mirror of
https://github.com/wahyd4/charts.git
synced 2026-08-09 05:06:29 +10:00
[bitnami/harbor] Deprecate harbor clair (#10728)
* deprecate harbor clair Signed-off-by: mauraza <gibone@vmware.com> * delete harbor-adater-clair Signed-off-by: mauraza <gibone@vmware.com>
This commit is contained in:
Ibone González Mauraza
@@ -1,12 +1,12 @@
|
||||
dependencies:
|
||||
- name: redis
|
||||
repository: https://charts.bitnami.com/bitnami
|
||||
version: 16.12.1
|
||||
version: 16.12.2
|
||||
- name: postgresql
|
||||
repository: https://charts.bitnami.com/bitnami
|
||||
version: 11.6.6
|
||||
version: 11.6.7
|
||||
- name: common
|
||||
repository: https://charts.bitnami.com/bitnami
|
||||
version: 1.16.0
|
||||
digest: sha256:f8983d23d80b1beeb933579613a89256816bc35bc66ceae297f3e20dee761223
|
||||
generated: "2022-06-11T06:45:05.352544625Z"
|
||||
digest: sha256:3ba340901c0196640e0b1ceb146569e3c29faebbc16cd87df5a60ce4a4c4b38e
|
||||
generated: "2022-06-20T16:58:56.373286227+02:00"
|
||||
|
||||
@@ -34,4 +34,4 @@ sources:
|
||||
- https://github.com/bitnami/bitnami-docker-harbor-registry
|
||||
- https://github.com/bitnami/bitnami-docker-harbor-registryctl
|
||||
- https://goharbor.io/
|
||||
version: 13.2.7
|
||||
version: 14.0.0
|
||||
|
||||
+28
-151
@@ -29,7 +29,7 @@ For example, the following changes have been introduced:
|
||||
- Uses Bitnami container images:
|
||||
- non-root by default
|
||||
- published for debian-10 and ol-7
|
||||
- This chart support the Harbor optional components Chartmuseum, Clair and Notary integrations.
|
||||
- This chart support the Harbor optional components Chartmuseum and Notary integrations.
|
||||
|
||||
Bitnami charts can be used with [Kubeapps](https://kubeapps.dev/) for deployment and management of Helm Charts in clusters.
|
||||
|
||||
@@ -88,19 +88,19 @@ Additionally, if `persistence.resourcePolicy` is set to `keep`, you should manua
|
||||
|
||||
### Harbor common parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| ---------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------- |
|
||||
| `adminPassword` | The initial password of Harbor admin. Change it from portal after launching Harbor | `""` |
|
||||
| `externalURL` | The external URL for Harbor Core service | `https://core.harbor.domain` |
|
||||
| `proxy.httpProxy` | The URL of the HTTP proxy server | `""` |
|
||||
| `proxy.httpsProxy` | The URL of the HTTPS proxy server | `""` |
|
||||
| `proxy.noProxy` | The URLs that the proxy settings not apply to | `127.0.0.1,localhost,.local,.internal` |
|
||||
| `proxy.components` | The component list that the proxy settings apply to | `["core","jobservice","clair","trivy"]` |
|
||||
| `logLevel` | The log level used for Harbor services. Allowed values are [ fatal \| error \| warn \| info \| debug \| trace ] | `debug` |
|
||||
| `internalTLS.enabled` | Use TLS in all the supported containers: chartmuseum, clair, core, jobservice, portal, registry and trivy | `false` |
|
||||
| `internalTLS.caBundleSecret` | Name of an existing secret with a custom CA that will be injected into the trust store for chartmuseum, clair, core, jobservice, registry, trivy components | `""` |
|
||||
| `ipFamily.ipv6.enabled` | Enable listening on IPv6 ([::]) for NGINX-based components (NGINX,portal) | `true` |
|
||||
| `ipFamily.ipv4.enabled` | Enable listening on IPv4 for NGINX-based components (NGINX,portal) | `true` |
|
||||
| Name | Description | Value |
|
||||
| ---------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------- |
|
||||
| `adminPassword` | The initial password of Harbor admin. Change it from portal after launching Harbor | `""` |
|
||||
| `externalURL` | The external URL for Harbor Core service | `https://core.harbor.domain` |
|
||||
| `proxy.httpProxy` | The URL of the HTTP proxy server | `""` |
|
||||
| `proxy.httpsProxy` | The URL of the HTTPS proxy server | `""` |
|
||||
| `proxy.noProxy` | The URLs that the proxy settings not apply to | `127.0.0.1,localhost,.local,.internal` |
|
||||
| `proxy.components` | The component list that the proxy settings apply to | `["core","jobservice","trivy"]` |
|
||||
| `logLevel` | The log level used for Harbor services. Allowed values are [ fatal \| error \| warn \| info \| debug \| trace ] | `debug` |
|
||||
| `internalTLS.enabled` | Use TLS in all the supported containers: chartmuseum, core, jobservice, portal, registry and trivy | `false` |
|
||||
| `internalTLS.caBundleSecret` | Name of an existing secret with a custom CA that will be injected into the trust store for chartmuseum, core, jobservice, registry, trivy components | `""` |
|
||||
| `ipFamily.ipv6.enabled` | Enable listening on IPv6 ([::]) for NGINX-based components (NGINX,portal) | `true` |
|
||||
| `ipFamily.ipv4.enabled` | Enable listening on IPv4 for NGINX-based components (NGINX,portal) | `true` |
|
||||
|
||||
|
||||
### Traffic Exposure Parameters
|
||||
@@ -250,7 +250,7 @@ Additionally, if `persistence.resourcePolicy` is set to `keep`, you should manua
|
||||
| `volumePermissions.enabled` | Enable init container that changes the owner and group of the persistent volume | `false` |
|
||||
| `volumePermissions.image.registry` | Init container volume-permissions image registry | `docker.io` |
|
||||
| `volumePermissions.image.repository` | Init container volume-permissions image repository | `bitnami/bitnami-shell` |
|
||||
| `volumePermissions.image.tag` | Init container volume-permissions image tag (immutable tags are recommended) | `11-debian-11-r0` |
|
||||
| `volumePermissions.image.tag` | Init container volume-permissions image tag (immutable tags are recommended) | `11-debian-11-r3` |
|
||||
| `volumePermissions.image.pullPolicy` | Init container volume-permissions image pull policy | `IfNotPresent` |
|
||||
| `volumePermissions.image.pullSecrets` | Init container volume-permissions image pull secrets | `[]` |
|
||||
| `volumePermissions.resources.limits` | Init container volume-permissions resource limits | `{}` |
|
||||
@@ -265,7 +265,7 @@ Additionally, if `persistence.resourcePolicy` is set to `keep`, you should manua
|
||||
| --------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------ | --------------------- |
|
||||
| `nginx.image.registry` | NGINX image registry | `docker.io` |
|
||||
| `nginx.image.repository` | NGINX image repository | `bitnami/nginx` |
|
||||
| `nginx.image.tag` | NGINX image tag (immutable tags are recommended) | `1.21.6-debian-11-r0` |
|
||||
| `nginx.image.tag` | NGINX image tag (immutable tags are recommended) | `1.21.6-debian-11-r4` |
|
||||
| `nginx.image.pullPolicy` | NGINX image pull policy | `IfNotPresent` |
|
||||
| `nginx.image.pullSecrets` | NGINX image pull secrets | `[]` |
|
||||
| `nginx.image.debug` | Enable NGINX image debug mode | `false` |
|
||||
@@ -338,7 +338,7 @@ Additionally, if `persistence.resourcePolicy` is set to `keep`, you should manua
|
||||
| ---------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------ | ----------------------- |
|
||||
| `portal.image.registry` | Harbor Portal image registry | `docker.io` |
|
||||
| `portal.image.repository` | Harbor Portal image repository | `bitnami/harbor-portal` |
|
||||
| `portal.image.tag` | Harbor Portal image tag (immutable tags are recommended) | `2.5.1-debian-11-r0` |
|
||||
| `portal.image.tag` | Harbor Portal image tag (immutable tags are recommended) | `2.5.1-debian-11-r3` |
|
||||
| `portal.image.pullPolicy` | Harbor Portal image pull policy | `IfNotPresent` |
|
||||
| `portal.image.pullSecrets` | Harbor Portal image pull secrets | `[]` |
|
||||
| `portal.image.debug` | Enable Harbor Portal image debug mode | `false` |
|
||||
@@ -410,7 +410,7 @@ Additionally, if `persistence.resourcePolicy` is set to `keep`, you should manua
|
||||
| -------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------- |
|
||||
| `core.image.registry` | Harbor Core image registry | `docker.io` |
|
||||
| `core.image.repository` | Harbor Core image repository | `bitnami/harbor-core` |
|
||||
| `core.image.tag` | Harbor Core image tag (immutable tags are recommended) | `2.5.1-debian-11-r0` |
|
||||
| `core.image.tag` | Harbor Core image tag (immutable tags are recommended) | `2.5.1-debian-11-r4` |
|
||||
| `core.image.pullPolicy` | Harbor Core image pull policy | `IfNotPresent` |
|
||||
| `core.image.pullSecrets` | Harbor Core image pull secrets | `[]` |
|
||||
| `core.image.debug` | Enable Harbor Core image debug mode | `false` |
|
||||
@@ -492,7 +492,7 @@ Additionally, if `persistence.resourcePolicy` is set to `keep`, you should manua
|
||||
| -------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------ |
|
||||
| `jobservice.image.registry` | Harbor Jobservice image registry | `docker.io` |
|
||||
| `jobservice.image.repository` | Harbor Jobservice image repository | `bitnami/harbor-jobservice` |
|
||||
| `jobservice.image.tag` | Harbor Jobservice image tag (immutable tags are recommended) | `2.5.1-debian-11-r0` |
|
||||
| `jobservice.image.tag` | Harbor Jobservice image tag (immutable tags are recommended) | `2.5.1-debian-11-r4` |
|
||||
| `jobservice.image.pullPolicy` | Harbor Jobservice image pull policy | `IfNotPresent` |
|
||||
| `jobservice.image.pullSecrets` | Harbor Jobservice image pull secrets | `[]` |
|
||||
| `jobservice.image.debug` | Enable Harbor Jobservice image debug mode | `false` |
|
||||
@@ -605,7 +605,7 @@ Additionally, if `persistence.resourcePolicy` is set to `keep`, you should manua
|
||||
| `registry.automountServiceAccountToken` | Automount service account token | `false` |
|
||||
| `registry.server.image.registry` | Harbor Registry image registry | `docker.io` |
|
||||
| `registry.server.image.repository` | Harbor Registry image repository | `bitnami/harbor-registry` |
|
||||
| `registry.server.image.tag` | Harbor Registry image tag (immutable tags are recommended) | `2.5.1-debian-11-r0` |
|
||||
| `registry.server.image.tag` | Harbor Registry image tag (immutable tags are recommended) | `2.5.1-debian-11-r4` |
|
||||
| `registry.server.image.pullPolicy` | Harbor Registry image pull policy | `IfNotPresent` |
|
||||
| `registry.server.image.pullSecrets` | Harbor Registry image pull secrets | `[]` |
|
||||
| `registry.server.image.debug` | Enable Harbor Registry image debug mode | `false` |
|
||||
@@ -651,7 +651,7 @@ Additionally, if `persistence.resourcePolicy` is set to `keep`, you should manua
