Starts a secure, trusted OCI registry for a GitHub Actions workflow. The nuscenes of creating and trusting certificates, or allowing clients to run insecurely is avoided.

• Usage
• Community
  • Code of Conduct
  • Communication
  • Contributing
• Acknowledgements
• License

See action.yml

- uses: reconcilerio/registry@v1
  with:
    # Optional kind-version.
    # Version of the kind CLI to install.
    # Default: latest stable
    kind-version: ''

    # Optional kubernetes-version.
    # Version of Kubernetes for the cluster. May be a tag that resolves to an image in the ghcr.io/reconcilerio/kind/node repository, or a fully qualified image. Tags match upstream kubernetes release versions, typically matching `v{MAJOR}.{MINOR}.{PATCH}` with an alias of `v{MAJOR.{MINOR}` to the latest patch for the minor line.
    # For example 'v1.33' maps to 'v1.33.11' and the fully qualified image 'ghcr.io/reconcilerio/kind/node:v1.33.11'.
    # Default: latest stable
    kubernetes-version: ''

    # Optional registry.
    # Coordinates for a local OCI registry. Often specified in conjunction with a CA certificate.
    # Default: none
    registry: ''

    # Optional registry-ca.
    # Path to the CA certificate for the registry. This cluster is configured to trust this certificate for operations against the registry.
    # Default: none
    registry-ca: ''

Basic

steps:
- uses: reconcilerio/kind@v1

Starts a kind cluster with a recent, stable Kubernetes.

With registry:

steps:
- uses: reconcilerio/registry@v1
  id: registry
- uses: reconcilerio/kind@v1
  with:
    kubernetes-version: v1.36
    registry: ${{ steps.registry.outputs.registry }}
    registry-ca: ${{ steps.registry.outputs.tls-ca }}

Starts a kind cluster configured to use a local OCI registry with a generated certificate that is trust by the job VM and the kind cluster.

Images can be pushed to the registry (defined by ${{ steps.registry.outputs.registry }}, defaulting to registry.local), and pulled for pods within the cluster. Direct, programmatic access to the registry from within a running container will likely require propagating the CA certificate to that container in a way it understands.

The reconciler.io projects follow the Contributor Covenant Code of Conduct. In short, be kind and treat others with respect.

General discussion and questions about the project can occur either on the Kubernetes Slack #reconcilerio channel, or in the project's GitHub discussions. Use the channel you find most comfortable.

The reconciler.io project team welcomes contributions from the community. A contributor license agreement (CLA) is not required. You own full rights to your contribution and agree to license the work to the community under the Apache License v2.0, via a Developer Certificate of Origin (DCO). For more detailed information, refer to CONTRIBUTING.md.

The basic ideas that manifest in this action originated as a pile of bash scripts in the Service Bindings for Kubernetes runtime project, among others.

Apache License v2.0: see LICENSE for details.