb6\x8a\x71\x2b\x04\xd4\xf8\x29\x73\x22\x23\x6a\xb8\x50\xb2\x5b\xee\x39\xa9\xef\x07\x53\x85\x9b\x53\x6b\xf7\x94\xd6\x0a\x44\x8d\xd8\x99\x12\x2d\x18\x94\x7c\x92\x0a\xaa\xbb\x06\x70\xd6\xfb\xd5\x70\x32\xfe\xda\x35\x0b\x44\x6b\x10\x72\x23\xf3\x1c\x5a\xa1\x12\x32\xa7\xe2\xf9\xd3\x74\xf0\x7b\xed\x4f\x66\x93\xd9\x28\x40\x24\xca\xd1\x2a\xbd\xce\xf3\x10\x21\x62\x4b\xa4\x70\x93\x4d\xa7\xfe\xc4\xfc\xcf\xb4\xd7\x23\xb5\xce\xb6\x6c\x60\x86\x8c\x34\xa3\x58\xad\xa5\xc1\xd5\x1b\x2e\x54\xe6\xec\x98\x92\x80\x5b\x41\xd5\xd3\xb9\xee\x7e\xef\x55\xb6\x75\x2c\x8d\xa0\x6b\xca\xa0\x04\x92\x39\x3d\x3b\x02\x4a\x2a\x95\x78\xea\x80\x7d\xc0\x83\x30\x34\x52\xa8\xd7\x96\xee\xdb\xe5\xaf\x97\x77\xf7\xb7\x7f\x3e\xfc\x76\x7f\x7f\xf3\xf0\xf2\xe2\xe2\xf6\xcc\xc6\x94\xf8\xfb\xa7\x93\x68\xb1\x39\x1e\x6b\xd2\x28\xd6\x9c\xb5\x15\x0c\x28\xa9\xb8\x40\x25\x78\xc3\xb6\xd3\x35\x12\x53\x46\xf3\xe9\x68\x95\xed\xa7\x66\x4d\xc9\x78\x8e\xd8\x43\x03\xa2\xa2\x52\x52\x5e\x0f\xb6\xdc\x17\x4e\x49\xd5\x3b\xa4\xf0\x0a\xc4\x04\x23\xa5\x18\x4c\x28\x9f\x6e\x84\xd2\xfd\x34\x14\xf3\xaa\xa2\x6a\x40\x7e\xff\xc2\xe9\xba\x75\x85\x1a\xf9\xfd\x46\x08\x6b\xa8\xd5\x20\x90\x80\x05\x28\xb9\x45\x24\xaa\xb5\xf1\xd1\xee\x3a\x7d\xc2\x49\xc7\xeb\x26\x71\xbc\x91\x27\x27\x36\x87\x18\x95\x0a\x6a\x93\x4a\x20\x65\x2f\xce\x12\x3f\xf5\x37\x5b\xdc\xb4\x8c\xdd\x70\x46\x75\x75\x20\xf6\x0e\x3d\xc9\x43\x87\x90\x76\x67\xb0\x52\xaa\xf1\x7a\x1e\x69\x8d\x14\x17\xb6\x1e\xbd\xd1\x8d\xf8\x09\x82\xbf\x7f\xa1\xab\x67\xcc\x82\xce\x5e\xd9\x20\x0c\x63\x61\x4f\xc6\x51\xb2\x0c\xc4\x74\x05\x84\x31\x6f\xb7\x35\x87\xc9\x7e\xaf\xaf\x73\xed\xca\x94\x40\xc3\xf8\x53\xb5\x65\x0f\x0b\x40\x0a\x4e\x4b\x50\xa7\x9a\xb8\x53\xc3\xe6\x69\x63\xfe\xb6\x0d\xd1\x3a\x02\x0c\x14\x74\x11\x4f\x1e\x6b\xa4\xe8\x1a\x26\x04\xd6\x5d\x6d\x7f\x4d\x53\x53\xa9\x90\x6a\xbf\xa2\x45\x05\x55\xc3\x90\x82\xaf\x63\x12\xb3\x56\x2a\x10\x47\x2c\xbf\x70\x30\xc2\x2b\x5a\x97\x13\xdb\x4a\xb7\x16\x9b\xbc\x1b\xa3\x51\x43\xcd\xd9\x98\x34\x99\x3c\x26\x52\x17\x11\x6e\xa5\xe2\x95\x00\xc9\x5b\x81\x81\x40\x61\x06\x0e\x5e\xf7\x0b\xfb\xfa\x28\xb1\xd0\xe0\xde\xbc\x27\x80\x01\x92\x20\x75\xbd\xac\xda\x7c\x82\x79\x65\x75\x1d\x0d\x53\x5c\x91\xe9\x26\x57\x7f\x92\x2b\x14