diff --git a/bitnami/harbor/.helmignore b/bitnami/harbor/.helmignore new file mode 100644 index 000000000..191381ee7 --- /dev/null +++ b/bitnami/harbor/.helmignore @@ -0,0 +1 @@ +.git \ No newline at end of file diff --git a/bitnami/harbor/Chart.yaml b/bitnami/harbor/Chart.yaml new file mode 100644 index 000000000..5ddd8a0fb --- /dev/null +++ b/bitnami/harbor/Chart.yaml @@ -0,0 +1,22 @@ +apiVersion: v1 +name: harbor +version: 0.0.3 +appVersion: 1.8.1 +description: Harbor is an an open source trusted cloud native registry project that stores, signs, and scans content +keywords: +- docker +- registry +- vulnerability +- scan +home: https://goharbor.io/ +sources: +- https://github.com/bitnami/bitnami-docker-harbor-core +- https://github.com/bitnami/bitnami-docker-harbor-portal +- https://github.com/bitnami/bitnami-docker-harbor-jobservice +- https://github.com/bitnami/bitnami-docker-harbor-registry +- https://github.com/bitnami/bitnami-docker-harbor-registryctl +maintainers: +- name: Bitnami + email: containers@bitnami.com +engine: gotpl +icon: https://bitnami.com/assets/stacks/harbor/img/harbor-stack-110x117.png diff --git a/bitnami/harbor/README.md b/bitnami/harbor/README.md new file mode 100644 index 000000000..df61dcd67 --- /dev/null +++ b/bitnami/harbor/README.md @@ -0,0 +1,348 @@ +# Helm Chart for Harbor + +This Helm chart has been developed based on [goharbor/harbor-helm](https://github.com/goharbor/harbor-helm) chart but including some features common to the Bitnami chart library. +For example, the following changes have been introduced: + +- Possibility to pull all the required images from a private registry through the Global Docker image parameters. +- Redis and PostgreSQL are managed as chart dependencies. +- Liveness and Readiness probes for all deployments are exposed to the values.yaml. +- Uses new Helm chart labels formating. +- Uses Bitnami container images: + - non-root by default + - published for debian-9, ol-7, and eventually centos-7 +- At this moment, this chart does not support the Harbor optional component Chartmuseum but it does support Clair and Notary integrations. + +## Introduction + +This [Helm](https://github.com/kubernetes/helm) chart installs [Harbor](https://github.com/goharbor/harbor) in a Kubernetes cluster. Welcome to [contribute](CONTRIBUTING.md) to Helm Chart for Harbor. + +## Prerequisites + +- Kubernetes cluster 1.10+ +- Helm 2.8.0+ + +## Installation + +### Download the chart + +Download Harbor helm chart + +```bash +git clone https://github.com/bitnami/charts +``` + +Change directory to Harbor code + +```bash +cd charts/bitnami/harbor +``` + +### Configure the chart + +The following items can be configured in `values.yaml` or set via `--set` flag during installation. + +#### Configure the way how to expose Harbor service: + +- **Ingress**: The ingress controller must be installed in the Kubernetes cluster. + **Notes:** if the TLS is disabled, the port must be included in the command when pulling/pushing images. Refer to issue [#5291](https://github.com/goharbor/harbor/issues/5291) for the detail. +- **ClusterIP**: Exposes the service on a cluster-internal IP. Choosing this value makes the service only reachable from within the cluster. +- **NodePort**: Exposes the service on each Node’s IP at a static port (the NodePort). You’ll be able to contact the NodePort service, from outside the cluster, by requesting `NodeIP:NodePort`. +- **LoadBalancer**: Exposes the service externally using a cloud provider’s load balancer. + +#### Configure the external URL + +The external URL for Harbor core service is used to: + +1. populate the docker/helm commands showed on portal +2. populate the token service URL returned to docker/notary client + +Format: `protocol://domain[:port]`. Usually: + +- if expose the service via `Ingress`, the `domain` should be the value of `service.ingress.hosts.core` +- if expose the service via `ClusterIP`, the `domain` should be the value of `service.clusterIP.name` +- if expose the service via `NodePort`, the `domain` should be the IP address of one Kubernetes node +- if expose the service via `LoadBalancer`, set the `domain` as your own domain name and add a CNAME record to map the domain name to the one you got from the cloud provider + +If Harbor is deployed behind the proxy, set it as the URL of proxy. + +#### Configure data persistence: + +- **Disable**: The data does not survive the termination of a pod. +- **Persistent Volume Claim(default)**: A default `StorageClass` is needed in the Kubernetes cluster to dynamically provision the volumes. Specify another StorageClass in the `storageClass` or set `existingClaim` if you have already existing persistent volumes to use. +- **External Storage(only for images and charts)**: For images and charts, the external storages are supported: `azure`, `gcs`, `s3` `swift` and `oss`. + +#### Configure the secrets + +- **Secret keys**: Secret keys are used for secure communication between components. Fill `core.secret`, `jobservice.secret` and `registry.secret` to configure. +- **Certificates**: Used for token encryption/decryption. Fill `core.secretName` to configure. + +Secrets and certificates must be setup to avoid changes on every Helm upgrade (see: [#107](https://github.com/goharbor/harbor-helm/issues/107)). + +#### Configure the other items listed in [configuration](#configuration) section. + +### Install the chart + +Install the Harbor helm chart with a release name `my-release`: + +```bash +helm install --name my-release --set service.tls.commonName=your.domain.com . +``` + +## Uninstallation + +To uninstall/delete the `my-release` deployment: + +```bash +helm delete --purge my-release +``` + +Additionaly, if `persistence.resourcePolicy` is set to `keep`, you should manually delete the PVCs. + +## Configuration + +The following table lists the configurable parameters of the Harbor chart and the default values. + +| Parameter | Description | Default | +| --------------------------------------------------------------------------- | ----------------------------------------------------------------------- | ------------------------------------------------------- | +| **Expose** | +| `service.type` | The way how to expose the service: `Ingress`, `ClusterIP`, `NodePort` or `LoadBalancer` | `ingress` | +| `service.tls.enabled` | Enable the tls or not | `true` | +| `service.ingress.controller` | The ingress controller type. Currently supports `default` and `gce` | `default` | +| `service.tls.secretName` | Fill the name of secret if you want to use your own TLS certificate and private key. The secret must contain two keys named `tls.crt` and `tls.key` that contain the certificate and private key to use for TLS. Will be generated automatically if not set | `nil` | +| `service.tls.notarySecretName` | By default, the Notary service will use the same cert and key as described above. Fill the name of secret if you want to use a separated one. Only needed when the `service.type` is `ingress`. | `nil` | +| `service.tls.commonName` | The common name used to generate the certificate, it's necessary when the `service.type` is `ClusterIP` or `NodePort` and `service.tls.secretName` is null | `nil` | +| `service.ingress.hosts.core` | The host of Harbor core service in ingress rule | `core.harbor.domain` | +| `service.ingress.hosts.notary` | The host of Harbor Notary service in ingress rule | `notary.harbor.domain` | +| `service.ingress.annotations` | The annotations used in ingress | `nil` | +| `service.clusterIP.name` | The name of ClusterIP service | `harbor` | +| `service.clusterIP.ports.httpPort` | The service port Harbor listens on when serving with HTTP | `80` | +| `service.clusterIP.ports.httpsPort` | The service port Harbor listens on when serving with HTTPS | `443` | +| `service.clusterIP.ports.notaryPort` | The service port Notary listens on. Only needed when `notary.enabled` is set to `true` | `4443` | +| `service.nodePort.name` | The name of NodePort service | `harbor` | +| `service.nodePort.ports.http.port` | The service port Harbor listens on when serving with HTTP | `80` | +| `service.nodePort.ports.http.nodePort` | The node port Harbor listens on when serving with HTTP | `30002` | +| `service.nodePort.ports.https.port` | The service port Harbor listens on when serving with HTTPS | `443` | +| `service.nodePort.ports.https.nodePort` | The node port Harbor listens on when serving with HTTPS | `30003` | +| `service.nodePort.ports.notary.port` | The service port Notary listens on. Only