|
||||
| `registry.server.service.ports.metrics` | Harbor Registry metrics service port | `8001` |
|
||||
| `registry.controller.image.registry` | Harbor Registryctl image registry | `docker.io` |
|
||||
| `registry.controller.image.repository` | Harbor Registryctl image repository | `bitnami/harbor-registryctl` |
|
||||
| `registry.controller.image.tag` | Harbor Registryctl image tag (immutable tags are recommended) | `2.5.1-debian-11-r0` |
|
||||
| `registry.controller.image.tag` | Harbor Registryctl image tag (immutable tags are recommended) | `2.5.1-debian-11-r4` |
|
||||
| `registry.controller.image.pullPolicy` | Harbor Registryctl image pull policy | `IfNotPresent` |
|
||||
| `registry.controller.image.pullSecrets` | Harbor Registryctl image pull secrets | `[]` |
|
||||
| `registry.controller.image.debug` | Enable Harbor Registryctl image debug mode | `false` |
|
||||
@@ -700,7 +700,7 @@ Additionally, if `persistence.resourcePolicy` is set to `keep`, you should manua
|
||||
| --------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------ | --------------------- |
|
||||
| `chartmuseum.image.registry` | ChartMuseum image registry | `docker.io` |
|
||||
| `chartmuseum.image.repository` | ChartMuseum image repository | `bitnami/chartmuseum` |
|
||||
| `chartmuseum.image.tag` | ChartMuseum image tag (immutable tags are recommended) | `0.14.0-debian-11-r0` |
|
||||
| `chartmuseum.image.tag` | ChartMuseum image tag (immutable tags are recommended) | `0.14.0-debian-11-r4` |
|
||||
| `chartmuseum.image.pullPolicy` | ChartMuseum image pull policy | `IfNotPresent` |
|
||||
| `chartmuseum.image.pullSecrets` | ChartMuseum image pull secrets | `[]` |
|
||||
| `chartmuseum.image.debug` | Enable ChartMuseum image debug mode | `false` |
|
||||
@@ -784,125 +784,6 @@ Additionally, if `persistence.resourcePolicy` is set to `keep`, you should manua
|
||||
| `chartmuseum.service.ports.https` | Chartmuseum HTTPS service port | `443` |
|
||||
|
||||
|
||||
### Clair Parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| ----------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------ |
|
||||
| `clair.enabled` | Enable Clair scanner. Add it as an additional interrogation service by following https://goharbor.io/docs/latest/administration/vulnerability-scanning/pluggable-scanners | `false` |
|
||||
| `clair.httpProxy` | The http proxy used to update vulnerabilities database from internet | `""` |
|
||||
| `clair.httpsProxy` | The https proxy used to update vulnerabilities database from internet | `""` |
|
||||
| `clair.updatersInterval` | The interval of clair updaters (hours), set to 0 to disable | `12` |
|
||||
| `clair.tls.existingSecret` | Name of an existing secret with the certificates for internal TLS access | `""` |
|
||||
| `clair.replicaCount` | Number of Clair replicas | `1` |
|
||||
| `clair.podSecurityContext.enabled` | Enabled Clair pods' Security Context | `true` |
|
||||
| `clair.podSecurityContext.fsGroup` | Set Clair pod's Security Context fsGroup | `1001` |
|
||||
| `clair.updateStrategy.type` | Clair deployment strategy type - only really applicable for deployments with RWO PVs attached | `RollingUpdate` |
|
||||
| `clair.hostAliases` | Clair pods host aliases | `[]` |
|
||||
| `clair.podLabels` | Add additional labels to the Clair pods (evaluated as a template) | `{}` |
|
||||
| `clair.podAnnotations` | Annotations to add to the Clair pods (evaluated as a template) | `{}` |
|
||||
| `clair.podAffinityPreset` | Clair Pod affinity preset. Ignored if `clair.affinity` is set. Allowed values: `soft` or `hard` | `""` |
|
||||
| `clair.podAntiAffinityPreset` | Clair Pod anti-affinity preset. Ignored if `clair.affinity` is set. Allowed values: `soft` or `hard` | `soft` |
|
||||
| `clair.nodeAffinityPreset.type` | Clair Node affinity preset type. Ignored if `clair.affinity` is set. Allowed values: `soft` or `hard` | `""` |
|
||||
| `clair.nodeAffinityPreset.key` | Clair Node label key to match Ignored if `clair.affinity` is set. | `""` |
|
||||
| `clair.nodeAffinityPreset.values` | Clair Node label values to match. Ignored if `clair.affinity` is set. | `[]` |
|
||||
| `clair.affinity` | Clair Affinity for pod assignment | `{}` |
|
||||
| `clair.nodeSelector` | Clair Node labels for pod assignment | `{}` |
|
||||
| `clair.tolerations` | Clair Tolerations for pod assignment | `[]` |
|
||||
| `clair.topologySpreadConstraints` | Topology Spread Constraints for pod assignment spread across your cluster among failure-domains. Evaluated as a template | `[]` |
|
||||
| `clair.priorityClassName` | Priority Class Name | `""` |
|
||||
| `clair.schedulerName` | Use an alternate scheduler, e.g. "stork". | `""` |
|
||||
| `clair.sidecars` | Add additional sidecar containers to the Clair pods | `[]` |
|
||||
| `clair.initContainers` | Add additional init containers to the Clair pods | `[]` |
|
||||
| `clair.extraVolumes` | Optionally specify extra list of additional volumes for the Clair pods | `[]` |
|
||||
| `clair.automountServiceAccountToken` | Automount service account token | `false` |
|
||||
| `clair.adapter.image.registry` | Harbor Adapter for Clair image registry | `docker.io` |
|
||||
| `clair.adapter.image.repository` | Harbor Adapter for Clair image repository | `bitnami/harbor-adapter-clair` |
|
||||
| `clair.adapter.image.tag` | Harbor Adapter for Clair image tag (immutable tags are recommended) | `2.5.1-debian-11-r0` |
|
||||
| `clair.adapter.image.pullPolicy` | Harbor Adapter for Clair image pull policy | `IfNotPresent` |
|
||||
| `clair.adapter.image.pullSecrets` | Harbor Adapter for Clair image pull secrets | `[]` |
|
||||
| `clair.adapter.image.debug` | Enable Harbor Adapter for Clair image debug mode | `false` |
|
||||
| `clair.adapter.command` | Override default container command (useful when using custom images) | `[]` |
|
||||
| `clair.adapter.args` | Override default container args (useful when using custom images) | `[]` |
|
||||
| `clair.adapter.extraEnvVars` | Array with extra environment variables to add Harbor Adapter for Clair containers | `[]` |
|
||||
| `clair.adapter.extraEnvVarsCM` | ConfigMap containing extra environment variables for Harbor Adapter for Clair containers | `""` |
|
||||
| `clair.adapter.extraEnvVarsSecret` | Secret containing extra environment variables (in case of sensitive data) for Harbor Adapter for Clair containers | `""` |
|
||||
| `clair.adapter.containerPorts.http` | Harbor Adapter for Clair HTTP container port | `8080` |
|
||||
| `clair.adapter.containerPorts.https` | Harbor Adapter for Clair HTTPS container port | `8443` |
|
||||
| `clair.adapter.livenessProbe.enabled` | Enable livenessProbe on Harbor Adapter for Clair containers | `true` |
|
||||
| `clair.adapter.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `20` |
|
||||
| `clair.adapter.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `10` |
|
||||
| `clair.adapter.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `5` |
|
||||
| `clair.adapter.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `6` |
|
||||
| `clair.adapter.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` |
|
||||
| `clair.adapter.readinessProbe.enabled` | Enable readinessProbe on Harbor Adapter for Clair containers | `true` |
|
||||
| `clair.adapter.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `20` |
|
||||
| `clair.adapter.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `10` |
|
||||
| `clair.adapter.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `5` |
|
||||
| `clair.adapter.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `6` |
|
||||
| `clair.adapter.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` |
|
||||
| `clair.adapter.startupProbe.enabled` | Enable startupProbe on Harbor Adapter for Clair containers | `false` |
|
||||
| `clair.adapter.startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `5` |
|
||||
| `clair.adapter.startupProbe.periodSeconds` | Period seconds for startupProbe | `10` |
|
||||
| `clair.adapter.startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `1` |
|
||||
| `clair.adapter.startupProbe.failureThreshold` | Failure threshold for startupProbe | `15` |
|
||||
| `clair.adapter.startupProbe.successThreshold` | Success threshold for startupProbe | `1` |
|
||||
| `clair.adapter.customLivenessProbe` | Custom livenessProbe that overrides the default one | `{}` |
|
||||
| `clair.adapter.customReadinessProbe` | Custom readinessProbe that overrides the default one | `{}` |
|
||||
| `clair.adapter.customStartupProbe` | Custom startupProbe that overrides the default one | `{}` |
|
||||
| `clair.adapter.resources.limits` | The resources limits for the Harbor Adapter for Clair containers | `{}` |
|
||||
| `clair.adapter.resources.requests` | The requested resources for the Harbor Adapter for Clair containers | `{}` |
|
||||
| `clair.adapter.containerSecurityContext.enabled` | Enabled Harbor Adapter for Clair containers' Security Context | `true` |
|
||||
| `clair.adapter.containerSecurityContext.runAsUser` | Set Harbor Adapter for Clair containers' Security Context runAsUser | `1001` |
|
||||
| `clair.adapter.containerSecurityContext.runAsNonRoot` | Set Harbor Adapter for Clair containers' Security Context runAsNonRoot | `true` |
|
||||
| `clair.adapter.lifecycleHooks` | LifecycleHook for the Harbor Adapter for Clair container(s) to automate configuration before or after startup | `{}` |
|
||||
| `clair.adapter.extraVolumeMounts` | Optionally specify extra list of additional volumeMounts for the Harbor Adapter for Clair pods | `[]` |
|
||||
| `clair.adapter.service.ports.http` | Harbor Adapter for Clair HTTP service port | `8080` |
|
||||
| `clair.adapter.service.ports.https` | Harbor Adapter for Clair HTTPS service port | `8443` |
|
||||
| `clair.server.image.registry` | Harbor Clair image registry | `docker.io` |
|
||||
| `clair.server.image.repository` | Harbor Clair image repository | `bitnami/harbor-clair` |
|
||||
| `clair.server.image.tag` | Harbor Clair image tag (immutable tags are recommended) | `2.5.1-debian-11-r0` |
|
||||
| `clair.server.image.pullPolicy` | Harbor Clair image pull policy | `IfNotPresent` |
|
||||
| `clair.server.image.pullSecrets` | Harbor Clair image pull secrets | `[]` |
|
||||
| `clair.server.image.debug` | Enable Harbor Clair image debug mode | `false` |