\x46\x8b\x2c\x8e\xf3\x24\x99\x15\x80\xe3\x24\xf4\x73\x32\x0b\x83\x14\xfb\x41\x10\xa7\x8b\x22\x8a\xc2\x22\x88\xa2\x38\x44\xfe\x2c\x4e\xd2\xa8\xc8\x21\x46\x31\x8e\x13\x1c\xcf\xc2\xa4\x20\xe9\x22\x48\x62\x7b\xd3\xd8\x39\x52\x07\xd6\xcf\x92\x53\x3b\x46\x4e\x41\xe1\x69\x87\xf1\x7a\xdd\x6e\x73\xbc\xfb\xf3\xee\x7e\xf9\xfa\xe1\xea\xe5\xeb\xe5\xdd\xcd\xcb\xf3\xe5\xd9\x77\x1f\x86\xcf\x1f\xf7\x2a\x5e\x5b\x51\xbc\x1b\x80\xac\xa8\xfb\xa6\x56\x02\xe4\x8a\x33\xd2\x8b\x2f\xaf\x7e\xb9\xb6\x88\x7e\x30\xd5\xf4\xd9\xce\xf1\x59\x1c\x0e\xf3\xad\xe5\x10\xf2\x22\x4a\x8a\x64\x9e\xe0\x45\x84\x23\x1f\xc5\x41\x94\xa0\x20\x8a\x48\x1e\x83\x3f\x4b\xe6\x78\x36\x9f\xf9\x61\x18\x44\x8b\x39\x9e\xe7\x39\x2a\x92\x19\x24\x45\x4e\x20\x29\xe2\x68\x51\x58\x6f\x3c\x33\x17\x7f\xa9\x7b\x76\xb8\xb6\xce\xf9\x69\x11\x86\x69\x90\x86\xd1\x22\x47\xf3\x22\x9e\x47\x01\xcc\x21\x4a\xa3\x30\x8c\x8b\x3c\x89\xc2\xdc\x47\x51\x04\x11\x04\x30\x5f\xa4\x73\x9c\xc7\xa4\x88\x72\xe4\x23\x12\xcf\xc3\x3c\x9c\x59\xe7\x6a\xde\x7c\xb9\x73\x35\x6f\xac\x5f\x68\x16\x24\x00\x71\x98\x90\x28\x58\x14\x45\x3c\x0b\x21\x4c\x16\x01\xf6\x43\x42\x8a\x64\x11\xa4\x31\x44\x21\x5e\x84\x49\xe2\xcf\xd3\x45\x1a\xc5\x49\x80\x70\x1e\xc7\x81\x8f\x93\x79\x40\xe6\x27\x27\x27\x8f\x6d\x0e\xa2\x06\xd5\x5d\x87\x15\xaa\x69\x01\x72\xf3\xab\x05\x35\xf4\x5f\x20\x74\x69\x65\x87\x0b\x6d\x1d\xe4\xa0\x50\x37\x02\x3c\xd2\x9a\x64\xce\xb9\x29\xbd\xdb\xbe\xf4\x2e\x86\xd2\xeb\xe6\x2b\x50\x88\x20\x85\xec\x60\xc0\x50\x0e\x6c\x34\x61\x6c\xb5\x09\x41\x3c\x5a\x4b\x85\x18\xcb\x1c\x57\x0f\x0c\x76\xca\x1b\x0d\x2c\x72\xb2\xd7\x5f\xba\xa1\x6b\x34\x5f\x21\x42\x8c\x07\x88\xdd\x08\xd3\x53\xce\xf5\x00\x50\x0f\xdb\x7a\xce\x3f\xef\xae\xaf\xf4\xaf\x82\xcc\x99\x74\xad\x53\xff\x46\xeb\x16\xc9\x37\xff\xf8\xe1\xa7\x89\x7a\x6a\xe0\xec\xcc\xbd\x6b\x31\x06\x20\x40\xdc\x1f\xdf\xf6\xc8\x93\xed\x29\x6a\x40\x0c\x72\xbd\x34\x73\xa4\x12\xb6\x64\x3f\x7b\x43\x01\x48\xf6\x3c\x6e\x36\xbc\xdd\x16\xfe\x9f\xbb\x49\x85\x84\xba\xa7\x15\xec\xba\xbf\x27\xef\x0c\xea\x86\xfe\xac\xf3\x55\xc3\x40\x7b\x7f\xc0\xe6\xf9\x61\xe5\x9e\xe1\x52\xf0\xb6\xc9\xf6\xef\x8b\xd1\xa1\x8f\x32\x05\x23\x05\x25\x17\x14\xb6\x46\x66\xc4\xd8\xe8\x5b\x6f\x64\x93\x5d\x26\x41\x7f\xd6