needed when `notary.enabled` is set to `true` | `4443` | +| `service.nodePort.ports.notary.nodePort` | The node port Notary listens on. Only needed when `notary.enabled` is set to `true` | `30004` | +| `service.loadBalancer.name` | The name of service | `harbor` | +| `service.loadBalancer.ports.httpPort` | The service port Harbor listens on when serving with HTTP | `80` | +| `service.loadBalancer.ports.httpsPort` | The service port Harbor listens on when serving with HTTP | `30002` | +| `service.loadBalancer.ports.notaryPort` | The service port Notary listens on. Only needed when `notary.enabled` is set to `true` | `nil` | +| **Persistence** | +| `persistence.enabled` | Enable the data persistence or not | `true` | +| `persistence.resourcePolicy` | Setting it to `keep` to avoid removing PVCs during a helm delete operation. Leaving it empty will delete PVCs after the chart deleted | `keep` | +| `persistence.persistentVolumeClaim.registry.existingClaim` | Use the existing PVC which must be created manually before bound, and specify the `subPath` if the PVC is shared with other components | `nil` | +| `persistence.persistentVolumeClaim.registry.storageClass` | Specify the `storageClass` used to provision the volume. Or the default StorageClass will be used(the default). Set it to `-` to disable dynamic provisioning | `nil` | +| `persistence.persistentVolumeClaim.registry.subPath` | The sub path used in the volume | `nil` | +| `persistence.persistentVolumeClaim.registry.accessMode` | The access mode of the volume | `ReadWriteOnce` | +| `persistence.persistentVolumeClaim.registry.size` | The size of the volume | `5Gi` | +| `persistence.persistentVolumeClaim.jobservice.existingClaim` | Use the existing PVC which must be created manually before bound, and specify the `subPath` if the PVC is shared with other components | `nil` | +| `persistence.persistentVolumeClaim.jobservice.storageClass` | Specify the `storageClass` used to provision the volume. Or the default StorageClass will be used(the default). Set it to `-` to disable dynamic provisioning | `nil` | +| `persistence.persistentVolumeClaim.jobservice.subPath` | The sub path used in the volume | `nil` | +| `persistence.persistentVolumeClaim.jobservice.accessMode` | The access mode of the volume | `ReadWriteOnce` | +| `persistence.persistentVolumeClaim.jobservice.size` | The size of the volume | `1Gi` | +| `persistence.imageChartStorage.disableredirect` | The configuration for managing redirects from content backends. For backends which do not supported it (such as using minio for `s3` storage type), please set it to `true` to disable redirects. Refer to the [guide](https://github.com/docker/distribution/blob/master/docs/configuration.md#redirect) for more information about the detail | `false` | +| `persistence.imageChartStorage.type` | The type of storage for images and charts: `filesystem`, `azure`, `gcs`, `s3`, `swift` or `oss`. The type must be `filesystem` if you want to use persistent volumes for registry and chartmuseum. Refer to the [guide](https://github.com/docker/distribution/blob/master/docs/configuration.md#storage) for more information about the detail | `filesystem` | +| **General** | +| `externalURL` | The external URL for Harbor core service | `https://core.harbor.domain` | +| `imagePullPolicy` | The image pull policy | `IfNotPresent` | +| `logLevel` | The log level | `debug` | +| `forcePassword` | Option to ensure all passwords and keys are set by the user | `false` | +| `harborAdminPassword` | The initial password of Harbor admin. Change it from portal after launching Harbor | `Harbor12345` | +| `secretkey` | The key used for encryption. Must be a string of 16 chars | `not-a-secure-key` | +| **Nginx** (if expose the service via `ingress`, the Nginx will not be used) | +| `nginx.image.repository` | Image repository | `goharbor/nginx-photon` | +| `nginx.image.tag` | Image tag | `dev` | +| `nginx.replicas` | The replica count | `1` | +| `nginx.resources` | The [resources] to allocate for container | undefined | +| `nginx.nodeSelector` | Node labels for pod assignment | `{}` (The value is evaluated as a template) | +| `nginx.tolerations` | Tolerations for pod assignment | `[]` (The value is evaluated as a template) | +| `nginx.affinity` | Node/Pod affinities | `{}` (The value is evaluated as a template) | +| `nginx.podAnnotations` | Annotations to add to the nginx pod | `{}` | +| **Portal** | +| `portalImage.registry` | Registry for portal image | `goharbor/harbor-portal` | +| `portalImage.repository` | Repository for portal image | `goharbor/harbor-portal` | +| `portalImage.tag` | Tag for portal image | `dev` | +| `portalImage.pullPolicy` | Harbor Portal image pull policy | `IfNotPresent` | +| `portalImage.