|
||||
| `clair.server.command` | Override default container command (useful when using custom images) | `[]` |
|
||||
| `clair.server.args` | Override default container args (useful when using custom images) | `[]` |
|
||||
| `clair.server.extraEnvVars` | Array with extra environment variables to add Harbor Clair containers | `[]` |
|
||||
| `clair.server.extraEnvVarsCM` | ConfigMap containing extra environment variables for Harbor Clair containers | `""` |
|
||||
| `clair.server.extraEnvVarsSecret` | Secret containing extra environment variables (in case of sensitive data) for Harbor Clair containers | `""` |
|
||||
| `clair.server.containerPorts.api` | Harbor Clair API container port | `6060` |
|
||||
| `clair.server.containerPorts.health` | Harbor Clair health container port | `6061` |
|
||||
| `clair.server.livenessProbe.enabled` | Enable livenessProbe on Harbor Clair containers | `true` |
|
||||
| `clair.server.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `20` |
|
||||
| `clair.server.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `10` |
|
||||
| `clair.server.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `5` |
|
||||
| `clair.server.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `6` |
|
||||
| `clair.server.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` |
|
||||
| `clair.server.readinessProbe.enabled` | Enable readinessProbe on Harbor Clair containers | `true` |
|
||||
| `clair.server.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `20` |
|
||||
| `clair.server.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `10` |
|
||||
| `clair.server.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `5` |
|
||||
| `clair.server.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `6` |
|
||||
| `clair.server.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` |
|
||||
| `clair.server.startupProbe.enabled` | Enable startupProbe on Harbor Clair containers | `false` |
|
||||
| `clair.server.startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `5` |
|
||||
| `clair.server.startupProbe.periodSeconds` | Period seconds for startupProbe | `10` |
|
||||
| `clair.server.startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `1` |
|
||||
| `clair.server.startupProbe.failureThreshold` | Failure threshold for startupProbe | `15` |
|
||||
| `clair.server.startupProbe.successThreshold` | Success threshold for startupProbe | `1` |
|
||||
| `clair.server.customLivenessProbe` | Custom livenessProbe that overrides the default one | `{}` |
|
||||
| `clair.server.customReadinessProbe` | Custom readinessProbe that overrides the default one | `{}` |
|
||||
| `clair.server.customStartupProbe` | Custom startupProbe that overrides the default one | `{}` |
|
||||
| `clair.server.resources.limits` | The resources limits for the Harbor Clair containers | `{}` |
|
||||
| `clair.server.resources.requests` | The requested resources for the Harbor Clair containers | `{}` |
|
||||
| `clair.server.containerSecurityContext.enabled` | Enabled Harbor Clair containers' Security Context | `true` |
|
||||
| `clair.server.containerSecurityContext.runAsUser` | Set Harbor Clair containers' Security Context runAsUser | `1001` |
|
||||
| `clair.server.containerSecurityContext.runAsNonRoot` | Set Harbor Clair containers' Security Context runAsNonRoot | `true` |
|
||||
| `clair.server.lifecycleHooks` | LifecycleHook for the Harbor Clair container(s) to automate configuration before or after startup | `{}` |
|
||||
| `clair.server.extraVolumeMounts` | Optionally specify extra list of additional volumeMounts for the Harbor Clair pods | `[]` |
|
||||
| `clair.server.service.ports.api` | Harbor Clair API service port | `6060` |
|
||||
| `clair.server.service.ports.health` | Harbor Clair health service port | `6061` |
|
||||
|
||||
|
||||
### Notary Parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
@@ -911,7 +792,7 @@ Additionally, if `persistence.resourcePolicy` is set to `keep`, you should manua
|
||||
| `notary.secretName` | Fill the name of a kubernetes secret if you want to use your own TLS certificate authority, certificate and private key for notary communications. The secret must contain keys named `notary-signer-ca.crt`, `notary-signer.key` and `notary-signer.crt` that contain the CA, certificate and private key. They will be generated if not set. | `""` |
|
||||
| `notary.server.image.registry` | Harbor Notary Server image registry | `docker.io` |
|
||||
| `notary.server.image.repository` | Harbor Notary Server image repository | `bitnami/harbor-notary-server` |
|
||||
| `notary.server.image.tag` | Harbor Notary Server image tag (immutable tags are recommended) | `2.5.1-debian-11-r0` |
|
||||
| `notary.server.image.tag` | Harbor Notary Server image tag (immutable tags are recommended) | `2.5.1-debian-11-r4` |
|
||||
| `notary.server.image.pullPolicy` | Harbor Notary Server image pull policy | `IfNotPresent` |
|
||||
| `notary.server.image.pullSecrets` | Harbor Notary Server image pull secrets | `[]` |
|
||||
| `notary.server.image.debug` | Enable Harbor Notary Server image debug mode | `false` |
|
||||
@@ -973,7 +854,7 @@ Additionally, if `persistence.resourcePolicy` is set to `keep`, you should manua
|
||||
| `notary.server.automountServiceAccountToken` | Automount service account token | `false` |
|
||||
| `notary.signer.image.registry` | Harbor Notary Signer image registry | `docker.io` |
|
||||
| `notary.signer.image.repository` | Harbor Notary Signer image repository | `bitnami/harbor-notary-signer` |
|
||||
| `notary.signer.image.tag` | Harbor Notary Signer image tag (immutable tags are recommended) | `2.5.1-debian-11-r0` |
|
||||
| `notary.signer.image.tag` | Harbor Notary Signer image tag (immutable tags are recommended) | `2.5.1-debian-11-r4` |
|
||||
| `notary.signer.image.pullPolicy` | Harbor Notary Signer image pull policy | `IfNotPresent` |
|
||||
| `notary.signer.image.pullSecrets` | Harbor Notary Signer image pull secrets | `[]` |
|
||||
| `notary.signer.image.debug` | Enable Harbor Notary Signer image debug mode | `false` |
|
||||
@@ -1043,7 +924,7 @@ Additionally, if `persistence.resourcePolicy` is set to `keep`, you should manua
|
||||
| --------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------ | -------------------------------------- |
|
||||
| `trivy.image.registry` | Harbor Adapter Trivy image registry | `docker.io` |
|
||||
| `trivy.image.repository` | Harbor Adapter Trivy image repository | `bitnami/harbor-adapter-trivy` |
|
||||
| `trivy.image.tag` | Harbor Adapter Trivy image tag (immutable tags are recommended) | `2.5.1-debian-11-r0` |
|
||||
| `trivy.image.tag` | Harbor Adapter Trivy image tag (immutable tags are recommended) | `2.5.1-debian-11-r4` |
|
||||
| `trivy.image.pullPolicy` | Harbor Adapter Trivy image pull policy | `IfNotPresent` |
|
||||
| `trivy.image.pullSecrets` | Harbor Adapter Trivy image pull secrets | `[]` |
|
||||
| `trivy.image.debug` | Enable Harbor Adapter Trivy image debug mode | `false` |
|
||||
@@ -1124,7 +1005,7 @@ Additionally, if `persistence.resourcePolicy` is set to `keep`, you should manua
|
||||
| ------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------- |
|
||||
| `exporter.image.registry` | Registry for exporter image | `docker.io` |
|
||||
| `exporter.image.repository` | Repository for exporter image | `bitnami/harbor-exporter` |
|
||||
| `exporter.image.tag` | Tag for exporter image | `2.5.1-debian-11-r0` |
|
||||
| `exporter.image.tag` | Tag for exporter image | `2.5.1-debian-11-r4` |
|
||||
| `exporter.image.pullPolicy` | Harbor exporter image pull policy | `IfNotPresent` |
|
||||
| `exporter.image.pullSecrets` | Specify docker-registry secret names as an array | `[]` |
|
||||
| `exporter.image.debug` | Specify if debug logs should be enabled | `false` |
|
||||
@@ -1202,16 +1083,13 @@ Additionally, if `persistence.resourcePolicy` is set to `keep`, you should manua
|
||||
| `postgresql.primary.initdb.scripts` | Initdb scripts to create Harbor databases | `{}` |
|
||||
| `postgresql.image.registry` | PostgreSQL image registry | `docker.io` |
|
||||
| `postgresql.image.repository` | PostgreSQL image repository | `bitnami/postgresql` |
|
||||
| `postgresql.image.tag` | PostgreSQL image tag (immutable tags are recommended) | `13.7.0-debian-11-r0` |
|
||||
| `postgresql.image.tag` | PostgreSQL image tag (immutable tags are recommended) | `13.7.0-debian-11-r4` |
|
||||
| `externalDatabase.host` | Database host | `localhost` |
|
||||
| `externalDatabase.port` | Database port number | `5432` |
|
||||
| `externalDatabase.user` | Non-root username for Harbor | `bn_harbor` |
|
||||
| `externalDatabase.password` | Password for the non-root username for Harbor | `""` |
|
||||
| `externalDatabase.sslmode` | External database ssl mode | `disable` |
|
||||
| `externalDatabase.coreDatabase` | External database name for core | `""` |
|
||||
| `externalDatabase.clairDatabase` | External database name for clair | `""` |
|
||||
| `externalDatabase.clairUsername` | External database username for clair | `""` |
|
||||
| `externalDatabase.clairPassword` | External database password for clair | `""` |
|
||||
| `externalDatabase.notaryServerDatabase` | External database name for notary server | `""` |
|
||||
| `externalDatabase.notaryServerUsername` | External database username for notary server | `""` |
|
||||
| `externalDatabase.notaryServerPassword` | External database password for notary server | `""` |
|
||||
@@ -1236,7 +1114,6 @@ Additionally, if `persistence.resourcePolicy` is set to `keep`, you should manua
|
||||
| `externalRedis.jobserviceDatabaseIndex` | Index for jobservice database | `1` |
|
||||
| `externalRedis.registryDatabaseIndex` | Index for registry database | `2` |
|
||||
| `externalRedis.chartmuseumDatabaseIndex` | Index for chartmuseum database | `3` |
|
||||
| `externalRedis.clairAdapterDatabaseIndex` | Index for chartmuseum database | `4` |
|
||||
| `externalRedis.trivyAdapterDatabaseIndex` | Index for chartmuseum database | `5` |
|
||||
| `externalRedis.sentinel.enabled` | If external redis with sentinal is used, set it to `true` | `false` |
|
||||
| `externalRedis.sentinel.masterSet` | Name of sentinel masterSet if sentinel is used | `mymaster` |
|
||||
@@ -1406,4 +1283,4 @@ Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
limitations under the License.
