mirror of
https://github.com/wahyd4/charts.git
synced 2026-08-09 05:06:29 +10:00
Add Harbor
This commit is contained in:
tompizmor
@@ -0,0 +1 @@
|
||||
.git
|
||||
@@ -0,0 +1,22 @@
|
||||
apiVersion: v1
|
||||
name: harbor
|
||||
version: 0.0.3
|
||||
appVersion: 1.8.1
|
||||
description: Harbor is an an open source trusted cloud native registry project that stores, signs, and scans content
|
||||
keywords:
|
||||
- docker
|
||||
- registry
|
||||
- vulnerability
|
||||
- scan
|
||||
home: https://goharbor.io/
|
||||
sources:
|
||||
- https://github.com/bitnami/bitnami-docker-harbor-core
|
||||
- https://github.com/bitnami/bitnami-docker-harbor-portal
|
||||
- https://github.com/bitnami/bitnami-docker-harbor-jobservice
|
||||
- https://github.com/bitnami/bitnami-docker-harbor-registry
|
||||
- https://github.com/bitnami/bitnami-docker-harbor-registryctl
|
||||
maintainers:
|
||||
- name: Bitnami
|
||||
email: containers@bitnami.com
|
||||
engine: gotpl
|
||||
icon: https://bitnami.com/assets/stacks/harbor/img/harbor-stack-110x117.png
|
||||
@@ -0,0 +1,348 @@
|
||||
# Helm Chart for Harbor
|
||||
|
||||
This Helm chart has been developed based on [goharbor/harbor-helm](https://github.com/goharbor/harbor-helm) chart but including some features common to the Bitnami chart library.
|
||||
For example, the following changes have been introduced:
|
||||
|
||||
- Possibility to pull all the required images from a private registry through the Global Docker image parameters.
|
||||
- Redis and PostgreSQL are managed as chart dependencies.
|
||||
- Liveness and Readiness probes for all deployments are exposed to the values.yaml.
|
||||
- Uses new Helm chart labels formating.
|
||||
- Uses Bitnami container images:
|
||||
- non-root by default
|
||||
- published for debian-9, ol-7, and eventually centos-7
|
||||
- At this moment, this chart does not support the Harbor optional component Chartmuseum but it does support Clair and Notary integrations.
|
||||
|
||||
## Introduction
|
||||
|
||||
This [Helm](https://github.com/kubernetes/helm) chart installs [Harbor](https://github.com/goharbor/harbor) in a Kubernetes cluster. Welcome to [contribute](CONTRIBUTING.md) to Helm Chart for Harbor.
|
||||
|
||||
## Prerequisites
|
||||
|
||||
- Kubernetes cluster 1.10+
|
||||
- Helm 2.8.0+
|
||||
|
||||
## Installation
|
||||
|
||||
### Download the chart
|
||||
|
||||
Download Harbor helm chart
|
||||
|
||||
```bash
|
||||
git clone https://github.com/bitnami/charts
|
||||
```
|
||||
|
||||
Change directory to Harbor code
|
||||
|
||||
```bash
|
||||
cd charts/bitnami/harbor
|
||||
```
|
||||
|
||||
### Configure the chart
|
||||
|
||||
The following items can be configured in `values.yaml` or set via `--set` flag during installation.
|
||||
|
||||
#### Configure the way how to expose Harbor service:
|
||||
|
||||
- **Ingress**: The ingress controller must be installed in the Kubernetes cluster.
|
||||
**Notes:** if the TLS is disabled, the port must be included in the command when pulling/pushing images. Refer to issue [#5291](https://github.com/goharbor/harbor/issues/5291) for the detail.
|
||||
- **ClusterIP**: Exposes the service on a cluster-internal IP. Choosing this value makes the service only reachable from within the cluster.
|
||||
- **NodePort**: Exposes the service on each Node’s IP at a static port (the NodePort). You’ll be able to contact the NodePort service, from outside the cluster, by requesting `NodeIP:NodePort`.
|
||||
- **LoadBalancer**: Exposes the service externally using a cloud provider’s load balancer.
|
||||
|
||||
#### Configure the external URL
|
||||
|
||||
The external URL for Harbor core service is used to:
|
||||
|
||||
1. populate the docker/helm commands showed on portal
|
||||
2. populate the token service URL returned to docker/notary client
|
||||
|
||||
Format: `protocol://domain[:port]`. Usually:
|
||||
|
||||
- if expose the service via `Ingress`, the `domain` should be the value of `service.ingress.hosts.core`
|
||||
- if expose the service via `ClusterIP`, the `domain` should be the value of `service.clusterIP.name`
|
||||
- if expose the service via `NodePort`, the `domain` should be the IP address of one Kubernetes node
|
||||
- if expose the service via `LoadBalancer`, set the `domain` as your own domain name and add a CNAME record to map the domain name to the one you got from the cloud provider
|
||||
|
||||
If Harbor is deployed behind the proxy, set it as the URL of proxy.
|
||||
|
||||
#### Configure data persistence:
|
||||
|
||||
- **Disable**: The data does not survive the termination of a pod.
|
||||
- **Persistent Volume Claim(default)**: A default `StorageClass` is needed in the Kubernetes cluster to dynamically provision the volumes. Specify another StorageClass in the `storageClass` or set `existingClaim` if you have already existing persistent volumes to use.
|
||||
- **External Storage(only for images and charts)**: For images and charts, the external storages are supported: `azure`, `gcs`, `s3` `swift` and `oss`.
|
||||
|
||||
#### Configure the secrets
|
||||
|
||||
- **Secret keys**: Secret keys are used for secure communication between components. Fill `core.secret`, `jobservice.secret` and `registry.secret` to configure.
|
||||
- **Certificates**: Used for token encryption/decryption. Fill `core.secretName` to configure.
|
||||
|
||||
Secrets and certificates must be setup to avoid changes on every Helm upgrade (see: [#107](https://github.com/goharbor/harbor-helm/issues/107)).
|
||||
|
||||
#### Configure the other items listed in [configuration](#configuration) section.
|
||||
|
||||
### Install the chart
|
||||
|
||||
Install the Harbor helm chart with a release name `my-release`:
|
||||
|
||||
```bash
|
||||
helm install --name my-release --set service.tls.commonName=your.domain.com .
|
||||
```
|
||||
|
||||
## Uninstallation
|
||||
|
||||
To uninstall/delete the `my-release` deployment:
|
||||
|
||||
```bash
|
||||
helm delete --purge my-release
|
||||
```
|
||||
|
||||
Additionaly, if `persistence.resourcePolicy` is set to `keep`, you should manually delete the PVCs.
|
||||
|
||||
## Configuration
|
||||
|
||||
The following table lists the configurable parameters of the Harbor chart and the default values.
|
||||
|
||||
| Parameter | Description | Default |
|
||||
| --------------------------------------------------------------------------- | ----------------------------------------------------------------------- | ------------------------------------------------------- |
|
||||
| **Expose** |
|
||||
| `service.type` | The way how to expose the service: `Ingress`, `ClusterIP`, `NodePort` or `LoadBalancer` | `ingress` |
|
||||
| `service.tls.enabled` | Enable the tls or not | `true` |
|
||||
| `service.ingress.controller` | The ingress controller type. Currently supports `default` and `gce` | `default` |
|
||||
| `service.tls.secretName` | Fill the name of secret if you want to use your own TLS certificate and private key. The secret must contain two keys named `tls.crt` and `tls.key` that contain the certificate and private key to use for TLS. Will be generated automatically if not set | `nil` |
|
||||
| `service.tls.notarySecretName` | By default, the Notary service will use the same cert and key as described above. Fill the name of secret if you want to use a separated one. Only needed when the `service.type` is `ingress`. | `nil` |
|
||||
| `service.tls.commonName` | The common name used to generate the certificate, it's necessary when the `service.type` is `ClusterIP` or `NodePort` and `service.tls.secretName` is null | `nil` |
|
||||
| `service.ingress.hosts.core` | The host of Harbor core service in ingress rule | `core.harbor.domain` |
|
||||
| `service.ingress.hosts.notary` | The host of Harbor Notary service in ingress rule | `notary.harbor.domain` |
|
||||
| `service.ingress.annotations` | The annotations used in ingress | `nil` |
|
||||
| `service.clusterIP.name` | The name of ClusterIP service | `harbor` |
|
||||
| `service.clusterIP.ports.httpPort` | The service port Harbor listens on when serving with HTTP | `80` |
|
||||
| `service.clusterIP.ports.httpsPort` | The service port Harbor listens on when serving with HTTPS | `443` |
|
||||
| `service.clusterIP.ports.notaryPort` | The service port Notary listens on. Only needed when `notary.enabled` is set to `true` | `4443` |
|
||||
| `service.nodePort.name` | The name of NodePort service | `harbor` |
|
||||
| `service.nodePort.ports.http.port` | The service port Harbor listens on when serving with HTTP | `80` |
|
||||
| `service.nodePort.ports.http.nodePort` | The node port Harbor listens on when serving with HTTP | `30002` |
|
||||
| `service.nodePort.ports.https.port` | The service port Harbor listens on when serving with HTTPS | `443` |
|
||||
| `service.nodePort.ports.https.nodePort` | The node port Harbor listens on when serving with HTTPS | `30003` |
|
||||
| `service.nodePort.ports.notary.port` | The service port Notary listens on. Only needed when `notary.enabled` is set to `true` | `4443` |
|
||||
| `service.nodePort.ports.notary.nodePort` | The node port Notary listens on. Only needed when `notary.enabled` is set to `true` | `30004` |
|
||||
| `service.loadBalancer.name` | The name of service | `harbor` |
|
||||
| `service.loadBalancer.ports.httpPort` | The service port Harbor listens on when serving with HTTP | `80` |
|
||||
| `service.loadBalancer.ports.httpsPort` | The service port Harbor listens on when serving with HTTP | `30002` |
|
||||
| `service.loadBalancer.ports.notaryPort` | The service port Notary listens on. Only needed when `notary.enabled` is set to `true` | `nil` |
|
||||
| **Persistence** |
|
||||
| `persistence.enabled` | Enable the data persistence or not | `true` |
|
||||
| `persistence.resourcePolicy` | Setting it to `keep` to avoid removing PVCs during a helm delete operation. Leaving it empty will delete PVCs after the chart deleted | `keep` |
|
||||
| `persistence.persistentVolumeClaim.registry.existingClaim` | Use the existing PVC which must be created manually before bound, and specify the `subPath` if the PVC is shared with other components | `nil` |
|
||||
| `persistence.persistentVolumeClaim.registry.storageClass` | Specify the `storageClass` used to provision the volume. Or the default StorageClass will be used(the default). Set it to `-` to disable dynamic provisioning | `nil` |
|
||||
| `persistence.persistentVolumeClaim.registry.subPath` | The sub path used in the volume | `nil` |
|
||||
| `persistence.persistentVolumeClaim.registry.accessMode` | The access mode of the volume | `ReadWriteOnce` |
|
||||
| `persistence.persistentVolumeClaim.registry.size` | The size of the volume | `5Gi` |
|
||||
| `persistence.persistentVolumeClaim.jobservice.existingClaim` | Use the existing PVC which must be created manually before bound, and specify the `subPath` if the PVC is shared with other components | `nil` |
|
||||
| `persistence.persistentVolumeClaim.jobservice.storageClass` | Specify the `storageClass` used to provision the volume. Or the default StorageClass will be used(the default). Set it to `-` to disable dynamic provisioning | `nil` |
|
||||
| `persistence.persistentVolumeClaim.jobservice.subPath` | The sub path used in the volume | `nil` |
|
||||
| `persistence.persistentVolumeClaim.jobservice.accessMode` | The access mode of the volume | `ReadWriteOnce` |
|
||||
| `persistence.persistentVolumeClaim.jobservice.size` | The size of the volume | `1Gi` |
|
||||
| `persistence.imageChartStorage.disableredirect` | The configuration for managing redirects from content backends. For backends which do not supported it (such as using minio for `s3` storage type), please set it to `true` to disable redirects. Refer to the [guide](https://github.com/docker/distribution/blob/master/docs/configuration.md#redirect) for more information about the detail | `false` |
|
||||
| `persistence.imageChartStorage.type` | The type of storage for images and charts: `filesystem`, `azure`, `gcs`, `s3`, `swift` or `oss`. The type must be `filesystem` if you want to use persistent volumes for registry and chartmuseum. Refer to the [guide](https://github.com/docker/distribution/blob/master/docs/configuration.md#storage) for more information about the detail | `filesystem` |
|
||||
| **General** |
|
||||
| `externalURL` | The external URL for Harbor core service | `https://core.harbor.domain` |
|
||||
| `imagePullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `logLevel` | The log level | `debug` |
|
||||
| `forcePassword` | Option to ensure all passwords and keys are set by the user | `false` |
|
||||
| `harborAdminPassword` | The initial password of Harbor admin. Change it from portal after launching Harbor | `Harbor12345` |
|
||||
| `secretkey` | The key used for encryption. Must be a string of 16 chars | `not-a-secure-key` |
|
||||
| **Nginx** (if expose the service via `ingress`, the Nginx will not be used) |
|
||||
| `nginx.image.repository` | Image repository | `goharbor/nginx-photon` |
|
||||
| `nginx.image.tag` | Image tag | `dev` |
|
||||
| `nginx.replicas` | The replica count | `1` |
|
||||
| `nginx.resources` | The [resources] to allocate for container | undefined |
|
||||
| `nginx.nodeSelector` | Node labels for pod assignment | `{}` (The value is evaluated as a template) |
|
||||
| `nginx.tolerations` | Tolerations for pod assignment | `[]` (The value is evaluated as a template) |
|
||||
| `nginx.affinity` | Node/Pod affinities | `{}` (The value is evaluated as a template) |
|
||||
| `nginx.podAnnotations` | Annotations to add to the nginx pod | `{}` |
|
||||
| **Portal** |
|
||||
| `portalImage.registry` | Registry for portal image | `goharbor/harbor-portal` |
|
||||
| `portalImage.repository` | Repository for portal image | `goharbor/harbor-portal` |
|
||||
| `portalImage.tag` | Tag for portal image | `dev` |
|
||||
| `portalImage.pullPolicy` | Harbor Portal image pull policy | `IfNotPresent` |
|
||||
| `portalImage.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) |
|
||||
| `portalImage.debug` | Specify if debug logs should be enabled | `false` |
|
||||
| `portal.replicas` | The replica count | `1` |
|
||||
| `portal.resources` | The [resources] to allocate for container | undefined |
|
||||
| `portal.nodeSelector` | Node labels for pod assignment | `{}` (The value is evaluated as a template) |
|
||||
| `portal.tolerations` | Tolerations for pod assignment | `[]` (The value is evaluated as a template) |
|
||||
| `portal.affinity` | Node/Pod affinities | `{}` (The value is evaluated as a template) |
|
||||
| `portal.podAnnotations` | Annotations to add to the portal pod | `{}` |
|
||||
| `portal.livenessProbe` | Liveness probe configuration for Portal | `Check values.yaml file` |
|
||||
| `portal.readinessProbe` | Readines probe configuration for Portal | `Check values.yaml file` |
|
||||
| **Core** |
|
||||
| `coreImage.registry` | Registry for core image | `goharbor/harbor-portal` |
|
||||
| `coreImage.repository` | Repository for Harbor core image | `goharbor/harbor-core` |
|
||||
| `coreImage.tag` | Tag for Harbor core image | `dev` |
|
||||
| `coreImage.pullPolicy` | Harbor Core image pull policy | `IfNotPresent` |
|
||||
| `coreImage.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) |
|
||||
| `coreImage.debug` | Specify if debug logs should be enabled | `false` |
|
||||
| `core.replicas` | The replica count | `1` |
|
||||
| `core.resources` | The [resources] to allocate for container | undefined |
|
||||
| `core.nodeSelector` | Node labels for pod assignment | `{}` (The value is evaluated as a template) |
|
||||
| `core.tolerations` | Tolerations for pod assignment | `[]` (The value is evaluated as a template) |
|
||||
| `core.affinity` | Node/Pod affinities | `{}` (The value is evaluated as a template) |
|
||||
| `core.podAnnotations` | Annotations to add to the core pod | `{}` |
|
||||
| `core.secret` | Secret used when the core server communicates with other components. If a secret key is not specified, Helm will generate one. Must be a string of 16 chars. | `nil` |
|
||||
| `core.secretName` | Fill the name of a kubernetes secret if you want to use your own TLS certificate and private key for token encryption/decryption. The secret must contain two keys named: `tls.crt` - the certificate and `tls.key` - the private key. The default key pair will be used if it isn't set | `nil` |
|
||||
| `core.livenessProbe` | Liveness probe configuration for Core | `Check values.yaml file` |
|
||||
| `core.readinessProbe` | Readines probe configuration for Core | `Check values.yaml file` |
|
||||
| **Jobservice** |
|
||||
| `jobserviceImage.registry` | Registry for jobservice image | `goharbor/harbor-portal` |
|
||||
| `jobserviceImage.repository` | Repository for jobservice image | `goharbor/harbor-jobservice` |
|
||||
| `jobserviceImage.tag` | Tag for jobservice image | `dev` |
|
||||
| `jobserviceImage.pullPolicy` | Harbor Jobservice image pull policy | `IfNotPresent` |
|
||||
| `jobserviceImage.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) |
|
||||
| `jobserviceImage.debug` | Specify if debug logs should be enabled | `false` |
|
||||
| `jobservice.replicas` | The replica count | `1` |
|
||||
| `jobservice.maxJobWorkers` | The max job workers | `10` |
|
||||
| `jobservice.jobLogger` | The logger for jobs: `file`, `database` or `stdout` | `file` |
|
||||
| `jobservice.resources` | The [resources] to allocate for container | undefined |
|
||||
| `jobservice.nodeSelector` | Node labels for pod assignment | `{}` (The value is evaluated as a template) |
|
||||
| `jobservice.tolerations` | Tolerations for pod assignment | `[]` (The value is evaluated as a template) |
|
||||
| `jobservice.affinity` | Node/Pod affinities | `{}` (The value is evaluated as a template) |
|
||||
| `jobservice.podAnnotations` | Annotations to add to the jobservice pod | `{}` |
|
||||
| `jobservice.secret` | Secret used when the job service communicates with other components. If a secret key is not specified, Helm will generate one. Must be a string of 16 chars. | |
|
||||
| `jobservice.livenessProbe` | Liveness probe configuration for Job Service | `Check values.yaml file` |
|
||||
| `jobservice.readinessProbe` | Readines probe configuration for Job Service | `Check values.yaml file` |
|
||||
| **Registry** |
|
||||
| `registryImage.registry` | Registry for registry image | `goharbor/harbor-portal` |
|
||||
| `registryImage.repository` | Repository for registry image | `goharbor/registry-photon` |
|
||||
| `registryImage.tag` | Tag for registry image | `dev` |
|
||||
| `registryImage.pullPolicy` | Harbor Registry image pull policy | `IfNotPresent` |
|
||||
| `registryImage.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) |
|
||||
| `registryImage.debug` | Specify if debug logs should be enabled | `false` |
|
||||
| `registry.registry.resources` | The [resources] to allocate for container | undefined |
|
||||
| `registry.registry.livenessProbe` | Liveness probe configuration for Registry | `Check values.yaml file` |
|
||||
| `registry.registry.readinessProbe` | Readines probe configuration for Registry | `Check values.yaml file` |
|
||||
| `registryctlImage.registry` | Registry for registryctl image | `goharbor/harbor-portal` |
|
||||
| `registryctlImage.repository` | Repository for registryctl controller image | `goharbor/harbor-registryctl` |
|
||||
| `registryctlImage.tag` | Tag for registrycrtl controller image | `dev` |
|
||||
| `registryctlImage.pullPolicy` | Harbor Registryctl image pull policy | `IfNotPresent` |
|
||||
| `registryctlImage.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) |
|
||||
| `registryctlImage.debug` | Specify if debug logs should be enabled | `false` |
|
||||
| `registry.controller.resources` | The [resources] to allocate for container | undefined |
|
||||
| `registry.controller.livenessProbe` | Liveness probe configuration for Registryctl | `Check values.yaml file` |
|
||||
| `registry.controller.readinessProbe` | Readines probe configuration for Registryctl | `Check values.yaml file` |
|
||||
| `registry.replicas` | The replica count | `1` |
|
||||
| `registry.nodeSelector` | Node labels for pod assignment | `{}` (The value is evaluated as a template) |
|
||||
| `registry.tolerations` | Tolerations for pod assignment | `[]` (The value is evaluated as a template) |
|
||||
| `registry.affinity` | Node/Pod affinities | `{}` (The value is evaluated as a template) |
|
||||
| `registry.podAnnotations` | Annotations to add to the registry pod | `{}` |
|
||||
| `registry.secret` | Secret is used to secure the upload state from client and registry storage backend. See: https://github.com/docker/distribution/blob/master/docs/configuration.md#http. If a secret key is not specified, Helm will generate one. Must be a string of 16 chars. | `nil` |
|
||||
| **Clair** |
|
||||
| `clairImage.registry` | Registry for clair image | `docker.io` |
|
||||
| `clairImage.repository` | Repository for clair image | `bitnami/harbor-clair` |
|
||||
| `clairImage.tag` | Tag for clair image | `{TAG_NAME}` |
|
||||
| `clairImage.pullPolicy` | Harbor Jobservice image pull policy | `IfNotPresent` |
|
||||
| `clairImage.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) |
|
||||
| `clairImage.debug` | Specify if debug logs should be enabled | `false` |
|
||||
| `clair.enabled` | Enable Clair | `true` |
|
||||
| `clair.replicas` | The replica count | `1` |
|
||||
| `clair.httpProxy` | The http proxy used to update vulnerabilities database from internet | undefined |
|
||||
| `clair.httpsProxy` | The https proxy used to update vulnerabilities database from internet | undefined |
|
||||
| `clair.updatersInterval` | The interval of clair updaters (hours), set to 0 to disable | `12` |
|
||||
| `clair.resource` | The [resources] to allocate for container | undefined |
|
||||
| `clair.nodeSelector` | Node labels for pod assignment | `{}` (The value is evaluated as a template) |
|
||||
| `clair.tolerations` | Tolerations for pod assignment | `[]` (The value is evaluated as a template) |
|
||||
| `clair.affinity` | Node/Pod affinities | `{}` (The value is evaluated as a template) |
|
||||
| `clair.podAnnotations` | Annotations to add to the clair pod | `{}` |
|
||||
| `clair.livenessProbe` | Liveness probe configuration | `Check values.yaml file` |
|
||||
| `clair.readinessProbe` | Readiness probe configuration | `Check values.yaml file` |
|
||||
| **PostgreSQL** |
|
||||
| `database.type` | If external database is used, set it to `external` | `internal` |
|
||||
| `database.internal.image.repository` | Repository for database image | `goharbor/harbor-db` |
|
||||
| `database.internal.image.tag` | Tag for database image | `dev` |
|
||||
| `database.internal.password` | The password for database | `changeit` |
|
||||
| `database.internal.resources` | The [resources] to allocate for container | undefined |
|
||||
| `database.internal.nodeSelector` | Node labels for pod assignment | `{}` |
|
||||
| `database.internal.tolerations` | Tolerations for pod assignment | `[]` |
|
||||
| `database.internal.affinity` | Node/Pod affinities | `{}` |
|
||||
| `database.external.host` | The hostname of external database | `192.168.0.1` |
|
||||
| `database.external.port` | The port of external database | `5432` |
|
||||
| `database.external.username` | The username of external database | `user` |
|
||||
| `database.external.password` | The password of external database | `password` |
|
||||
| `database.external.coreDatabase` | The database used by core service | `registry` |
|
||||
| `database.external.clairDatabase` | The database used by clair | `clair` |
|
||||
| `database.external.notaryServerDatabase` | The database used by Notary server | `notary_server` |
|
||||
| `database.external.notarySignerDatabase` | The database used by Notary signer | `notary_signer` |
|
||||
| `database.external.sslmode` | Connection method of external database (require | prefer |
|
||||
| `database.podAnnotations` | Annotations to add to the database pod | `{}` |
|
||||
| **Redis** |
|
||||
| `redis.type` | If external redis is used, set it to `external` | `internal` |
|
||||
| `redis.internal.image.repository` | Repository for redis image | `goharbor/redis-photon` |
|
||||
| `redis.internal.image.tag` | Tag for redis image | `dev` |
|
||||
| `redis.internal.resources` | The [resources] to allocate for container | undefined |
|
||||
| `redis.internal.nodeSelector` | Node labels for pod assignment | `{}` |
|
||||
| `redis.internal.tolerations` | Tolerations for pod assignment | `[]` |
|
||||
| `redis.internal.affinity` | Node/Pod affinities | `{}` |
|
||||
| `redis.external.host` | The hostname of external Redis | `192.168.0.2` |
|
||||
| `redis.external.port` | The port of external Redis | `6379` |
|
||||
| `redis.external.coreDatabaseIndex` | The database index for core | `0` |
|
||||
| `redis.external.jobserviceDatabaseIndex` | The database index for jobservice | `1` |
|
||||
| `redis.external.registryDatabaseIndex` | The database index for registry | `2` |
|
||||
| `redis.external.chartmuseumDatabaseIndex` | The database index for chartmuseum | `3` |
|
||||
| `redis.external.password` | The password of external Redis | `nil` |
|
||||
| `redis.podAnnotations` | Annotations to add to the redis pod | `{}` |
|
||||
|
||||
[resources]: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/
|
||||
|
||||
Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example,
|
||||
|
||||
```console
|
||||
$ helm install --name my-release \
|
||||
--set harborAdminPassword=password \
|
||||
bitnami/harbor
|
||||
```
|
||||
|
||||
The above command sets the Harbor administrator account password to `password`.
|
||||
|
||||
Alternatively, a YAML file that specifies the values for the above parameters can be provided while installing the chart. For example,
|
||||
|
||||
```console
|
||||
$ helm install --name my-release -f values.yaml bitnami/harbor
|
||||
```
|
||||
### Production configuration
|
||||
|
||||
This chart includes a `values-production.yaml` file where you can find some parameters oriented to production configuration in comparison to the regular `values.yaml`:
|
||||
|
||||
- The way how to expose the service: `Ingress`, `ClusterIP`, `NodePort` or `LoadBalancer`:
|
||||
```diff
|
||||
- service.type: ClusterIP
|
||||
+ service.type: Ingress
|
||||
```
|
||||
|
||||
- The common name used to generate the certificate. It's necessary when the `service.type` is `ClusterIP` or `NodePort` and `service.tls.secretName` is null:
|
||||
```diff
|
||||
- service.tls.commonName: "core.harbor.domain"
|
||||
+ service.tls.commonName: ""
|
||||
```
|
||||
|
||||
- Option to ensure all passwords and keys are set by the user:
|
||||
```diff
|
||||
- forcePassword: false
|
||||
+ forcePassword: true
|
||||
```
|
||||
|
||||
- Option to deploy Redis cluster:
|
||||
```diff
|
||||
- redis.cluster.enabled: false
|
||||
+ redis.cluster.enabled: true
|
||||
```
|
||||
|
||||
- Option to deploy PostgreSQL replication cluster:
|
||||
```diff
|
||||
- postgresql.replication.enabled: false
|
||||
+ postgresql.replication.enabled: true
|
||||
```
|
||||
|
||||
### [Rolling VS Immutable tags](https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/)
|
||||
|
||||
It is strongly recommended to use immutable tags in a production environment. This ensures your deployment does not change automatically if the same tag is updated with a different image.
