Constraints

Inside a customer's network, machines rarely reach the internet directly. There is an HTTP proxy, a private registry that mirrors Docker Hub, a mirror of the distribution's packages, and the site's own time servers. constraints: says so once, and every target applies it. It usually lives in a profile, one customer at a time.

Constraints arrive in the next release.

# profiles/bank-fr.yml
spec:
  constraints:
    proxy: { http: "http://proxy.bank.local:3128", no_proxy: [.bank.local] }
    registries: { docker.io: registry.bank.local/dockerhub, ghcr.io: registry.bank.local/ghcr }
    mirrors:
      debian: "http://mirror.bank.local/debian"
      ubuntu: "http://mirror.bank.local/ubuntu"
      pypi: "https://pypi.bank.local/simple"
      npm: "https://npm.bank.local"
    ntp: [ntp1.bank.local, ntp2.bank.local]

Field	What it does
`proxy.http`, `proxy.https`	The proxy for outbound HTTP and HTTPS. `https` defaults to `http`.
`proxy.no_proxy`	Names, domains (`.corp`) and blocks reached directly. The environment's own machine names and network blocks, and localhost, are always added.
`registries`	A mirror per registry, as an image prefix without a scheme. `docker.io: registry.corp/dockerhub` pulls `redis:7` as `registry.corp/dockerhub/library/redis:7`.
`mirrors.debian`, `mirrors.ubuntu`	Replace the distribution's archive in the VMs' apt sources. Debian's separate `debian-security` archive is left as it is.
`mirrors.pypi`, `mirrors.npm`	A Python package index and an npm registry, for containers and VMs.
`ntp`	Time servers for the Linux VMs.

On containers

Images: every image in the Compose file and the Kubernetes manifests is pulled through its registry's mirror, Isoloom's own router and check images included. Images the project builds are local tags and stay as they are. Their FROM lines belong to your Dockerfiles.
Proxy: each machine's container gets HTTP_PROXY, HTTPS_PROXY and NO_PROXY, in both cases. Its image build gets the same as Docker's predefined build arguments, so Dockerfiles need no change.
Mirrors: PIP_INDEX_URL and NPM_CONFIG_REGISTRY for the machines.
Checks: Isoloom's check runners never go through the proxy.

On Linux VMs

Every Linux VM runs a preamble as root before anything else. It is idempotent.

The proxy for every login shell, systemd's services, sudo, apt, dnf or yum, and Docker's daemon.
Debian's and Ubuntu's apt sources pointed at the mirrors.
/etc/pip.conf and /etc/npmrc.
chrony when it is installed, else systemd-timesyncd, on the time servers.

Target	Where the preamble runs
Vagrant, docker-vm, hybrid	Each VM's first provisioner: machines, router, controller, the `shell` tool, the Docker host
Proxmox	Cloud-init's `bootcmd`, before cloud-init installs packages
Clouds (`cloud-vm`, `cloud-docker`)	The first step once cloud-init is done

Windows machines aren't covered yet.

Validated

isoloom validate names the field when a proxy or mirror isn't a URL, a registry key isn't a host, or a registry mirror carries a scheme. Without constraints:, every generated file is unchanged.