|
||||
|
||||
@@ -1,16 +0,0 @@
|
||||
clair:
|
||||
database:
|
||||
type: pgsql
|
||||
options:
|
||||
source: "{{ template "harbor.database.clair" . }}"
|
||||
# Number of elements kept in the cache
|
||||
# Values unlikely to change (e.g. namespaces) are cached in order to save prevent needless roundtrips to the database.
|
||||
cachesize: 16384
|
||||
api:
|
||||
# API server port
|
||||
port: {{ .Values.clair.server.containerPorts.api }}
|
||||
healthport: {{ .Values.clair.server.containerPorts.health }}
|
||||
# Deadline before an API request will respond with a 503
|
||||
timeout: 300s
|
||||
updater:
|
||||
interval: {{ .Values.clair.updatersInterval }}
|
||||
@@ -46,16 +46,5 @@ APP VERSION: {{ .Chart.AppVersion }}
|
||||
echo Username: "admin"
|
||||
echo Password: $(kubectl get secret --namespace {{ .Release.Namespace }} {{ printf "%s-envvars" (include "harbor.core" .) }} -o jsonpath="{.data.HARBOR_ADMIN_PASSWORD}" | base64 -d)
|
||||
|
||||
{{- if .Values.clair.enabled }}
|
||||
|
||||
Clair scanner was deployed. Follow these steps to add it as an additional interrogation service for Harbor:
|
||||
https://goharbor.io/docs/latest/administration/vulnerability-scanning/pluggable-scanners
|
||||
|
||||
Endpoint: {{ include "harbor.clairAdapter.url" . | quote }}
|
||||
Authorization: "None"
|
||||
Options: "Use internal registry address"
|
||||
|
||||
{{- end }}
|
||||
|
||||
{{ include "harbor.validateValues" . }}
|
||||
{{ include "harbor.checkRollingTags" . }}
|
||||
|
||||
@@ -45,11 +45,6 @@ Set the http prefix if the externalURl doesn't have it
|
||||
subPath: ca.crt
|
||||
{{- end -}}
|
||||
|
||||
{{/* Harbor Adapter for Clair URL */}}
|
||||
{{- define "harbor.clairAdapter.url" -}}
|
||||
{{- printf "%s://%s:%d" (ternary "https" "http" .Values.internalTLS.enabled) (include "harbor.clair" .) (ternary .Values.clair.adapter.service.ports.https .Values.clair.adapter.service.ports.http .Values.internalTLS.enabled | int ) -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* port is included in this url as a workaround for issue https://github.com/aquasecurity/harbor-scanner-trivy/issues/108 */}}
|
||||
{{- define "harbor.core.url" -}}
|
||||
{{- printf "%s://%s:%d" (ternary "https" "http" .Values.internalTLS.enabled) (include "harbor.core" .) (ternary .Values.core.service.ports.https .Values.core.service.ports.http .Values.internalTLS.enabled | int) -}}
|
||||
@@ -92,11 +87,6 @@ Set the http prefix if the externalURl doesn't have it
|
||||
{{- printf "%s" (coalesce .Values.chartmuseum.tls.existingSecret (printf "%s-crt" (include "harbor.chartmuseum" .))) -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Clair TLS secret name */}}
|
||||
{{- define "harbor.clair.tls.secretName" -}}
|
||||
{{- printf "%s" (coalesce .Values.clair.tls.existingSecret (printf "%s-crt" (include "harbor.clair" .))) -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Jobservice TLS secret name */}}
|
||||
{{- define "harbor.jobservice.tls.secretName" -}}
|
||||
{{- printf "%s" (coalesce .Values.jobservice.tls.existingSecret (printf "%s-crt" (include "harbor.jobservice" .))) -}}
|
||||
@@ -141,10 +131,6 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this
|
||||
{{- ternary "postgres" .Values.externalDatabase.user .Values.postgresql.enabled -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "harbor.database.clairUsername" -}}
|
||||
{{- ternary "postgres" (default .Values.externalDatabase.user .Values.externalDatabase.clairUsername) .Values.postgresql.enabled -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "harbor.database.notaryServerUsername" -}}
|
||||
{{- ternary "postgres" (default .Values.externalDatabase.user .Values.externalDatabase.notaryServerUsername) .Values.postgresql.enabled -}}
|
||||
{{- end -}}
|
||||
@@ -169,10 +155,6 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "harbor.database.clairRawPassword" -}}
|
||||
{{- ternary (include "harbor.database.rawPassword" .) (default .Values.externalDatabase.password .Values.externalDatabase.clairPassword) .Values.postgresql.enabled -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "harbor.database.notaryServerRawPassword" -}}
|
||||
{{- ternary (include "harbor.database.rawPassword" .) (default .Values.externalDatabase.password .Values.externalDatabase.notaryServerPassword) .Values.postgresql.enabled -}}
|
||||
{{- end -}}
|
||||
@@ -181,10 +163,6 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this
|
||||
{{- ternary (include "harbor.database.rawPassword" .) (default .Values.externalDatabase.password .Values.externalDatabase.notarySignerPassword) .Values.postgresql.enabled -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "harbor.database.escapedClairRawPassword" -}}
|
||||
{{- include "harbor.database.clairRawPassword" . | urlquery | replace "+" "%20" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{ define "harbor.database.escapedNotaryServerRawPassword" -}}
|
||||
{{- include "harbor.database.notaryServerRawPassword" . | urlquery | replace "+" "%20" -}}
|
||||
{{- end -}}
|
||||
@@ -197,18 +175,10 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this
|
||||
{{- include "harbor.database.rawPassword" . | b64enc | quote -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "harbor.database.encryptedClairPassword" -}}
|
||||
{{- include "harbor.database.clairRawPassword" . | b64enc | quote -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "harbor.database.coreDatabase" -}}
|
||||
{{- ternary "registry" .Values.externalDatabase.coreDatabase .Values.postgresql.enabled -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "harbor.database.clairDatabase" -}}
|
||||
{{- ternary "postgres" .Values.externalDatabase.clairDatabase .Values.postgresql.enabled -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "harbor.database.notaryServerDatabase" -}}
|
||||
{{- ternary "notaryserver" .Values.externalDatabase.notaryServerDatabase .Values.postgresql.enabled -}}
|
||||
{{- end -}}
|
||||
@@ -221,10 +191,6 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this
|
||||
{{- ternary "disable" .Values.externalDatabase.sslmode .Values.postgresql.enabled -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "harbor.database.clair" -}}
|
||||
postgres://{{ template "harbor.database.clairUsername" . }}:{{ template "harbor.database.escapedClairRawPassword" . }}@{{ template "harbor.database.host" . }}:{{ template "harbor.database.port" . }}/{{ template "harbor.database.clairDatabase" . }}?sslmode={{ template "harbor.database.sslmode" . }}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "harbor.database.notaryServer" -}}
|
||||
postgres://{{ template "harbor.database.notaryServerUsername" . }}:{{ template "harbor.database.escapedNotaryServerRawPassword" . }}@{{ template "harbor.database.host" . }}:{{ template "harbor.database.port" . }}/{{ template "harbor.database.notaryServerDatabase" . }}?sslmode={{ template "harbor.database.sslmode" . }}
|
||||
{{- end -}}
|
||||
@@ -265,10 +231,6 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this
|
||||
{{- ternary "3" .Values.externalRedis.chartmuseumDatabaseIndex .Values.redis.enabled -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "harbor.redis.clairAdapterDatabaseIndex" -}}
|
||||
{{- ternary "4" .Values.externalRedis.clairAdapterDatabaseIndex .Values.redis.enabled -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "harbor.redis.trivyAdapterDatabaseIndex" -}}
|
||||
{{- ternary "5" .Values.externalRedis.trivyAdapterDatabaseIndex .Values.redis.enabled -}}
|
||||
{{- end -}}
|
||||
@@ -331,23 +293,6 @@ Return whether Redis® uses password authentication or not
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*the username redis is used for a placeholder as no username needed in redis*/}}
|
||||
{{- define "harbor.redisForClairAdapter" -}}
|
||||
{{- if eq .Values.externalRedis.sentinel.enabled false -}}
|
||||
{{- if (include "harbor.redis.escapedRawPassword" . ) -}}
|
||||
{{- printf "redis://redis:%s@%s:%s/%s" (include "harbor.redis.escapedRawPassword" . ) (include "harbor.redis.host" . ) (include "harbor.redis.port" . ) (include "harbor.redis.clairAdapterDatabaseIndex" . ) -}}
|
||||
{{- else -}}
|
||||
{{- printf "redis://%s:%s/%s" (include "harbor.redis.host" . ) (include "harbor.redis.port" . ) (include "harbor.redis.clairAdapterDatabaseIndex" . ) -}}
|
||||
{{- end -}}
|
||||
{{- else -}}
|
||||
{{- if (include "harbor.redis.escapedRawPassword" . ) -}}
|
||||
{{- printf "redis+sentinel://redis:%s@%s/%s" (include "harbor.redis.escapedRawPassword" . ) (include "harbor.redis.host" . ) (include "harbor.redis.clairAdapterDatabaseIndex" . ) -}}
|
||||
{{- else -}}
|
||||
{{- printf "redis+sentinel://%s/%s" (include "harbor.redis.host" . ) (include "harbor.redis.clairAdapterDatabaseIndex" . ) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "harbor.redisForTrivyAdapter" -}}
|
||||
{{- if eq .Values.externalRedis.sentinel.enabled false -}}
|
||||
{{- if (include "harbor.redis.escapedRawPassword" . ) -}}
|
||||
@@ -408,10 +353,6 @@ Return whether Redis® uses password authentication or not
|
||||
{{- printf "%s-database" (include "common.names.fullname" .) -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "harbor.clair" -}}
|
||||
{{- printf "%s-clair" (include "common.names.fullname" .) -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "harbor.trivy" -}}
|
||||
{{- printf "%s-trivy" (include "common.names.fullname" .) -}}
|
||||
{{- end -}}
|
||||
@@ -441,7 +382,7 @@ Return whether Redis® uses password authentication or not
|
||||
{{- end -}}
|
||||
|
||||
{{- define "harbor.noProxy" -}}
|
||||
{{- printf "%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s" (include "harbor.core" .) (include "harbor.jobservice" .) (include "harbor.database" .) (include "harbor.chartmuseum" .) (include "harbor.clair" .) (include "harbor.notary-server" .) (include "harbor.notary-signer" .) (include "harbor.registry" .) (include "harbor.portal" .) (include "harbor.trivy" .) .Values.proxy.noProxy -}}
|
||||
{{- printf "%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s" (include "harbor.core" .) (include "harbor.jobservice" .) (include "harbor.database" .) (include "harbor.chartmuseum" .) (include "harbor.notary-server" .) (include "harbor.notary-signer" .) (include "harbor.registry" .) (include "harbor.portal" .) (include "harbor.trivy" .) .Values.proxy.noProxy -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