|
||||
|
||||
Bitnami will release a new chart updating its containers if a new version of the main container, significant changes, or critical vulnerabilities exist.
|
||||
@@ -0,0 +1,32 @@
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIFkzCCA3ugAwIBAgIJALr+LVOEsw+sMA0GCSqGSIb3DQEBCwUAMGAxCzAJBgNV
|
||||
BAYTAkVTMRAwDgYDVQQIDAdTZXZpbGxlMRAwDgYDVQQHDAdTZXZpbGxlMRAwDgYD
|
||||
VQQKDAdCaXRuYW1pMRswGQYDVQQDDBJoYXJib3IuYml0bmFtaS5jb20wHhcNMTkw
|
||||
NTIwMTAwMTUzWhcNMjAwNTE5MTAwMTUzWjBgMQswCQYDVQQGEwJFUzEQMA4GA1UE
|
||||
CAwHU2V2aWxsZTEQMA4GA1UEBwwHU2V2aWxsZTEQMA4GA1UECgwHQml0bmFtaTEb
|
||||
MBkGA1UEAwwSaGFyYm9yLmJpdG5hbWkuY29tMIICIjANBgkqhkiG9w0BAQEFAAOC
|
||||
Ag8AMIICCgKCAgEAqoG8fsnwCpf+mWY7ojxTCqasNVuDQv84klj1GkM7dJFNVp0J
|
||||
W5uZIZR+vuDq4VIuvqeeucO9F1xMaFhGqfVibuewED2oWI4Y2Km3+T9a0r6tFKaj
|
||||
aIyp57OHXysXchOJ8zytdlandii8zPAa/lH0bjOGGybNNMZ9EksDnNXM9YLP95DH
|
||||
jsHRuoIt5iQoIJXqhao/DEwaBcdxWKO+wSEFneO0NIiiytvThu4l6h8DNVDXxsP0
|
||||
sj7dvVeqY10c1DD3JK+Z50rNYl5B95WHfTkmNsHJlb8v1st9t98y34+MkDMGQJKO
|
||||
XeQPLwCDKImL7nwy+cjUiHlwEY39lEAc7AUl4QFwjS38R1Z9K5NKwQbAMuLiUeIm
|
||||
y8VFo14c/AlLE9qHZLq38bFheJoByi8oY46e6CWJTMTsfrlgVWGSCUoOmpC3Ff+l
|
||||
uCU+ptfkFHz2lQuVMj+U7vRkgKgrqtomJIPsqoKw1wKQpoX9kjnUCptg4Gm8sN/R
|
||||
L9IeBIBxdWXle/glfMOR/WnkUgajsj7mXggt3r9nITh6ZRMYSR5uvcD3eul+bmXE
|
||||
n1qf9WWCQJGg6+Dzbul8U00/sstiakoOHDLst8HaZy1NfNRPm7YNVguyqr6oX4CO
|
||||
onM4m6yboF+jPLCufXU6EavT3E4KAS4RhTsowjc0r/pCSfNdc7EOD1bnpt0CAwEA
|
||||
AaNQME4wHQYDVR0OBBYEFIQgwAN9VXy/1W0NXl7EDL8FE3gHMB8GA1UdIwQYMBaA
|
||||
FIQgwAN9VXy/1W0NXl7EDL8FE3gHMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEL
|
||||
BQADggIBADJi2GhrFMH2hAcJWbYFbJsnFRnC9PHG24hRiM62bBCcuzEerr7D3NRE
|
||||
9qXav+KiZmVN/OcqwuHdUmp5tv8v8lLA13Z/X2VaHmsVkB+02JAScpjonE0L8UAp
|
||||
4+Brq/tC15s+l6g6pHB9J9XP0IwnsPBDoVdAzIk/uztDERfjCAyoM4WqrjXIXp4u
|
||||
yTWDoDQaHpQSdfZAJcv7t82JJe1J9vbe+tFmDgMcfIoeCqCt1fkYf/usFFM6mLa+
|
||||
gtHnIAIGLvGjDR/RtSlbvGcRrqvoyK3Xx4WoYzNOfC6e6nESlkTPjJ6PyRqqGhbL
|
||||
FG+V6EPYDz/E63VGtxNaZ+MQcjHjk4q7c8pAL1FE19JpoeaEAHLKBRHAqJbKsOZh
|
||||
WSmvCX23uNOrymagh7N6pGyBC5YJctroaXl+rPOdNjBnimZw9BlxlZLvQLTTiL4z
|
||||
lSWPuzRdxblSLGEGPfY6wI9jeGJ6w/xOODAHNmPKLienH9TVUppoL/TcJDSo1L2T
|
||||
q2+DPbrYJJ5sGmRuEqjopDdLOCstanOAzdGrI/vEQdKD/ZzkRKjKDY/kD2nXgsTO
|
||||
fwaPvxjhMTRmSPRX10A6zC22Qu3OREDW48EL/E72IwnQPwHU3FGUrUd9ndaXa0vE
|
||||
UqZiWtD+/SImPWMwPhqVqt/zwpmCZBXNwkv5fgHQco/eGjDXkixl
|
||||
-----END CERTIFICATE-----
|
||||
@@ -0,0 +1,51 @@
|
||||
-----BEGIN RSA PRIVATE KEY-----
|
||||
MIIJKAIBAAKCAgEAqoG8fsnwCpf+mWY7ojxTCqasNVuDQv84klj1GkM7dJFNVp0J
|
||||
W5uZIZR+vuDq4VIuvqeeucO9F1xMaFhGqfVibuewED2oWI4Y2Km3+T9a0r6tFKaj
|
||||
aIyp57OHXysXchOJ8zytdlandii8zPAa/lH0bjOGGybNNMZ9EksDnNXM9YLP95DH
|
||||
jsHRuoIt5iQoIJXqhao/DEwaBcdxWKO+wSEFneO0NIiiytvThu4l6h8DNVDXxsP0
|
||||
sj7dvVeqY10c1DD3JK+Z50rNYl5B95WHfTkmNsHJlb8v1st9t98y34+MkDMGQJKO
|
||||
XeQPLwCDKImL7nwy+cjUiHlwEY39lEAc7AUl4QFwjS38R1Z9K5NKwQbAMuLiUeIm
|
||||
y8VFo14c/AlLE9qHZLq38bFheJoByi8oY46e6CWJTMTsfrlgVWGSCUoOmpC3Ff+l
|
||||
uCU+ptfkFHz2lQuVMj+U7vRkgKgrqtomJIPsqoKw1wKQpoX9kjnUCptg4Gm8sN/R
|
||||
L9IeBIBxdWXle/glfMOR/WnkUgajsj7mXggt3r9nITh6ZRMYSR5uvcD3eul+bmXE
|
||||
n1qf9WWCQJGg6+Dzbul8U00/sstiakoOHDLst8HaZy1NfNRPm7YNVguyqr6oX4CO
|
||||
onM4m6yboF+jPLCufXU6EavT3E4KAS4RhTsowjc0r/pCSfNdc7EOD1bnpt0CAwEA
|
||||
AQKCAgAU/jY8Ehbo5v/k2S58chrzU8QeKa9Gn2/SrPs4iZCXcJBqGpmdWtIGzWax
|
||||
j7W7mkfBF5g2XQA6ERYjPsMsh9bfusz1ovHIPW6XtoW9PWysR+e9hCrYY4FD0tnX
|
||||
ANI5LGiutwjQaijiJm/gd6uLJoIG03cufp+DYPDjQLMoKza5/6olXAEF9Z0h7odC
|
||||
L691G6AtZuGuXOxTS9QLytVgp/UuFGwKj8wjV996XHX0lm7psJNwmI3XKGBawKFs
|
||||
7HjxMzoqnShAzvfspZhPqGxvIYsv8LomIsz8ED/hVKzJ073Fv1KEvsaijsLD0bdU
|
||||
VWMSMN6B3JU2XGVM9AOFrkMhWBzqnKfR3qnmthY95Dmg5c5OJOAniY6CzVr/LZze
|
||||
Fy7Yp6dho+GFd2iOo0LboiUVs+qPoLRGiaDisViCW74mDj+uavsx0FNalWOJ3oZb
|
||||
QQfcC2EERcIJFeIUxnykpyvsq9mR6nlJA5m0UXL+yTp+ixGSkMx7hGxk7W4iI+TE
|
||||
7SYkdpMprDtNd46CCpEjL4cp3wKqO83DHZbRiIBW4Lnmv8/Fk139xfaVKU1a8Oz6
|
||||
eIv7SAjJiCVpjiz7W2XvFIM6GIdivqJ5teDHUKVgbgHVVXWze9FLfUnWe6xXxk7P
|
||||
7wAjhPA8KMX0/SkNO9sCo8O0bVLgmhQTZPedBn4/iVjj+63PQQKCAQEA2pmvKjDn
|
||||
MdOqKw7cusWGB0LtdxzgYt8EVXFqcdwQIk8j2bjk9TfgGseAmAfwvl+pmz249KHa
|
||||
995FjOSMIgABAA71lVCVPgS+9Y85egmyq6jUqmdlrrZPiAm4DO9Qz6xIFJTfLE1k
|
||||
Wj8eeoO6EqMih7mQ0kk+x4hBSE/PEbqjMYDONq7wukp4nV/2xyLRTAkz8dzYQ4Eq
|
||||
5UHAeH6WURRM4NcR/xsZx1Wg0YeMPcyFw/z+9gS4vp9Y6Gajx/9PrAhfJcipM/q8
|
||||
D6ZAfiH+lmm2oB3xd2QKG7BY7ZIxx/d4RzkloAUi9khmtsmfI95/5O65nY54BvIW
|
||||
FCBV4H8zLnxHsQKCAQEAx62jVmKqqzcRty8yhSzmTwB+WQRCw1TOSWwX+5iEi2Ol
|
||||
UPQX12ooSV9QwqoM8Km7gH6uTuXl9iK7x5cg0fXEyX2u6eYg8cFmoP/uWitRwiVr
|
||||
rSc6RrC9p7/guTVPIHZj410OHMyi3jHde/MkOe3h2Uky3pxMe3cpBz52hQ41zn3X
|
||||
RkPK9BE3chxN5UWtuY5vZXI1Daijb91XyZsEY3dEJIXy2U9Z/Ks/J2Ht7QWcpnZn
|
||||
SrdqOB+OknPocOpz9GVmeTHu8r2JrYLWju+1hHsVQcOXSxVYfgWY7RW78oBRPijh
|
||||
JO5xq/5sVGV0kz8J/+vcuVqpwGRpnPQlF8UqQAfI7QKCAQEAh3PNT2ZoC77tZara
|
||||
6Tx1tVAqVrFk9L7eL5eMbqr+sFO7kjB4Zt5Nlipiq1HYQg6CyPfxAFy+kvJ+xDPm
|
||||
BTddZ0zdrbz2DSzhqsUpx031EVsXE9Pn9N9w3omvKwyrVVOagm5Q72GxOh58Y0v2
|
||||
Y5AEWHeKnlLWfMsYMJeLZp/weT8oCEhUUArPPCz3fCM971CQiGDg/Msv6kjY25EM
|
||||
0YazsGpz81A2pAaSFONZ6f0uMeg1j/oTA8M3UyIugEHae23gj0gMWHIYT9YjhkTI
|
||||
PSmaCRMkyWcKwGeAYw1AnXjhZbiqcMJeDJ+GTeMXIiG/u/qUt2VNSHh/Z881h1sq
|
||||
Ora1sQKCAQBIwfRqXbliecZywTffXuTslHl1ZiANnLEt/70daA2j3MM4JDkrvPrB
|
||||
AYIj7GKarr4rq/1Hsm2AqldR+rdyyeLSqIE7qScH8Di9IYRwRqib3ZbGmSya5Xu1
|
||||
zCzOT6ZtZbYv+pBR3h7aZ8EUkRv6H7vTuOBYTQtxUZIZmaEGCo+AlkoCyGEDXeKe
|
||||
KcIYcLNEkan1hQ/f0jr7X+PFCj8nHyYtSMGcfVWEw8FXUE+ptgnGfg5VI1AI8za4
|
||||
FpPz0Po/a1NTheZTfMzV9H7Jxn6Vr2OneuV97mE4SkHW4byCOE9iHvMqydeRnDtM
|
||||
5Ur8/FNgdUkQIQEJoYz6K9v4NVeXzT5hAoIBAAoLtyr4GfN4N8y3WFx0qVWIeKro
|
||||
znTJ3D9nGbGSKZDFTPNb8nPfY9KNJ5GHaLrVZLgCvuNkRmhy8DE5y06+DglcA/DE
|
||||
tTx3u3oovj4uAumN+gqGBKD6VCG5jcuHveqIbDfsl1ZYySkk40+cfElyCtoML5JZ
|
||||
GKTYSZ/Qy4CxmKWQcbHA12oEp/YbOsW0jLSnMVDF5T62FV6RGZ/adbaPz6/boKCY
|
||||
tLtq93PxmhUd1eZzjodycEO32NpVy7OCXZXhrvAZezfJyt71qXzQHYUlLCPUkf/e
|
||||
C7IwGaDMIq4gB+1UP7zlxWUIENqTVTDg7U6+BvXoKw2e7wyN1sYl9/zQroI=
|
||||
-----END RSA PRIVATE KEY-----
|
||||
@@ -0,0 +1,9 @@
|
||||
dependencies:
|
||||
- name: postgresql
|
||||
repository: https://charts.bitnami.com/bitnami
|
||||
version: 4.2.2
|
||||
- name: redis
|
||||
repository: https://charts.bitnami.com/bitnami
|
||||
version: 7.1.1
|
||||
digest: sha256:df803216464c2e9422e4a97214aad873cc91214543ab8eb399da8005db862a95
|
||||
generated: 2019-05-28T18:02:33.507059362+02:00
|
||||
@@ -0,0 +1,9 @@
|
||||
dependencies:
|
||||
- name: postgresql
|
||||
version: 4.x.x
|
||||
repository: https://charts.bitnami.com/bitnami
|
||||
condition: postgresql.enabled
|
||||
- name: redis
|
||||
version: 7.x.x
|
||||
repository: https://charts.bitnami.com/bitnami
|
||||
condition: redis.enabled
|
||||
@@ -0,0 +1,46 @@
|
||||
** Please be patient while the chart is being deployed **
|
||||
|
||||
1. Get the Harbor URL:
|
||||
|
||||
{{- if contains "Ingress" .Values.service.type }}
|
||||
|
||||
You should be able to access your new Harbor installation through {{ .Values.externalURL }}
|
||||
|
||||
{{- else if contains "LoadBalancer" .Values.service.type }}
|
||||
|
||||
NOTE: It may take a few minutes for the LoadBalancer IP to be available.
|
||||
Watch the status with: 'kubectl get svc --namespace {{ .Release.Namespace }} -w {{ .Values.service.loadBalancer.name }}'
|
||||
|
||||
{{- $port:=.Values.service.loadBalancer.ports.httpPort | toString }}
|
||||
export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ .Values.service.loadBalancer.name }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
|
||||
echo "Harbor URL: http://$SERVICE_IP{{- if ne $port "80" }}:{{ .Values.loadBalancer.ports.httpPort }}{{ end }}/"
|
||||
|
||||
{{- else if contains "ClusterIP" .Values.service.type }}
|
||||
|
||||
{{- if .Values.service.tls.enabled }}
|
||||
|
||||
echo "Harbor URL: https://127.0.0.1:8443/"
|
||||
kubectl port-forward --namespace {{ .Release.Namespace }} svc/{{ .Values.service.clusterIP.name }} 8443:{{ .Values.service.clusterIP.ports.httpsPort }}
|
||||
|
||||
{{- else }}
|
||||
|
||||
echo "Harbor URL: http://127.0.0.1:8080/"
|
||||
kubectl port-forward --namespace {{ .Release.Namespace }} svc/{{ .Values.service.clusterIP.name }} 8080:{{ .Values.service.clusterIP.ports.httpPort }}
|
||||
|
||||
{{- end }}
|
||||
|
||||
{{- else if contains "NodePort" .Values.service.type }}
|
||||
|
||||
export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ .Values.service.nodePort.name }})
|
||||
export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
|
||||
echo "Harbor URL: http://$NODE_IP:$NODE_PORT/"
|
||||
|
||||
{{- end }}
|
||||
|
||||
2. Login with the following credentials to see your Harbor application
|
||||
|
||||
echo Username: "admin"
|
||||
echo Password: $(kubectl get secret --namespace {{ .Release.Namespace }} {{ template "harbor.core" . }}-envvars -o jsonpath="{.data.HARBOR_ADMIN_PASSWORD}" | base64 --decode)
|
||||
|
||||
{{ include "harbor.validateValues" . }}
|
||||
{{ include "harbor.checkRollingTags" . }}
|
||||
@@ -0,0 +1,638 @@
|
||||
{{/* vim: set filetype=mustache: */}}
|
||||
{{/*
|
||||
Expand the name of the chart.
|
||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
*/}}
|
||||
{{- define "harbor.name" -}}
|
||||
{{- default "harbor" .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create chart name and version as used by the chart label.
|
||||
*/}}
|
||||
{{- define "harbor.chart" -}}
|
||||
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create a default fully qualified app name.
|
||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
*/}}
|
||||
{{- define "harbor.fullname" -}}
|
||||
{{- $name := default "harbor" .Values.nameOverride -}}
|
||||
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Helm required labels */}}
|
||||
{{- define "harbor.labels" -}}
|
||||
app.kubernetes.io/name: {{ template "harbor.name" . }}
|
||||
helm.sh/chart: {{ template "harbor.chart" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
{{- end -}}
|
||||
|
||||
{{/* matchLabels */}}
|
||||
{{- define "harbor.matchLabels" -}}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/name: {{ template "harbor.name" . }}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "harbor.autoGenCert" -}}
|
||||
{{- if and .Values.service.tls.enabled (not .Values.service.tls.secretName) -}}
|
||||
{{- printf "true" -}}
|
||||
{{- else -}}
|
||||
{{- printf "false" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "harbor.autoGenCertForIngress" -}}
|
||||
{{- if and (eq (include "harbor.autoGenCert" .) "true") (eq .Values.service.type "Ingress") -}}
|
||||
{{- printf "true" -}}
|
||||
{{- else -}}
|
||||
{{- printf "false" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "harbor.autoGenCertForNginx" -}}
|
||||
{{- if and (eq (include "harbor.autoGenCert" .) "true") (ne .Values.service.type "Ingress") -}}
|
||||
{{- printf "true" -}}
|
||||
{{- else -}}
|
||||
{{- printf "false" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
Create a default fully qualified postgresql name.
|
||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
*/}}
|
||||
{{- define "harbor.postgresql.fullname" -}}
|
||||
{{- $name := default "postgresql" .Values.postgresql.nameOverride -}}
|
||||
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "harbor.database.host" -}}
|
||||
{{- if eq .Values.postgresql.enabled true -}}
|
||||
{{- template "harbor.postgresql.fullname" . }}
|
||||
{{- else -}}
|
||||
{{- .Values.externalDatabase.host -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "harbor.database.port" -}}
|
||||
{{- if eq .Values.postgresql.enabled true -}}
|
||||
{{- printf "%s" "5432" -}}
|
||||
{{- else -}}
|
||||
{{- .Values.externalDatabase.port -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "harbor.database.username" -}}
|
||||
{{- if eq .Values.postgresql.enabled true -}}
|
||||
{{- printf "%s" "postgres" -}}
|
||||
{{- else -}}
|
||||
{{- .Values.externalDatabase.user -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "harbor.database.rawPassword" -}}
|
||||
{{- if eq .Values.postgresql.enabled true -}}
|
||||
{{- .Values.postgresql.postgresqlPassword -}}
|
||||
{{- else -}}
|
||||
{{- .Values.externalDatabase.password -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "harbor.database.escapedRawPassword" -}}
|
||||
{{- include "harbor.database.rawPassword" . | urlquery | replace "+" "%20" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "harbor.database.encryptedPassword" -}}
|
||||
{{- include "harbor.database.rawPassword" . | b64enc | quote -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "harbor.database.coreDatabase" -}}
|
||||
{{- if eq .Values.postgresql.enabled true -}}
|
||||
{{- printf "%s" "registry" -}}
|
||||
{{- else -}}
|
||||
{{- .Values.externalDatabase.coreDatabase -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "harbor.database.clairDatabase" -}}
|
||||
{{- if eq .Values.postgresql.enabled true -}}
|
||||
{{- printf "%s" "postgres" -}}
|
||||
{{- else -}}
|
||||
{{- .Values.externalDatabase.clairDatabase -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "harbor.database.notaryServerDatabase" -}}
|
||||
{{- if eq .Values.postgresql.enabled true -}}
|
||||
{{- printf "%s" "notaryserver" -}}
|
||||
{{- else -}}
|
||||
{{- .Values.externalDatabase.notaryServerDatabase -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "harbor.database.notarySignerDatabase" -}}
|
||||
{{- if eq .Values.postgresql.enabled true -}}
|
||||
{{- printf "%s" "notarysigner" -}}
|
||||
{{- else -}}
|
||||
{{- .Values.database.external.notarySignerDatabase -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "harbor.database.sslmode" -}}
|
||||
{{- if eq .Values.postgresql.enabled true -}}
|
||||
{{- printf "%s" "disable" -}}
|
||||
{{- else -}}
|
||||
{{- .Values.database.external.sslmode -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "harbor.database.clair" -}}
|
||||
postgres://{{ template "harbor.database.username" . }}:{{ template "harbor.database.escapedRawPassword" . }}@{{ template "harbor.database.host" . }}:{{ template "harbor.database.port" . }}/{{ template "harbor.database.clairDatabase" . }}?sslmode={{ template "harbor.database.sslmode" . }}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "harbor.database.notaryServer" -}}
|
||||
postgres://{{ template "harbor.database.username" . }}:{{ template "harbor.database.escapedRawPassword" . }}@{{ template "harbor.database.host" . }}:{{ template "harbor.database.port" . }}/{{ template "harbor.database.notaryServerDatabase" . }}?sslmode={{ template "harbor.database.sslmode" . }}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "harbor.database.notarySigner" -}}
|
||||
postgres://{{ template "harbor.database.username" . }}:{{ template "harbor.database.escapedRawPassword" . }}@{{ template "harbor.database.host" . }}:{{ template "harbor.database.port" . }}/{{ template "harbor.database.notarySignerDatabase" . }}?sslmode={{ template "harbor.database.sslmode" . }}
|
||||
{{- end -}}
|
||||
|
||||
Create a default fully qualified redis name.
|
||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
*/}}
|
||||
{{- define "harbor.redis.fullname" -}}
|
||||
{{- $name := default "redis" .Values.redis.nameOverride -}}
|
||||
{{- printf "%s-%s-master" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
|
||||
{{- define "harbor.redis.host" -}}
|
||||
{{- if eq .Values.redis.enabled true -}}
|
||||
{{- template "harbor.redis.fullname" . -}}
|
||||
{{- else -}}
|
||||
{{- .Values.externalRedis.host -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "harbor.redis.port" -}}
|
||||
{{- if eq .Values.redis.enabled true -}}
|
||||
{{- printf "%s" "6379" -}}
|
||||
{{- else -}}
|
||||
{{- .Values.externalRedis.port -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "harbor.redis.coreDatabaseIndex" -}}
|
||||
{{- if eq .Values.redis.enabled true -}}
|
||||
{{- printf "%s" "0" }}
|
||||
{{- else -}}
|
||||
{{- .Values.externalRedis.coreDatabaseIndex -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "harbor.redis.jobserviceDatabaseIndex" -}}
|
||||
{{- if eq .Values.redis.enabled true -}}
|
||||
{{- printf "%s" "1" }}
|
||||
{{- else -}}
|
||||
{{- .Values.externalRedis.jobserviceDatabaseIndex -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "harbor.redis.registryDatabaseIndex" -}}
|
||||
{{- if eq .Values.redis.enabled true -}}
|
||||
{{- printf "%s" "2" }}
|
||||
{{- else -}}
|
||||
{{- .Values.externalRedis.registryDatabaseIndex -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "harbor.redis.chartmuseumDatabaseIndex" -}}
|
||||
{{- if eq .Values.redis.enabled true -}}
|
||||
{{- printf "%s" "3" }}
|
||||
{{- else -}}
|
||||
{{- .Values.externalRedis.chartmuseumDatabaseIndex -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "harbor.redis.rawPassword" -}}
|
||||
{{- if and (eq .Values.redis.enabled false) .Values.externalRedis.password -}}
|
||||
{{- .Values.externalRedis.password -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "harbor.redis.escapedRawPassword" -}}
|
||||
{{- if (include "harbor.redis.rawPassword" . ) -}}
|
||||
{{- include "harbor.redis.rawPassword" . | urlquery | replace "+" "%20" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*the username redis is used for a placeholder as no username needed in redis*/}}
|
||||
{{- define "harbor.redisForJobservice" -}}
|
||||
{{- if (include "harbor.redis.escapedRawPassword" . ) -}}
|
||||
{{- printf "redis://redis:%s@%s:%s/%s" (include "harbor.redis.escapedRawPassword" . ) (include "harbor.redis.host" . ) (include "harbor.redis.port" . ) (include "harbor.redis.jobserviceDatabaseIndex" . ) }}
|
||||
{{- else }}
|
||||
{{- template "harbor.redis.host" . }}:{{ template "harbor.redis.port" . }}/{{ template "harbor.redis.jobserviceDatabaseIndex" . }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*the username redis is used for a placeholder as no username needed in redis*/}}
|
||||
{{- define "harbor.redisForGC" -}}
|
||||
{{- if (include "harbor.redis.escapedRawPassword" . ) -}}
|
||||
{{- printf "redis://redis:%s@%s:%s/%s" (include "harbor.redis.escapedRawPassword" . ) (include "harbor.redis.host" . ) (include "harbor.redis.port" . ) (include "harbor.redis.registryDatabaseIndex" . ) }}
|
||||
{{- else }}
|
||||
{{- printf "redis://%s:%s/%s" (include "harbor.redis.host" . ) (include "harbor.redis.port" . ) (include "harbor.redis.registryDatabaseIndex" . ) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
host:port,pool_size,password
|
||||
100 is the default value of pool size
|
||||
*/}}
|
||||
{{- define "harbor.redisForCore" -}}
|
||||
{{- template "harbor.redis.host" . }}:{{ template "harbor.redis.port" . }},100,{{ template "harbor.redis.rawPassword" . }}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "harbor.portal" -}}
|
||||
{{- printf "%s-portal" (include "harbor.fullname" .) -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "harbor.core" -}}
|
||||
{{- printf "%s-core" (include "harbor.fullname" .) -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "harbor.redis" -}}
|
||||
{{- printf "%s-redis" (include "harbor.fullname" .) -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "harbor.jobservice" -}}
|
||||
{{- printf "%s-jobservice" (include "harbor.fullname" .) -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "harbor.registry" -}}
|
||||
{{- printf "%s-registry" (include "harbor.fullname" .) -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "harbor.chartmuseum" -}}
|
||||
{{- printf "%s-chartmuseum" (include "harbor.fullname" .) -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "harbor.database" -}}
|
||||
{{- printf "%s-database" (include "harbor.fullname" .) -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "harbor.clair" -}}
|
||||
{{- printf "%s-clair" (include "harbor.fullname" .) -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "harbor.notary-server" -}}
|
||||
{{- printf "%s-notary-server" (include "harbor.fullname" .) -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "harbor.notary-signer" -}}
|
||||
{{- printf "%s-notary-signer" (include "harbor.fullname" .) -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "harbor.nginx" -}}
|
||||
{{- printf "%s-nginx" (include "harbor.fullname" .) -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "harbor.ingress" -}}
|
||||
{{- printf "%s-ingress" (include "harbor.fullname" .) -}}
|
||||
{{- end -}}
|
||||
|
||||
Create a default fully qualified nginx name.
