Add optional highAvailability feature for registry cache

docs/usage/registry-cache/configuration.md

@@ -100,6 +100,8 @@ The `providerConfig.caches[].proxy.httpProxy` field represents the proxy server
 
 The `providerConfig.caches[].proxy.httpsProxy` field represents the proxy server for HTTPS connections which is used by the registry cache. It must include an `https://` or `http://` scheme.
 
+The `providerConfig.caches[].highAvailability.enabled` defines if the registry cache is scaled to 2 replicas. See [High Availability](#high-availability) for more information.
+
 ## Garbage Collection
 
 When the registry cache receives a request for an image that is not present in its local store, it fetches the image from the upstream, returns it to the client and stores the image in the local store. The registry cache runs a scheduler that deletes images when their time to live (ttl) expires. When adding an image to the local store, the registry cache also adds a time to live for the image. The ttl defaults to `168h` (7 days) and is configurable. The garbage collection can be disabled by setting the ttl to `0s`. Requesting an image from the registry cache does not extend the time to live of the image. Hence, an image is always garbage collected from the registry cache store when its ttl expires.
@@ -145,7 +147,9 @@ There is always the option to remove the cache from the Shoot spec and to readd
 
 ## High Availability
 
-The registry cache runs with a single replica. This fact may lead to concerns for the high availability such as "What happens when the registry cache is down? Does containerd fail to pull the image?". As outlined in the [How does it work? section](#how-does-it-work), containerd is configured to fall back to the upstream registry if it fails to pull the image from the registry cache. Hence, when the registry cache is unavailable, the containerd's image pull operations are not affected because containerd falls back to image pull from the upstream registry.
+Per default the registry cache runs with a single replica. This fact may lead to concerns for the high availability such as "What happens when the registry cache is down? Does containerd fail to pull the image?". As outlined in the [How does it work? section](#how-does-it-work), containerd is configured to fall back to the upstream registry if it fails to pull the image from the registry cache. Hence, when the registry cache is unavailable, the containerd's image pull operations are not affected because containerd falls back to image pull from the upstream registry.
+
+In special cases where this is not enough (for example when using an upstream which is only accessible with a proxy) it is possible to set `providerConfig.caches[].highAvailability` to `true`, this will add the label `high-availability-config.resources.gardener.cloud/type=server` and scale the statefulset to 2 replicas. The `topologySpreadConstraints` is added according to the cluster configuration. See also [High Availability of Deployed Components](https://gardener.cloud/docs/gardener/high-availability/#system-components). Each registry cache replica uses an own volume, so each registry cache needs to pull the image from upstream.
 
 ## Possible Pitfalls
 

hack/api-reference/registry.md

@@ -44,6 +44,36 @@ Defaults to 168h (7 days).</p>
 </tr>
 </tbody>
 </table>
+<h3 id="registry.extensions.gardener.cloud/v1alpha3.HighAvailability">HighAvailability
+</h3>
+<p>
+(<em>Appears on:</em>
+<a href="#registry.extensions.gardener.cloud/v1alpha3.RegistryCache">RegistryCache</a>)
+</p>
+<p>
+<p>HighAvailability contains settings for high availability of the registry cache.</p>
+</p>
+<table>
+<thead>
+<tr>
+<th>Field</th>
+<th>Description</th>
+</tr>
+</thead>
+<tbody>
+<tr>
+<td>
+<code>enabled</code></br>
+<em>
+bool
+</em>
+</td>
+<td>
+<p>Enabled defines if the registry cache is scaled with the <a href="https://gardener.cloud/docs/gardener/high-availability/#system-components">High Availability</a> feature.</p>
+</td>
+</tr>
+</tbody>
+</table>
 <h3 id="registry.extensions.gardener.cloud/v1alpha3.Proxy">Proxy
 </h3>
 <p>
@@ -186,6 +216,20 @@ Proxy
 <p>Proxy contains settings for a proxy used in the registry cache.</p>
 </td>
 </tr>
+<tr>
+<td>
+<code>highAvailability</code></br>
+<em>
+<a href="#registry.extensions.gardener.cloud/v1alpha3.HighAvailability">
+HighAvailability
+</a>
+</em>
+</td>
+<td>
+<em>(Optional)</em>
+<p>HighAvailability contains settings for high availability of the registry cache.</p>
+</td>
+</tr>
 </tbody>
 </table>
 <h3 id="registry.extensions.gardener.cloud/v1alpha3.RegistryCacheStatus">RegistryCacheStatus