@@ -514,20 +455,6 @@ Return the proper Harbor Registryctl image name
|
||||
{{- include "common.images.image" ( dict "imageRoot" .Values.registry.controller.image "global" .Values.global ) -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the proper Harbor Clair image name
|
||||
*/}}
|
||||
{{- define "harbor.clair.server.image" -}}
|
||||
{{- include "common.images.image" ( dict "imageRoot" .Values.clair.server.image "global" .Values.global ) -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the proper Harbor Clair image name
|
||||
*/}}
|
||||
{{- define "harbor.clair.adapter.image" -}}
|
||||
{{- include "common.images.image" ( dict "imageRoot" .Values.clair.adapter.image "global" .Values.global ) -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the proper Nginx image name
|
||||
*/}}
|
||||
@@ -546,7 +473,7 @@ Return the proper image name (for the init container volume-permissions image)
|
||||
Return the proper Docker Image Registry Secret Names
|
||||
*/}}
|
||||
{{- define "harbor.imagePullSecrets" -}}
|
||||
{{- include "common.images.pullSecrets" (dict "images" (list .Values.core.image .Values.exporter.image .Values.portal.image .Values.jobservice.image .Values.clair.server.image .Values.clair.adapter.image .Values.chartmuseum.image .Values.trivy.image .Values.notary.server.image .Values.notary.signer.image .Values.registry.server.image .Values.registry.controller.image .Values.nginx.image .Values.volumePermissions.image) "global" .Values.global) -}}
|
||||
{{- include "common.images.pullSecrets" (dict "images" (list .Values.core.image .Values.exporter.image .Values.portal.image .Values.jobservice.image .Values.chartmuseum.image .Values.trivy.image .Values.notary.server.image .Values.notary.signer.image .Values.registry.server.image .Values.registry.controller.image .Values.nginx.image .Values.volumePermissions.image) "global" .Values.global) -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Check if there are rolling tags in the images */}}
|
||||
@@ -556,8 +483,6 @@ Return the proper Docker Image Registry Secret Names
|
||||
{{- include "common.warnings.rollingTag" .Values.jobservice.image -}}
|
||||
{{- include "common.warnings.rollingTag" .Values.registry.server.image -}}
|
||||
{{- include "common.warnings.rollingTag" .Values.registry.controller.image -}}
|
||||
{{- include "common.warnings.rollingTag" .Values.clair.server.image -}}
|
||||
{{- include "common.warnings.rollingTag" .Values.clair.adapter.image -}}
|
||||
{{- include "common.warnings.rollingTag" .Values.chartmuseum.image -}}
|
||||
{{- include "common.warnings.rollingTag" .Values.trivy.image -}}
|
||||
{{- include "common.warnings.rollingTag" .Values.volumePermissions.image -}}
|
||||
|
||||
@@ -1,286 +0,0 @@
|
||||
{{- if .Values.clair.enabled }}
|
||||
apiVersion: {{ template "common.capabilities.deployment.apiVersion" . }}
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ include "harbor.clair" . }}
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
labels: {{- include "common.labels.standard" . | nindent 4 }}
|
||||
{{- if .Values.commonLabels }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
app.kubernetes.io/component: clair
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
replicas: {{ .Values.clair.replicaCount }}
|
||||
selector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" . | nindent 6 }}
|
||||
app.kubernetes.io/component: clair
|
||||
{{- if .Values.clair.updateStrategy }}
|
||||
strategy: {{- toYaml .Values.clair.updateStrategy | nindent 4 }}
|
||||
{{- end }}
|
||||
template:
|
||||
metadata:
|
||||
labels: {{- include "common.labels.standard" . | nindent 8 }}
|
||||
{{- if .Values.commonLabels }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.clair.podLabels }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.clair.podLabels "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
app.kubernetes.io/component: clair
|
||||
annotations:
|
||||
checksum/secret: {{ include (print $.Template.BasePath "/clair/clair-secret.yaml") . | sha256sum }}
|
||||
{{- if and .Values.internalTLS.enabled (not .Values.clair.tls.existingSecret) }}
|
||||
checksum/tls: {{ include (print $.Template.BasePath "/internal/internal-crt-secret.yaml") . | sha256sum }}
|
||||
{{- end }}
|
||||
{{- if .Values.clair.podAnnotations }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.clair.podAnnotations "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- include "harbor.imagePullSecrets" . | nindent 6 }}
|
||||
{{- if .Values.clair.hostAliases }}
|
||||
hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.clair.hostAliases "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
automountServiceAccountToken: {{ .Values.clair.automountServiceAccountToken }}
|
||||
{{- if .Values.clair.affinity }}
|
||||
affinity: {{- include "common.tplvalues.render" (dict "value" .Values.clair.affinity "context" $) | nindent 8 }}
|
||||
{{- else }}
|
||||
affinity:
|
||||
podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.clair.podAffinityPreset "component" "clair" "context" $) | nindent 10 }}
|
||||
podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.clair.podAntiAffinityPreset "component" "clair" "context" $) | nindent 10 }}
|
||||
nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.clair.nodeAffinityPreset.type "key" .Values.clair.nodeAffinityPreset.key "values" .Values.clair.nodeAffinityPreset.values) | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- if .Values.clair.nodeSelector }}
|
||||
nodeSelector: {{- include "common.tplvalues.render" (dict "value" .Values.clair.nodeSelector "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.clair.tolerations }}
|
||||
tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.clair.tolerations "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.clair.topologySpreadConstraints }}
|
||||
topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.clair.topologySpreadConstraints "context" .) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.clair.priorityClassName }}
|
||||
priorityClassName: {{ .Values.clair.priorityClassName | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.clair.schedulerName }}
|
||||
schedulerName: {{ .Values.clair.schedulerName }}
|
||||
{{- end }}
|
||||
{{- if .Values.clair.podSecurityContext.enabled }}
|
||||
securityContext: {{- omit .Values.clair.podSecurityContext "enabled" | toYaml | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.clair.initContainers }}
|
||||
initContainers: {{- include "common.tplvalues.render" (dict "value" .Values.clair.initContainers "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: clair
|
||||
image: {{ include "harbor.clair.server.image" . }}
|
||||
imagePullPolicy: {{ .Values.clair.server.image.pullPolicy | quote }}
|
||||
{{- if .Values.clair.server.containerSecurityContext.enabled }}
|
||||
securityContext: {{- omit .Values.clair.server.containerSecurityContext "enabled" | toYaml | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.diagnosticMode.enabled }}
|
||||
command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }}
|
||||
{{- else if .Values.clair.server.command }}
|
||||
command: {{- include "common.tplvalues.render" (dict "value" .Values.clair.server.command "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.diagnosticMode.enabled }}
|
||||
args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }}
|
||||
{{- else if .Values.clair.server.args }}
|
||||
args: {{- include "common.tplvalues.render" (dict "value" .Values.clair.server.args "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
env:
|
||||
- name: BITNAMI_DEBUG
|
||||
value: {{ ternary "true" "false" .Values.clair.server.image.debug | quote }}
|
||||
{{- if has "clair" .Values.proxy.components }}
|
||||
{{- if .Values.clair.httpProxy }}
|
||||
- name: HTTP_PROXY
|
||||
value: {{ .Values.clair.httpProxy | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.clair.httpsProxy }}
|
||||
- name: HTTPS_PROXY
|
||||
value: {{ .Values.clair.httpsProxy | quote }}
|
||||
{{- end }}
|
||||
- name: NO_PROXY
|
||||
value: {{ include "harbor.noProxy" . | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.clair.server.extraEnvVars }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.clair.server.extraEnvVars "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
envFrom:
|
||||
{{- if .Values.clair.server.extraEnvVarsCM }}
|
||||
- configMapRef:
|
||||
name: {{ include "common.tplvalues.render" (dict "value" .Values.clair.server.extraEnvVarsCM "context" $) }}
|
||||
{{- end }}
|
||||
{{- if .Values.clair.server.extraEnvVarsSecret }}
|
||||
- secretRef:
|
||||
name: {{ include "common.tplvalues.render" (dict "value" .Values.clair.server.extraEnvVarsSecret "context" $) }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- containerPort: {{ .Values.clair.server.containerPorts.api }}
|
||||
name: api
|
||||
- containerPort: {{ .Values.clair.server.containerPorts.health }}
|
||||
name: health
|
||||
{{- if not .Values.diagnosticMode.enabled }}
|
||||
{{- if .Values.clair.server.startupProbe.enabled }}
|
||||
startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.clair.server.startupProbe "enabled") "context" $) | nindent 12 }}
|
||||
tcpSocket:
|
||||
port: health
|
||||
{{- else if .Values.clair.server.customStartupProbe }}
|
||||
startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.clair.server.customStartupProbe "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.clair.server.livenessProbe.enabled }}
|
||||
livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.clair.server.livenessProbe "enabled") "context" $) | nindent 12 }}
|
||||
httpGet:
|
||||
path: /health
|
||||
port: health
|
||||
{{- else if .Values.clair.server.customLivenessProbe }}
|
||||
livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.clair.server.customLivenessProbe "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.clair.server.readinessProbe.enabled }}
|
||||
readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.clair.server.readinessProbe "enabled") "context" $) | nindent 12 }}
|
||||
httpGet:
|
||||
path: /health
|
||||
port: health
|
||||
{{- else if .Values.clair.server.customReadinessProbe }}
|
||||
readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.clair.server.customReadinessProbe "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.clair.server.lifecycleHooks }}