|
||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
*/}}
|
||||
{{- define "harbor.nginx.fullname" -}}
|
||||
{{- $name := default "nginx" .Values.nginx.nameOverride -}}
|
||||
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the proper Harbor Core image name
|
||||
*/}}
|
||||
{{- define "harbor.coreImage" -}}
|
||||
{{- $registryName := .Values.coreImage.registry -}}
|
||||
{{- $repositoryName := .Values.coreImage.repository -}}
|
||||
{{- $tag := .Values.coreImage.tag | toString -}}
|
||||
{{/*
|
||||
Helm 2.11 supports the assignment of a value to a variable defined in a different scope,
|
||||
but Helm 2.9 and 2.10 doesn't support it, so we need to implement this if-else logic.
|
||||
Also, we can't use a single if because lazy evaluation is not an option
|
||||
*/}}
|
||||
{{- if .Values.global }}
|
||||
{{- if .Values.global.imageRegistry }}
|
||||
{{- printf "%s/%s:%s" .Values.global.imageRegistry $repositoryName $tag -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s/%s:%s" $registryName $repositoryName $tag -}}
|
||||
{{- end -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s/%s:%s" $registryName $repositoryName $tag -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the proper Harbor Portal image name
|
||||
*/}}
|
||||
{{- define "harbor.portalImage" -}}
|
||||
{{- $registryName := .Values.portalImage.registry -}}
|
||||
{{- $repositoryName := .Values.portalImage.repository -}}
|
||||
{{- $tag := .Values.portalImage.tag | toString -}}
|
||||
{{/*
|
||||
Helm 2.11 supports the assignment of a value to a variable defined in a different scope,
|
||||
but Helm 2.9 and 2.10 doesn't support it, so we need to implement this if-else logic.
|
||||
Also, we can't use a single if because lazy evaluation is not an option
|
||||
*/}}
|
||||
{{- if .Values.global }}
|
||||
{{- if .Values.global.imageRegistry }}
|
||||
{{- printf "%s/%s:%s" .Values.global.imageRegistry $repositoryName $tag -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s/%s:%s" $registryName $repositoryName $tag -}}
|
||||
{{- end -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s/%s:%s" $registryName $repositoryName $tag -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the proper Harbor Job Service image name
|
||||
*/}}
|
||||
{{- define "harbor.jobserviceImage" -}}
|
||||
{{- $registryName := .Values.jobserviceImage.registry -}}
|
||||
{{- $repositoryName := .Values.jobserviceImage.repository -}}
|
||||
{{- $tag := .Values.jobserviceImage.tag | toString -}}
|
||||
{{/*
|
||||
Helm 2.11 supports the assignment of a value to a variable defined in a different scope,
|
||||
but Helm 2.9 and 2.10 doesn't support it, so we need to implement this if-else logic.
|
||||
Also, we can't use a single if because lazy evaluation is not an option
|
||||
*/}}
|
||||
{{- if .Values.global }}
|
||||
{{- if .Values.global.imageRegistry }}
|
||||
{{- printf "%s/%s:%s" .Values.global.imageRegistry $repositoryName $tag -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s/%s:%s" $registryName $repositoryName $tag -}}
|
||||
{{- end -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s/%s:%s" $registryName $repositoryName $tag -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the proper Harbor Notary Server image name
|
||||
*/}}
|
||||
{{- define "harbor.notaryServerImage" -}}
|
||||
{{- $registryName := .Values.notaryServerImage.registry -}}
|
||||
{{- $repositoryName := .Values.notaryServerImage.repository -}}
|
||||
{{- $tag := .Values.notaryServerImage.tag | toString -}}
|
||||
{{/*
|
||||
Helm 2.11 supports the assignment of a value to a variable defined in a different scope,
|
||||
but Helm 2.9 and 2.10 doesn't support it, so we need to implement this if-else logic.
|
||||
Also, we can't use a single if because lazy evaluation is not an option
|
||||
*/}}
|
||||
{{- if .Values.global }}
|
||||
{{- if .Values.global.imageRegistry }}
|
||||
{{- printf "%s/%s:%s" .Values.global.imageRegistry $repositoryName $tag -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s/%s:%s" $registryName $repositoryName $tag -}}
|
||||
{{- end -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s/%s:%s" $registryName $repositoryName $tag -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the proper Harbor Notary Signer image name
|
||||
*/}}
|
||||
{{- define "harbor.notarySignerImage" -}}
|
||||
{{- $registryName := .Values.notarySignerImage.registry -}}
|
||||
{{- $repositoryName := .Values.notarySignerImage.repository -}}
|
||||
{{- $tag := .Values.notarySignerImage.tag | toString -}}
|
||||
{{/*
|
||||
Helm 2.11 supports the assignment of a value to a variable defined in a different scope,
|
||||
but Helm 2.9 and 2.10 doesn't support it, so we need to implement this if-else logic.
|
||||
Also, we can't use a single if because lazy evaluation is not an option
|
||||
*/}}
|
||||
{{- if .Values.global }}
|
||||
{{- if .Values.global.imageRegistry }}
|
||||
{{- printf "%s/%s:%s" .Values.global.imageRegistry $repositoryName $tag -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s/%s:%s" $registryName $repositoryName $tag -}}
|
||||
{{- end -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s/%s:%s" $registryName $repositoryName $tag -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the proper Harbor Registry image name
|
||||
*/}}
|
||||
{{- define "harbor.registryImage" -}}
|
||||
{{- $registryName := .Values.registryImage.registry -}}
|
||||
{{- $repositoryName := .Values.registryImage.repository -}}
|
||||
{{- $tag := .Values.registryImage.tag | toString -}}
|
||||
{{/*
|
||||
Helm 2.11 supports the assignment of a value to a variable defined in a different scope,
|
||||
but Helm 2.9 and 2.10 doesn't support it, so we need to implement this if-else logic.
|
||||
Also, we can't use a single if because lazy evaluation is not an option
|
||||
*/}}
|
||||
{{- if .Values.global }}
|
||||
{{- if .Values.global.imageRegistry }}
|
||||
{{- printf "%s/%s:%s" .Values.global.imageRegistry $repositoryName $tag -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s/%s:%s" $registryName $repositoryName $tag -}}
|
||||
{{- end -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s/%s:%s" $registryName $repositoryName $tag -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the proper Harbor Registryctl image name
|
||||
*/}}
|
||||
{{- define "harbor.registryctlImage" -}}
|
||||
{{- $registryName := .Values.registryctlImage.registry -}}
|
||||
{{- $repositoryName := .Values.registryctlImage.repository -}}
|
||||
{{- $tag := .Values.registryctlImage.tag | toString -}}
|
||||
{{/*
|
||||
Helm 2.11 supports the assignment of a value to a variable defined in a different scope,
|
||||
but Helm 2.9 and 2.10 doesn't support it, so we need to implement this if-else logic.
|
||||
Also, we can't use a single if because lazy evaluation is not an option
|
||||
*/}}
|
||||
{{- if .Values.global }}
|
||||
{{- if .Values.global.imageRegistry }}
|
||||
{{- printf "%s/%s:%s" .Values.global.imageRegistry $repositoryName $tag -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s/%s:%s" $registryName $repositoryName $tag -}}
|
||||
{{- end -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s/%s:%s" $registryName $repositoryName $tag -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the proper Harbor Clair image name
|
||||
*/}}
|
||||
{{- define "harbor.clairImage" -}}
|
||||
{{- $registryName := .Values.clairImage.registry -}}
|
||||
{{- $repositoryName := .Values.clairImage.repository -}}
|
||||
{{- $tag := .Values.clairImage.tag | toString -}}
|
||||
{{/*
|
||||
Helm 2.11 supports the assignment of a value to a variable defined in a different scope,
|
||||
but Helm 2.9 and 2.10 doesn't support it, so we need to implement this if-else logic.
|
||||
Also, we can't use a single if because lazy evaluation is not an option
|
||||
*/}}
|
||||
{{- if .Values.global }}
|
||||
{{- if .Values.global.imageRegistry }}
|
||||
{{- printf "%s/%s:%s" .Values.global.imageRegistry $repositoryName $tag -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s/%s:%s" $registryName $repositoryName $tag -}}
|
||||
{{- end -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s/%s:%s" $registryName $repositoryName $tag -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the proper Nginx image name
|
||||
*/}}
|
||||
{{- define "harbor.nginxImage" -}}
|
||||
{{- $registryName := .Values.nginxImage.registry -}}
|
||||
{{- $repositoryName := .Values.nginxImage.repository -}}
|
||||
{{- $tag := .Values.nginxImage.tag | toString -}}
|
||||
{{/*
|
||||
Helm 2.11 supports the assignment of a value to a variable defined in a different scope,
|
||||
but Helm 2.9 and 2.10 doesn't support it, so we need to implement this if-else logic.
|
||||
Also, we can't use a single if because lazy evaluation is not an option
|
||||
*/}}
|
||||
{{- if .Values.global }}
|
||||
{{- if .Values.global.imageRegistry }}
|
||||
{{- printf "%s/%s:%s" .Values.global.imageRegistry $repositoryName $tag -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s/%s:%s" $registryName $repositoryName $tag -}}
|
||||
{{- end -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s/%s:%s" $registryName $repositoryName $tag -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the proper Docker Image Registry Secret Names
|
||||
*/}}
|
||||
{{- define "harbor.imagePullSecrets" -}}
|
||||
{{/*
|
||||
Helm 2.11 supports the assignment of a value to a variable defined in a different scope,
|
||||
but Helm 2.9 and 2.10 does not support it, so we need to implement this if-else logic.
|
||||
Also, we can not use a single if because lazy evaluation is not an option
|
||||
*/}}
|
||||
{{- if .Values.global }}
|
||||
{{- if .Values.global.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- range .Values.global.imagePullSecrets }}
|
||||
- name: {{ . }}
|
||||
{{- end }}
|
||||
{{- else if or .Values.harbor.coreImage.pullSecrets .Values.portalImage.pullSecrets .Values.jobserviceImage.pullSecrets .Values.registryImage.pullSecrets .Values.registryctlImage.pullSecrets .Values.nginxImage.pullSecrets}}
|
||||
imagePullSecrets:
|
||||
{{- range .Values.harbor.coreImage.pullSecrets }}
|
||||
- name: {{ . }}
|
||||
{{- end }}
|
||||
{{- range .Values.portalImage.pullSecrets }}
|
||||
- name: {{ . }}
|
||||
{{- end }}
|
||||
{{- range .Values.jobserviceImage.pullSecrets }}
|
||||
- name: {{ . }}
|
||||
{{- end }}
|
||||
{{- range .Values.registryImage.pullSecrets }}
|
||||
- name: {{ . }}
|
||||
{{- end }}
|
||||
{{- range .Values.registryctlImage.pullSecrets }}
|
||||
- name: {{ . }}
|
||||
{{- end }}
|
||||
{{- range .Values.nginxImage.pullSecrets }}
|
||||
- name: {{ . }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
{{- else if or .Values.harbor.coreImage.pullSecrets .Values.portalImage.pullSecrets .Values.jobserviceImage.pullSecrets .Values.registryImage.pullSecrets .Values.registryctlImage.pullSecrets .Values.nginxImage.pullSecrets}}
|
||||
imagePullSecrets:
|
||||
{{- range .Values.harbor.coreImage.pullSecrets }}
|
||||
- name: {{ . }}
|
||||
{{- end }}
|
||||
{{- range .Values.portalImage.pullSecrets }}
|
||||
- name: {{ . }}
|
||||
{{- end }}
|
||||
{{- range .Values.jobserviceImage.pullSecrets }}
|
||||
- name: {{ . }}
|
||||
{{- end }}
|
||||
{{- range .Values.registryImage.pullSecrets }}
|
||||
- name: {{ . }}
|
||||
{{- end }}
|
||||
{{- range .Values.registryctlImage.pullSecrets }}
|
||||
- name: {{ . }}
|
||||
{{- end }}
|
||||
{{- range .Values.nginxImage.pullSecrets }}
|
||||
- name: {{ . }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Check if there are rolling tags in the images */}}
|
||||
{{- define "harbor.checkRollingTags" -}}
|
||||
{{- if and (contains "bitnami/" .Values.coreImage.repository) (not (.Values.coreImage.tag | toString | regexFind "-r\\d+$|sha256:")) }}
|
||||
WARNING: Rolling tag detected ({{ .Values.coreImage.repository }}:{{ .Values.coreImage.tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment.
|
||||
+info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/
|
||||
{{- end }}
|
||||
{{- if and (contains "bitnami/" .Values.portalImage.repository) (not (.Values.portalImage.tag | toString | regexFind "-r\\d+$|sha256:")) }}
|
||||
WARNING: Rolling tag detected ({{ .Values.portalImage.repository }}:{{ .Values.portalImage.tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment.
|
||||
+info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/
|
||||
{{- end }}
|
||||
{{- if and (contains "bitnami/" .Values.jobserviceImage.repository) (not (.Values.jobserviceImage.tag | toString | regexFind "-r\\d+$|sha256:")) }}
|
||||
WARNING: Rolling tag detected ({{ .Values.jobserviceImage.repository }}:{{ .Values.jobserviceImage.tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment.
|
||||
+info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/
|
||||
{{- end }}
|
||||
{{- if and (contains "bitnami/" .Values.registryImage.repository) (not (.Values.registryImage.tag | toString | regexFind "-r\\d+$|sha256:")) }}
|
||||
WARNING: Rolling tag detected ({{ .Values.registryImage.repository }}:{{ .Values.registryImage.tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment.
|
||||
+info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/
|
||||
{{- end }}
|
||||
{{- if and (contains "bitnami/" .Values.registryctlImage.repository) (not (.Values.registryctlImage.tag | toString | regexFind "-r\\d+$|sha256:")) }}
|
||||
WARNING: Rolling tag detected ({{ .Values.registryctlImage.repository }}:{{ .Values.registryctlImage.tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment.
|
||||
+info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/
|
||||
{{- end }}
|
||||
{{- if and (contains "bitnami/" .Values.nginxImage.repository) (not (.Values.nginxImage.tag | toString | regexFind "-r\\d+$|sha256:")) }}
|
||||
WARNING: Rolling tag detected ({{ .Values.nginxImage.repository }}:{{ .Values.nginxImage.tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment.
|
||||
+info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Compile all warnings into a single message, and call fail.
|
||||
*/}}
|
||||
{{- define "harbor.validateValues" -}}
|
||||
{{- $messages := list -}}
|
||||
{{- $messages := append $messages (include "harbor.validateValues.postgresqlPassword" .) -}}
|
||||
{{- $messages := without $messages "" -}}
|
||||
{{- $message := join "\n" $messages -}}
|
||||
|
||||
{{- if $message -}}
|
||||
{{- printf "\nVALUES VALIDATION:\n%s" $message | fail -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Validate values of Harbor - must provide a password for PostgreSQL */}}
|
||||
{{- define "harbor.validateValues.postgresqlPassword" -}}
|
||||
{{- if eq .Values.postgresql.enabled true -}}
|
||||
{{- if not .Values.postgresql.postgresqlPassword -}}
|
||||
harbor: PostgreSQL password
|
||||
A database password is required!.
|
||||
Please set a passsord (--set postgresql.postgresqlPassword="xxxx")
|
||||
{{- end -}}
|
||||
{{- else -}}
|
||||
{{- if not .Values.externalDatabase.password -}}
|
||||
harbor: External PostgreSQL password
|
||||
An external database password is required!.
|
||||
Please set a passsord (--set externalDatabase.password="xxxx")
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,35 @@
|
||||
{{ if .Values.clair.enabled }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ template "harbor.clair" . }}
|
||||
labels:
|
||||
{{ include "harbor.labels" . | nindent 4 }}
|
||||
app.kubernetes.io/component: clair
|
||||
data:
|
||||
config.yaml: |
|
||||
clair:
|
||||
database:
|
||||
type: pgsql
|
||||
options:
|
||||
source: "{{ template "harbor.database.clair" . }}"
|
||||
# Number of elements kept in the cache
|
||||
# Values unlikely to change (e.g. namespaces) are cached in order to save prevent needless roundtrips to the database.
|
||||
cachesize: 16384
|
||||
|
||||
api:
|
||||
# API server port
|
||||
port: 6060
|
||||
healthport: 6061
|
||||
|
||||
# Deadline before an API request will respond with a 503
|
||||
timeout: 300s
|
||||
updater:
|
||||
interval: {{ .Values.clair.updatersInterval }}h
|
||||
|
||||
notifier:
|
||||
attempts: 3
|
||||
renotifyinterval: 2h
|
||||
http:
|
||||
endpoint: "http://{{ template "harbor.core" . }}/service/notifications/clair"
|
||||
{{ end }}
|
||||
@@ -0,0 +1,89 @@
|
||||
{{ if .Values.clair.enabled }}
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ template "harbor.clair" . }}
|
||||
labels:
|
||||
{{ include "harbor.labels" . | nindent 4 }}
|
||||
app.kubernetes.io/component: clair
|
||||
spec:
|
||||
replicas: {{ .Values.clair.replicas }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{ include "harbor.matchLabels" . | nindent 6 }}
|
||||
app.kubernetes.io/component: clair
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
{{ include "harbor.labels" . | nindent 8 }}
|
||||
app.kubernetes.io/component: clair
|
||||
annotations:
|
||||
checksum/configmap: {{ include (print $.Template.BasePath "/clair/clair-cm.yaml") . | sha256sum }}
|
||||
{{- if .Values.clair.podAnnotations }}
|
||||
{{ toYaml .Values.clair.podAnnotations | nindent 8 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- with .Values.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: clair
|
||||
image: "{{ template "harbor.clairImage" . }}"
|
||||
imagePullPolicy: {{ .Values.clairImage.pullPolicy | quote }}
|
||||
{{- if .Values.clair.livenessProbe.enabled }}
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /health
|
||||
port: 6061
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 10
|
||||
{{- end }}
|
||||
{{- if .Values.clair.readinessProbe.enabled }}
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /health
|
||||
port: 6061
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 10
|
||||
{{- end }}
|
||||
env:
|
||||
- name: BITNAMI_DEBUG
|
||||
value: {{ ternary "true" "false" .Values.registryImage.debug | quote }}
|
||||
{{- if .Values.clair.httpProxy }}
|
||||
- name: HTTP_PROXY
|
||||
value: {{ .Values.clair.httpProxy }}
|
||||
{{- end }}
|
||||
{{- if .Values.clair.httpsProxy }}
|
||||
- name: HTTPS_PROXY
|
||||
value: {{ .Values.clair.httpsProxy }}
|
||||
{{- end }}
|
||||
- name: NO_PROXY
|
||||
value: "{{ template "harbor.registry" . }},{{ template "harbor.core" . }}"
|
||||
{{- if .Values.clair.resources }}
|
||||
resources:
|
||||
{{ toYaml .Values.clair.resources | nindent 10 }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- containerPort: 6060
|
||||
volumeMounts:
|
||||
- name: clair-config
|
||||
mountPath: /etc/clair/config.yaml
|
||||
subPath: config.yaml
|
||||
volumes:
|
||||
- name: clair-config
|
||||
configMap:
|
||||
name: "{{ template "harbor.clair" . }}"
|
||||
items:
|
||||
- key: config.yaml
|
||||
path: config.yaml
|
||||
{{- with .Values.clair.nodeSelector }}
|
||||
nodeSelector: {{ toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.clair.affinity }}
|
||||
affinity: {{ toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.clair.tolerations }}
|
||||
tolerations: {{ tpl (toYaml .) $ | nindent 8 }}
|
||||
{{- end }}
|
||||
{{ end }}
|
||||
@@ -0,0 +1,18 @@
|
||||
{{ if .Values.clair.enabled }}
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ template "harbor.clair" . }}
|
||||
labels:
|
||||
{{ include "harbor.labels" . | nindent 4 }}
|
||||
app.kubernetes.io/component: clair
|
||||
spec:
|
||||
ports:
|
||||
- name: clair
|
||||
port: 6060
|
||||
- name: health
|
||||
port: 6061
|
||||
selector:
|
||||
{{ include "harbor.matchLabels" . | nindent 4 }}
|
||||
app.kubernetes.io/component: clair
|
||||
{{ end }}
|
||||
@@ -0,0 +1,43 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ template "harbor.core" . }}-envvars
|
||||
labels: {{ include "harbor.labels" . | nindent 4 }}
|
||||
data:
|
||||
DATABASE_TYPE: "postgresql"
|
||||
POSTGRESQL_HOST: "{{ template "harbor.postgresql.fullname" . }}"
|
||||
POSTGRESQL_PORT: "{{ .Values.postgresql.service.port }}"
|
||||
POSTGRESQL_USERNAME: "{{ .Values.postgresql.postgresqlUsername }}"
|
||||
POSTGRESQL_DATABASE: "registry"
|
||||
POSTGRESQL_SSLMODE: "{{ template "harbor.database.sslmode" . }}"
|
||||
EXT_ENDPOINT: "{{ .Values.externalURL }}"
|
||||
CORE_URL: "http://{{ template "harbor.core" . }}"
|
||||
JOBSERVICE_URL: "http://{{ template "harbor.fullname" . }}-jobservice"
|
||||
REGISTRY_URL: "http://{{ template "harbor.registry" . }}:5000"
|
||||
TOKEN_SERVICE_URL: "http://{{ template "harbor.core" . }}/service/token"
|
||||
WITH_NOTARY: "{{ .Values.notary.enabled }}"
|
||||
NOTARY_URL: "http://{{ template "harbor.notary-server" . }}:4443"
|
||||
CFG_EXPIRATION: "5"
|
||||
ADMIRAL_URL: "NA"
|
||||
WITH_CLAIR: "{{ .Values.clair.enabled }}"
|
||||
CLAIR_DB_HOST: "{{ template "harbor.postgresql.fullname" . }}"
|
||||
CLAIR_DB_PORT: "{{ .Values.postgresql.service.port }}"
|
||||
CLAIR_DB_USERNAME: "{{ .Values.postgresql.postgresqlUsername }}"
|
||||
CLAIR_DB: "{{ template "harbor.database.clairDatabase" . }}"
|
||||
CLAIR_DB_SSLMODE: "{{ template "harbor.database.sslmode" . }}"
|
||||
CLAIR_URL: "http://{{ template "harbor.fullname" . }}-clair:6060"
|
||||
REGISTRY_STORAGE_PROVIDER_NAME: "{{ .Values.persistence.imageChartStorage.type }}"
|
||||
WITH_CHARTMUSEUM: "{{ .Values.chartmuseum.enabled }}"
|
||||
CHART_REPOSITORY_URL: "http://{{ template "harbor.chartmuseum" . }}"
|
||||
LOG_LEVEL: "{{ .Values.logLevel }}"
|
||||
CONFIG_PATH: "/etc/core/app.conf"
|
||||
SYNC_REGISTRY: "false"
|
||||
CHART_CACHE_DRIVER: "redis"
|
||||
_REDIS_URL: "{{ template "harbor.redisForCore" . }}"
|
||||
_REDIS_URL_REG: "{{ template "harbor.redisForGC" . }}"
|
||||
PORTAL_URL: "http://{{ template "harbor.portal" . }}"
|
||||
REGISTRYCTL_URL: "http://{{ template "harbor.registry" . }}:8080"
|
||||
CLAIR_HEALTH_CHECK_SERVER_URL: "http://{{ template "harbor.clair" . }}:6061"
|
||||
{{- if .Values.uaaSecretName }}
|
||||
UAA_CA_ROOT: "/etc/core/ca/auth-ca.crt"
|
||||
{{- end }}
|
||||
@@ -0,0 +1,13 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ template "harbor.core" . }}
|
||||
labels: {{ include "harbor.labels" . | nindent 4 }}
|
||||
data:
|
||||
app.conf: |+
|
||||
appname = Harbor
|
||||
runmode = dev
|
||||
enablegzip = true
|
||||
|
||||
[dev]
|
||||
httpport = 8080
|
||||
@@ -0,0 +1,157 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ template "harbor.core" . }}
|
||||
labels:
|
||||
{{- include "harbor.labels" . | nindent 4 }}
|
||||
app.kubernetes.io/component: core
|
||||
spec:
|
||||
replicas: {{ .Values.core.replicas }}
|
||||
selector:
|
||||
matchLabels: {{ include "harbor.matchLabels" . | nindent 6 }}
|
||||
app.kubernetes.io/component: core
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
{{ include "harbor.matchLabels" . | nindent 8 }}
|
||||
app.kubernetes.io/component: core
|
||||
annotations:
|
||||
checksum/configmap: {{ include (print $.Template.BasePath "/core/core-cm.yaml") . | sha256sum }}
|
||||
checksum/configmap-envvars: {{ include (print $.Template.BasePath "/core/core-cm-envvars.yaml") . | sha256sum }}
|
||||
checksum/secret: {{ include (print $.Template.BasePath "/core/core-secret.yaml") . | sha256sum }}
|
||||
checksum/secret-envvars: {{ include (print $.Template.BasePath "/core/core-secret-envvars.yaml") . | sha256sum }}
|
||||
checksum/secret-jobservice: {{ include (print $.Template.BasePath "/jobservice/jobservice-secrets.yaml") . | sha256sum }}
|
||||
{{- if .Values.core.podAnnotations }}
|
||||
{{- toYaml .Values.core.podAnnotations | nindent 8 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if .Values.securityContext.enabled }}
|
||||
securityContext:
|
||||
fsGroup: {{ .Values.securityContext.fsGroup }}
|
||||
runAsUser: {{ .Values.securityContext.runAsUser }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: core
|
||||
image: "{{ template "harbor.coreImage" . }}"
|
||||
imagePullPolicy: {{ .Values.coreImage.pullPolicy | quote }}
|
||||
{{- if .Values.core.livenessProbe.enabled }}
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /api/ping
|
||||
port: http
|
||||
initialDelaySeconds: {{ .Values.core.livenessProbe.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.core.livenessProbe.periodSeconds }}
|
||||
timeoutSeconds: {{ .Values.core.livenessProbe.timeoutSeconds }}
|
||||
successThreshold: {{ .Values.core.livenessProbe.successThreshold }}