\x1b\x0c\xb2\x86\xb5\x02\x31\x9b\x4d\xbd\x58\x62\xae\x9d\xbb\xb2\xa3\x85\x85\xcb\x36\xb7\x77\xca\x68\xdb\x8e\x84\xcc\xf9\x60\x7f\x77\xac\x6d\xc9\xac\x03\xc4\x9a\x55\x5f\x1e\x9e\xb7\x5f\x53\xcf\x5e\x75\x5b\xab\x3b\xdf\x2f\x87\xee\xb1\x5b\x49\x1d\xd7\x9b\xc6\x3a\x66\x4d\x87\x90\x39\x7b\xd7\xc1\xb8\x46\xbe\xe8\x46\xfc\x9b\xba\xf9\x37\xe0\xcb\x76\xfa\x6f\xc8\xd6\xdf\x73\xb9\x7c\x0b\xae\xb0\xf4\x0a\xd8\xfc\x48\xf8\x5c\xba\x30\xe3\x2d\xf1\x0c\x21\x20\xe4\x74\xd7\xec\xb7\x08\xa5\xe6\xcd\x37\x3c\xf1\xaf\x79\x63\x1f\x63\x68\x7f\xca\x3e\x40\xcb\x79\x37\x78\x9b\x06\x78\xdf\x0f\xde\xcf\xb0\x64\x5f\x04\xf6\xc8\x68\x90\x40\x15\xa8\xd1\x73\x85\xd7\x2f\xb9\x7c\xfd\xf2\xd7\xe5\xd0\x18\x09\x48\x2c\x68\xa3\x8c\x87\xff\x5e\x81\x00\x47\x71\xa7\x69\x73\x46\xe5\xca\x51\x2b\x70\x04\xc8\x96\x29\x5a\x97\xce\x66\x2e\xda\x58\xbb\xb8\x3e\x7f\xb5\xbc\xfd\xe5\xf2\xf7\x23\x26\xef\x57\x60\x90\x0e\x2f\x8c\xb5\x0b\x8e\x1f\x41\x14\x94\xc1\x08\x5f\xa0\x96\xa9\xcc\x71\x37\x4a\x77\x67\x9b\x9b\x3f\xee\x7e\x3b\xea\xb3\x5a\x81\x70\x9a\x56\xae\x1c\x2e\x9c\x9a\xab\x03\x96\xc7\xa3\xc9\xe0\xfa\xe5\xed\xf2\xfc\xfe\xfa\xf6\xcf\xe3\x9e\x13\x2a\x00\x2b\x2e\x9e\xec\x9b\x8a\xa6\x41\x87\x81\x9a\xe6\xc0\x2e\xd3\x77\x5c\x3c\x9a\x54\xdd\xdd\xeb\xe7\x3f\x2e\x7f\xbf\x78\x75\x79\xff\x70\xfe\xfb\xe5\xf2\xea\xfe\xe1\x99\x43\xd8\x65\xcc\xa4\xc2\x2b\xaa\x1c\xcc\x28\xd4\xca\xf9\xc1\x9c\x39\x56\xec\xc7\xad\x03\x19\xfb\x71\xe0\x39\x2a\xf0\x04\xe7\x8a\x81\x94\x36\xcf\xc3\xb9\x1f\x63\x1c\x17\xe1\x1c\x82\x68\x8e\xe2\x7c\x91\xa6\x69\x9c\xe2\x18\x03\x49\x92\x45\xe2\x47\x18\xe1\x45\x9c\x86\x7e\xb0\x48\x09\x86\x1c\x63\x94\x06\x8b\xc5\x3c\x9d\x01\x84\xf9\xe2\x68\x88\x17\x2f\x97\xaf\xaf\xaf\xcc\xd3\xcf\xf2\xee\xee\x78\x90\xfd\xb3\xc5\x5e\x9c\x04\x41\xc5\xeb\x3e\xce\x47\xaa\xc8\x8f\xf6\x21\xe0\xd0\xc1\x9a\x57\xb3\x01\x9a\x05\xe1\x6c\x6e\x3d\x93\x0a\x9a\xbd\xf4\xef\x5e\x33\x50\x4d\x3c\x9d\x31\x83\xc5\xbe\x79\x7c\xf7\xdd\x87\x83\x47\xb5\x79\xae\xd4\x47\x4c\xeb\xf2\x82\x0a\x83\x1e\x92\x68\x83\xc0\xbc\xaa\x90\xae\xe5\x37\xae\x3d\x2a\xf7\xd4\x71\xbb\x27\xbf\xb3\xf1\x0e\xdb\x4c\x7d\xd4\x28\xb3\x62\xef\x35\x55\xff\x73\x3d\xaf\x11\xbc\xd4\x94\x9d\x35\x0c\xd1\xdd\x27\xef\x01\x05\xef\x1b\x