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `portalImage.debug` | Specify if debug logs should be enabled | `false` | +| `portal.replicas` | The replica count | `1` | +| `portal.resources` | The [resources] to allocate for container | undefined | +| `portal.nodeSelector` | Node labels for pod assignment | `{}` (The value is evaluated as a template) | +| `portal.tolerations` | Tolerations for pod assignment | `[]` (The value is evaluated as a template) | +| `portal.affinity` | Node/Pod affinities | `{}` (The value is evaluated as a template) | +| `portal.podAnnotations` | Annotations to add to the portal pod | `{}` | +| `portal.livenessProbe` | Liveness probe configuration for Portal | `Check values.yaml file` | +| `portal.readinessProbe` | Readines probe configuration for Portal | `Check values.yaml file` | +| **Core** | +| `coreImage.registry` | Registry for core image | `goharbor/harbor-portal` | +| `coreImage.repository` | Repository for Harbor core image | `goharbor/harbor-core` | +| `coreImage.tag` | Tag for Harbor core image | `dev` | +| `coreImage.pullPolicy` | Harbor Core image pull policy | `IfNotPresent` | +| `coreImage.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `coreImage.debug` | Specify if debug logs should be enabled | `false` | +| `core.replicas` | The replica count | `1` | +| `core.resources` | The [resources] to allocate for container | undefined | +| `core.nodeSelector` | Node labels for pod assignment | `{}` (The value is evaluated as a template) | +| `core.tolerations` | Tolerations for pod assignment | `[]` (The value is evaluated as a template) | +| `core.affinity` | Node/Pod affinities | `{}` (The value is evaluated as a template) | +| `core.podAnnotations` | Annotations to add to the core pod | `{}` | +| `core.secret` | Secret used when the core server communicates with other components. If a secret key is not specified, Helm will generate one. Must be a string of 16 chars. | `nil` | +| `core.secretName` | Fill the name of a kubernetes secret if you want to use your own TLS certificate and private key for token encryption/decryption. The secret must contain two keys named: `tls.crt` - the certificate and `tls.key` - the private key. The default key pair will be used if it isn't set | `nil` | +| `core.livenessProbe` | Liveness probe configuration for Core | `Check values.yaml file` | +| `core.readinessProbe` | Readines probe configuration for Core | `Check values.yaml file` | +| **Jobservice** | +| `jobserviceImage.registry` | Registry for jobservice image | `goharbor/harbor-portal` | +| `jobserviceImage.repository` | Repository for jobservice image | `goharbor/harbor-jobservice` | +| `jobserviceImage.tag` | Tag for jobservice image | `dev` | +| `jobserviceImage.pullPolicy` | Harbor Jobservice image pull policy | `IfNotPresent` | +| `jobserviceImage.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `jobserviceImage.debug` | Specify if debug logs should be enabled | `false` | +| `jobservice.replicas` | The replica count | `1` | +| `jobservice.maxJobWorkers` | The max job workers | `10` | +| `jobservice.jobLogger` | The logger for jobs: `file`, `database` or `stdout` | `file` | +| `jobservice.resources` | The [resources] to allocate for container | undefined | +| `jobservice.nodeSelector` | Node labels for pod assignment | `{}` (The value is evaluated as a template) | +| `jobservice.tolerations` | Tolerations for pod assignment | `[]` (The value is evaluated as a template) | +| `jobservice.affinity` | Node/Pod affinities | `{}` (The value is evaluated as a template) | +| `jobservice.podAnnotations` | Annotations to add to the jobservice pod | `{}` | +| `jobservice.secret` | Secret used when the job service communicates with other components. If a secret key is not specified, Helm will generate one. Must be a string of 16 chars. | | +| `jobservice.livenessProbe` | Liveness probe configuration for Job Service | `Check values.yaml file` | +| `jobservice.readinessProbe` | Readines probe configuration for Job Service | `Check values.yaml file` | +| **Registry** | +| `registryImage.registry` | Registry for registry image | `goharbor/harbor-portal` | +| `registryImage.repository` | Repository for registry image | `goharbor/registry-photon` | +| `registryImage.tag` | Tag for registry image | `dev` | +| `registryImage.pullPolicy` | Harbor Registry image pull policy | `IfNotPresent` | +| `registryImage.