|
||||
failureThreshold: {{ .Values.core.livenessProbe.failureThreshold }}
|
||||
{{- end }}
|
||||
{{- if .Values.core.readinessProbe.enabled }}
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /api/ping
|
||||
port: http
|
||||
initialDelaySeconds: {{ .Values.core.readinessProbe.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.core.readinessProbe.periodSeconds }}
|
||||
timeoutSeconds: {{ .Values.core.readinessProbe.timeoutSeconds }}
|
||||
successThreshold: {{ .Values.core.readinessProbe.successThreshold }}
|
||||
failureThreshold: {{ .Values.core.readinessProbe.failureThreshold }}
|
||||
{{- end }}
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: "{{ template "harbor.core" . }}-envvars"
|
||||
- secretRef:
|
||||
name: "{{ template "harbor.core" . }}-envvars"
|
||||
env:
|
||||
- name: BITNAMI_DEBUG
|
||||
value: {{ ternary "true" "false" .Values.coreImage.debug | quote }}
|
||||
- name: CORE_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ template "harbor.core" . }}
|
||||
key: secret
|
||||
- name: JOBSERVICE_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: "{{ template "harbor.jobservice" . }}"
|
||||
key: secret
|
||||
ports:
|
||||
- containerPort: 8080
|
||||
name: http
|
||||
volumeMounts:
|
||||
- name: config
|
||||
mountPath: /etc/core/app.conf
|
||||
subPath: app.conf
|
||||
- name: secret-key
|
||||
mountPath: /etc/core/key
|
||||
subPath: key
|
||||
- name: token-service-private-key
|
||||
mountPath: /etc/core/private_key.pem
|
||||
subPath: tls.key
|
||||
{{- if .Values.service.tls.enabled }}
|
||||
- name: ca-download
|
||||
mountPath: /etc/core/ca/ca.crt
|
||||
subPath: ca.crt
|
||||
{{- end }}
|
||||
{{- if .Values.uaaSecretName }}
|
||||
- name: auth-ca-cert
|
||||
mountPath: /etc/core/ca/auth-ca.crt
|
||||
subPath: auth-ca.crt
|
||||
{{- end }}
|
||||
- name: psc
|
||||
mountPath: /etc/core/token
|
||||
{{- if .Values.core.resources }}
|
||||
resources: {{ toYaml .Values.core.resources | nindent 10 }}
|
||||
{{- end }}
|
||||
volumes:
|
||||
- name: config
|
||||
configMap:
|
||||
name: {{ template "harbor.core" . }}
|
||||
items:
|
||||
- key: app.conf
|
||||
path: app.conf
|
||||
- name: secret-key
|
||||
secret:
|
||||
secretName: {{ template "harbor.core" . }}
|
||||
items:
|
||||
- key: secretKey
|
||||
path: key
|
||||
- name: token-service-private-key
|
||||
secret:
|
||||
{{- if .Values.core.secretName }}
|
||||
secretName: {{ .Values.core.secretName }}
|
||||
{{- else }}
|
||||
secretName: {{ template "harbor.core" . }}
|
||||
{{- end }}
|
||||
{{- if .Values.service.tls.enabled }}
|
||||
- name: ca-download
|
||||
secret:
|
||||
{{- if eq (include "harbor.autoGenCertForIngress" .) "true" }}
|
||||
secretName: "{{ template "harbor.ingress" . }}"
|
||||
{{- else if eq (include "harbor.autoGenCertForNginx" .) "true" }}
|
||||
secretName: {{ template "harbor.nginx" . }}
|
||||
{{- else }}
|
||||
secretName: {{ .Values.service.tls.secretName }}
|
||||
{{- end }}
|
||||
items:
|
||||
- key: ca.crt
|
||||
path: ca.crt
|
||||
{{- end }}
|
||||
{{- if .Values.uaaSecretName }}
|
||||
- name: auth-ca-cert
|
||||
secret:
|
||||
secretName: {{ .Values.uaaSecretName }}
|
||||
items:
|
||||
- key: ca.crt
|
||||
path: auth-ca.crt
|
||||
{{- end }}
|
||||
- name: psc
|
||||
emptyDir: {}
|
||||
{{- with .Values.core.nodeSelector }}
|
||||
nodeSelector: {{ tpl (toYaml .) $ | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.core.affinity }}
|
||||
affinity: {{ tpl (toYaml .) $ | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.core.tolerations }}
|
||||
tolerations: {{ tpl (toYaml .) $ | nindent 8 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,18 @@
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ template "harbor.core" . }}-envvars
|
||||
labels: {{ include "harbor.labels" . | nindent 4 }}
|
||||
type: Opaque
|
||||
data:
|
||||
{{- if .Values.harborAdminPassword }}
|
||||
HARBOR_ADMIN_PASSWORD: {{ .Values.harborAdminPassword | b64enc | quote }}
|
||||
{{- else if (not .Values.forcePassword) }}
|
||||
HARBOR_ADMIN_PASSWORD: "{{ randAlphaNum 10 | b64enc }}"
|
||||
{{ else }}
|
||||
HARBOR_ADMIN_PASSWORD: {{ required "A Harbor Admin Password is required!" .Values.harborAdminPassword }}
|
||||
{{- end }}
|
||||
POSTGRESQL_PASSWORD: {{ template "harbor.database.encryptedPassword" . }}
|
||||
{{- if .Values.clair.enabled }}
|
||||
CLAIR_DB_PASSWORD: {{ template "harbor.database.encryptedPassword" . }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,27 @@
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ template "harbor.core" . }}
|
||||
labels: {{ include "harbor.labels" . | nindent 4 }}
|
||||
type: Opaque
|
||||
data:
|
||||
{{- if .Values.secretKey }}
|
||||
secretKey: {{ .Values.secretKey | b64enc | quote }}
|
||||
{{- else if (not .Values.forcePassword) }}
|
||||
secretKey: "{{ randAlphaNum 16 | b64enc }}"
|
||||
{{ else }}
|
||||
secretKey: {{ required "A secret key is required!" .Values.secretKey }}
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.core.secret }}
|
||||
secret: {{ .Values.core.secret | b64enc | quote }}
|
||||
{{- else if (not .Values.forcePassword) }}
|
||||
secret: "{{ randAlphaNum 16 | b64enc }}"
|
||||
{{ else }}
|
||||
secret: {{ required "A secret is required!" .Values.core.secret }}
|
||||
{{- end }}
|
||||
|
||||
{{- if not .Values.core.secretName }}
|
||||
tls.crt: {{ .Files.Get "cert/tls.crt" | b64enc }}
|
||||
tls.key: {{ .Files.Get "cert/tls.key" | b64enc }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,15 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ template "harbor.core" . }}
|
||||
labels: {{ include "harbor.labels" . | nindent 4 }}
|
||||
spec:
|
||||
{{- if (eq .Values.service.ingress.controller "gce") }}
|
||||
type: NodePort
|
||||
{{- end }}
|
||||
ports:
|
||||
- port: 80
|
||||
targetPort: http
|
||||
selector:
|
||||
{{- include "harbor.matchLabels" . | nindent 4 }}
|
||||
app.kubernetes.io/component: core
|
||||
@@ -0,0 +1,122 @@
|
||||
{{- if eq .Values.service.type "Ingress" }}
|
||||
{{- $ingress := .Values.service.ingress -}}
|
||||
{{- $tls := .Values.service.tls -}}
|
||||
apiVersion: extensions/v1beta1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: "{{ template "harbor.ingress" . }}"
|
||||
labels: {{ include "harbor.labels" . | nindent 4 }}
|
||||
annotations:
|
||||
{{ toYaml $ingress.annotations | nindent 4 }}
|
||||
spec:
|
||||
{{- if $tls.enabled }}
|
||||
tls:
|
||||
{{- if $tls.secretName }}
|
||||
- secretName: "{{ $tls.secretName }}"
|
||||
{{- else }}
|
||||
- secretName: "{{ template "harbor.ingress" . }}"
|
||||
{{- end }}
|
||||
{{- if $ingress.hosts.core }}
|
||||
hosts:
|
||||
- {{ $ingress.hosts.core }}
|
||||
{{- end }}
|
||||
{{- if .Values.notary.enabled }}
|
||||
{{- if $tls.notarySecretName }}
|
||||
- secretName: "{{ $tls.notarySecretName }}"
|
||||
{{- else if $tls.secretName }}
|
||||
- secretName: "{{ $tls.secretName }}"
|
||||
{{- else }}
|
||||
- secretName: "{{ template "harbor.ingress" . }}"
|
||||
{{- end }}
|
||||
{{- if $ingress.hosts.notary }}
|
||||
hosts:
|
||||
- {{ $ingress.hosts.notary }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if eq .Values.service.ingress.controller "gce" }}
|
||||
rules:
|
||||
- http:
|
||||
paths:
|
||||
- path: /*
|
||||
backend:
|
||||
serviceName: {{ template "harbor.portal" . }}
|
||||
servicePort: 80
|
||||
- path: /api/*
|
||||
backend:
|
||||
serviceName: {{ template "harbor.core" . }}
|
||||
servicePort: 80
|
||||
- path: /service/*
|
||||
backend:
|
||||
serviceName: {{ template "harbor.core" . }}
|
||||
servicePort: 80
|
||||
- path: /v2/*
|
||||
backend:
|
||||
serviceName: {{ template "harbor.core" . }}
|
||||
servicePort: 80
|
||||
- path: /chartrepo/*
|
||||
backend:
|
||||
serviceName: {{ template "harbor.core" . }}
|
||||
servicePort: 80
|
||||
- path: /c/*
|
||||
backend:
|
||||
serviceName: {{ template "harbor.core" . }}
|
||||
servicePort: 80
|
||||
{{- if $ingress.hosts.core }}
|
||||
host: {{ $ingress.hosts.core }}
|
||||
{{- end }}
|
||||
{{- if .Values.notary.enabled }}
|
||||
- http:
|
||||
paths:
|
||||
- path: /
|
||||
backend:
|
||||
serviceName: {{ template "harbor.notary-server" . }}
|
||||
servicePort: 4443
|
||||
{{- if $ingress.hosts.notary }}
|
||||
host: {{ $ingress.hosts.notary }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- else }}
|
||||
rules:
|
||||
- http:
|
||||
paths:
|
||||
- path: /
|
||||
backend:
|
||||
serviceName: {{ template "harbor.portal" . }}
|
||||
servicePort: 80
|
||||
- path: /api/
|
||||
backend:
|
||||
serviceName: {{ template "harbor.core" . }}
|
||||
servicePort: 80
|
||||
- path: /service/
|
||||
backend:
|
||||
serviceName: {{ template "harbor.core" . }}
|
||||
servicePort: 80
|
||||
- path: /v2/
|
||||
backend:
|
||||
serviceName: {{ template "harbor.core" . }}
|
||||
servicePort: 80
|
||||
- path: /chartrepo/
|
||||
backend:
|
||||
serviceName: {{ template "harbor.core" . }}
|
||||
servicePort: 80
|
||||
- path: /c/
|
||||
backend:
|
||||
serviceName: {{ template "harbor.core" . }}
|
||||
servicePort: 80
|
||||
{{- if $ingress.hosts.core }}
|
||||
host: {{ $ingress.hosts.core }}
|
||||
{{- end }}
|
||||
{{- if .Values.notary.enabled }}
|
||||
- http:
|
||||
paths:
|
||||
- path: /
|
||||
backend:
|
||||
serviceName: {{ template "harbor.notary-server" . }}
|
||||
servicePort: 4443
|
||||
{{- if $ingress.hosts.notary }}
|
||||
host: {{ $ingress.hosts.notary }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,14 @@
|
||||
{{- if eq (include "harbor.autoGenCertForIngress" .) "true" }}
|
||||
{{- $ca := genCA "harbor-ca" 365 }}
|
||||
{{- $cert := genSignedCert .Values.service.ingress.hosts.core nil (list .Values.service.ingress.hosts.core .Values.service.ingress.hosts.notary) 365 $ca }}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: "{{ template "harbor.ingress" . }}"
|
||||
labels: {{ include "harbor.labels" . | nindent 4 }}
|
||||
type: kubernetes.io/tls
|
||||
data:
|
||||
tls.crt: {{ $cert.Cert | b64enc | quote }}
|
||||
tls.key: {{ $cert.Key | b64enc | quote }}
|
||||
ca.crt: {{ $ca.Cert | b64enc | quote }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,38 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: "{{ template "harbor.jobservice" . }}"
|
||||
labels: {{ include "harbor.labels" . | nindent 4 }}
|
||||
data:
|
||||
config.yml: |+
|
||||
protocol: "http"
|
||||
port: 8080
|
||||
worker_pool:
|
||||
workers: {{ .Values.jobservice.maxJobWorkers }}
|
||||
backend: "redis"
|
||||
redis_pool:
|
||||
redis_url: "{{ template "harbor.redisForJobservice" . }}"
|
||||
namespace: "harbor_job_service_namespace"
|
||||
job_loggers:
|
||||
{{- if eq .Values.jobservice.jobLogger "file" }}
|
||||
- name: "FILE"
|
||||
level: {{ .Values.logLevel | upper }}
|
||||
settings: # Customized settings of logger
|
||||
base_dir: "/var/log/jobs"
|
||||
sweeper:
|
||||
duration: 14 #days
|
||||
settings: # Customized settings of sweeper
|
||||
work_dir: "/var/log/jobs"
|
||||
{{- else if eq .Values.jobservice.jobLogger "database" }}
|
||||
- name: "DB"
|
||||
level: {{ .Values.logLevel | upper }}
|
||||
sweeper:
|
||||
duration: 14 #days
|
||||
{{- else }}
|
||||
- name: "STD_OUTPUT"
|
||||
level: {{ .Values.logLevel | upper }}
|
||||
{{- end }}
|
||||
#Loggers for the job service
|
||||
loggers:
|
||||
- name: "STD_OUTPUT"
|
||||
level: {{ .Values.logLevel | upper }}
|
||||
@@ -0,0 +1,108 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: "{{ template "harbor.jobservice" . }}"
|
||||
labels:
|
||||
{{- include "harbor.labels" . | nindent 4 }}
|
||||
app.kubernetes.io/component: jobservice
|
||||
spec:
|
||||
replicas: {{ .Values.jobservice.replicas }}
|
||||
selector:
|
||||
matchLabels: {{ include "harbor.matchLabels" . | nindent 6 }}
|
||||
app.kubernetes.io/component: jobservice
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
{{ include "harbor.labels" . | nindent 8 }}
|
||||
app.kubernetes.io/component: jobservice
|
||||
annotations:
|
||||
checksum/configmap: {{ include (print $.Template.BasePath "/jobservice/jobservice-cm.yaml") . | sha256sum }}
|
||||
checksum/secret: {{ include (print $.Template.BasePath "/jobservice/jobservice-secrets.yaml") . | sha256sum }}
|
||||
checksum/secret-core: {{ include (print $.Template.BasePath "/core/core-secret.yaml") . | sha256sum }}
|
||||
{{- if .Values.jobservice.podAnnotations }}
|
||||
{{ toYaml .Values.jobservice.podAnnotations | nindent 8 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if .Values.securityContext.enabled }}
|
||||
securityContext:
|
||||
fsGroup: {{ .Values.securityContext.fsGroup }}
|
||||
runAsUser: {{ .Values.securityContext.runAsUser }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: jobservice
|
||||
image: "{{ template "harbor.jobserviceImage" . }}"
|
||||
imagePullPolicy: {{ .Values.jobserviceImage.pullPolicy | quote }}
|
||||
{{- if .Values.jobservice.livenessProbe.enabled }}
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /api/v1/stats
|
||||
port: http
|
||||
initialDelaySeconds: {{ .Values.jobservice.livenessProbe.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.jobservice.livenessProbe.periodSeconds }}
|
||||
timeoutSeconds: {{ .Values.jobservice.livenessProbe.timeoutSeconds }}
|
||||
successThreshold: {{ .Values.jobservice.livenessProbe.successThreshold }}
|
||||
failureThreshold: {{ .Values.jobservice.livenessProbe.failureThreshold }}
|
||||
{{- end }}
|
||||
{{- if .Values.jobservice.readinessProbe.enabled }}
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /api/v1/stats
|
||||
port: http
|
||||
initialDelaySeconds: {{ .Values.jobservice.readinessProbe.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.jobservice.readinessProbe.periodSeconds }}
|
||||
timeoutSeconds: {{ .Values.jobservice.readinessProbe.timeoutSeconds }}
|
||||
successThreshold: {{ .Values.jobservice.readinessProbe.successThreshold }}
|
||||
failureThreshold: {{ .Values.jobservice.readinessProbe.failureThreshold }}
|
||||
{{- end }}
|
||||
{{- if .Values.jobservice.resources }}
|
||||
resources: {{ toYaml .Values.jobservice.resources | nindent 10 }}
|
||||
{{- end }}
|
||||
env:
|
||||
- name: BITNAMI_DEBUG
|
||||
value: {{ ternary "true" "false" .Values.jobserviceImage.debug | quote }}
|
||||
- name: CORE_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ template "harbor.core" . }}
|
||||
key: secret
|
||||
- name: JOBSERVICE_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: "{{ template "harbor.jobservice" . }}"
|
||||
key: secret
|
||||
- name: CORE_URL
|
||||
value: "http://{{ template "harbor.core" . }}"
|
||||
- name: REGISTRY_CONTROLLER_URL
|
||||
value: "http://{{ template "harbor.registry" . }}:8080"
|
||||
- name: LOG_LEVEL
|
||||
value: debug
|
||||
ports:
|
||||
- containerPort: 8080
|
||||
name: http
|
||||
volumeMounts:
|
||||
- name: jobservice-config
|
||||
mountPath: /etc/jobservice/config.yml
|
||||
subPath: config.yml
|
||||
- name: job-logs
|
||||
mountPath: /var/log/jobs
|
||||
subPath: {{ .Values.persistence.persistentVolumeClaim.jobservice.subPath }}
|
||||
volumes:
|
||||
- name: jobservice-config
|
||||
configMap:
|
||||
name: "{{ template "harbor.jobservice" . }}"
|
||||
- name: job-logs
|
||||
{{- if and .Values.persistence.enabled (eq .Values.jobservice.jobLogger "file") }}
|
||||
persistentVolumeClaim:
|
||||
claimName: {{ .Values.persistence.persistentVolumeClaim.jobservice.existingClaim | default (include "harbor.jobservice" .) }}
|
||||
{{- else }}
|
||||
emptyDir: {}
|
||||
{{- end }}
|
||||
{{- with .Values.jobservice.nodeSelector }}
|
||||
nodeSelector: {{ tpl (toYaml .) $ | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.jobservice.affinity }}
|
||||
affinity: {{ tpl (toYaml .) $ | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.jobservice.tolerations }}
|
||||
tolerations: {{ tpl (toYaml .) $ | nindent 8 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,29 @@
|
||||
{{- $jobservice := .Values.persistence.persistentVolumeClaim.jobservice -}}
|
||||
{{- if and .Values.persistence.enabled (not $jobservice.existingClaim) }}
|
||||
{{- if eq .Values.jobservice.jobLogger "file" }}
|
||||
kind: PersistentVolumeClaim
|
||||
apiVersion: v1
|
||||
metadata:
|
||||
name: {{ template "harbor.jobservice" . }}
|
||||
{{- if eq .Values.persistence.resourcePolicy "keep" }}
|
||||
annotations:
|
||||
helm.sh/resource-policy: keep
|
||||
{{- end }}
|
||||
labels:
|
||||
{{- include "harbor.labels" . | nindent 4 }}
|
||||
app.kubernetes.io/component: jobservice
|
||||
spec:
|
||||
accessModes:
|
||||
- {{ $jobservice.accessMode }}
|
||||
resources:
|
||||
requests:
|
||||
storage: {{ $jobservice.size }}
|
||||
{{- if $jobservice.storageClass }}
|
||||
{{- if eq "-" $jobservice.storageClass }}
|
||||
storageClassName: ""
|
||||
{{- else }}
|
||||
storageClassName: {{ $jobservice.storageClass }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,8 @@
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: "{{ template "harbor.jobservice" . }}"
|
||||
labels: {{ include "harbor.labels" . | nindent 4 }}
|
||||
type: Opaque
|
||||
data:
|
||||
secret: {{ .Values.jobservice.secret | default (randAlphaNum 16) | b64enc | quote }}
|
||||
@@ -0,0 +1,12 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: "{{ template "harbor.jobservice" . }}"
|
||||
labels: {{ include "harbor.labels" . | nindent 4 }}
|
||||
spec:
|
||||
ports:
|
||||
- port: 80
|
||||
targetPort: http
|
||||
selector:
|
||||
{{- include "harbor.matchLabels" . | nindent 4 }}
|
||||
app.kubernetes.io/component: jobservice
|
||||
@@ -0,0 +1,136 @@
|
||||
{{- if and (ne .Values.service.type "Ingress") (not .Values.service.tls.enabled) }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ template "harbor.nginx" . }}
|
||||
labels: {{ include "harbor.labels" . | nindent 4 }}
|
||||
data:
|
||||
nginx.conf: |+
|
||||
worker_processes auto;
|
||||
|
||||
events {
|
||||
worker_connections 1024;
|
||||
use epoll;
|
||||
multi_accept on;
|
||||
}
|
||||
|
||||
http {
|
||||
tcp_nodelay on;
|
||||
|
||||
# this is necessary for us to be able to disable request buffering in all cases
|
||||
proxy_http_version 1.1;
|
||||
|
||||
upstream core {
|
||||
server {{ template "harbor.core" . }};
|
||||
}
|
||||
|
||||
upstream portal {
|
||||
server {{ template "harbor.portal" . }};
|
||||
}
|
||||
|
||||
log_format timed_combined '$remote_addr - '
|
||||
'"$request" $status $body_bytes_sent '
|
||||
'"$http_referer" "$http_user_agent" '
|
||||
'$request_time $upstream_response_time $pipe';
|
||||
|
||||
access_log /dev/stdout timed_combined;
|
||||
|
||||
client_body_temp_path "/opt/bitnami/nginx/tmp/client_body" 1 2;
|
||||
proxy_temp_path "/opt/bitnami/nginx/tmp/proxy" 1 2;
|
||||
fastcgi_temp_path "/opt/bitnami/nginx/tmp/fastcgi" 1 2;
|
||||
scgi_temp_path "/opt/bitnami/nginx/tmp/scgi" 1 2;
|
||||
uwsgi_temp_path "/opt/bitnami/nginx/tmp/uwsgi" 1 2;
|
||||
|
||||
server {
|
||||
listen 8080;
|
||||
server_tokens off;
|
||||
# disable any limits to avoid HTTP 413 for large image uploads
|
||||
client_max_body_size 0;
|
||||
|
||||
location / {
|
||||
proxy_pass http://portal/;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
|
||||
# When setting up Harbor behind other proxy, such as an Nginx instance, remove the below line if the proxy already has similar settings.
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
|
||||
proxy_buffering off;
|
||||
proxy_request_buffering off;
|
||||
}
|
||||
|
||||
location /api/ {
|
||||
proxy_pass http://core/api/;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
|
||||
# When setting up Harbor behind other proxy, such as an Nginx instance, remove the below line if the proxy already has similar settings.
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
|
||||
proxy_buffering off;
|
||||
proxy_request_buffering off;
|
||||
}
|
||||
|
||||
location /chartrepo/ {
|
||||
proxy_pass http://core/chartrepo/;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
|
||||
# When setting up Harbor behind other proxy, such as an Nginx instance, remove the below line if the proxy already has similar settings.
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
|
||||
proxy_buffering off;
|
||||
proxy_request_buffering off;
|
||||
}
|
||||
|
||||
location /c/ {
|
||||
proxy_pass http://core/c/;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
|
||||
# When setting up Harbor behind other proxy, such as an Nginx instance, remove the below line if the proxy already has similar settings.
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
|
||||
proxy_buffering off;
|
||||
proxy_request_buffering off;
|
||||
}
|
||||
|
||||
location /v1/ {
|
||||
return 404;
|
||||
}
|
||||
|
||||
location /v2/ {
|
||||
proxy_pass http://core/v2/;
|
||||
proxy_set_header Host $http_host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
|
||||
# When setting up Harbor behind other proxy, such as an Nginx instance, remove the below line if the proxy already has similar settings.
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_buffering off;
|
||||
proxy_request_buffering off;
|
||||
}
|
||||
|
||||
location /service/ {
|
||||
proxy_pass http://core/service/;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
|
||||
# When setting up Harbor behind other proxy, such as an Nginx instance, remove the below line if the proxy already has similar settings.
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
|
||||
proxy_buffering off;
|
||||
proxy_request_buffering off;
|
||||
}
|
||||
|
||||
location /service/notifications {
|
||||
return 404;
|
||||
}
|
||||
}
|
||||
}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,199 @@
|
||||
{{- if and (ne .Values.service.type "Ingress") .Values.service.tls.enabled }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ template "harbor.nginx" . }}
|
||||
labels: {{ include "harbor.labels" . | nindent 4 }}
|
||||
data:
|
||||
nginx.conf: |+
|
||||
worker_processes auto;
|
||||
|
||||
events {
|
||||
worker_connections 1024;
|
||||
use epoll;
|
||||
multi_accept on;
|
||||
}
|
||||
|
||||
http {
|
||||
tcp_nodelay on;
|
||||
|
||||
# this is necessary for us to be able to disable request buffering in all cases
|
||||
proxy_http_version 1.1;
|
||||
|
||||
upstream core {
|
||||
server {{ template "harbor.core" . }};
|
||||
}
|
||||
|
||||
upstream portal {
|
||||
server {{ template "harbor.portal" . }};
|
||||
}
|
||||
|
||||
{{- if .Values.notary.enabled }}
|
||||
upstream notary-server {
|
||||
server {{ template "harbor.notary-server" . }}:4443;
|
||||
}
|
||||
{{- end }}
|
||||
|
||||
log_format timed_combined 'remote_addr - '
|
||||
'"$request" $status $body_bytes_sent '
|
||||
'"$http_referer" "$http_user_agent" '
|
||||
'$request_time $upstream_response_time $pipe';
|
||||
|
||||
access_log /dev/stdout timed_combined;
|
||||
|
||||
client_body_temp_path "/opt/bitnami/nginx/tmp/client_body" 1 2;
|
||||
proxy_temp_path "/opt/bitnami/nginx/tmp/proxy" 1 2;
|
||||
fastcgi_temp_path "/opt/bitnami/nginx/tmp/fastcgi" 1 2;
|
||||
scgi_temp_path "/opt/bitnami/nginx/tmp/scgi" 1 2;
|
||||
uwsgi_temp_path "/opt/bitnami/nginx/tmp/uwsgi" 1 2;
|
||||
|
||||
{{- if .Values.notary.enabled }}
|
||||
server {
|
||||
listen 4443 ssl;
|
||||
server_tokens off;
|
||||
# ssl
|
||||
ssl_certificate /etc/nginx/cert/tls.crt;
|
||||
ssl_certificate_key /etc/nginx/cert/tls.key;
|
||||
|
||||
# recommendations from https://raymii.org/s/tutorials/strong_ssl_security_on_nginx.html
|
||||
ssl_protocols tlsv1.1 tlsv1.2;
|
||||
ssl_ciphers '!aNULL:kECDH+AESGCM:ECDH+AESGCM:RSA+AESGCM:kECDH+AES:ECDH+AES:RSA+AES:';
|
||||
ssl_prefer_server_ciphers on;
|
||||
ssl_session_cache shared:ssl:10m;
|
||||
|
||||
# disable any limits to avoid http 413 for large image uploads
|
||||
client_max_body_size 0;
|
||||
|
||||
# required to avoid http 411: see issue #1486 (https://github.com/docker/docker/issues/1486)
|
||||
chunked_transfer_encoding on;
|
||||
|
||||
location /v2/ {
|
||||
proxy_pass http://notary-server/v2/;
|
||||
proxy_set_header Host $http_host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
|
||||
# When setting up Harbor behind other proxy, such as an Nginx instance, remove the below line if the proxy already has similar settings.