2e\x14\x08\x8f\x37\xea\xcc\xbe\x8f\x4d\x68\x6d\x1e\xfe\xc0\x3c\x7a\x1e\x5b\x5a\x08\xf3\x5b\x96\x9c\x91\xa1\x12\x27\x6b\xff\x53\x68\xbd\x91\xf6\x5d\xc3\x35\xc9\x3a\xc6\x4d\x5f\xf8\x78\x6c\x39\xe3\x18\x19\x66\x70\xf7\x12\x79\x36\xe9\x68\x1a\xe4\x1b\x27\xb4\xea\xf9\x60\xcf\xcc\x01\x76\x06\xc6\x04\x68\x89\xf5\xa9\x3b\xc9\xc3\x18\x9d\x0c\x1a\xa3\x1b\xcd\x47\xf7\xed\xc9\xff\x02\x00\x00\xff\xff\x4e\xaf\x8f\x01\x34\x1a\x00\x00")
 
 func stacksBuildStackYamlBytes() ([]byte, error) {
 	return bindataRead(
@@ -92,7 +92,7 @@ func stacksBuildStackYaml() (*asset, error) {
 		return nil, err
 	}
 
-	info := bindataFileInfo{name: "stacks/build-stack.yaml", size: 7037, mode: os.FileMode(420), modTime: time.Unix(1557785965, 0)}
+	info := bindataFileInfo{name: "stacks/build-stack.yaml", size: 6708, mode: os.FileMode(420), modTime: time.Unix(1557785965, 0)}
 	a := &asset{bytes: bytes, info: info}
 	return a, nil
 }

stacks/build-stack.yaml

@@ -52,25 +52,12 @@ services:
             privileged: true
   registry:
     image: registry:2
-    labels:
-      request-subdomain: 'true'
-    secrets:
-    - rio-wildcard:/etc/registry
     env:
-    - REGISTRY_HTTP_ADDR=0.0.0.0:443
-    - REGISTRY_HTTP_TLS_CERTIFICATE=/etc/registry/tls.crt
-    - REGISTRY_HTTP_TLS_KEY=/etc/registry/tls.key
+    - REGISTRY_HTTP_ADDR=0.0.0.0:80
     ports:
-    - 443:443/tcp,registry
+    - 80:80/tcp,registry
     volumes:
     - storage-registry:/var/lib/registry
-    containers:
-    - name: cert-checker
-      init: true
-      image: rancher/rio-cert-checker:v0.1.0-rc7
-      imagePullPolicy: Always
-      secrets:
-      - rio-wildcard:/etc/registry
   webhook:
     global_permissions:
     - "* gitwatcher.cattle.io/gitwatchers"
@@ -213,6 +200,7 @@ kubernetes:
         workingDir: $${DIRECTORY}
         command: ["buildctl", "--addr=$${BUILDKIT_DAEMON_ADDRESS}", "build",
                   "--progress=plain",
+                  "--exporter-opt=registry.insecure=true",
                   "--frontend=dockerfile.v0",
                   "--frontend-opt", "filename=$${DOCKERFILE}",
                   "--local", "context=.", "--local", "dockerfile=.",