pkg/apis/registry/types.go

@@ -40,6 +40,8 @@ type RegistryCache struct {
 	SecretReferenceName *string
 	// Proxy contains settings for a proxy used in the registry cache.
 	Proxy *Proxy
+	//HighAvailability contains settings for high availability of the registry cache.
+	HighAvailability *HighAvailability
 }
 
 // Volume contains settings for the registry cache volume.
@@ -68,6 +70,12 @@ type Proxy struct {
 	HTTPSProxy *string
 }
 
+// HighAvailability contains settings for high availability of the registry cache.
+type HighAvailability struct {
+	// Enabled defines if the registry cache is scaled with the [High Availability](https://gardener.cloud/docs/gardener/high-availability/#system-components) feature.
+	Enabled bool
+}
+
 var (
 	// DefaultTTL is the default time to live of a blob in the cache.
 	DefaultTTL = metav1.Duration{Duration: 7 * 24 * time.Hour}

pkg/apis/registry/v1alpha3/types.go

@@ -46,6 +46,9 @@ type RegistryCache struct {
 	// Proxy contains settings for a proxy used in the registry cache.
 	// +optional
 	Proxy *Proxy `json:"proxy,omitempty"`
+	// HighAvailability contains settings for high availability of the registry cache.
+	// +optional
+	HighAvailability *HighAvailability `json:"highAvailability,omitempty"`
 }
 
 // Volume contains settings for the registry cache volume.
@@ -79,6 +82,12 @@ type Proxy struct {
 	HTTPSProxy *string `json:"httpsProxy,omitempty"`
 }
 
+// HighAvailability contains settings for high availability of the registry cache.
+type HighAvailability struct {
+	// Enabled defines if the registry cache is scaled with the [High Availability](https://gardener.cloud/docs/gardener/high-availability/#system-components) feature.
+	Enabled bool `json:"enabled,omitempty"`
+}
+
 var (
 	// DefaultTTL is the default time to live of a blob in the cache.
 	DefaultTTL = metav1.Duration{Duration: 7 * 24 * time.Hour}

pkg/component/registrycaches/registry_caches.go

@@ -18,6 +18,7 @@ import (
 	gardencorev1beta1 "github.com/gardener/gardener/pkg/apis/core/v1beta1"
 	v1beta1constants "github.com/gardener/gardener/pkg/apis/core/v1beta1/constants"
 	v1beta1helper "github.com/gardener/gardener/pkg/apis/core/v1beta1/helper"
+	resourcesv1alpha1 "github.com/gardener/gardener/pkg/apis/resources/v1alpha1"
 	"github.com/gardener/gardener/pkg/client/kubernetes"
 	"github.com/gardener/gardener/pkg/component"
 	"github.com/gardener/gardener/pkg/utils"
@@ -478,6 +479,10 @@ source /entrypoint.sh /etc/distribution/config.yml
 		}
 	}
 
+	if cache.HighAvailability != nil && cache.HighAvailability.Enabled {
+		metav1.SetMetaDataLabel(&statefulSet.ObjectMeta, resourcesv1alpha1.HighAvailabilityConfigType, resourcesv1alpha1.HighAvailabilityConfigTypeServer)
+	}
+
 	var vpa *vpaautoscalingv1.VerticalPodAutoscaler
 	if r.values.VPAEnabled {
 		vpa = &vpaautoscalingv1.VerticalPodAutoscaler{