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
|
||||
proxy_buffering off;
|
||||
proxy_request_buffering off;
|
||||
}
|
||||
}
|
||||
{{- end }}
|
||||
|
||||
server {
|
||||
listen 8443 ssl;
|
||||
# server_name harbordomain.com;
|
||||
server_tokens off;
|
||||
# SSL
|
||||
ssl_certificate /etc/nginx/cert/tls.crt;
|
||||
ssl_certificate_key /etc/nginx/cert/tls.key;
|
||||
|
||||
# Recommendations from https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html
|
||||
ssl_protocols TLSv1.1 TLSv1.2;
|
||||
ssl_ciphers '!aNULL:kECDH+AESGCM:ECDH+AESGCM:RSA+AESGCM:kECDH+AES:ECDH+AES:RSA+AES:';
|
||||
ssl_prefer_server_ciphers on;
|
||||
ssl_session_cache shared:SSL:10m;
|
||||
|
||||
# disable any limits to avoid HTTP 413 for large image uploads
|
||||
client_max_body_size 0;
|
||||
|
||||
# required to avoid HTTP 411: see Issue #1486 (https://github.com/docker/docker/issues/1486)
|
||||
chunked_transfer_encoding on;
|
||||
|
||||
location / {
|
||||
proxy_pass http://portal/;
|
||||
proxy_set_header Host $http_host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
|
||||
# When setting up Harbor behind other proxy, such as an Nginx instance, remove the below line if the proxy already has similar settings.
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
|
||||
# Add Secure flag when serving HTTPS
|
||||
proxy_cookie_path / "/; secure";
|
||||
|
||||
proxy_buffering off;
|
||||
proxy_request_buffering off;
|
||||
}
|
||||
|
||||
location /api/ {
|
||||
proxy_pass http://core/api/;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
|
||||
# When setting up Harbor behind other proxy, such as an Nginx instance, remove the below line if the proxy already has similar settings.
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
|
||||
proxy_buffering off;
|
||||
proxy_request_buffering off;
|
||||
}
|
||||
|
||||
location /chartrepo/ {
|
||||
proxy_pass http://core/chartrepo/;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
|
||||
# When setting up Harbor behind other proxy, such as an Nginx instance, remove the below line if the proxy already has similar settings.
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
|
||||
proxy_buffering off;
|
||||
proxy_request_buffering off;
|
||||
}
|
||||
|
||||
location /c/ {
|
||||
proxy_pass http://core/c/;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
|
||||
# When setting up Harbor behind other proxy, such as an Nginx instance, remove the below line if the proxy already has similar settings.
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
|
||||
proxy_buffering off;
|
||||
proxy_request_buffering off;
|
||||
}
|
||||
|
||||
location /v1/ {
|
||||
return 404;
|
||||
}
|
||||
|
||||
location /v2/ {
|
||||
proxy_pass http://core/v2/;
|
||||
proxy_set_header Host $http_host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
|
||||
# When setting up Harbor behind other proxy, such as an Nginx instance, remove the below line if the proxy already has similar settings.
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_buffering off;
|
||||
proxy_request_buffering off;
|
||||
}
|
||||
|
||||
location /service/ {
|
||||
proxy_pass http://core/service/;
|
||||
proxy_set_header Host $http_host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
|
||||
# When setting up Harbor behind other proxy, such as an Nginx instance, remove the below line if the proxy already has similar settings.
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
|
||||
proxy_buffering off;
|
||||
proxy_request_buffering off;
|
||||
}
|
||||
|
||||
location /service/notifications {
|
||||
return 404;
|
||||
}
|
||||
}
|
||||
server {
|
||||
listen 8080;
|
||||
#server_name harbordomain.com;
|
||||
return 301 https://$host$request_uri:8443;
|
||||
}
|
||||
}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,112 @@
|
||||
{{- if ne .Values.service.type "Ingress" }}
|
||||
apiVersion: extensions/v1beta1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ template "harbor.nginx" . }}
|
||||
labels:
|
||||
{{- include "harbor.labels" . | nindent 4 }}
|
||||
app.kubernetes.io/component: nginx
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels: {{ include "harbor.matchLabels" . | nindent 6 }}
|
||||
app.kubernetes.io/component: nginx
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
{{ include "harbor.labels" . | nindent 8 }}
|
||||
app.kubernetes.io/component: nginx
|
||||
annotations:
|
||||
{{- if not .Values.service.tls.enabled }}
|
||||
checksum/configmap: {{ include (print $.Template.BasePath "/nginx/configmap-http.yaml") . | sha256sum }}
|
||||
{{- else }}
|
||||
checksum/configmap: {{ include (print $.Template.BasePath "/nginx/configmap-https.yaml") . | sha256sum }}
|
||||
{{- end }}
|
||||
{{- if eq (include "harbor.autoGenCertForNginx" .) "true" }}
|
||||
checksum/secret: {{ include (print $.Template.BasePath "/nginx/secret.yaml") . | sha256sum }}
|
||||
{{- end }}
|
||||
{{- if .Values.nginx.podAnnotations }}
|
||||
{{ toYaml .Values.nginx.podAnnotations | nindent 8 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if .Values.securityContext.enabled }}
|
||||
securityContext:
|
||||
fsGroup: {{ .Values.securityContext.fsGroup }}
|
||||
runAsUser: {{ .Values.securityContext.runAsUser }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: nginx
|
||||
image: "{{ template "harbor.nginxImage" . }}"
|
||||
imagePullPolicy: {{ .Values.nginxImage.pullPolicy | quote }}
|
||||
{{- if .Values.nginx.livenessProbe.enabled }}
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /
|
||||
port: {{ ternary "https" "http" .Values.service.tls.enabled }}
|
||||
{{- if .Values.service.tls.enabled }}
|
||||
scheme: HTTPS
|
||||
{{- end }}
|
||||
initialDelaySeconds: {{ .Values.nginx.livenessProbe.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.nginx.livenessProbe.periodSeconds }}
|
||||
timeoutSeconds: {{ .Values.nginx.livenessProbe.timeoutSeconds }}
|
||||
successThreshold: {{ .Values.nginx.livenessProbe.successThreshold }}
|
||||
failureThreshold: {{ .Values.nginx.livenessProbe.failureThreshold }}
|
||||
{{- end }}
|
||||
{{- if .Values.nginx.readinessProbe.enabled }}
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /
|
||||
port: {{ ternary "https" "http" .Values.service.tls.enabled }}
|
||||
{{- if .Values.service.tls.enabled }}
|
||||
scheme: HTTPS
|
||||
{{- end }}
|
||||
initialDelaySeconds: {{ .Values.nginx.readinessProbe.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.nginx.readinessProbe.periodSeconds }}
|
||||
timeoutSeconds: {{ .Values.nginx.readinessProbe.timeoutSeconds }}
|
||||
successThreshold: {{ .Values.nginx.readinessProbe.successThreshold }}
|
||||
failureThreshold: {{ .Values.nginx.readinessProbe.failureThreshold }}
|
||||
{{- end }}
|
||||
env:
|
||||
- name: BITNAMI_DEBUG
|
||||
value: {{ ternary "true" "false" .Values.nginxImage.debug | quote }}
|
||||
{{- if .Values.nginx.resources }}
|
||||
resources: {{ toYaml .Values.nginx.resources | nindent 10 }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- containerPort: 8080
|
||||
name: http
|
||||
- containerPort: 8443
|
||||
name: https
|
||||
- containerPort: 4443
|
||||
name: notary
|
||||
volumeMounts:
|
||||
- name: config
|
||||
mountPath: /opt/bitnami/nginx/conf/nginx.conf
|
||||
subPath: nginx.conf
|
||||
{{- if .Values.service.tls.enabled }}
|
||||
- name: certificate
|
||||
mountPath: /etc/nginx/cert
|
||||
{{- end }}
|
||||
volumes:
|
||||
- name: config
|
||||
configMap:
|
||||
name: {{ template "harbor.nginx" . }}
|
||||
{{- if .Values.service.tls.enabled }}
|
||||
- name: certificate
|
||||
secret:
|
||||
{{- if .Values.service.tls.secretName }}
|
||||
secretName: {{ .Values.service.tls.secretName }}
|
||||
{{- else }}
|
||||
secretName: {{ template "harbor.nginx" . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.nginx.nodeSelector }}
|
||||
nodeSelector: {{ tpl (toYaml .) $ | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.nginx.affinity }}
|
||||
affinity: {{ tpl (toYaml .) $ | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.nginx.tolerations }}
|
||||
tolerations: {{ tpl (toYaml .) $ | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,22 @@
|
||||
{{- if eq (include "harbor.autoGenCertForNginx" .) "true" }}
|
||||
{{- $ca := genCA "harbor-ca" 365 }}
|
||||
{{- $cn := (required "The \"service.tls.commonName\" is required!" .Values.service.tls.commonName) }}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ template "harbor.nginx" . }}
|
||||
labels: {{ include "harbor.labels" . | nindent 4 }}
|
||||
type: Opaque
|
||||
data:
|
||||
{{- if regexMatch `^((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$` $cn }}
|
||||
{{- $cert := genSignedCert $cn (list $cn) nil 365 $ca }}
|
||||
tls.crt: {{ $cert.Cert | b64enc | quote }}
|
||||
tls.key: {{ $cert.Key | b64enc | quote }}
|
||||
ca.crt: {{ $ca.Cert | b64enc | quote }}
|
||||
{{- else }}
|
||||
{{- $cert := genSignedCert $cn nil (list $cn) 365 $ca }}
|
||||
tls.crt: {{ $cert.Cert | b64enc | quote }}
|
||||
tls.key: {{ $cert.Key | b64enc | quote }}
|
||||
ca.crt: {{ $ca.Cert | b64enc | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,80 @@
|
||||
{{- if ne .Values.service.type "Ingress" }}
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
{{- if eq .Values.service.type "ClusterIP" }}
|
||||
{{- $clusterIP := .Values.service.clusterIP }}
|
||||
name: {{ $clusterIP.name }}
|
||||
labels: {{ include "harbor.labels" . | nindent 4 }}
|
||||
spec:
|
||||
type: ClusterIP
|
||||
ports:
|
||||
- name: http
|
||||
port: {{ $clusterIP.ports.httpPort }}
|
||||
targetPort: 8080
|
||||
{{- if .Values.service.tls.enabled }}
|
||||
- name: https
|
||||
port: {{ $clusterIP.ports.httpsPort }}
|
||||
targetPort: 8443
|
||||
{{- end }}
|
||||
{{- if .Values.notary.enabled }}
|
||||
- name: notary
|
||||
port: {{ $clusterIP.ports.notaryPort }}
|
||||
targetPort: 4443
|
||||
{{- end }}
|
||||
{{- else if eq .Values.service.type "NodePort" }}
|
||||
{{- $nodePort := .Values.service.nodePort }}
|
||||
name: {{ $nodePort.name }}
|
||||
labels:
|
||||
{{ include "harbor.labels" . | nindent 4 }}
|
||||
spec:
|
||||
type: NodePort
|
||||
ports:
|
||||
- name: http
|
||||
port: {{ $nodePort.ports.http.port }}
|
||||
targetPort: 8080
|
||||
{{- if $nodePort.ports.http.nodePort }}
|
||||
nodePort: {{ $nodePort.ports.http.nodePort }}
|
||||
{{- end }}
|
||||
{{- if .Values.service.tls.enabled }}
|
||||
- name: https
|
||||
port: {{ $nodePort.ports.https.port }}
|
||||
targetPort: 8443
|
||||
{{- if $nodePort.ports.https.nodePort }}
|
||||
nodePort: {{ $nodePort.ports.https.nodePort }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.notary.enabled }}
|
||||
- name: notary
|
||||
port: {{ $nodePort.ports.notary.port }}
|
||||
targetPort: 4443
|
||||
{{- if $nodePort.ports.notary.nodePort }}
|
||||
nodePort: {{ $nodePort.ports.notary.nodePort }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- else if eq .Values.service.type "LoadBalancer" }}
|
||||
{{- $loadBalancer := .Values.service.loadBalancer }}
|
||||
name: {{ $loadBalancer.name }}
|
||||
labels:
|
||||
{{ include "harbor.labels" . | nindent 4 }}
|
||||
spec:
|
||||
type: LoadBalancer
|
||||
ports:
|
||||
- name: http
|
||||
port: {{ $loadBalancer.ports.httpPort }}
|
||||
targetPort: 8080
|
||||
{{- if .Values.service.tls.enabled }}
|
||||
- name: https
|
||||
port: {{ $loadBalancer.ports.httpsPort }}
|
||||
targetPort: 8443
|
||||
{{- end }}
|
||||
{{- if .Values.notary.enabled }}
|
||||
- name: notary
|
||||
port: {{ $loadBalancer.ports.notaryPort }}
|
||||
targetPort: 4443
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
selector:
|
||||
{{- include "harbor.matchLabels" . | nindent 4 }}
|
||||
app.kubernetes.io/component: nginx
|
||||
{{- end }}
|
||||
@@ -0,0 +1,73 @@
|
||||
{{ if .Values.notary.enabled }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ template "harbor.notary-server" . }}
|
||||
labels: {{ include "harbor.labels" . | nindent 4 }}
|
||||
component: notary
|
||||
data:
|
||||
{{ $ca := genCA "harbor-notary-ca" 365 }}
|
||||
{{ $cert := genSignedCert (include "harbor.notary-signer" .) nil nil 365 $ca }}
|
||||
{{- if not .Values.notary.secretName }}
|
||||
notary-signer-ca.crt: |
|
||||
{{ $ca.Cert | nindent 4 }}
|
||||
notary-signer.crt: |
|
||||
{{ $cert.Cert | nindent 4 }}
|
||||
notary-signer.key: |
|
||||
{{ $cert.Key | nindent 4 }}
|
||||
{{- end }}
|
||||
server-config.postgres.json: |
|
||||
{
|
||||
"server": {
|
||||
"http_addr": ":4443"
|
||||
},
|
||||
"trust_service": {
|
||||
"type": "remote",
|
||||
"hostname": "{{ template "harbor.notary-signer" . }}",
|
||||
"port": "7899",
|
||||
{{- if not .Values.notary.secretName }}
|
||||
"tls_ca_file": "./notary-signer-ca.crt",
|
||||
{{- else }}
|
||||
"tls_ca_file": "/etc/ssl/notary/cert/notary-signer-ca.crt",
|
||||
{{- end }}
|
||||
"key_algorithm": "ecdsa"
|
||||
},
|
||||
"logging": {
|
||||
"level": "{{ .Values.logLevel }}"
|
||||
},
|
||||
"storage": {
|
||||
"backend": "postgres",
|
||||
"db_url": "{{ template "harbor.database.notaryServer" . }}"
|
||||
},
|
||||
"auth": {
|
||||
"type": "token",
|
||||
"options": {
|
||||
"realm": "{{ .Values.externalURL }}/service/token",
|
||||
"service": "harbor-notary",
|
||||
"issuer": "harbor-token-issuer",
|
||||
"rootcertbundle": "/root.crt"
|
||||
}
|
||||
}
|
||||
}
|
||||
signer-config.postgres.json: |
|
||||
{
|
||||
"server": {
|
||||
"grpc_addr": ":7899",
|
||||
{{- if not .Values.notary.secretName }}
|
||||
"tls_cert_file": "./notary-signer.crt",
|
||||
"tls_key_file": "./notary-signer.key"
|
||||
{{- else }}
|
||||
"tls_cert_file": "/etc/ssl/notary/cert/notary-signer.crt",
|
||||
"tls_key_file": "/etc/ssl/notary/cert/notary-signer.key"
|
||||
{{- end }}
|
||||
},
|
||||
"logging": {
|
||||
"level": "{{ .Values.logLevel }}"
|
||||
},
|
||||
"storage": {
|
||||
"backend": "postgres",
|
||||
"db_url": "{{ template "harbor.database.notarySigner" . }}",
|
||||
"default_alias": "defaultalias"
|
||||
}
|
||||
}
|
||||
{{ end }}
|
||||
@@ -0,0 +1,79 @@
|
||||
{{ if .Values.notary.enabled }}
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ template "harbor.notary-server" . }}
|
||||
labels: {{ include "harbor.labels" . | nindent 4 }}
|
||||
component: notary-server
|
||||
spec:
|
||||
replicas: {{ .Values.notary.server.replicas }}
|
||||
selector:
|
||||
matchLabels: {{ include "harbor.matchLabels" . | nindent 6 }}
|
||||
component: notary-server
|
||||
template:
|
||||
metadata:
|
||||
labels: {{ include "harbor.labels" . | nindent 8 }}
|
||||
component: notary-server
|
||||
annotations:
|
||||
checksum/configmap: {{ include (print $.Template.BasePath "/notary/notary-cm.yaml") . | sha256sum }}
|
||||
checksum/secret-core: {{ include (print $.Template.BasePath "/core/core-secret.yaml") . | sha256sum }}
|
||||
{{- if .Values.notary.podAnnotations }}
|
||||
{{ toYaml .Values.notary.podAnnotations | nindent 8 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if .Values.securityContext.enabled }}
|
||||
securityContext:
|
||||
fsGroup: {{ .Values.securityContext.fsGroup }}
|
||||
runAsUser: {{ .Values.securityContext.runAsUser }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: notary-server
|
||||
image: {{ template "harbor.notaryServerImage" . }}
|
||||
imagePullPolicy: {{ .Values.notaryServerImage.pullPolicy }}
|
||||
{{- if .Values.notary.server.resources }}
|
||||
resources: {{ toYaml .Values.notary.server.resources | nindent 10 }}
|
||||
{{- end }}
|
||||
env:
|
||||
- name: BITNAMI_DEBUG
|
||||
value: {{ ternary "true" "false" .Values.notaryServerImage.debug | quote }}
|
||||
- name: MIGRATIONS_PATH
|
||||
value: migrations/server/postgresql
|
||||
- name: DB_URL
|
||||
value: {{ template "harbor.database.notaryServer" . }}
|
||||
volumeMounts:
|
||||
- name: notary-config
|
||||
mountPath: /etc/notary
|
||||
- name: root-certificate
|
||||
mountPath: /root.crt
|
||||
subPath: tls.crt
|
||||
{{- if .Values.notary.secretName }}
|
||||
- name: notary-ca
|
||||
mountPath: /etc/ssl/notary/cert/notary-signer-ca.crt
|
||||
subPath: ca
|
||||
{{- end }}
|
||||
volumes:
|
||||
- name: notary-config
|
||||
configMap:
|
||||
name: "{{ template "harbor.notary-server" . }}"
|
||||
- name: root-certificate
|
||||
secret:
|
||||
{{- if .Values.core.secretName }}
|
||||
secretName: {{ .Values.core.secretName }}
|
||||
{{- else }}
|
||||
secretName: {{ template "harbor.core" . }}
|
||||
{{- end }}
|
||||
{{- if .Values.notary.secretName }}
|
||||
- name: notary-ca
|
||||
secret:
|
||||
secretName: {{ .Values.notary.secretName }}
|
||||
{{- end }}
|
||||
{{- with .Values.notary.nodeSelector }}
|
||||
nodeSelector: {{ toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.notary.affinity }}
|
||||
affinity: {{ toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.notary.tolerations }}
|
||||
tolerations: {{ toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{ end }}
|
||||
@@ -0,0 +1,77 @@
|
||||
{{ if .Values.notary.enabled }}
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ template "harbor.notary-signer" . }}
|
||||
labels: {{ include "harbor.labels" . | nindent 4 }}
|
||||
component: notary-signer
|
||||
spec:
|
||||
replicas: {{ .Values.notary.signer.replicas }}
|
||||
selector:
|
||||
matchLabels: {{ include "harbor.matchLabels" . | nindent 6 }}
|
||||
component: notary-signer
|
||||
template:
|
||||
metadata:
|
||||
labels: {{ include "harbor.labels" . | nindent 8 }}
|
||||
component: notary-signer
|
||||
annotations:
|
||||
checksum/configmap: {{ include (print $.Template.BasePath "/notary/notary-cm.yaml") . | sha256sum }}
|
||||
spec:
|
||||
{{- if .Values.securityContext.enabled }}
|
||||
securityContext:
|
||||
fsGroup: {{ .Values.securityContext.fsGroup }}
|
||||
runAsUser: {{ .Values.securityContext.runAsUser }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: notary-signer
|
||||
image: {{ template "harbor.notarySignerImage" . }}
|
||||
imagePullPolicy: {{ .Values.notarySignerImage.pullPolicy }}
|
||||
{{- if .Values.notary.signer.resources }}
|
||||
resources:
|
||||
{{ toYaml .Values.notary.signer.resources | nindent 10 }}
|
||||
{{- end }}
|
||||
env:
|
||||
- name: BITNAMI_DEBUG
|
||||
value: {{ ternary "true" "false" .Values.notarySignerImage.debug | quote }}
|
||||
- name: MIGRATIONS_PATH
|
||||
value: migrations/signer/postgresql
|
||||
- name: DB_URL
|
||||
value: {{ template "harbor.database.notarySigner" . }}
|
||||
- name: NOTARY_SIGNER_DEFAULTALIAS
|
||||
value: defaultalias
|
||||
volumeMounts:
|
||||
- name: notary-config
|
||||
mountPath: /etc/notary
|
||||
{{- if .Values.notary.secretName }}
|
||||
- name: notary-cert
|
||||
mountPath: /etc/ssl/notary/cert/notary-signer-ca.crt
|
||||
subPath: ca
|
||||
- name: notary-cert
|
||||
mountPath: /etc/ssl/notary/cert/notary-signer.crt
|
||||
subPath: crt
|
||||
- name: notary-cert
|
||||
mountPath: /etc/ssl/notary/cert/notary-signer.key
|
||||
subPath: key
|
||||
{{- end }}
|
||||
volumes:
|
||||
- name: notary-config
|
||||
configMap:
|
||||
name: {{ template "harbor.notary-server" . }}
|
||||
{{- if .Values.notary.secretName }}
|
||||
- name: notary-cert
|
||||
secret:
|
||||
secretName: {{ .Values.notary.secretName }}
|
||||
{{- end }}
|
||||
{{- with .Values.notary.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{ toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.notary.affinity }}
|
||||
affinity:
|
||||
{{ toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.notary.tolerations }}
|
||||
tolerations:
|
||||
{{ toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{ end }}
|
||||
@@ -0,0 +1,29 @@
|
||||
{{ if .Values.notary.enabled }}
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ template "harbor.notary-server" . }}
|
||||
labels: {{ include "harbor.labels" . | nindent 4 }}
|
||||
spec:
|
||||
{{- if (eq .Values.service.ingress.controller "gce") }}
|
||||
type: NodePort
|
||||
{{- end }}
|
||||
ports:
|
||||
- port: 4443
|
||||
selector:
|
||||
{{ include "harbor.matchLabels" . | nindent 4 }}
|
||||
component: notary-server
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ template "harbor.notary-signer" . }}
|
||||
labels: {{ include "harbor.labels" . | nindent 4 }}
|
||||
spec:
|
||||
ports:
|
||||
- port: 7899
|
||||
selector:
|
||||
{{ include "harbor.matchLabels" . | nindent 4 }}
|
||||
component: notary-signer
|
||||
{{ end }}
|
||||
@@ -0,0 +1,71 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: "{{ template "harbor.portal" . }}"
|
||||
labels:
|
||||
{{- include "harbor.labels" . | nindent 4 }}
|
||||
app.kubernetes.io/component: portal
|
||||
spec:
|
||||
replicas: {{ .Values.portal.replicas }}
|
||||
selector:
|
||||
matchLabels: {{ include "harbor.matchLabels" . | nindent 6 }}
|
||||
app.kubernetes.io/component: portal
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
{{ include "harbor.matchLabels" . | nindent 8 }}
|
||||
app.kubernetes.io/component: portal
|
||||
annotations:
|
||||
{{- if .Values.portal.podAnnotations }}
|
||||
{{ toYaml .Values.portal.podAnnotations | nindent 8 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if .Values.securityContext.enabled }}
|
||||
securityContext:
|
||||
fsGroup: {{ .Values.securityContext.fsGroup }}
|
||||
runAsUser: {{ .Values.securityContext.runAsUser }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: portal
|
||||
image: "{{ template "harbor.portalImage" . }}"
|
||||
imagePullPolicy: {{ .Values.portalImage.pullPolicy | quote }}
|
||||
{{- if .Values.portal.resources }}
|
||||
resources: {{ toYaml .Values.portal.resources | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- if .Values.portal.livenessProbe.enabled }}
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /
|
||||
port: http
|
||||
initialDelaySeconds: {{ .Values.portal.livenessProbe.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.portal.livenessProbe.periodSeconds }}
|
||||
timeoutSeconds: {{ .Values.portal.livenessProbe.timeoutSeconds }}
|
||||
successThreshold: {{ .Values.portal.livenessProbe.successThreshold }}
|
||||
failureThreshold: {{ .Values.portal.livenessProbe.failureThreshold }}
|
||||
{{- end }}
|
||||
{{- if .Values.portal.readinessProbe.enabled }}
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /
|
||||
port: http
|
||||
initialDelaySeconds: {{ .Values.portal.readinessProbe.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.portal.readinessProbe.periodSeconds }}
|
||||
timeoutSeconds: {{ .Values.portal.readinessProbe.timeoutSeconds }}
|
||||
successThreshold: {{ .Values.portal.readinessProbe.successThreshold }}
|
||||
failureThreshold: {{ .Values.portal.readinessProbe.failureThreshold }}
|
||||
{{- end }}
|
||||
env:
|
||||
- name: BITNAMI_DEBUG
|
||||
value: {{ ternary "true" "false" .Values.portalImage.debug | quote }}
|
||||
ports:
|
||||
- containerPort: 8080
|
||||
name: http
|
||||
{{- with .Values.portal.nodeSelector }}
|
||||
nodeSelector: {{ tpl (toYaml .) $ | indent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.portal.affinity }}
|
||||
affinity: {{ tpl (toYaml .) $ | indent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.portal.tolerations }}
|
||||
