# Throwaway in-cluster OCI registry, published on NodePort 30500.
#
# Talos has no Docker daemon and no way to side-load an image, so the images built
# from this repo must come from a registry. This one lives *inside* the cluster on
# purpose: a registry on the laptop needs an inbound port opened on firewalld's
# libvirt zone (root), while pushing from the laptop to the node is outbound and
# always allowed. The node then pulls from its own NodePort.
#
# Talos must be told it speaks plain HTTP — see the machine.registries.mirrors
# patch in docs/runbooks/kubernetes-talos.md. Storage is emptyDir: if this pod is
# replaced, re-run `make k8s-images`.
apiVersion: v1
kind: Namespace
metadata:
  name: registry
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: registry
  namespace: registry
spec:
  replicas: 1
  strategy: { type: Recreate }
  selector:
    matchLabels: { app: registry }
  template:
    metadata:
      labels: { app: registry }
    spec:
      containers:
        - name: registry
          image: docker.io/library/registry:2
          env:
            - name: REGISTRY_STORAGE_DELETE_ENABLED
              value: "true"
          ports:
            - containerPort: 5000
          readinessProbe:
            httpGet: { path: /v2/, port: 5000 }
          volumeMounts:
            - name: data
              mountPath: /var/lib/registry
      volumes:
        - name: data
          emptyDir: {}
---
apiVersion: v1
kind: Service
metadata:
  name: registry
  namespace: registry
spec:
  type: NodePort
  selector: { app: registry }
  ports:
    - name: http
      port: 5000
      targetPort: 5000
      nodePort: 30500