|
||||
lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.clair.server.lifecycleHooks "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.clair.server.resources }}
|
||||
resources: {{- toYaml .Values.clair.server.resources | nindent 12 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: config
|
||||
mountPath: /etc/clair/config.yaml
|
||||
subPath: config.yaml
|
||||
{{- if .Values.internalTLS.caBundleSecret }}
|
||||
{{- include "harbor.caBundleVolumeMount" . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.internalTLS.enabled }}
|
||||
- name: internal-tls-certs
|
||||
mountPath: /etc/harbor/ssl/clair
|
||||
{{- end }}
|
||||
{{- if .Values.clair.server.extraVolumeMounts }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.clair.server.extraVolumeMounts "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
- name: adapter
|
||||
image: {{ include "harbor.clair.adapter.image" . }}
|
||||
imagePullPolicy: {{ .Values.clair.adapter.image.pullPolicy }}
|
||||
{{- if .Values.clair.adapter.containerSecurityContext.enabled }}
|
||||
securityContext: {{- omit .Values.clair.adapter.containerSecurityContext "enabled" | toYaml | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.diagnosticMode.enabled }}
|
||||
command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }}
|
||||
{{- else if .Values.clair.adapter.command }}
|
||||
command: {{- include "common.tplvalues.render" (dict "value" .Values.clair.adapter.command "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.diagnosticMode.enabled }}
|
||||
args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }}
|
||||
{{- else if .Values.clair.adapter.args }}
|
||||
args: {{- include "common.tplvalues.render" (dict "value" .Values.clair.adapter.args "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
env:
|
||||
- name: BITNAMI_DEBUG
|
||||
value: {{ ternary "true" "false" .Values.clair.adapter.image.debug | quote }}
|
||||
- name: SCANNER_CLAIR_URL
|
||||
# To avoid a pod cannot reach itself via service IP when the clusters disable hairpin
|
||||
value: {{ printf "http://127.0.0.1:%d" (int .Values.clair.server.containerPorts.api) | quote }}
|
||||
- name: SCANNER_STORE_REDIS_URL
|
||||
value: {{ include "harbor.redisForClairAdapter" . }}
|
||||
- name: SCANNER_CLAIR_DATABASE_URL
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ template "harbor.clair" . }}
|
||||
key: database
|
||||
{{- if .Values.internalTLS.enabled }}
|
||||
- name: INTERNAL_TLS_ENABLED
|
||||
value: "true"
|
||||
- name: SCANNER_API_SERVER_ADDR
|
||||
value: {{ printf ":%d" (ternary .Values.clair.adapter.containerPorts.https .Values.clair.adapter.containerPorts.http .Values.internalTLS.enabled | int) | quote }}
|
||||
- name: SCANNER_API_SERVER_TLS_KEY
|
||||
value: /etc/harbor/ssl/clair/tls.key
|
||||
- name: SCANNER_API_SERVER_TLS_CERTIFICATE
|
||||
value: /etc/harbor/ssl/clair/tls.crt
|
||||
{{- end }}
|
||||
{{- if .Values.clair.adapter.extraEnvVars }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.clair.adapter.extraEnvVars "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
envFrom:
|
||||
{{- if .Values.clair.adapter.extraEnvVarsCM }}
|
||||
- configMapRef:
|
||||
name: {{ include "common.tplvalues.render" (dict "value" .Values.clair.adapter.extraEnvVarsCM "context" $) }}
|
||||
{{- end }}
|
||||
{{- if .Values.clair.adapter.extraEnvVarsSecret }}
|
||||
- secretRef:
|
||||
name: {{ include "common.tplvalues.render" (dict "value" .Values.clair.adapter.extraEnvVarsSecret "context" $) }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- containerPort: {{ ternary .Values.clair.adapter.containerPorts.https .Values.clair.adapter.containerPorts.http .Values.internalTLS.enabled }}
|
||||
name: {{ ternary "https" "http" .Values.internalTLS.enabled }}
|
||||
{{- if not .Values.diagnosticMode.enabled }}
|
||||
{{- if .Values.clair.adapter.startupProbe.enabled }}
|
||||
startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.clair.adapter.startupProbe "enabled") "context" $) | nindent 12 }}
|
||||
tcpSocket:
|
||||
port: {{ ternary "https" "http" .Values.internalTLS.enabled }}
|
||||
{{- else if .Values.clair.adapter.customStartupProbe }}
|
||||
startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.clair.adapter.customStartupProbe "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.clair.adapter.livenessProbe.enabled }}
|
||||
livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.clair.adapter.livenessProbe "enabled") "context" $) | nindent 12 }}
|
||||
httpGet:
|
||||
path: /probe/healthy
|
||||
port: {{ ternary "https" "http" .Values.internalTLS.enabled }}
|
||||
scheme: {{ ternary "https" "http" .Values.internalTLS.enabled | upper }}
|
||||
{{- else if .Values.clair.adapter.customLivenessProbe }}
|
||||
livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.clair.adapter.customLivenessProbe "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.clair.adapter.readinessProbe.enabled }}
|
||||
readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.clair.adapter.readinessProbe "enabled") "context" $) | nindent 12 }}
|
||||
httpGet:
|
||||
path: /probe/ready
|
||||
port: {{ ternary "https" "http" .Values.internalTLS.enabled }}
|
||||
scheme: {{ ternary "https" "http" .Values.internalTLS.enabled | upper }}
|
||||
{{- else if .Values.clair.adapter.customReadinessProbe }}
|
||||
readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.clair.adapter.customReadinessProbe "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.clair.adapter.lifecycleHooks }}
|
||||
lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.clair.adapter.lifecycleHooks "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.clair.adapter.resources }}
|
||||
resources: {{- toYaml .Values.clair.adapter.resources | nindent 12 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
{{- if .Values.internalTLS.enabled }}
|
||||
- name: internal-tls-certs
|
||||
mountPath: /etc/harbor/ssl/clair
|
||||
{{- end }}
|
||||
{{- if .Values.internalTLS.caBundleSecret }}
|
||||
{{- include "harbor.caBundleVolumeMount" . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.clair.adapter.extraVolumeMounts }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.clair.adapter.extraVolumeMounts "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.clair.sidecars }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.clair.sidecars "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
volumes:
|
||||
- name: config
|
||||
secret:
|
||||
secretName: {{ include "harbor.clair" . | quote }}
|
||||
{{- if .Values.internalTLS.enabled }}
|
||||
- name: internal-tls-certs
|
||||
secret:
|
||||
secretName: {{ template "harbor.clair.tls.secretName" . }}
|
||||
{{- end }}
|
||||
{{- if .Values.internalTLS.caBundleSecret }}
|
||||
{{- include "harbor.caBundleVolume" . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.clair.extraVolumes }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.clair.extraVolumes "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -1,19 +0,0 @@
|
||||
{{- if .Values.clair.enabled }}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ template "harbor.clair" . }}
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
labels: {{- include "common.labels.standard" . | nindent 4 }}
|
||||
{{- if .Values.commonLabels }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
type: Opaque
|
||||
data:
|
||||
config.yaml: {{ tpl (.Files.Get "conf/clair.yaml") . | b64enc }}
|
||||
redis: {{ include "harbor.redisForClairAdapter" . | b64enc }}
|
||||
database: {{ include "harbor.database.clair" . | b64enc }}
|
||||
{{- end }}
|
||||
@@ -1,25 +0,0 @@
|
||||
{{- if .Values.clair.enabled }}
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ include "harbor.clair" . }}
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
labels: {{- include "common.labels.standard" . | nindent 4 }}
|
||||
{{- if .Values.commonLabels }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
app.kubernetes.io/component: clair
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
ports:
|
||||
- name: api
|
||||
port: {{ .Values.clair.server.service.ports.api }}
|
||||
- name: health
|
||||
port: {{ .Values.clair.server.service.ports.health }}
|
||||
- name: adapter
|
||||
port: {{ ternary .Values.clair.adapter.service.ports.https .Values.clair.adapter.service.ports.http .Values.internalTLS.enabled }}
|
||||
selector: {{- include "common.labels.matchLabels" . | nindent 4 }}
|
||||
app.kubernetes.io/component: clair
|
||||
{{- end }}
|
||||
@@ -101,27 +101,6 @@ data:
|
||||
tls.key: {{ $chartCrt.Key | b64enc | quote }}
|
||||
{{- end }}
|
||||
|
||||
{{- if and .Values.clair.enabled (not .Values.clair.tls.existingSecret) }}
|
||||
{{- $clairCN := include "harbor.clair" . }}
|
||||
{{- $clairCrt := genSignedCert $clairCN nil (list $clairCN) 365 $ca }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "harbor.clair" . }}-crt
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
labels: {{- include "common.labels.standard" . | nindent 4 }}
|
||||
{{- if .Values.commonLabels }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
app.kubernetes.io/component: clair
|
||||
type: kubernetes.io/tls
|
||||
data:
|
||||
ca.crt: {{ $ca.Cert | b64enc | quote }}
|
||||
tls.crt: {{ $clairCrt.Cert | b64enc | quote }}
|
||||
tls.key: {{ $clairCrt.Key | b64enc | quote }}
|
||||
{{- end }}
|
||||
|
||||
{{- if and .Values.trivy.enabled (not .Values.trivy.tls.existingSecret) }}
|
||||
{{- $trivyCN := include "harbor.trivy" . }}
|
||||
{{- $trivyCrt := genSignedCert $trivyCN nil (list $trivyCN) 365 $ca }}
|
||||
|
||||
+2
-426
@@ -78,8 +78,6 @@ adminPassword: ""
|
||||
## the "domain" should be the LoadBalancer IP
|
||||
##
|
||||
externalURL: https://core.harbor.domain
|
||||
## The proxy settings for updating clair vulnerabilities from the Internet and replicating
|
||||
## artifacts from/to the registries that cannot be reached directly
|
||||
## Note: If Harbor is exposed via Ingress, the NGINX server will not be used
|
||||
## @param proxy.httpProxy The URL of the HTTP proxy server
|
||||
## @param proxy.httpsProxy The URL of the HTTPS proxy server
|
||||
@@ -93,7 +91,6 @@ proxy:
|
||||
components:
|
||||
- core
|
||||
- jobservice
|
||||
- clair
|
||||
- trivy
|
||||
## @param logLevel The log level used for Harbor services. Allowed values are [ fatal \| error \| warn \| info \| debug \| trace ]