tolerations: {{ tpl (toYaml .) $ | indent 8 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,15 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: "{{ template "harbor.portal" . }}"
|
||||
labels: {{ include "harbor.labels" . | nindent 4 }}
|
||||
spec:
|
||||
{{- if (eq .Values.service.ingress.controller "gce") }}
|
||||
type: NodePort
|
||||
{{- end }}
|
||||
ports:
|
||||
- port: 80
|
||||
targetPort: http
|
||||
selector:
|
||||
{{- include "harbor.matchLabels" . | nindent 4 }}
|
||||
app.kubernetes.io/component: portal
|
||||
@@ -0,0 +1,170 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ template "harbor.registry" . }}
|
||||
labels: {{ include "harbor.labels" . | nindent 4 }}
|
||||
data:
|
||||
config.yml: |+
|
||||
version: 0.1
|
||||
log:
|
||||
level: {{ .Values.logLevel }}
|
||||
fields:
|
||||
service: registry
|
||||
storage:
|
||||
{{- $storage := .Values.persistence.imageChartStorage }}
|
||||
{{- $type := $storage.type }}
|
||||
{{- if eq $type "filesystem" }}
|
||||
filesystem:
|
||||
rootdirectory: {{ $storage.filesystem.rootdirectory }}
|
||||
{{- if $storage.filesystem.maxthreads }}
|
||||
maxthreads: {{ $storage.filesystem.maxthreads }}
|
||||
{{- end }}
|
||||
{{- else if eq $type "azure" }}
|
||||
azure:
|
||||
accountname: {{ $storage.azure.accountname }}
|
||||
container: {{ $storage.azure.container }}
|
||||
{{- if $storage.azure.realm }}
|
||||
realm: {{ $storage.azure.realm }}
|
||||
{{- end }}
|
||||
{{- else if eq $type "gcs" }}
|
||||
gcs:
|
||||
bucket: {{ $storage.gcs.bucket }}
|
||||
keyfile: /etc/registry/gcs-key.json
|
||||
{{- if $storage.gcs.rootdirectory }}
|
||||
rootdirectory: {{ $storage.gcs.rootdirectory }}
|
||||
{{- end }}
|
||||
{{- if $storage.gcs.chunksize }}
|
||||
chunksize: {{ $storage.gcs.chunksize }}
|
||||
{{- end }}
|
||||
{{- else if eq $type "s3" }}
|
||||
s3:
|
||||
region: {{ $storage.s3.region }}
|
||||
bucket: {{ $storage.s3.bucket }}
|
||||
{{- if $storage.s3.regionendpoint }}
|
||||
regionendpoint: {{ $storage.s3.regionendpoint }}
|
||||
{{- end }}
|
||||
{{- if $storage.s3.encrypt }}
|
||||
encrypt: {{ $storage.s3.encrypt }}
|
||||
{{- end }}
|
||||
{{- if $storage.s3.secure }}
|
||||
secure: {{ $storage.s3.secure }}
|
||||
{{- end }}
|
||||
{{- if $storage.s3.v4auth }}
|
||||
v4auth: {{ $storage.s3.v4auth }}
|
||||
{{- end }}
|
||||
{{- if $storage.s3.chunksize }}
|
||||
chunksize: {{ $storage.s3.chunksize }}
|
||||
{{- end }}
|
||||
{{- if $storage.s3.rootdirectory }}
|
||||
rootdirectory: {{ $storage.s3.rootdirectory }}
|
||||
{{- end }}
|
||||
{{- if $storage.s3.storageclass }}
|
||||
storageclass: {{ $storage.s3.storageclass }}
|
||||
{{- end }}
|
||||
{{- else if eq $type "swift" }}
|
||||
swift:
|
||||
authurl: {{ $storage.swift.authurl }}
|
||||
username: {{ $storage.swift.username }}
|
||||
container: {{ $storage.swift.container }}
|
||||
{{- if $storage.swift.region }}
|
||||
region: {{ $storage.swift.region }}
|
||||
{{- end }}
|
||||
{{- if $storage.swift.tenant }}
|
||||
tenant: {{ $storage.swift.tenant }}
|
||||
{{- end }}
|
||||
{{- if $storage.swift.tenantid }}
|
||||
tenantid: {{ $storage.swift.tenantid }}
|
||||
{{- end }}
|
||||
{{- if $storage.swift.domain }}
|
||||
domain: {{ $storage.swift.domain }}
|
||||
{{- end }}
|
||||
{{- if $storage.swift.domainid }}
|
||||
domainid: {{ $storage.swift.domainid }}
|
||||
{{- end }}
|
||||
{{- if $storage.swift.trustid }}
|
||||
trustid: {{ $storage.swift.trustid }}
|
||||
{{- end }}
|
||||
{{- if $storage.swift.insecureskipverify }}
|
||||
insecureskipverify: {{ $storage.swift.insecureskipverify }}
|
||||
{{- end }}
|
||||
{{- if $storage.swift.chunksize }}
|
||||
chunksize: {{ $storage.swift.chunksize }}
|
||||
{{- end }}
|
||||
{{- if $storage.swift.prefix }}
|
||||
prefix: {{ $storage.swift.prefix }}
|
||||
{{- end }}
|
||||
{{- if $storage.swift.authversion }}
|
||||
authversion: {{ $storage.swift.authversion }}
|
||||
{{- end }}
|
||||
{{- if $storage.swift.endpointtype }}
|
||||
endpointtype: {{ $storage.swift.endpointtype }}
|
||||
{{- end }}
|
||||
{{- if $storage.swift.tempurlcontainerkey }}
|
||||
tempurlcontainerkey: {{ $storage.swift.tempurlcontainerkey }}
|
||||
{{- end }}
|
||||
{{- if $storage.swift.tempurlmethods }}
|
||||
tempurlmethods: {{ $storage.swift.tempurlmethods }}
|
||||
{{- end }}
|
||||
{{- else if eq $type "oss" }}
|
||||
oss:
|
||||
accesskeyid: {{ $storage.oss.accesskeyid }}
|
||||
region: {{ $storage.oss.region }}
|
||||
bucket: {{ $storage.oss.bucket }}
|
||||
{{- if $storage.oss.endpoint }}
|
||||
endpoint: {{ $storage.oss.endpoint }}
|
||||
{{- end }}
|
||||
{{- if $storage.oss.internal }}
|
||||
internal: {{ $storage.oss.internal }}
|
||||
{{- end }}
|
||||
{{- if $storage.oss.encrypt }}
|
||||
encrypt: {{ $storage.oss.encrypt }}
|
||||
{{- end }}
|
||||
{{- if $storage.oss.secure }}
|
||||
secure: {{ $storage.oss.secure }}
|
||||
{{- end }}
|
||||
{{- if $storage.oss.chunksize }}
|
||||
chunksize: {{ $storage.oss.chunksize }}
|
||||
{{- end }}
|
||||
{{- if $storage.oss.rootdirectory }}
|
||||
rootdirectory: {{ $storage.oss.rootdirectory }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
cache:
|
||||
layerinfo: redis
|
||||
maintenance:
|
||||
uploadpurging:
|
||||
enabled: false
|
||||
delete:
|
||||
enabled: true
|
||||
redirect:
|
||||
disable: {{ $storage.disableredirect }}
|
||||
redis:
|
||||
addr: "{{ template "harbor.redis.host" . }}:{{ template "harbor.redis.port" . }}"
|
||||
db: {{ template "harbor.redis.registryDatabaseIndex" . }}
|
||||
http:
|
||||
addr: :5000
|
||||
# set via environment variable
|
||||
# secret: placeholder
|
||||
debug:
|
||||
addr: localhost:5001
|
||||
auth:
|
||||
token:
|
||||
issuer: harbor-token-issuer
|
||||
realm: "{{ .Values.externalURL }}/service/token"
|
||||
rootcertbundle: /etc/registry/root.crt
|
||||
service: harbor-registry
|
||||
validation:
|
||||
disabled: true
|
||||
notifications:
|
||||
endpoints:
|
||||
- name: harbor
|
||||
disabled: false
|
||||
url: http://{{ template "harbor.core" . }}/service/notifications
|
||||
timeout: 3000ms
|
||||
threshold: 5
|
||||
backoff: 1s
|
||||
ctl-config.yml: |+
|
||||
---
|
||||
protocol: "http"
|
||||
port: 8080
|
||||
log_level: {{ .Values.logLevel }}
|
||||
@@ -0,0 +1,178 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: "{{ template "harbor.registry" . }}"
|
||||
labels:
|
||||
{{- include "harbor.labels" . | nindent 4 }}
|
||||
app.kubernetes.io/component: registry
|
||||
spec:
|
||||
replicas: {{ .Values.registry.replicas }}
|
||||
selector:
|
||||
matchLabels: {{ include "harbor.matchLabels" . | nindent 6 }}
|
||||
app.kubernetes.io/component: registry
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
{{ include "harbor.labels" . | nindent 8 }}
|
||||
app.kubernetes.io/component: registry
|
||||
annotations:
|
||||
checksum/configmap: {{ include (print $.Template.BasePath "/registry/registry-cm.yaml") . | sha256sum }}
|
||||
checksum/secret: {{ include (print $.Template.BasePath "/registry/registry-secret.yaml") . | sha256sum }}
|
||||
checksum/secret-jobservice: {{ include (print $.Template.BasePath "/jobservice/jobservice-secrets.yaml") . | sha256sum }}
|
||||
checksum/secret-core: {{ include (print $.Template.BasePath "/core/core-secret.yaml") . | sha256sum }}
|
||||
{{- if .Values.registry.podAnnotations }}
|
||||
{{ toYaml .Values.registry.podAnnotations | nindent 8 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if .Values.securityContext.enabled }}
|
||||
securityContext:
|
||||
fsGroup: {{ .Values.securityContext.fsGroup }}
|
||||
runAsUser: {{ .Values.securityContext.runAsUser }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: registry
|
||||
image: "{{ template "harbor.registryImage" . }}"
|
||||
imagePullPolicy: {{ .Values.registryImage.pullPolicy | quote }}
|
||||
{{- if .Values.registry.registry.livenessProbe.enabled }}
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /
|
||||
port: registry
|
||||
initialDelaySeconds: {{ .Values.registry.registry.livenessProbe.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.registry.registry.livenessProbe.periodSeconds }}
|
||||
timeoutSeconds: {{ .Values.registry.registry.livenessProbe.timeoutSeconds }}
|
||||
successThreshold: {{ .Values.registry.registry.livenessProbe.successThreshold }}
|
||||
failureThreshold: {{ .Values.registry.registry.livenessProbe.failureThreshold }}
|
||||
{{- end }}
|
||||
{{- if .Values.registry.registry.readinessProbe.enabled }}
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /
|
||||
port: registry
|
||||
initialDelaySeconds: {{ .Values.registry.registry.readinessProbe.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.registry.registry.readinessProbe.periodSeconds }}
|
||||
timeoutSeconds: {{ .Values.registry.registry.readinessProbe.timeoutSeconds }}
|
||||
successThreshold: {{ .Values.registry.registry.readinessProbe.successThreshold }}
|
||||
failureThreshold: {{ .Values.registry.registry.readinessProbe.failureThreshold }}
|
||||
{{- end }}
|
||||
{{- if .Values.registry.registry.resources }}
|
||||
resources: {{ toYaml .Values.registry.registry.resources | nindent 10 }}
|
||||
{{- end }}
|
||||
env:
|
||||
- name: BITNAMI_DEBUG
|
||||
value: {{ ternary "true" "false" .Values.registryImage.debug | quote }}
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: "{{ template "harbor.registry" . }}"
|
||||
ports:
|
||||
- containerPort: 5000
|
||||
name: registry
|
||||
- containerPort: 5001
|
||||
name: debug
|
||||
volumeMounts:
|
||||
- name: registry-data
|
||||
mountPath: {{ .Values.persistence.imageChartStorage.filesystem.rootdirectory }}
|
||||
subPath: {{ .Values.persistence.persistentVolumeClaim.registry.subPath }}
|
||||
- name: registry-root-certificate
|
||||
mountPath: /etc/registry/root.crt
|
||||
subPath: tls.crt
|
||||
- name: registry-config
|
||||
mountPath: /etc/registry/config.yml
|
||||
subPath: config.yml
|
||||
{{- if and .Values.persistence.enabled (eq .Values.persistence.imageChartStorage.type "gcs") }}
|
||||
- name: gcs-key
|
||||
mountPath: /etc/registry/gcs-key.json
|
||||
subPath: gcs-key.json
|
||||
{{- end }}
|
||||
- name: registryctl
|
||||
image: "{{ template "harbor.registryctlImage" . }}"
|
||||
imagePullPolicy: {{ .Values.registryctlImage.pullPolicy | quote }}
|
||||
{{- if .Values.registry.controller.livenessProbe.enabled }}
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /api/health
|
||||
port: registryctl
|
||||
initialDelaySeconds: {{ .Values.registry.controller.livenessProbe.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.registry.controller.livenessProbe.periodSeconds }}
|
||||
timeoutSeconds: {{ .Values.registry.controller.livenessProbe.timeoutSeconds }}
|
||||
successThreshold: {{ .Values.registry.controller.livenessProbe.successThreshold }}
|
||||
failureThreshold: {{ .Values.registry.controller.livenessProbe.failureThreshold }}
|
||||
{{- end }}
|
||||
{{- if .Values.registry.controller.readinessProbe.enabled }}
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /api/health
|
||||
port: registryctl
|
||||
initialDelaySeconds: {{ .Values.registry.controller.readinessProbe.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.registry.controller.readinessProbe.periodSeconds }}
|
||||
timeoutSeconds: {{ .Values.registry.controller.readinessProbe.timeoutSeconds }}
|
||||
successThreshold: {{ .Values.registry.controller.readinessProbe.successThreshold }}
|
||||
failureThreshold: {{ .Values.registry.controller.readinessProbe.failureThreshold }}
|
||||
{{- end }}
|
||||
{{- if .Values.registry.controller.resources }}
|
||||
resources: {{ toYaml .Values.registry.controller.resources | nindent 10 }}
|
||||
{{- end }}
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: "{{ template "harbor.registry" . }}"
|
||||
env:
|
||||
- name: BITNAMI_DEBUG
|
||||
value: {{ ternary "true" "false" .Values.registryctlImage.debug | quote }}
|
||||
- name: CORE_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ template "harbor.core" . }}
|
||||
key: secret
|
||||
- name: JOBSERVICE_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ template "harbor.jobservice" . }}
|
||||
key: secret
|
||||
ports:
|
||||
- containerPort: 8080
|
||||
name: registryctl
|
||||
volumeMounts:
|
||||
- name: registry-data
|
||||
mountPath: {{ .Values.persistence.imageChartStorage.filesystem.rootdirectory }}
|
||||
subPath: {{ .Values.persistence.persistentVolumeClaim.registry.subPath }}
|
||||
- name: registry-config
|
||||
mountPath: /etc/registry/config.yml
|
||||
subPath: config.yml
|
||||
- name: registry-config
|
||||
mountPath: /etc/registryctl/config.yml
|
||||
subPath: ctl-config.yml
|
||||
volumes:
|
||||
- name: registry-root-certificate
|
||||
secret:
|
||||
{{- if .Values.core.secretName }}
|
||||
secretName: {{ .Values.core.secretName }}
|
||||
{{- else }}
|
||||
secretName: {{ template "harbor.core" . }}
|
||||
{{- end }}
|
||||
- name: registry-config
|
||||
configMap:
|
||||
name: "{{ template "harbor.registry" . }}"
|
||||
- name: registry-data
|
||||
{{- if and .Values.persistence.enabled (eq .Values.persistence.imageChartStorage.type "filesystem") }}
|
||||
persistentVolumeClaim:
|
||||
claimName: {{ .Values.persistence.persistentVolumeClaim.registry.existingClaim | default (include "harbor.registry" .) }}
|
||||
{{- else }}
|
||||
emptyDir: {}
|
||||
{{- end }}
|
||||
{{- if and .Values.persistence.enabled (eq .Values.persistence.imageChartStorage.type "gcs") }}
|
||||
- name: gcs-key
|
||||
secret:
|
||||
secretName: {{ template "harbor.registry" . }}
|
||||
items:
|
||||
- key: GCS_KEY_DATA
|
||||
path: gcs-key.json
|
||||
{{- end }}
|
||||
{{- with .Values.registry.nodeSelector }}
|
||||
nodeSelector: {{ tpl (toYaml .) $ | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.registry.affinity }}
|
||||
affinity: {{ tpl (toYaml .) $ | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.registry.tolerations }}
|
||||
tolerations: {{ tpl (toYaml .) $ | nindent 8 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,29 @@
|
||||
{{- if .Values.persistence.enabled }}
|
||||
{{- $registry := .Values.persistence.persistentVolumeClaim.registry -}}
|
||||
{{- if and (not $registry.existingClaim) (eq .Values.persistence.imageChartStorage.type "filesystem") }}
|
||||
kind: PersistentVolumeClaim
|
||||
apiVersion: v1
|
||||
metadata:
|
||||
name: {{ template "harbor.registry" . }}
|
||||
{{- if eq .Values.persistence.resourcePolicy "keep" }}
|
||||
annotations:
|
||||
helm.sh/resource-policy: keep
|
||||
{{- end }}
|
||||
labels:
|
||||
{{- include "harbor.labels" . | nindent 4 }}
|
||||
app.kubernetes.io/component: registry
|
||||
spec:
|
||||
accessModes:
|
||||
- {{ $registry.accessMode }}
|
||||
resources:
|
||||
requests:
|
||||
storage: {{ $registry.size }}
|
||||
{{- if $registry.storageClass }}
|
||||
{{- if eq "-" $registry.storageClass }}
|
||||
storageClassName: ""
|
||||
{{- else }}
|
||||
storageClassName: {{ $registry.storageClass }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,33 @@
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: "{{ template "harbor.registry" . }}"
|
||||
labels: {{ include "harbor.labels" . | nindent 4 }}
|
||||
type: Opaque
|
||||
data:
|
||||
REGISTRY_HTTP_SECRET: {{ .Values.registry.secret | default (randAlphaNum 16) | b64enc | quote }}
|
||||
REGISTRY_REDIS_PASSWORD: {{ (include "harbor.redis.rawPassword" .) | b64enc | quote }}
|
||||
{{- $storage := .Values.persistence.imageChartStorage }}
|
||||
{{- $type := $storage.type }}
|
||||
{{- if eq $type "azure" }}
|
||||
REGISTRY_STORAGE_AZURE_ACCOUNTKEY: {{ $storage.azure.accountkey | b64enc | quote }}
|
||||
{{- else if eq $type "gcs" }}
|
||||
GCS_KEY_DATA: {{ $storage.gcs.encodedkey | quote }}
|
||||
{{- else if eq $type "s3" }}
|
||||
{{- if $storage.s3.accesskey }}
|
||||
REGISTRY_STORAGE_S3_ACCESSKEY: {{ $storage.s3.accesskey | b64enc | quote }}
|
||||
{{- end }}
|
||||
{{- if $storage.s3.secretkey }}
|
||||
REGISTRY_STORAGE_S3_SECRETKEY: {{ $storage.s3.secretkey | b64enc | quote }}
|
||||
{{- end }}
|
||||
{{- else if eq $type "swift" }}
|
||||
REGISTRY_STORAGE_SWIFT_PASSWORD: {{ $storage.swift.password | b64enc | quote }}
|
||||
{{- if $storage.swift.secretkey }}
|
||||
REGISTRY_STORAGE_SWIFT_SECRETKEY: {{ $storage.swift.secretkey | b64enc | quote }}
|
||||
{{- end }}
|
||||
{{- if $storage.swift.accesskey }}
|
||||
REGISTRY_STORAGE_SWIFT_ACCESSKEY: {{ $storage.swift.accesskey | b64enc | quote }}
|
||||
{{- end }}
|
||||
{{- else if eq $type "oss" }}
|
||||
REGISTRY_STORAGE_OSS_ACCESSKEYSECRET: {{ $storage.oss.accesskeysecret | b64enc | quote }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,14 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: "{{ template "harbor.registry" . }}"
|
||||
labels: {{ include "harbor.labels" . | nindent 4 }}
|
||||
spec:
|
||||
ports:
|
||||
- name: registry
|
||||
port: 5000
|
||||
- name: controller
|
||||
port: 8080
|
||||
selector:
|
||||
{{- include "harbor.matchLabels" . | nindent 4 }}
|
||||
app.kubernetes.io/component: registry
|
||||
@@ -0,0 +1,836 @@
|
||||
## Global Docker image parameters
|
||||
## Please, note that this will override the image parameters, including dependencies, configured to use the global value
|
||||
## Current available global Docker image parameters: imageRegistry and imagePullSecrets
|
||||
##
|
||||
# global:
|
||||
# imageRegistry: myRegistryName
|
||||
# imagePullSecrets:
|
||||
# - myRegistryKeySecretName
|
||||
|
||||
## Bitnami Harbor Core image
|
||||
## ref: https://hub.docker.com/r/bitnami/harbor-core/tags/
|
||||
##
|
||||
coreImage:
|
||||
registry: docker.io
|
||||
repository: bitnami/harbor-core
|
||||
tag: 1.8.1-debian-9-r3
|
||||
## Specify a imagePullPolicy
|
||||
## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
|
||||
## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images
|
||||
##
|
||||
pullPolicy: IfNotPresent
|
||||
## Optionally specify an array of imagePullSecrets.
|
||||
## Secrets must be manually created in the namespace.
|
||||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
|
||||
##
|
||||
# pullSecrets:
|
||||
# - myRegistryKeySecretName
|
||||
|
||||
## Set to true if you would like to see extra information on logs
|
||||
## It turns BASH and NAMI debugging in minideb
|
||||
## ref: https://github.com/bitnami/minideb-extras/#turn-on-bash-debugging
|
||||
debug: false
|
||||
|
||||
## Bitnami Harbor Portal image
|
||||
## ref: https://hub.docker.com/r/bitnami/harbor-portal/tags/
|
||||
##
|
||||
portalImage:
|
||||
registry: docker.io
|
||||
repository: bitnami/harbor-portal
|
||||
tag: 1.8.1-debian-9-r0
|
||||
## Specify a imagePullPolicy
|
||||
## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
|
||||
## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images
|
||||
##
|
||||
pullPolicy: IfNotPresent
|
||||
## Optionally specify an array of imagePullSecrets.
|
||||
## Secrets must be manually created in the namespace.
|
||||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
|
||||
##
|
||||
# pullSecrets:
|
||||
# - myRegistryKeySecretName
|
||||
|
||||
## Set to true if you would like to see extra information on logs
|
||||
## It turns BASH and NAMI debugging in minideb
|
||||
## ref: https://github.com/bitnami/minideb-extras/#turn-on-bash-debugging
|
||||
debug: false
|
||||
|
||||
## Bitnami Harbor Job Service image
|
||||
## ref: https://hub.docker.com/r/bitnami/harbor-jobservice/tags/
|
||||
##
|
||||
jobserviceImage:
|
||||
registry: docker.io
|
||||
repository: bitnami/harbor-jobservice
|
||||
tag: 1.8.1-debian-9-r3
|
||||
## Specify a imagePullPolicy
|
||||
## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
|
||||
## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images
|
||||
##
|
||||
pullPolicy: IfNotPresent
|
||||
## Optionally specify an array of imagePullSecrets.
|
||||
## Secrets must be manually created in the namespace.
|
||||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
|
||||
##
|
||||
# pullSecrets:
|
||||
# - myRegistryKeySecretName
|
||||
|
||||
## Set to true if you would like to see extra information on logs
|
||||
## It turns BASH and NAMI debugging in minideb
|
||||
## ref: https://github.com/bitnami/minideb-extras/#turn-on-bash-debugging
|
||||
debug: false
|
||||
|
||||
## Bitnami Harbor Registry image
|
||||
## ref: https://hub.docker.com/r/bitnami/harbor-registry/tags/
|
||||
##
|
||||
registryImage:
|
||||
registry: docker.io
|
||||
repository: bitnami/harbor-registry
|
||||
tag: 1.8.1-debian-9-r3
|
||||
## Specify a imagePullPolicy
|
||||
## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
|
||||
## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images
|
||||
##
|
||||
pullPolicy: IfNotPresent
|
||||
## Optionally specify an array of imagePullSecrets.
|
||||
## Secrets must be manually created in the namespace.
|
||||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
|
||||
##
|
||||
# pullSecrets:
|
||||
# - myRegistryKeySecretName
|
||||
|
||||
## Set to true if you would like to see extra information on logs
|
||||
## It turns BASH and NAMI debugging in minideb
|
||||
## ref: https://github.com/bitnami/minideb-extras/#turn-on-bash-debugging
|
||||
debug: false
|
||||
|
||||
## Bitnami Harbor Registryctl image
|
||||
## ref: https://hub.docker.com/r/bitnami/harbor-registryctl/tags/
|
||||
##
|
||||
registryctlImage:
|
||||
registry: docker.io
|
||||
repository: bitnami/harbor-registryctl
|
||||
tag: 1.8.1-debian-9-r3
|
||||
## Specify a imagePullPolicy
|
||||
## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
|
||||
## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images
|
||||
##
|
||||
pullPolicy: IfNotPresent
|
||||
## Optionally specify an array of imagePullSecrets.
|
||||
## Secrets must be manually created in the namespace.
|
||||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
|
||||
##
|
||||
# pullSecrets:
|
||||
# - myRegistryKeySecretName
|
||||
|
||||
## Set to true if you would like to see extra information on logs
|
||||
## It turns BASH and NAMI debugging in minideb
|
||||
## ref: https://github.com/bitnami/minideb-extras/#turn-on-bash-debugging
|
||||
debug: false
|
||||
|
||||
## Bitnami Harbor Clair image
|
||||
## ref: https://hub.docker.com/r/bitnami/harbor-clair/tags/
|
||||
##
|
||||
clairImage:
|
||||
registry: docker.io
|
||||
repository: bitnami/harbor-clair
|
||||
tag: 1.8.1-debian-9-r3
|
||||
## Specify a imagePullPolicy
|
||||
## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
|
||||
## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images
|
||||
##
|
||||
pullPolicy: IfNotPresent
|
||||
## Optionally specify an array of imagePullSecrets.
|
||||
## Secrets must be manually created in the namespace.
|
||||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
|
||||
##
|
||||
# pullSecrets:
|
||||
# - myRegistryKeySecretName
|
||||
|
||||
## Set to true if you would like to see extra information on logs
|
||||
## It turns BASH and NAMI debugging in minideb
|
||||
## ref: https://github.com/bitnami/minideb-extras/#turn-on-bash-debugging
|
||||
debug: false
|
||||
|
||||
## Bitnami Harbor Notary Server image
|
||||
## ref: https://hub.docker.com/r/bitnami/harbor-notary-server/tags/
|
||||
##
|
||||
notaryServerImage:
