2405d1ce6e
The 429 error is not a pull rate limit, but rather a general API endpoint throttling to prevent DoS attacks through API. Let's correct it in the document. Signed-off-by: Michal Konecny <mkonecny@redhat.com>
85 lines
2.9 KiB
ReStructuredText
85 lines
2.9 KiB
ReStructuredText
Migrate registry.fedoraproject.org to quay.io
|
|
=============================================
|
|
|
|
Purpose
|
|
-------
|
|
|
|
This investigation is looking into service `quay.io <https://quay.io/>`_ and how can we utilize
|
|
it for the projects hosted on `registry.fedoraproject.org <https://registry.fedoraproject.org/>`_. It should also resolve if this is work should be initiative.
|
|
|
|
Resources
|
|
---------
|
|
|
|
* Fedora Infrastructure ticket: https://pagure.io/fedora-infrastructure/issue/10386
|
|
|
|
Requirements
|
|
------------
|
|
|
|
* Multi Arch containers (Already supported on quay.io)
|
|
* OCI images (Already supported on quay.io)
|
|
* Web interface (Quay.io already has web interface)
|
|
* Integrate Quay.io in current workflow
|
|
* Must not affect users of images
|
|
* `candidate-registry <https://candidate-registry.fedoraproject.org/>`_ must be moved as well
|
|
|
|
Nice to have
|
|
------------
|
|
|
|
* Staging namespace on quay.io
|
|
|
|
Risks
|
|
-----
|
|
|
|
* There is a `API endpoint throttling <https://docs.quay.io/issues/429.html>`_ per second on IP address on quay.io. This could cause issues in the future, but current load should be easily handled.
|
|
|
|
Statistics
|
|
----------
|
|
|
|
These statistical data were retrieved from `oci-registry.iad2.fedoraproject.org` machine logs.
|
|
The logs on the machine are kept only for few days. These data were obtained from 16th September 2023 to 21st September 2023 (it corresponds with release of Fedora 39 Beta).
|
|
|
|
* Number of downloads per day: 800 - 1 000
|
|
* Number of requests per day: 350 000 - 400 000
|
|
|
|
Investigation
|
|
-------------
|
|
|
|
The investigation is separated to multiple parts based on the current artifacts hosted on registry:
|
|
Fedora flatpaks, Fedora container images (base, minimal, coreos) and toolbox images.
|
|
|
|
.. toctree::
|
|
:maxdepth: 1
|
|
|
|
flatpaks
|
|
toolbox
|
|
fedora_images
|
|
|
|
|
|
|
|
Conclusions
|
|
-----------
|
|
|
|
Migrating `registry.fedoraproject.org <https://registry.fedoraproject.org/>`_ to `quay.io <https://quay.io/>`_
|
|
doesn't seem to be initiative worthy. Especially with changes happening in Fedora 39.
|
|
There needs to be changes done to all three build pipelines we investigated, but those aren't complex.
|
|
|
|
Recommendations
|
|
---------------
|
|
|
|
It will be best to first set everything on staging and then continue with production.
|
|
Only redirect the Fedora 39+ workflow and continue with step 4 after Fedora 38 will
|
|
be EOL.
|
|
|
|
Proposed Roadmap
|
|
----------------
|
|
|
|
* Step 1 - Create namespaces corresponding to candidate-registry and registry on `quay.io <https://quay.io/>`_ (Optional: Create staging namespaces as well)
|
|
* Step 2 - Modify configurations and scripts (see corresponding investigation document for what needs
|
|
to be changed)
|
|
* Step 3 - Redirect proxies to `quay.io <https://quay.io/>`_
|
|
* Step 4 - Decommision `candidate-registry <https://candidate-registry.fedoraproject.org/>`_ and `candidate-registry <https://candidate-registry.fedoraproject.org/>`_
|
|
|
|
Estimate of work
|
|
----------------
|
|
|
|
This should be handled as normal ticket. It would need 1 sysadmin for 2-4 weeks.
|