|
||||
##
|
||||
@@ -102,10 +99,10 @@ logLevel: debug
|
||||
## Note: TLS cert files need to provided in each components in advance.
|
||||
##
|
||||
internalTLS:
|
||||
## @param internalTLS.enabled Use TLS in all the supported containers: chartmuseum, clair, core, jobservice, portal, registry and trivy
|
||||
## @param internalTLS.enabled Use TLS in all the supported containers: chartmuseum, core, jobservice, portal, registry and trivy
|
||||
##
|
||||
enabled: false
|
||||
## @param internalTLS.caBundleSecret Name of an existing secret with a custom CA that will be injected into the trust store for chartmuseum, clair, core, jobservice, registry, trivy components
|
||||
## @param internalTLS.caBundleSecret Name of an existing secret with a custom CA that will be injected into the trust store for chartmuseum, core, jobservice, registry, trivy components
|
||||
## The secret must contain the key "ca.crt"
|
||||
##
|
||||
caBundleSecret: ""
|
||||
@@ -2540,419 +2537,6 @@ chartmuseum:
|
||||
http: 80
|
||||
https: 443
|
||||
|
||||
## @section Clair Parameters
|
||||
##
|
||||
|
||||
clair:
|
||||
## @param clair.enabled Enable Clair scanner. Add it as an additional interrogation service by following https://goharbor.io/docs/latest/administration/vulnerability-scanning/pluggable-scanners
|
||||
##
|
||||
enabled: false
|
||||
## The http(s) proxy used to update vulnerabilities database from internet
|
||||
## @param clair.httpProxy The http proxy used to update vulnerabilities database from internet
|
||||
## @param clair.httpsProxy The https proxy used to update vulnerabilities database from internet
|
||||
##
|
||||
httpProxy: ""
|
||||
httpsProxy: ""
|
||||
## @param clair.updatersInterval The interval of clair updaters (hours), set to 0 to disable
|
||||
## disable the updaters
|
||||
##
|
||||
updatersInterval: 12
|
||||
## Use TLS in the container
|
||||
##
|
||||
tls:
|
||||
## @param clair.tls.existingSecret Name of an existing secret with the certificates for internal TLS access
|
||||
## Requires `internalTLS.enabled` to be set to `true``
|
||||
## Self-signed TLS certificates will be used otherwise
|
||||
##
|
||||
existingSecret: ""
|
||||
## @param clair.replicaCount Number of Clair replicas
|
||||
##
|
||||
replicaCount: 1
|
||||
## Configure Clair pods Security Context
|
||||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod
|
||||
## @param clair.podSecurityContext.enabled Enabled Clair pods' Security Context
|
||||
## @param clair.podSecurityContext.fsGroup Set Clair pod's Security Context fsGroup
|
||||
##
|
||||
podSecurityContext:
|
||||
enabled: true
|
||||
fsGroup: 1001
|
||||
## @param clair.updateStrategy.type Clair deployment strategy type - only really applicable for deployments with RWO PVs attached
|
||||
## If replicas = 1, an update can get "stuck", as the previous pod remains attached to the
|
||||
## PV, and the "incoming" pod can never start. Changing the strategy to "Recreate" will
|
||||
## terminate the single previous pod, so that the new, incoming pod can attach to the PV
|
||||
##
|
||||
updateStrategy:
|
||||
type: RollingUpdate
|
||||
## @param clair.hostAliases Clair pods host aliases
|
||||
##
|
||||
hostAliases: []
|
||||
## @param clair.podLabels Add additional labels to the Clair pods (evaluated as a template)
|
||||
## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
|
||||
##
|
||||
podLabels: {}
|
||||
## @param clair.podAnnotations Annotations to add to the Clair pods (evaluated as a template)
|
||||
## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
|
||||
##
|
||||
podAnnotations: {}
|
||||
## @param clair.podAffinityPreset Clair Pod affinity preset. Ignored if `clair.affinity` is set. Allowed values: `soft` or `hard`
|
||||
## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity
|
||||
##
|
||||
podAffinityPreset: ""
|
||||
## @param clair.podAntiAffinityPreset Clair Pod anti-affinity preset. Ignored if `clair.affinity` is set. Allowed values: `soft` or `hard`
|
||||
## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity
|
||||
##
|
||||
podAntiAffinityPreset: soft
|
||||
## Node affinity preset
|
||||
## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity
|
||||
##
|
||||
nodeAffinityPreset:
|
||||
## @param clair.nodeAffinityPreset.type Clair Node affinity preset type. Ignored if `clair.affinity` is set. Allowed values: `soft` or `hard`
|
||||
##
|
||||
type: ""
|
||||
## @param clair.nodeAffinityPreset.key Clair Node label key to match Ignored if `clair.affinity` is set.
|
||||
## E.g.
|
||||
## key: "kubernetes.io/e2e-az-name"
|
||||
##
|
||||
key: ""
|
||||
## @param clair.nodeAffinityPreset.values Clair Node label values to match. Ignored if `clair.affinity` is set.
|
||||
## E.g.
|
||||
## values:
|
||||
## - e2e-az1
|
||||
## - e2e-az2
|
||||
##
|
||||
values: []
|
||||
## @param clair.affinity Clair Affinity for pod assignment
|
||||
## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity
|
||||
## Note: clair.podAffinityPreset, clair.podAntiAffinityPreset, and clair.nodeAffinityPreset will be ignored when it's set
|
||||
##
|
||||
affinity: {}
|
||||
## @param clair.nodeSelector Clair Node labels for pod assignment
|
||||
## Ref: https://kubernetes.io/docs/user-guide/node-selection/
|
||||
##
|
||||
nodeSelector: {}
|
||||
## @param clair.tolerations Clair Tolerations for pod assignment
|
||||
## Ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
|
||||
##
|
||||
tolerations: []
|
||||
## @param clair.topologySpreadConstraints Topology Spread Constraints for pod assignment spread across your cluster among failure-domains. Evaluated as a template
|
||||
## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/#spread-constraints-for-pods
|
||||
##
|
||||
topologySpreadConstraints: []
|
||||
## @param clair.priorityClassName Priority Class Name
|
||||
## ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
|
||||
##
|
||||
priorityClassName: ""
|
||||
## @param clair.schedulerName Use an alternate scheduler, e.g. "stork".
|
||||
## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/
|
||||
##
|
||||
schedulerName: ""
|
||||
## @param clair.sidecars Add additional sidecar containers to the Clair pods
|
||||
## Example:
|
||||
## sidecars:
|
||||
## - name: your-image-name
|
||||
## image: your-image
|
||||
## imagePullPolicy: Always
|
||||
## ports:
|
||||
## - name: portname
|
||||
## containerPort: 1234
|
||||
##
|
||||
sidecars: []
|
||||
## @param clair.initContainers Add additional init containers to the Clair pods
|
||||
## Example:
|
||||
## initContainers:
|
||||
## - name: your-image-name
|
||||
## image: your-image
|
||||
## imagePullPolicy: Always
|
||||
## ports:
|
||||
## - name: portname
|
||||
## containerPort: 1234
|
||||
##
|
||||
initContainers: []
|
||||
## @param clair.extraVolumes Optionally specify extra list of additional volumes for the Clair pods
|
||||
##
|
||||
extraVolumes: []
|
||||
## @param clair.automountServiceAccountToken Automount service account token
|
||||
##
|
||||
automountServiceAccountToken: false
|
||||
## Harbor needs Clair adapter to communicate with Clair API.
|
||||
##
|
||||
adapter:
|
||||
## Bitnami Harbor Adapter for Clair image
|
||||
## ref: https://hub.docker.com/r/bitnami/harbor-adapter-clair/tags/
|
||||
## @param clair.adapter.image.registry Harbor Adapter for Clair image registry
|
||||
## @param clair.adapter.image.repository Harbor Adapter for Clair image repository
|
||||
## @param clair.adapter.image.tag Harbor Adapter for Clair image tag (immutable tags are recommended)
|
||||
## @param clair.adapter.image.pullPolicy Harbor Adapter for Clair image pull policy
|
||||
## @param clair.adapter.image.pullSecrets Harbor Adapter for Clair image pull secrets
|
||||
## @param clair.adapter.image.debug Enable Harbor Adapter for Clair image debug mode
|
||||
##
|
||||
image:
|
||||
registry: docker.io
|
||||
repository: bitnami/harbor-adapter-clair
|
||||
tag: 2.5.1-debian-11-r4
|
||||
## Specify a imagePullPolicy
|
||||
## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
|
||||
## ref: https://kubernetes.io/docs/user-guide/images/#pre-pulling-images
|
||||
##
|
||||
pullPolicy: IfNotPresent
|
||||
## Optionally specify an array of imagePullSecrets.
|
||||
## Secrets must be manually created in the namespace.
|
||||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
|
||||
## e.g:
|
||||
## pullSecrets:
|
||||
## - myRegistryKeySecretName
|
||||
##
|
||||
pullSecrets: []
|
||||
## Enable debug mode
|
||||
##
|
||||
debug: false
|
||||
## @param clair.adapter.command Override default container command (useful when using custom images)
|
||||
##
|
||||
command: []
|
||||
## @param clair.adapter.args Override default container args (useful when using custom images)
|
||||
##
|
||||
args: []
|
||||
## @param clair.adapter.extraEnvVars Array with extra environment variables to add Harbor Adapter for Clair containers
|
||||
##
|
||||
extraEnvVars: []
|
||||
## @param clair.adapter.extraEnvVarsCM ConfigMap containing extra environment variables for Harbor Adapter for Clair containers
|
||||
##
|
||||
extraEnvVarsCM: ""
|
||||
## @param clair.adapter.extraEnvVarsSecret Secret containing extra environment variables (in case of sensitive data) for Harbor Adapter for Clair containers
|
||||
##
|
||||
extraEnvVarsSecret: ""
|
||||
## @param clair.adapter.containerPorts.http Harbor Adapter for Clair HTTP container port
|
||||
## @param clair.adapter.containerPorts.https Harbor Adapter for Clair HTTPS container port
|
||||
##
|
||||
containerPorts:
|
||||
http: 8080
|
||||
https: 8443
|
||||
## Configure extra options for Harbor Adapter for Clair containers' liveness, readiness and startup probes
|
||||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#configure-probes
|
||||
## @param clair.adapter.livenessProbe.enabled Enable livenessProbe on Harbor Adapter for Clair containers
|
||||
## @param clair.adapter.livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe
|
||||
## @param clair.adapter.livenessProbe.periodSeconds Period seconds for livenessProbe
|
||||
## @param clair.adapter.livenessProbe.timeoutSeconds Timeout seconds for livenessProbe
|
||||
## @param clair.adapter.livenessProbe.failureThreshold Failure threshold for livenessProbe
|
||||
## @param clair.adapter.livenessProbe.successThreshold Success threshold for livenessProbe
|
||||
##
|
||||
livenessProbe:
|
||||
enabled: true
|
||||
initialDelaySeconds: 20
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 6
|
||||
successThreshold: 1
|
||||
## @param clair.adapter.readinessProbe.enabled Enable readinessProbe on Harbor Adapter for Clair containers
|
||||
## @param clair.adapter.readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe
|
||||
## @param clair.adapter.readinessProbe.periodSeconds Period seconds for readinessProbe
|
||||
## @param clair.adapter.readinessProbe.timeoutSeconds Timeout seconds for readinessProbe
|
||||
## @param clair.adapter.readinessProbe.failureThreshold Failure threshold for readinessProbe
|
||||
## @param clair.adapter.readinessProbe.successThreshold Success threshold for readinessProbe
|
||||
##
|
||||
readinessProbe:
|
||||
enabled: true
|
||||
initialDelaySeconds: 20
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 6
|
||||
successThreshold: 1
|
||||
## @param clair.adapter.startupProbe.enabled Enable startupProbe on Harbor Adapter for Clair containers
|
||||
## @param clair.adapter.startupProbe.initialDelaySeconds Initial delay seconds for startupProbe
|
||||
## @param clair.adapter.startupProbe.periodSeconds Period seconds for startupProbe
|
||||
## @param clair.adapter.startupProbe.timeoutSeconds Timeout seconds for startupProbe
|
||||
## @param clair.adapter.startupProbe.failureThreshold Failure threshold for startupProbe
|
||||
## @param clair.adapter.startupProbe.successThreshold Success threshold for startupProbe
|
||||
##
|
||||
startupProbe:
|
||||
enabled: false
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 1
|
||||
failureThreshold: 15
|
||||
successThreshold: 1
|
||||
## @param clair.adapter.customLivenessProbe Custom livenessProbe that overrides the default one
|
||||
##
|
||||
customLivenessProbe: {}
|
||||
## @param clair.adapter.customReadinessProbe Custom readinessProbe that overrides the default one
|
||||
##
|
||||
customReadinessProbe: {}
|
||||
## @param clair.adapter.customStartupProbe Custom startupProbe that overrides the default one
|
||||
##
|
||||
customStartupProbe: {}
|
||||
## Harbor Adapter for Clair resource requests and limits
|
||||
## ref: https://kubernetes.io/docs/user-guide/compute-resources/
|
||||
## @param clair.adapter.resources.limits The resources limits for the Harbor Adapter for Clair containers
|
||||
## @param clair.adapter.resources.requests The requested resources for the Harbor Adapter for Clair containers
|
||||
##
|
||||
resources:
|
||||
limits: {}
|
||||
requests: {}
|
||||
## Configure Harbor Adapter for Clair containers (only main one) Security Context
|
||||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container
|
||||
## @param clair.adapter.containerSecurityContext.enabled Enabled Harbor Adapter for Clair containers' Security Context
|
||||
## @param clair.adapter.containerSecurityContext.runAsUser Set Harbor Adapter for Clair containers' Security Context runAsUser
|
||||
## @param clair.adapter.containerSecurityContext.runAsNonRoot Set Harbor Adapter for Clair containers' Security Context runAsNonRoot
|
||||
##
|
||||
containerSecurityContext:
|
||||
enabled: true
|
||||
runAsUser: 1001
|
||||
runAsNonRoot: true
|
||||
## @param clair.adapter.lifecycleHooks LifecycleHook for the Harbor Adapter for Clair container(s) to automate configuration before or after startup
|
||||
##
|
||||
lifecycleHooks: {}
|
||||
## @param clair.adapter.extraVolumeMounts Optionally specify extra list of additional volumeMounts for the Harbor Adapter for Clair pods
|
||||
##
|
||||
extraVolumeMounts: []
|
||||
## Harbor Adapter for Clair service configuration
|
||||
##
|
||||
service:
|
||||
## @param clair.adapter.service.ports.http Harbor Adapter for Clair HTTP service port
|
||||
## @param clair.adapter.service.ports.https Harbor Adapter for Clair HTTPS service port
|
||||
##
|
||||
ports:
|
||||
http: 8080
|
||||
https: 8443
|
||||
## Clair main container properties
|
||||
##
|
||||
server:
|
||||
## Bitnami Harbor Clair image
|
||||
## ref: https://hub.docker.com/r/bitnami/harbor-clair/tags/
|
||||
## @param clair.server.image.registry Harbor Clair image registry
|
||||
## @param clair.server.image.repository Harbor Clair image repository
|
||||
## @param clair.server.image.tag Harbor Clair image tag (immutable tags are recommended)
|
||||
## @param clair.server.image.pullPolicy Harbor Clair image pull policy
|
||||
## @param clair.server.image.pullSecrets Harbor Clair image pull secrets
|
||||
## @param clair.server.image.debug Enable Harbor Clair image debug mode
|
||||
##
|
||||
image:
|
||||
registry: docker.io
|
||||
repository: bitnami/harbor-clair
|
||||
tag: 2.5.1-debian-11-r4
|
||||
## Specify a imagePullPolicy
|
||||
## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
|
||||
## ref: https://kubernetes.io/docs/user-guide/images/#pre-pulling-images
|
||||
##
|
||||
pullPolicy: IfNotPresent
|
||||
## Optionally specify an array of imagePullSecrets.
|
||||
## Secrets must be manually created in the namespace.
|
||||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
|
||||
## e.g:
|
||||
## pullSecrets:
|
||||
## - myRegistryKeySecretName
|
||||
##
|
||||
pullSecrets: []
|
||||
## Enable debug mode
|
||||
##
|
||||
debug: false
|
||||
## @param clair.server.command Override default container command (useful when using custom images)
|
||||
##
|
||||
command: []
|
||||
## @param clair.server.args Override default container args (useful when using custom images)
|
||||
##
|
||||
args: []
|
||||
## @param clair.server.extraEnvVars Array with extra environment variables to add Harbor Clair containers
|
||||
##
|
||||
extraEnvVars: []
|
||||
## @param clair.server.extraEnvVarsCM ConfigMap containing extra environment variables for Harbor Clair containers
|
||||
##
|
||||
extraEnvVarsCM: ""
|
||||
## @param clair.server.extraEnvVarsSecret Secret containing extra environment variables (in case of sensitive data) for Harbor Clair containers
|
||||
##
|
||||
extraEnvVarsSecret: ""
|
||||
## @param clair.server.containerPorts.api Harbor Clair API container port
|
||||
## @param clair.server.containerPorts.health Harbor Clair health container port
|
||||
##
|
||||
containerPorts:
|
||||
api: 6060
|
||||
health: 6061
|
||||
## Configure extra options for Harbor Clair containers' liveness, readiness and startup probes
|
||||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#configure-probes
|
||||
## @param clair.server.livenessProbe.enabled Enable livenessProbe on Harbor Clair containers
|
||||
## @param clair.server.livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe
|
||||
## @param clair.server.livenessProbe.periodSeconds Period seconds for livenessProbe
|
||||
## @param clair.server.livenessProbe.timeoutSeconds Timeout seconds for livenessProbe
|
||||
## @param clair.server.livenessProbe.failureThreshold Failure threshold for livenessProbe
|
||||
## @param clair.server.livenessProbe.successThreshold Success threshold for livenessProbe
|
||||
##
|
||||
livenessProbe:
|
||||
enabled: true
|
||||
initialDelaySeconds: 20
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 6
|
||||
successThreshold: 1
|
||||
## @param clair.server.readinessProbe.enabled Enable readinessProbe on Harbor Clair containers
|
||||
## @param clair.server.readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe
|
||||
## @param clair.server.readinessProbe.periodSeconds Period seconds for readinessProbe
|
||||
## @param clair.server.readinessProbe.timeoutSeconds Timeout seconds for readinessProbe
|
||||
## @param clair.server.readinessProbe.failureThreshold Failure threshold for readinessProbe
|
||||
## @param clair.server.readinessProbe.successThreshold Success threshold for readinessProbe
|
||||
##
|
||||
readinessProbe:
|
||||
enabled: true
|
||||
initialDelaySeconds: 20
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 6
|
||||
successThreshold: 1
|
||||
## @param clair.server.startupProbe.enabled Enable startupProbe on Harbor Clair containers
|
||||
## @param clair.server.startupProbe.initialDelaySeconds Initial delay seconds for startupProbe
|
||||
## @param clair.server.startupProbe.periodSeconds Period seconds for startupProbe
|
||||
## @param clair.server.startupProbe.timeoutSeconds Timeout seconds for startupProbe
|
||||
## @param clair.server.startupProbe.failureThreshold Failure threshold for startupProbe
|
||||
## @param clair.server.startupProbe.successThreshold Success threshold for startupProbe
|
||||
##
|
||||
startupProbe:
|
||||
enabled: false
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 1
|
||||
failureThreshold: 15
|
||||
successThreshold: 1
|
||||
## @param clair.server.customLivenessProbe Custom livenessProbe that overrides the default one
|
||||
##
|
||||
customLivenessProbe: {}
|
||||
## @param clair.server.customReadinessProbe Custom readinessProbe that overrides the default one
|
||||
##
|
||||
customReadinessProbe: {}
|
||||
## @param clair.server.customStartupProbe Custom startupProbe that overrides the default one
|
||||
##
|
||||
customStartupProbe: {}
|
||||
## Harbor Clair resource requests and limits
|
||||
## ref: https://kubernetes.io/docs/user-guide/compute-resources/
|
||||
## @param clair.server.resources.limits The resources limits for the Harbor Clair containers
|
||||
## @param clair.server.resources.requests The requested resources for the Harbor Clair containers
|
||||
##
|
||||
resources:
|
||||
limits: {}
|
||||
requests: {}
|
||||
## Configure Harbor Clair containers (only main one) Security Context
|
||||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container
|
||||
## @param clair.server.containerSecurityContext.enabled Enabled Harbor Clair containers' Security Context
|
||||
## @param clair.server.containerSecurityContext.runAsUser Set Harbor Clair containers' Security Context runAsUser
|
||||
## @param clair.server.containerSecurityContext.runAsNonRoot Set Harbor Clair containers' Security Context runAsNonRoot
|
||||
##
|
||||
containerSecurityContext:
|
||||
enabled: true
|
||||
runAsUser: 1001
|
||||
runAsNonRoot: true
|
||||
## @param clair.server.lifecycleHooks LifecycleHook for the Harbor Clair container(s) to automate configuration before or after startup
|
||||
##
|
||||
lifecycleHooks: {}
|
||||
## @param clair.server.extraVolumeMounts Optionally specify extra list of additional volumeMounts for the Harbor Clair pods
|
||||
##
|
||||
extraVolumeMounts: []
|
||||
## Harbor Clair service configuration
|
||||
##
|
||||
service:
|
||||
## @param clair.server.service.ports.api Harbor Clair API service port
|
||||
## @param clair.server.service.ports.health Harbor Clair health service port
|
||||
##
|
||||
ports:
|
||||
api: 6060
|
||||
health: 6061
|
||||
|
||||
## @section Notary Parameters
|
||||
##
|
||||
|
||||
@@ -4052,9 +3636,6 @@ postgresql:
|
||||
## @param externalDatabase.password Password for the non-root username for Harbor
|
||||
## @param externalDatabase.sslmode External database ssl mode
|
||||
## @param externalDatabase.coreDatabase External database name for core
|
||||
## @param externalDatabase.clairDatabase External database name for clair
|
||||
## @param externalDatabase.clairUsername External database username for clair
|
||||
## @param externalDatabase.clairPassword External database password for clair
|
||||
## @param externalDatabase.notaryServerDatabase External database name for notary server
|
||||
## @param externalDatabase.notaryServerUsername External database username for notary server
|
||||
## @param externalDatabase.notaryServerPassword External database password for notary server
|
||||
@@ -4069,9 +3650,6 @@ externalDatabase:
|
||||
password: ""
|
||||
sslmode: disable
|
||||
coreDatabase: ""
|
||||
clairDatabase: ""
|
||||
clairUsername: ""
|
||||
clairPassword: ""
|
||||
notaryServerDatabase: ""
|
||||
notaryServerUsername: ""
|
||||
notaryServerPassword: ""
|
||||
@@ -4112,7 +3690,6 @@ redis:
|
||||
## @param externalRedis.jobserviceDatabaseIndex Index for jobservice database
|
||||
## @param externalRedis.registryDatabaseIndex Index for registry database
|
||||
## @param externalRedis.chartmuseumDatabaseIndex Index for chartmuseum database
|
||||
## @param externalRedis.clairAdapterDatabaseIndex Index for chartmuseum database
|
||||
## @param externalRedis.trivyAdapterDatabaseIndex Index for chartmuseum database
|
||||
##
|
||||
externalRedis:
|
||||
@@ -4123,7 +3700,6 @@ externalRedis:
|
||||
jobserviceDatabaseIndex: '1'
|
||||
registryDatabaseIndex: '2'
|
||||
chartmuseumDatabaseIndex: '3'
|
||||
clairAdapterDatabaseIndex: '4'
|
||||
trivyAdapterDatabaseIndex: '5'
|
||||
## Redis® sentinel configuration
|
||||
## @param externalRedis.sentinel.enabled If external redis with sentinal is used, set it to `true`
|
||||
|
||||
Reference in New Issue
Block a user