|
||||
registry: docker.io
|
||||
repository: bitnami/harbor-notary-server
|
||||
tag: 1.8.1-debian-9-r3
|
||||
## Specify a imagePullPolicy
|
||||
## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
|
||||
## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images
|
||||
##
|
||||
pullPolicy: IfNotPresent
|
||||
## Optionally specify an array of imagePullSecrets.
|
||||
## Secrets must be manually created in the namespace.
|
||||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
|
||||
##
|
||||
# pullSecrets:
|
||||
# - myRegistryKeySecretName
|
||||
|
||||
## Set to true if you would like to see extra information on logs
|
||||
## It turns BASH and NAMI debugging in minideb
|
||||
## ref: https://github.com/bitnami/minideb-extras/#turn-on-bash-debugging
|
||||
debug: false
|
||||
|
||||
## Bitnami Harbor Notary Signer image
|
||||
## ref: https://hub.docker.com/r/bitnami/harbor-notary-signer/tags/
|
||||
##
|
||||
notarySignerImage:
|
||||
registry: docker.io
|
||||
repository: bitnami/harbor-notary-signer
|
||||
tag: 1.8.1-debian-9-r3
|
||||
## Specify a imagePullPolicy
|
||||
## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
|
||||
## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images
|
||||
##
|
||||
pullPolicy: IfNotPresent
|
||||
## Optionally specify an array of imagePullSecrets.
|
||||
## Secrets must be manually created in the namespace.
|
||||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
|
||||
##
|
||||
# pullSecrets:
|
||||
# - myRegistryKeySecretName
|
||||
|
||||
## Set to true if you would like to see extra information on logs
|
||||
## It turns BASH and NAMI debugging in minideb
|
||||
## ref: https://github.com/bitnami/minideb-extras/#turn-on-bash-debugging
|
||||
debug: false
|
||||
|
||||
## Bitnami Nginx image
|
||||
## ref: https://hub.docker.com/r/bitnami/nginx/tags/
|
||||
##
|
||||
nginxImage:
|
||||
registry: docker.io
|
||||
repository: bitnami/nginx
|
||||
tag: 1.16.0-debian-9-r72
|
||||
## Specify a imagePullPolicy
|
||||
## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
|
||||
## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images
|
||||
##
|
||||
pullPolicy: IfNotPresent
|
||||
## Optionally specify an array of imagePullSecrets.
|
||||
## Secrets must be manually created in the namespace.
|
||||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
|
||||
##
|
||||
# pullSecrets:
|
||||
# - myRegistryKeySecretName
|
||||
|
||||
## Set to true if you would like to see extra information on logs
|
||||
## It turns BASH and NAMI debugging in minideb
|
||||
## ref: https://github.com/bitnami/minideb-extras/#turn-on-bash-debugging
|
||||
debug: false
|
||||
|
||||
service:
|
||||
# Set the way how to expose the service. Set the type as "Ingress",
|
||||
# "ClusterIP", "NodePort" or "LoadBalancer" and fill the information
|
||||
# in the corresponding section
|
||||
type: Ingress
|
||||
tls:
|
||||
# Enable the tls or not. Note: if the type is "ingress" and the tls
|
||||
# is disabled, the port must be included in the command when pull/push
|
||||
# images. Refer to https://github.com/goharbor/harbor/issues/5291
|
||||
# for the detail.
|
||||
enabled: true
|
||||
# Fill the name of secret if you want to use your own TLS certificate.
|
||||
# The secret must contain keys named:
|
||||
# "tls.crt" - the certificate
|
||||
# "tls.key" - the private key
|
||||
# "ca.crt" - the certificate of CA
|
||||
# These files will be generated automatically if the "secretName" is not set
|
||||
secretName: ""
|
||||
# By default, the Notary service will use the same cert and key as
|
||||
# described above. Fill the name of secret if you want to use a
|
||||
# separated one. Only needed when the type is "ingress".
|
||||
notarySecretName: ""
|
||||
# The commmon name used to generate the certificate, it's necessary
|
||||
# when the type isn't "ingress" and "secretName" is null
|
||||
commonName: ""
|
||||
ingress:
|
||||
hosts:
|
||||
core: core.harbor.domain
|
||||
notary: notary.harbor.domain
|
||||
# set to the type of ingress controller if it has specific requirements.
|
||||
# leave as `default` for most ingress controllers.
|
||||
# set to `gce` if using the GCE ingress controller
|
||||
controller: default
|
||||
annotations:
|
||||
ingress.kubernetes.io/ssl-redirect: "true"
|
||||
ingress.kubernetes.io/proxy-body-size: "0"
|
||||
nginx.ingress.kubernetes.io/ssl-redirect: "true"
|
||||
nginx.ingress.kubernetes.io/proxy-body-size: "0"
|
||||
clusterIP:
|
||||
# The name of ClusterIP service
|
||||
name: harbor
|
||||
ports:
|
||||
# The service port Harbor listens on when serving with HTTP
|
||||
httpPort: 80
|
||||
# The service port Harbor listens on when serving with HTTPS
|
||||
httpsPort: 443
|
||||
# The service port Notary listens on. Only needed when notary.enabled
|
||||
# is set to true
|
||||
notaryPort: 4443
|
||||
nodePort:
|
||||
# The name of NodePort service
|
||||
name: harbor
|
||||
ports:
|
||||
http:
|
||||
# The service port Harbor listens on when serving with HTTP
|
||||
port: 80
|
||||
# The node port Harbor listens on when serving with HTTP
|
||||
nodePort: 30002
|
||||
https:
|
||||
# The service port Harbor listens on when serving with HTTPS
|
||||
port: 443
|
||||
# The node port Harbor listens on when serving with HTTPS
|
||||
nodePort: 30003
|
||||
# Only needed when notary.enabled is set to true
|
||||
notary:
|
||||
# The service port Notary listens on
|
||||
port: 4443
|
||||
# The node port Notary listens on
|
||||
nodePort: 30004
|
||||
loadBalancer:
|
||||
# The name of LoadBalancer service
|
||||
name: harbor
|
||||
ports:
|
||||
# The service port Harbor listens on when serving with HTTP
|
||||
httpPort: 80
|
||||
# The service port Harbor listens on when serving with HTTPS
|
||||
httpsPort: 443
|
||||
# The service port Notary listens on. Only needed when notary.enabled
|
||||
# is set to true
|
||||
notaryPort: 4443
|
||||
|
||||
# The external URL for Harbor core service. It is used to
|
||||
# 1) populate the docker/helm commands showed on portal
|
||||
# 2) populate the token service URL returned to docker/notary client
|
||||
#
|
||||
# Format: protocol://domain[:port]. Usually:
|
||||
# 1) if "service.type" is "ingress", the "domain" should be
|
||||
# the value of "service.ingress.hosts.core"
|
||||
# 2) if "service.type" is "clusterIP", the "domain" should be
|
||||
# the value of "service.clusterIP.name"
|
||||
# 3) if "service.type" is "nodePort", the "domain" should be
|
||||
# the IP address of k8s node
|
||||
#
|
||||
# If Harbor is deployed behind the proxy, set it as the URL of proxy
|
||||
externalURL: https://core.harbor.domain
|
||||
|
||||
## Kubernetes Security Context
|
||||
## https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
|
||||
##
|
||||
securityContext:
|
||||
enabled: true
|
||||
fsGroup: 1001
|
||||
runAsUser: 1001
|
||||
|
||||
# The persistence is enabled by default and a default StorageClass
|
||||
# is needed in the k8s cluster to provision volumes dynamicly.
|
||||
# Specify another StorageClass in the "storageClass" or set "existingClaim"
|
||||
# if you have already existing persistent volumes to use
|
||||
#
|
||||
# For storing images and charts, you can also use "azure", "gcs", "s3",
|
||||
# "swift" or "oss". Set it in the "imageChartStorage" section
|
||||
persistence:
|
||||
enabled: true
|
||||
# Setting it to "keep" to avoid removing PVCs during a helm delete
|
||||
# operation. Leaving it empty will delete PVCs after the chart deleted
|
||||
resourcePolicy: "keep"
|
||||
persistentVolumeClaim:
|
||||
registry:
|
||||
# Use the existing PVC which must be created manually before bound,
|
||||
# and specify the "subPath" if the PVC is shared with other components
|
||||
# If your storage type is `filesystem` and you deploy more than 1 registry replica, the existing PVC must be ReadWriteMany.
|
||||
existingClaim: ""
|
||||
# Specify the "storageClass" used to provision the volume. Or the default
|
||||
# StorageClass will be used(the default).
|
||||
# Set it to "-" to disable dynamic provisioning
|
||||
storageClass: ""
|
||||
subPath: ""
|
||||
accessMode: ReadWriteOnce
|
||||
size: 5Gi
|
||||
jobservice:
|
||||
# Use the existing PVC which must be created manually before bound,
|
||||
# and specify the "subPath" if the PVC is shared with other components
|
||||
# If you deploy more than 1 jobservice replica, the existing PVC must be ReadWriteMany.
|
||||
existingClaim: ""
|
||||
storageClass: ""
|
||||
subPath: ""
|
||||
accessMode: ReadWriteOnce
|
||||
size: 1Gi
|
||||
# Define which storage backend is used for registry and chartmuseum to store
|
||||
# images and charts. Refer to
|
||||
# https://github.com/docker/distribution/blob/master/docs/configuration.md#storage
|
||||
# for the detail.
|
||||
imageChartStorage:
|
||||
# Specify whether to disable `redirect` for images and chart storage, for
|
||||
# backends which not supported it (such as using minio for `s3` storage type), please disable
|
||||
# it. To disable redirects, simply set `disableredirect` to `true` instead.
|
||||
# Refer to
|
||||
# https://github.com/docker/distribution/blob/master/docs/configuration.md#redirect
|
||||
# for the detail.
|
||||
disableredirect: false
|
||||
# Specify the type of storage: "filesystem", "azure", "gcs", "s3", "swift",
|
||||
# "oss" and fill the information needed in the corresponding section. The type
|
||||
# must be "filesystem" if you want to use persistent volumes for registry
|
||||
# and chartmuseum
|
||||
type: filesystem
|
||||
filesystem:
|
||||
rootdirectory: /storage
|
||||
#maxthreads: 100
|
||||
azure:
|
||||
accountname: accountname
|
||||
accountkey: base64encodedaccountkey
|
||||
container: containername
|
||||
#realm: core.windows.net
|
||||
gcs:
|
||||
bucket: bucketname
|
||||
# The base64 encoded json file which contains the key
|
||||
encodedkey: base64-encoded-json-key-file
|
||||
#rootdirectory: /gcs/object/name/prefix
|
||||
#chunksize: "5242880"
|
||||
s3:
|
||||
region: us-west-1
|
||||
bucket: bucketname
|
||||
#accesskey: awsaccesskey
|
||||
#secretkey: awssecretkey
|
||||
#regionendpoint: http://myobjects.local
|
||||
#encrypt: false
|
||||
#keyid: mykeyid
|
||||
#secure: true
|
||||
#v4auth: true
|
||||
#chunksize: "5242880"
|
||||
#rootdirectory: /s3/object/name/prefix
|
||||
#storageclass: STANDARD
|
||||
swift:
|
||||
authurl: https://storage.myprovider.com/v3/auth
|
||||
username: username
|
||||
password: password
|
||||
container: containername
|
||||
#region: fr
|
||||
#tenant: tenantname
|
||||
#tenantid: tenantid
|
||||
#domain: domainname
|
||||
#domainid: domainid
|
||||
#trustid: trustid
|
||||
#insecureskipverify: false
|
||||
#chunksize: 5M
|
||||
#prefix:
|
||||
#secretkey: secretkey
|
||||
#accesskey: accesskey
|
||||
#authversion: 3
|
||||
#endpointtype: public
|
||||
#tempurlcontainerkey: false
|
||||
#tempurlmethods:
|
||||
oss:
|
||||
accesskeyid: accesskeyid
|
||||
accesskeysecret: accesskeysecret
|
||||
region: regionname
|
||||
bucket: bucketname
|
||||
#endpoint: endpoint
|
||||
#internal: false
|
||||
#encrypt: false
|
||||
#secure: true
|
||||
#chunksize: 10M
|
||||
#rootdirectory: rootdirectory
|
||||
|
||||
## The log level used for Harbor services. Possible values are [ fatal | error | warn | info | debug | trace ]
|
||||
##
|
||||
logLevel: debug
|
||||
|
||||
## Option to force users to specify passwords (core.secret, harborAdminPassword, and secretKey). That is required for 'helm upgrade' to work properly.
|
||||
## If it is not forced, random values will be generated.
|
||||
##
|
||||
forcePassword: true
|
||||
|
||||
## The initial password of Harbor admin. Change it from portal after launching Harbor
|
||||
##
|
||||
## harborAdminPassword:
|
||||
|
||||
## The secret key used for encryption. Must be a string of 16 chars.
|
||||
##
|
||||
## secretKey: "not-a-secure-key"
|
||||
|
||||
# If expose the service via "ingress", the Nginx will not be used
|
||||
nginx:
|
||||
replicas: 1
|
||||
# resources:
|
||||
# requests:
|
||||
# memory: 256Mi
|
||||
# cpu: 100m
|
||||
## These values are evaluated as a template (nodeSelector, tolerations and affinity)
|
||||
nodeSelector: {}
|
||||
tolerations: []
|
||||
affinity: {}
|
||||
## Additional deployment annotations
|
||||
podAnnotations: {}
|
||||
## Configure extra options for liveness and readiness probes
|
||||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes)
|
||||
##
|
||||
livenessProbe:
|
||||
enabled: true
|
||||
initialDelaySeconds: 20
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 6
|
||||
successThreshold: 1
|
||||
readinessProbe:
|
||||
enabled: true
|
||||
initialDelaySeconds: 20
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 6
|
||||
successThreshold: 1
|
||||
|
||||
portal:
|
||||
replicas: 1
|
||||
# resources:
|
||||
# requests:
|
||||
# memory: 256Mi
|
||||
# cpu: 100m
|
||||
## These values are evaluated as a template (nodeSelector, tolerations and affinity)
|
||||
nodeSelector: {}
|
||||
tolerations: []
|
||||
affinity: {}
|
||||
## Additional deployment annotations
|
||||
podAnnotations: {}
|
||||
## Configure extra options for liveness and readiness probes
|
||||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes)
|
||||
##
|
||||
livenessProbe:
|
||||
enabled: true
|
||||
initialDelaySeconds: 20
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 6
|
||||
successThreshold: 1
|
||||
readinessProbe:
|
||||
enabled: true
|
||||
initialDelaySeconds: 20
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 6
|
||||
successThreshold: 1
|
||||
|
||||
core:
|
||||
replicas: 1
|
||||
# resources:
|
||||
# requests:
|
||||
# memory: 256Mi
|
||||
# cpu: 100m
|
||||
## These values are evaluated as a template (nodeSelector, tolerations and affinity)
|
||||
nodeSelector: {}
|
||||
tolerations: []
|
||||
affinity: {}
|
||||
## Additional deployment annotations
|
||||
podAnnotations: {}
|
||||
# Secret is used when core server communicates with other components.
|
||||
# If a secret key is not specified, Helm will generate one.
|
||||
# Must be a string of 16 chars.
|
||||
secret: ""
|
||||
# Fill the name of a kubernetes secret if you want to use your own
|
||||
# TLS certificate and private key for token encryption/decryption.
|
||||
# The secret must contain keys named:
|
||||
# "tls.crt" - the certificate
|
||||
# "tls.key" - the private key
|
||||
# The default key pair will be used if it isn't set
|
||||
secretName: ""
|
||||
## Configure extra options for liveness and readiness probes
|
||||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes)
|
||||
##
|
||||
livenessProbe:
|
||||
enabled: true
|
||||
initialDelaySeconds: 20
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 6
|
||||
successThreshold: 1
|
||||
readinessProbe:
|
||||
enabled: true
|
||||
initialDelaySeconds: 20
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 6
|
||||
successThreshold: 1
|
||||
|
||||
jobservice:
|
||||
replicas: 1
|
||||
maxJobWorkers: 10
|
||||
# The logger for jobs: "file", "database" or "stdout"
|
||||
jobLogger: file
|
||||
# resources:
|
||||
# requests:
|
||||
# memory: 256Mi
|
||||
# cpu: 100m
|
||||
## These values are evaluated as a template (nodeSelector, tolerations and affinity)
|
||||
nodeSelector: {}
|
||||
tolerations: []
|
||||
affinity: {}
|
||||
## Additional deployment annotations
|
||||
podAnnotations: {}
|
||||
# Secret is used when job service communicates with other components.
|
||||
# If a secret key is not specified, Helm will generate one.
|
||||
# Must be a string of 16 chars.
|
||||
secret: ""
|
||||
## Configure extra options for liveness and readiness probes
|
||||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes)
|
||||
##
|
||||
livenessProbe:
|
||||
enabled: true
|
||||
initialDelaySeconds: 20
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 6
|
||||
successThreshold: 1
|
||||
readinessProbe:
|
||||
enabled: true
|
||||
initialDelaySeconds: 20
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 6
|
||||
successThreshold: 1
|
||||
|
||||
registry:
|
||||
registry:
|
||||
## Configure extra options for liveness and readiness probes
|
||||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes)
|
||||
##
|
||||
livenessProbe:
|
||||
enabled: true
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 6
|
||||
successThreshold: 1
|
||||
readinessProbe:
|
||||
enabled: true
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 6
|
||||
successThreshold: 1
|
||||
# resources:
|
||||
# requests:
|
||||
# memory: 256Mi
|
||||
# cpu: 100m
|
||||
controller:
|
||||
## Configure extra options for liveness and readiness probes
|
||||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes)
|
||||
##
|
||||
livenessProbe:
|
||||
enabled: true
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 6
|
||||
successThreshold: 1
|
||||
readinessProbe:
|
||||
enabled: true
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 6
|
||||
successThreshold: 1
|
||||
# resources:
|
||||
# requests:
|
||||
# memory: 256Mi
|
||||
# cpu: 100m
|
||||
replicas: 1
|
||||
## These values are evaluated as a template (nodeSelector, tolerations and affinity)
|
||||
nodeSelector: {}
|
||||
tolerations: []
|
||||
affinity: {}
|
||||
## Additional deployment annotations
|
||||
podAnnotations: {}
|
||||
# Secret is used to secure the upload state from client
|
||||
# and registry storage backend.
|
||||
# See: https://github.com/docker/distribution/blob/master/docs/configuration.md#http
|
||||
# If a secret key is not specified, Helm will generate one.
|
||||
# Must be a string of 16 chars.
|
||||
secret: ""
|
||||
|
||||
# Enable Chartmuseum is not supported yet.
|
||||
chartmuseum:
|
||||
enabled: false
|
||||
|
||||
clair:
|
||||
enabled: true
|
||||
replicas: 1
|
||||
# The http(s) proxy used to update vulnerabilities database from internet
|
||||
httpProxy:
|
||||
httpsProxy:
|
||||
# The interval of clair updaters, the unit is hour, set to 0 to
|
||||
# disable the updaters
|
||||
updatersInterval: 12
|
||||
# resources:
|
||||
# requests:
|
||||
# memory: 256Mi
|
||||
# cpu: 100m
|
||||
nodeSelector: {}
|
||||
tolerations: []
|
||||
affinity: {}
|
||||
## Additional deployment annotations
|
||||
podAnnotations: {}
|
||||
## Configure extra options for liveness and readiness probes
|
||||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes)
|
||||
##
|
||||
livenessProbe:
|
||||
enabled: true
|
||||
initialDelaySeconds: 20
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 6
|
||||
successThreshold: 1
|
||||
readinessProbe:
|
||||
enabled: true
|
||||
initialDelaySeconds: 20
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 6
|
||||
successThreshold: 1
|
||||
|
||||
notary:
|
||||
enabled: true
|
||||
server:
|
||||
## Configure extra options for liveness and readiness probes
|
||||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes)
|
||||
##
|
||||
livenessProbe:
|
||||
enabled: true
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 6
|
||||
successThreshold: 1
|
||||
readinessProbe:
|
||||
enabled: true
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 6
|
||||
successThreshold: 1
|
||||
# resources:
|
||||
# requests:
|
||||
# memory: 256Mi
|
||||
# cpu: 100m
|
||||
signer:
|
||||
## Configure extra options for liveness and readiness probes
|
||||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes)
|
||||
##
|
||||
livenessProbe:
|
||||
enabled: true
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 6
|
||||
successThreshold: 1
|
||||
readinessProbe:
|
||||
enabled: true
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 6
|
||||
successThreshold: 1
|
||||
# resources:
|
||||
# requests:
|
||||
# memory: 256Mi
|
||||
# cpu: 100m
|
||||
replicas: 1
|
||||
|
||||
##
|
||||
## Redis chart configuration
|
||||
##
|
||||
## https://github.com/helm/charts/blob/master/stable/redis/values.yaml
|
||||
##
|
||||
redis:
|
||||
enabled: true
|
||||
# image:
|
||||
# tag:
|
||||
# password: ""
|
||||
usePassword: false
|
||||
cluster:
|
||||
enabled: true
|
||||
master:
|
||||
persistence:
|
||||
enabled: true
|
||||
slave:
|
||||
persistence:
|
||||
enabled: true
|
||||
|
||||
## If the Redis included in the chart is disabled, Harbor will use below
|
||||
## Redis parameters to connect to an external Redis server.
|
||||
##
|
||||
externalRedis:
|
||||
## All of these values are only used when redis.enabled is set to false
|
||||
## Redis host
|
||||
host: localhost
|
||||
## Redis port number
|
||||
port: 6379
|
||||
## Redis password
|
||||
password: ""
|
||||
# The "coreDatabaseIndex" must be "0" as the library Harbor
|
||||
# used doesn't support configuring it
|
||||
coreDatabaseIndex: "0"
|
||||
jobserviceDatabaseIndex: "1"
|
||||
registryDatabaseIndex: "2"
|
||||
chartmuseumDatabaseIndex: "3"
|
||||
|
||||
##
|
||||
## PostgreSQL chart configuration
|
||||
##
|
||||
## https://github.com/helm/charts/blob/master/stable/postgresql/values.yaml
|
||||
##
|
||||
postgresql:
|
||||
enabled: true
|
||||
# image:
|
||||
# tag:
|
||||
postgresqlUsername: postgres
|
||||
postgresqlPassword: not-secure-database-password
|
||||
replication:
|
||||
enabled: true
|
||||
persistence:
|
||||
enabled: true
|
||||
initdbScripts:
|
||||
initial-notaryserver.sql: |
|
||||
CREATE DATABASE notaryserver;
|
||||
CREATE USER server;
|
||||
alter user server with encrypted password 'password';
|
||||
GRANT ALL PRIVILEGES ON DATABASE notaryserver TO server;
|
||||
initial-notarysigner.sql: |
|
||||
CREATE DATABASE notarysigner;
|
||||
CREATE USER signer;
|
||||
alter user signer with encrypted password 'password';
|
||||
GRANT ALL PRIVILEGES ON DATABASE notarysigner TO signer;
|
||||
initial-registry.sql: |
|
||||
CREATE DATABASE registry ENCODING 'UTF8';
|
||||
\c registry;
|
||||
CREATE TABLE schema_migrations(version bigint not null primary key, dirty boolean not null);
|
||||
|
||||
## If the PostgreSQL database included in the chart is disabled, Harbor will
|
||||
## use below parameters to connect to an external PostgreSQL server.
|
||||
##
|
||||
externalDatabase:
|
||||
## All of these values are only used when postgresql.enabled is set to false
|
||||
## Database host
|
||||
host: localhost
|
||||
## non-root Username for portal Database
|
||||
user: bn_harbor
|
||||
## Database password
|
||||
password: ""
|
||||
## Database name
|
||||
database: bitnami_harbor
|
||||
## Database port number
|
||||
port: 5432
|
||||
## External database ssl mode
|
||||
##sslmode:
|
||||
## External database name for core
|
||||
##coreDatabase:
|
||||
## External database name for clair
|
||||
##clairDatabase:
|
||||
## External database name for notaryserver
|
||||
##notaryServerDatabase:
|
||||
## External database name for notaryserver
|
||||
##notarySignerDatabase:
|
||||
@@ -0,0 +1,836 @@
|
||||
## Global Docker image parameters
|
||||
## Please, note that this will override the image parameters, including dependencies, configured to use the global value
|
||||
## Current available global Docker image parameters: imageRegistry and imagePullSecrets
|
||||
##
|
||||
# global:
|
||||
# imageRegistry: myRegistryName
|
||||
# imagePullSecrets:
|
||||
# - myRegistryKeySecretName
|
||||
|
||||
## Bitnami Harbor Core image
|
||||
## ref: https://hub.docker.com/r/bitnami/harbor-core/tags/
|
||||
##
|
||||
coreImage:
|
||||
registry: docker.io
|
||||
repository: bitnami/harbor-core
|
||||
tag: 1.8.1-debian-9-r3
|
||||
## Specify a imagePullPolicy
|
||||
## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
|
||||
## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images
|
||||
##
|
||||
pullPolicy: IfNotPresent
|
||||
## Optionally specify an array of imagePullSecrets.
|
||||
## Secrets must be manually created in the namespace.
|
||||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
|
||||
##
|
||||
# pullSecrets:
|
||||
# - myRegistryKeySecretName
|
||||
|
||||
## Set to true if you would like to see extra information on logs
|
||||
## It turns BASH and NAMI debugging in minideb
|
||||
## ref: https://github.com/bitnami/minideb-extras/#turn-on-bash-debugging
|
||||
debug: false
|
||||
|
||||
## Bitnami Harbor Portal image
|
||||
## ref: https://hub.docker.com/r/bitnami/harbor-portal/tags/
|
||||
##
|
||||
portalImage:
|
||||
registry: docker.io
|
||||
repository: bitnami/harbor-portal
|
||||
tag: 1.8.1-debian-9-r0
|
||||
## Specify a imagePullPolicy
|
||||
## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
|
||||
## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images
|
||||
##
|
||||
pullPolicy: IfNotPresent
|
||||
## Optionally specify an array of imagePullSecrets.
|
||||
## Secrets must be manually created in the namespace.
|
||||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
|
||||
##
|
||||
# pullSecrets:
|
||||
# - myRegistryKeySecretName
|
||||
|
||||
## Set to true if you would like to see extra information on logs
|
||||
## It turns BASH and NAMI debugging in minideb
|
||||
## ref: https://github.com/bitnami/minideb-extras/#turn-on-bash-debugging
|
||||
debug: false
|
||||
|
||||
## Bitnami Harbor Job Service image
|
||||
## ref: https://hub.docker.com/r/bitnami/harbor-jobservice/tags/
|
||||
##
|
||||
jobserviceImage:
|
||||
registry: docker.io
|
||||
repository: bitnami/harbor-jobservice
|
||||
tag: 1.8.1-debian-9-r3
|
||||
## Specify a imagePullPolicy
|
||||
## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
|
||||
## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images
|
||||
##
|
||||
pullPolicy: IfNotPresent
|
||||
## Optionally specify an array of imagePullSecrets.
|
||||
## Secrets must be manually created in the namespace.
|
||||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
|
||||
##
|
||||
# pullSecrets:
|
||||
# - myRegistryKeySecretName
|
||||
|
||||
## Set to true if you would like to see extra information on logs
|
||||
## It turns BASH and NAMI debugging in minideb
|
||||
## ref: https://github.com/bitnami/minideb-extras/#turn-on-bash-debugging
|
||||
debug: false
|
||||
|
||||
## Bitnami Harbor Registry image
|
||||
## ref: https://hub.docker.com/r/bitnami/harbor-registry/tags/
|
||||
##
|
||||
registryImage:
|
||||
registry: docker.io
|
||||
repository: bitnami/harbor-registry
|
||||
tag: 1.8.1-debian-9-r3
|
||||
## Specify a imagePullPolicy
|
||||
## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
|
||||
## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images
|
||||
##
|
||||
pullPolicy: IfNotPresent
|
||||
## Optionally specify an array of imagePullSecrets.
|
||||
## Secrets must be manually created in the namespace.
|
||||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
|
||||
##
|
||||
# pullSecrets:
|
||||
# - myRegistryKeySecretName
|
||||
|
||||
## Set to true if you would like to see extra information on logs
|
||||
## It turns BASH and NAMI debugging in minideb
|
||||
## ref: https://github.com/bitnami/minideb-extras/#turn-on-bash-debugging
|
||||
debug: false
|
||||
|
||||
## Bitnami Harbor Registryctl image
|
||||
## ref: https://hub.docker.com/r/bitnami/harbor-registryctl/tags/
|
||||
##
|
||||
registryctlImage:
|
||||
registry: docker.io
|
||||
repository: bitnami/harbor-registryctl
|
||||
tag: 1.8.1-debian-9-r3
|
||||
## Specify a imagePullPolicy
|
||||
## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
|
||||
## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images
|
||||
##
|
||||
pullPolicy: IfNotPresent
|
||||
## Optionally specify an array of imagePullSecrets.
|
||||
## Secrets must be manually created in the namespace.
|
||||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
|
||||
##
|
||||
# pullSecrets:
|
||||
# - myRegistryKeySecretName
|
||||
|
||||
## Set to true if you would like to see extra information on logs
|
||||
## It turns BASH and NAMI debugging in minideb
|
||||
## ref: https://github.com/bitnami/minideb-extras/#turn-on-bash-debugging
|
||||
debug: false
|
||||
|
||||
## Bitnami Harbor Clair image
|
||||
## ref: https://hub.docker.com/r/bitnami/harbor-clair/tags/
|
||||
##
|
||||
clairImage:
|
||||
registry: docker.io
|
||||
repository: bitnami/harbor-clair
|
||||
tag: 1.8.1-debian-9-r3
|
||||
## Specify a imagePullPolicy
|
||||
## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
|
||||
## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images
|
||||
##
|
||||
pullPolicy: IfNotPresent
|
||||
## Optionally specify an array of imagePullSecrets.
|
||||
## Secrets must be manually created in the namespace.
|
||||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
|
||||
##
|
||||
# pullSecrets:
|
||||
# - myRegistryKeySecretName
|
||||
|
||||
## Set to true if you would like to see extra information on logs
|
||||
## It turns BASH and NAMI debugging in minideb
|
||||
## ref: https://github.com/bitnami/minideb-extras/#turn-on-bash-debugging
|
||||
debug: false
|
||||
|
||||
## Bitnami Harbor Notary Server image
|
||||
## ref: https://hub.docker.com/r/bitnami/harbor-notary-server/tags/
|
||||
##
|
||||
notaryServerImage:
|
||||
registry: docker.io
|
||||
repository: bitnami/harbor-notary-server
|
||||
tag: 1.8.1-debian-9-r3
|
||||
## Specify a imagePullPolicy
|
||||
## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
|
||||
## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images
|
||||
##
|
||||
pullPolicy: IfNotPresent
|
||||
## Optionally specify an array of imagePullSecrets.
|
||||
## Secrets must be manually created in the namespace.
|
||||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
|
||||
##
|
||||
# pullSecrets:
|
||||
# - myRegistryKeySecretName
|
||||
|
||||
## Set to true if you would like to see extra information on logs
|
||||
## It turns BASH and NAMI debugging in minideb
|
||||
## ref: https://github.com/bitnami/minideb-extras/#turn-on-bash-debugging
|
||||
debug: false
|
||||
|
||||
## Bitnami Harbor Notary Signer image
|
||||
## ref: https://hub.docker.com/r/bitnami/harbor-notary-signer/tags/
|
||||
##
|
||||
notarySignerImage:
|
||||
registry: docker.io
|
||||
repository: bitnami/harbor-notary-signer
|
||||
tag: 1.8.1-debian-9-r3
|
||||
## Specify a imagePullPolicy
|
||||
## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
|
||||
## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images
|
||||
##
|
||||
pullPolicy: IfNotPresent
|
||||
## Optionally specify an array of imagePullSecrets.
|
||||
## Secrets must be manually created in the namespace.
|
||||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
|
||||
##
|
||||
# pullSecrets:
|
||||
# - myRegistryKeySecretName
|
||||
|
||||
## Set to true if you would like to see extra information on logs
|
||||
## It turns BASH and NAMI debugging in minideb
|
||||
## ref: https://github.com/bitnami/minideb-extras/#turn-on-bash-debugging
|
||||
debug: false
|
||||
|
||||
## Bitnami Nginx image
|
||||
## ref: https://hub.docker.com/r/bitnami/nginx/tags/
|
||||
##
|
||||
nginxImage:
|
||||
registry: docker.io
|
||||
repository: bitnami/nginx
|
||||
tag: 1.16.0-debian-9-r72
|
||||
## Specify a imagePullPolicy
|
||||
## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
|
||||
## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images
|
||||
##
|
||||
pullPolicy: IfNotPresent
|
||||
## Optionally specify an array of imagePullSecrets.
|
||||
## Secrets must be manually created in the namespace.
|
||||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
|
||||
##
|
||||
# pullSecrets:
|
||||
# - myRegistryKeySecretName
|
||||
|
||||
## Set to true if you would like to see extra information on logs
|
||||
## It turns BASH and NAMI debugging in minideb
|
||||
## ref: https://github.com/bitnami/minideb-extras/#turn-on-bash-debugging
|
||||
debug: false
|
||||
|
||||
service:
|
||||
# Set the way how to expose the service. Set the type as "Ingress",
|
||||
# "ClusterIP", "NodePort" or "LoadBalancer" and fill the information
|
||||
# in the corresponding section
|
||||
type: ClusterIP
|
||||
tls:
|
||||
# Enable the tls or not. Note: if the type is "ingress" and the tls
|
||||
# is disabled, the port must be included in the command when pull/push
|
||||
# images. Refer to https://github.com/goharbor/harbor/issues/5291
|
||||
# for the detail.
|
||||
enabled: true
|
||||
# Fill the name of secret if you want to use your own TLS certificate.
|
||||
# The secret must contain keys named:
|
||||
# "tls.crt" - the certificate
|
||||
# "tls.key" - the private key
|
||||
# "ca.crt" - the certificate of CA
|
||||
# These files will be generated automatically if the "secretName" is not set
|
||||
secretName: ""
|
||||
# By default, the Notary service will use the same cert and key as
|
||||
# described above. Fill the name of secret if you want to use a
|
||||
# separated one. Only needed when the type is "ingress".
|
||||
notarySecretName: ""
|
||||
# The commmon name used to generate the certificate, it's necessary
|
||||
# when the type isn't "ingress" and "secretName" is null
|
||||
commonName: ""
|
||||
ingress:
|
||||
hosts:
|
||||
core: core.harbor.domain
|
||||
notary: notary.harbor.domain
|
||||
# set to the type of ingress controller if it has specific requirements.
|
||||
# leave as `default` for most ingress controllers.
|
||||
# set to `gce` if using the GCE ingress controller
|
||||
controller: default
|
||||
annotations:
|
||||
ingress.kubernetes.io/ssl-redirect: "true"
|
||||
ingress.kubernetes.io/proxy-body-size: "0"
|
||||
nginx.ingress.kubernetes.io/ssl-redirect: "true"
|
||||
nginx.ingress.kubernetes.io/proxy-body-size: "0"
|
||||
clusterIP:
|
||||
# The name of ClusterIP service
|
||||
name: harbor
|
||||
ports:
|
||||
# The service port Harbor listens on when serving with HTTP
|
||||
httpPort: 80
|
||||
# The service port Harbor listens on when serving with HTTPS
|
||||
httpsPort: 443
|
||||
# The service port Notary listens on. Only needed when notary.enabled
|
||||
# is set to true
|
||||
notaryPort: 4443
|
||||
nodePort:
|
||||
# The name of NodePort service
|
||||
name: harbor
|
||||
ports:
|
||||
http:
|
||||
# The service port Harbor listens on when serving with HTTP
|
||||
port: 80
|
||||
# The node port Harbor listens on when serving with HTTP
|
||||
nodePort: 30002
|
||||
https:
|
||||
# The service port Harbor listens on when serving with HTTPS
|
||||
port: 443
|
||||
# The node port Harbor listens on when serving with HTTPS
|
||||
nodePort: 30003
|
||||
# Only needed when notary.enabled is set to true
|
||||
notary:
|
||||
# The service port Notary listens on
|
||||
port: 4443
|
||||
# The node port Notary listens on
|
||||
nodePort: 30004
|
||||
loadBalancer:
|
||||
# The name of LoadBalancer service
|
||||
name: harbor
|
||||
ports:
|
||||
# The service port Harbor listens on when serving with HTTP
|
||||
httpPort: 80
|
||||
# The service port Harbor listens on when serving with HTTPS
|
||||
httpsPort: 443
|
||||
# The service port Notary listens on. Only needed when notary.enabled
|
||||
# is set to true
|
||||
notaryPort: 4443
|
||||
|
||||
# The external URL for Harbor core service. It is used to
|
||||
# 1) populate the docker/helm commands showed on portal
|
||||
# 2) populate the token service URL returned to docker/notary client
|
||||
#
|
||||
# Format: protocol://domain[:port]. Usually:
|
||||
# 1) if "service.type" is "ingress", the "domain" should be
|
||||
# the value of "service.ingress.hosts.core"
|
||||
# 2) if "service.type" is "clusterIP", the "domain" should be
|
||||
# the value of "service.clusterIP.name"
|
||||
# 3) if "service.type" is "nodePort", the "domain" should be
|
||||
# the IP address of k8s node
|
||||
#
|
||||
# If Harbor is deployed behind the proxy, set it as the URL of proxy
|
||||
externalURL: https://core.harbor.domain
|
||||
|
||||
## Kubernetes Security Context
|
||||
## https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
|
||||
##
|
||||
securityContext:
|
||||
enabled: true
|
||||
fsGroup: 1001
|
||||
runAsUser: 1001
|
||||
|
||||
# The persistence is enabled by default and a default StorageClass
|
||||
# is needed in the k8s cluster to provision volumes dynamicly.
|
||||
# Specify another StorageClass in the "storageClass" or set "existingClaim"
|
||||
# if you have already existing persistent volumes to use
|
||||
#
|
||||
# For storing images and charts, you can also use "azure", "gcs", "s3",
|
||||
# "swift" or "oss". Set it in the "imageChartStorage" section
|
||||
persistence:
|
||||
enabled: true
|
||||
# Setting it to "keep" to avoid removing PVCs during a helm delete
|
||||
# operation. Leaving it empty will delete PVCs after the chart deleted
|
||||
resourcePolicy: "keep"
|
||||
persistentVolumeClaim:
|
||||
registry:
|
||||
# Use the existing PVC which must be created manually before bound,
|
||||
# and specify the "subPath" if the PVC is shared with other components
|
||||
# If your storage type is `filesystem` and you deploy more than 1 registry replica, the existing PVC must be ReadWriteMany.
|
||||
existingClaim: ""
|
||||
# Specify the "storageClass" used to provision the volume. Or the default
|
||||
# StorageClass will be used(the default).
|
||||
# Set it to "-" to disable dynamic provisioning
|
||||
storageClass: ""
|
||||
subPath: ""
|
||||
accessMode: ReadWriteOnce
|
||||
size: 5Gi
|
||||
jobservice:
|
||||
# Use the existing PVC which must be created manually before bound,
|
||||
# and specify the "subPath" if the PVC is shared with other components
|
||||
# If you deploy more than 1 jobservice replica, the existing PVC must be ReadWriteMany.
|
||||
existingClaim: ""
|
||||
storageClass: ""
|
||||
subPath: ""
|
||||
accessMode: ReadWriteOnce
|
||||
size: 1Gi
|
||||
# Define which storage backend is used for registry and chartmuseum to store
|
||||
# images and charts. Refer to
|
||||
# https://github.com/docker/distribution/blob/master/docs/configuration.md#storage
|
||||
# for the detail.
|
||||
imageChartStorage:
|
||||
# Specify whether to disable `redirect` for images and chart storage, for
|
||||
# backends which not supported it (such as using minio for `s3` storage type), please disable
|
||||
# it. To disable redirects, simply set `disableredirect` to `true` instead.
|
||||
# Refer to
|
||||
# https://github.com/docker/distribution/blob/master/docs/configuration.md#redirect
|
||||
# for the detail.
|
||||
disableredirect: false
|
||||
# Specify the type of storage: "filesystem", "azure", "gcs", "s3", "swift",
|
||||
# "oss" and fill the information needed in the corresponding section. The type
|
||||
# must be "filesystem" if you want to use persistent volumes for registry
|
||||
# and chartmuseum
|
||||
type: filesystem
|
||||
filesystem:
|
||||
rootdirectory: /storage
|
||||
#maxthreads: 100
|
||||
azure:
|
||||
accountname: accountname
|
||||
accountkey: base64encodedaccountkey
|
||||
container: containername
|
||||
#realm: core.windows.net
|
||||
gcs:
|
||||
bucket: bucketname
|
||||
# The base64 encoded json file which contains the key
|
||||
encodedkey: base64-encoded-json-key-file
|
||||
#rootdirectory: /gcs/object/name/prefix
|
||||
#chunksize: "5242880"
|
||||
s3:
|
||||
region: us-west-1
|
||||
bucket: bucketname
|
||||
#accesskey: awsaccesskey
|
||||
#secretkey: awssecretkey
|
||||
#regionendpoint: http://myobjects.local
|
||||
#encrypt: false
|
||||
#keyid: mykeyid
|
||||
#secure: true
|
||||
#v4auth: true
|
||||
#chunksize: "5242880"
|
||||
#rootdirectory: /s3/object/name/prefix
|
||||
#storageclass: STANDARD
|
||||
swift:
|
||||
authurl: https://storage.myprovider.com/v3/auth
|
||||
username: username
|
||||
password: password
|
||||
container: containername
|
||||
#region: fr
|
||||
#tenant: tenantname
|
||||
#tenantid: tenantid
|
||||
#domain: domainname
|
||||
#domainid: domainid
|
||||
#trustid: trustid
|
||||
#insecureskipverify: false
|
||||
#chunksize: 5M
|
||||
#prefix:
|
||||
#secretkey: secretkey
|
||||
#accesskey: accesskey
|
||||
#authversion: 3
|
||||
#endpointtype: public
|
||||
#tempurlcontainerkey: false
|
||||
#tempurlmethods:
|
||||
oss:
|
||||
accesskeyid: accesskeyid
|
||||
accesskeysecret: accesskeysecret
|
||||
region: regionname
|
||||
bucket: bucketname
|
||||
#endpoint: endpoint
|
||||
#internal: false
|
||||
#encrypt: false
|
||||
#secure: true
|
||||
#chunksize: 10M
|
||||
#rootdirectory: rootdirectory
|
||||
|
||||
## The log level used for Harbor services. Possible values are [ fatal | error | warn | info | debug | trace ]
|
||||
##
|
||||
logLevel: debug
|
||||
|
||||
## Option to force users to specify passwords (core.secret, harborAdminPassword, and secretKey). That is required for 'helm upgrade' to work properly.
|
||||
## If it is not forced, random values will be generated.
|
||||
##
|
||||
forcePassword: false
|
||||
|
||||
## The initial password of Harbor admin. Change it from portal after launching Harbor
|
||||
##
|
||||
## harborAdminPassword:
|
||||
|
||||
## The secret key used for encryption. Must be a string of 16 chars.
|
||||
##
|
||||
## secretKey: "not-a-secure-key"
|
||||
|
||||
# If expose the service via "ingress", the Nginx will not be used
|
||||
nginx:
|
||||
replicas: 1
|
||||
# resources:
|
||||
# requests:
|
||||
# memory: 256Mi
|
||||
# cpu: 100m
|
||||
## These values are evaluated as a template (nodeSelector, tolerations and affinity)
|
||||
nodeSelector: {}
|
||||
tolerations: []
|
||||
affinity: {}
|
||||
## Additional deployment annotations
|
||||
podAnnotations: {}
|
||||
## Configure extra options for liveness and readiness probes
|
||||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes)
|
||||
##
|
||||
livenessProbe:
|
||||
enabled: true
|
||||
initialDelaySeconds: 20
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 6
|
||||
successThreshold: 1
|
||||
readinessProbe:
|
||||
enabled: true
|
||||
initialDelaySeconds: 20
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 6
|
||||
successThreshold: 1
|
||||
|
||||
portal:
|
||||
replicas: 1
|
||||
# resources:
|
||||
# requests:
|
||||
# memory: 256Mi
|
||||
# cpu: 100m
|
||||
## These values are evaluated as a template (nodeSelector, tolerations and affinity)
|
||||
nodeSelector: {}
|
||||
tolerations: []
|
||||
affinity: {}
|
||||
## Additional deployment annotations
|
||||
podAnnotations: {}
|
||||
## Configure extra options for liveness and readiness probes
|
||||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes)
|
||||
##
|
||||
livenessProbe:
|
||||
enabled: true
|
||||
initialDelaySeconds: 20
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 6
|
||||
successThreshold: 1
|
||||
readinessProbe:
|
||||
enabled: true
|
||||
initialDelaySeconds: 20
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 6
|
||||
successThreshold: 1
|
||||
|
||||
core:
|
||||
replicas: 1
|
||||
# resources:
|
||||
# requests:
|
||||
# memory: 256Mi
|
||||
# cpu: 100m
|
||||
## These values are evaluated as a template (nodeSelector, tolerations and affinity)
|
||||
nodeSelector: {}
|
||||
tolerations: []
|
||||
affinity: {}
|
||||
## Additional deployment annotations
|
||||
podAnnotations: {}
|
||||
# Secret is used when core server communicates with other components.
|
||||
# If a secret key is not specified, Helm will generate one.
|
||||
# Must be a string of 16 chars.
|
||||
secret: ""
|
||||
# Fill the name of a kubernetes secret if you want to use your own
|
||||
# TLS certificate and private key for token encryption/decryption.
|
||||
# The secret must contain keys named:
|
||||
# "tls.crt" - the certificate
|
||||
# "tls.key" - the private key
|
||||
# The default key pair will be used if it isn't set
|
||||
secretName: ""
|
||||
## Configure extra options for liveness and readiness probes
|
||||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes)
|
||||
##
|
||||
livenessProbe:
|
||||
enabled: true
|
||||
initialDelaySeconds: 20
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 6
|
||||
successThreshold: 1
|
||||
readinessProbe:
|
||||
enabled: true
|
||||
initialDelaySeconds: 20
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 6
|
||||
successThreshold: 1
|
||||
|
||||
jobservice:
|
||||
replicas: 1
|
||||
maxJobWorkers: 10
|
||||
# The logger for jobs: "file", "database" or "stdout"
|
||||
jobLogger: file
|
||||
# resources:
|
||||
# requests:
|
||||
# memory: 256Mi
|
||||
# cpu: 100m
|
||||
## These values are evaluated as a template (nodeSelector, tolerations and affinity)
|
||||
nodeSelector: {}
|
||||
tolerations: []
|
||||
affinity: {}
|
||||
## Additional deployment annotations
|
||||
podAnnotations: {}
|
||||
# Secret is used when job service communicates with other components.
|
||||
# If a secret key is not specified, Helm will generate one.
|
||||
# Must be a string of 16 chars.
|
||||
secret: ""
|
||||
## Configure extra options for liveness and readiness probes
|
||||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes)
|
||||
##
|
||||
livenessProbe:
|
||||
enabled: true
|
||||
initialDelaySeconds: 20
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 6
|
||||
successThreshold: 1
|
||||
readinessProbe:
|
||||
enabled: true
|
||||
initialDelaySeconds: 20
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 6
|
||||
successThreshold: 1
|
||||
|
||||
registry:
|
||||
registry:
|
||||
## Configure extra options for liveness and readiness probes
|
||||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes)
|
||||
##
|
||||
livenessProbe:
|
||||
enabled: true
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 6
|
||||
successThreshold: 1
|
||||
readinessProbe:
|
||||
enabled: true
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 6
|
||||
successThreshold: 1
|
||||
# resources:
|
||||
# requests:
|
||||
# memory: 256Mi
|
||||
# cpu: 100m
|
||||
controller:
|
||||
## Configure extra options for liveness and readiness probes
|
||||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes)
|
||||
##
|
||||
livenessProbe:
|
||||
enabled: true
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 6
|
||||
successThreshold: 1
|
||||
readinessProbe:
|
||||
enabled: true
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 6
|
||||
successThreshold: 1
|
||||
# resources:
|
||||
# requests:
|
||||
# memory: 256Mi
|
||||
# cpu: 100m
|
||||
replicas: 1
|
||||
## These values are evaluated as a template (nodeSelector, tolerations and affinity)
|
||||
nodeSelector: {}
|
||||
tolerations: []
|
||||
affinity: {}
|
||||
## Additional deployment annotations
|
||||
podAnnotations: {}
|
||||
# Secret is used to secure the upload state from client
|
||||
# and registry storage backend.
|
||||
# See: https://github.com/docker/distribution/blob/master/docs/configuration.md#http
|
||||
# If a secret key is not specified, Helm will generate one.
|
||||
# Must be a string of 16 chars.
|
||||
secret: ""
|
||||
|
||||
# Enable Chartmuseum is not supported yet.
|
||||
chartmuseum:
|
||||
enabled: false
|
||||
|
||||
clair:
|
||||
enabled: true
|
||||
replicas: 1
|
||||
# The http(s) proxy used to update vulnerabilities database from internet
|
||||
httpProxy:
|
||||
httpsProxy:
|
||||
# The interval of clair updaters, the unit is hour, set to 0 to
|
||||
# disable the updaters
|
||||
updatersInterval: 12
|
||||
# resources:
|
||||
# requests:
|
||||
# memory: 256Mi
|
||||
# cpu: 100m
|
||||
nodeSelector: {}
|
||||
tolerations: []
|
||||
affinity: {}
|
||||
## Additional deployment annotations
|
||||
podAnnotations: {}
|
||||
## Configure extra options for liveness and readiness probes
|
||||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes)
|
||||
##
|
||||
livenessProbe:
|
||||
enabled: true
|
||||
initialDelaySeconds: 20
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 6
|
||||
successThreshold: 1
|
||||
readinessProbe:
|
||||
enabled: true
|
||||
initialDelaySeconds: 20
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 6
|
||||
successThreshold: 1
|
||||
|
||||
notary:
|
||||
enabled: true
|
||||
server:
|
||||
## Configure extra options for liveness and readiness probes
|
||||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes)
|
||||
##
|
||||
livenessProbe:
|
||||
enabled: true
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 6
|
||||
successThreshold: 1
|
||||
readinessProbe:
|
||||
enabled: true
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 6
|
||||
successThreshold: 1
|
||||
# resources:
|
||||
# requests:
|
||||
# memory: 256Mi
|
||||
# cpu: 100m
|
||||
signer:
|
||||
## Configure extra options for liveness and readiness probes
|
||||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes)
|
||||
##
|
||||
livenessProbe:
|
||||
enabled: true
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 6
|
||||
successThreshold: 1
|
||||
readinessProbe:
|
||||
enabled: true
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 6
|
||||
successThreshold: 1
|
||||
# resources:
|
||||
# requests:
|
||||
# memory: 256Mi
|
||||
# cpu: 100m
|
||||
replicas: 1
|
||||
|
||||
##
|
||||
## Redis chart configuration
|
||||
##
|
||||
## https://github.com/helm/charts/blob/master/stable/redis/values.yaml
|
||||
##
|
||||
redis:
|
||||
enabled: true
|
||||
# image:
|
||||
# tag:
|
||||
# password: ""
|
||||
usePassword: false
|
||||
cluster:
|
||||
enabled: false
|
||||
master:
|
||||
persistence:
|
||||
enabled: true
|
||||
slave:
|
||||
persistence:
|
||||
enabled: true
|
||||
|
||||
## If the Redis included in the chart is disabled, Harbor will use below
|
||||
## Redis parameters to connect to an external Redis server.
|
||||
##
|
||||
externalRedis:
|
||||
## All of these values are only used when redis.enabled is set to false
|
||||
## Redis host
|
||||
host: localhost
|
||||
## Redis port number
|
||||
port: 6379
|
||||
## Redis password
|
||||
password: ""
|
||||
# The "coreDatabaseIndex" must be "0" as the library Harbor
|
||||
# used doesn't support configuring it
|
||||
coreDatabaseIndex: "0"
|
||||
jobserviceDatabaseIndex: "1"
|
||||
registryDatabaseIndex: "2"
|
||||
chartmuseumDatabaseIndex: "3"
|
||||
|
||||
##
|
||||
## PostgreSQL chart configuration
|
||||
##
|
||||
## https://github.com/helm/charts/blob/master/stable/postgresql/values.yaml
|
||||
##
|
||||
postgresql:
|
||||
enabled: true
|
||||
# image:
|
||||
# tag:
|
||||
postgresqlUsername: postgres
|
||||
postgresqlPassword: not-secure-database-password
|
||||
replication:
|
||||
enabled: false
|
||||
persistence:
|
||||
enabled: true
|
||||
initdbScripts:
|
||||
initial-notaryserver.sql: |
|
||||
CREATE DATABASE notaryserver;
|
||||
CREATE USER server;
|
||||
alter user server with encrypted password 'password';
|
||||
GRANT ALL PRIVILEGES ON DATABASE notaryserver TO server;
|
||||
initial-notarysigner.sql: |
|
||||
CREATE DATABASE notarysigner;
|
||||
CREATE USER signer;
|
||||
alter user signer with encrypted password 'password';
|
||||
GRANT ALL PRIVILEGES ON DATABASE notarysigner TO signer;
|
||||
initial-registry.sql: |
|
||||
CREATE DATABASE registry ENCODING 'UTF8';
|
||||
\c registry;
|
||||
CREATE TABLE schema_migrations(version bigint not null primary key, dirty boolean not null);
|
||||
|
||||
## If the PostgreSQL database included in the chart is disabled, Harbor will
|
||||
## use below parameters to connect to an external PostgreSQL server.
|
||||
##
|
||||
externalDatabase:
|
||||
## All of these values are only used when postgresql.enabled is set to false
|
||||
## Database host
|
||||
host: localhost
|
||||
## non-root Username for portal Database
|
||||
user: bn_harbor
|
||||
## Database password
|
||||
password: ""
|
||||
## Database name
|
||||
database: bitnami_harbor
|
||||
## Database port number
|
||||
port: 5432
|
||||
## External database ssl mode
|
||||
##sslmode:
|
||||
## External database name for core
|
||||
##coreDatabase:
|
||||
## External database name for clair
|
||||
##clairDatabase:
|
||||
## External database name for notaryserver
|
||||
##notaryServerDatabase:
|
||||
## External database name for notaryserver
|
||||
##notarySignerDatabase:
|
||||
Reference in New Issue
Block a user