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `registryImage.debug` | Specify if debug logs should be enabled | `false` | +| `registry.registry.resources` | The [resources] to allocate for container | undefined | +| `registry.registry.livenessProbe` | Liveness probe configuration for Registry | `Check values.yaml file` | +| `registry.registry.readinessProbe` | Readines probe configuration for Registry | `Check values.yaml file` | +| `registryctlImage.registry` | Registry for registryctl image | `goharbor/harbor-portal` | +| `registryctlImage.repository` | Repository for registryctl controller image | `goharbor/harbor-registryctl` | +| `registryctlImage.tag` | Tag for registrycrtl controller image | `dev` | +| `registryctlImage.pullPolicy` | Harbor Registryctl image pull policy | `IfNotPresent` | +| `registryctlImage.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `registryctlImage.debug` | Specify if debug logs should be enabled | `false` | +| `registry.controller.resources` | The [resources] to allocate for container | undefined | +| `registry.controller.livenessProbe` | Liveness probe configuration for Registryctl | `Check values.yaml file` | +| `registry.controller.readinessProbe` | Readines probe configuration for Registryctl | `Check values.yaml file` | +| `registry.replicas` | The replica count | `1` | +| `registry.nodeSelector` | Node labels for pod assignment | `{}` (The value is evaluated as a template) | +| `registry.tolerations` | Tolerations for pod assignment | `[]` (The value is evaluated as a template) | +| `registry.affinity` | Node/Pod affinities | `{}` (The value is evaluated as a template) | +| `registry.podAnnotations` | Annotations to add to the registry pod | `{}` | +| `registry.secret` | Secret is used to secure the upload state from client and registry storage backend. See: https://github.com/docker/distribution/blob/master/docs/configuration.md#http. If a secret key is not specified, Helm will generate one. Must be a string of 16 chars. | `nil` | +| **Clair** | +| `clairImage.registry` | Registry for clair image | `docker.io` | +| `clairImage.repository` | Repository for clair image | `bitnami/harbor-clair` | +| `clairImage.tag` | Tag for clair image | `{TAG_NAME}` | +| `clairImage.pullPolicy` | Harbor Jobservice image pull policy | `IfNotPresent` | +| `clairImage.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `clairImage.debug` | Specify if debug logs should be enabled | `false` | +| `clair.enabled` | Enable Clair | `true` | +| `clair.replicas` | The replica count | `1` | +| `clair.httpProxy` | The http proxy used to update vulnerabilities database from internet | undefined | +| `clair.httpsProxy` | The https proxy used to update vulnerabilities database from internet | undefined | +| `clair.updatersInterval` | The interval of clair updaters (hours), set to 0 to disable | `12` | +| `clair.resource` | The [resources] to allocate for container | undefined | +| `clair.nodeSelector` | Node labels for pod assignment | `{}` (The value is evaluated as a template) | +| `clair.tolerations` | Tolerations for pod assignment | `[]` (The value is evaluated as a template) | +| `clair.affinity` | Node/Pod affinities | `{}` (The value is evaluated as a template) | +| `clair.podAnnotations` | Annotations to add to the clair pod | `{}` | +| `clair.livenessProbe` | Liveness probe configuration | `Check values.yaml file` | +| `clair.readinessProbe` | Readiness probe configuration | `Check values.yaml file` | +| **PostgreSQL** | +| `database.type` | If external database is used, set it to `external` | `internal` | +| `database.internal.image.repository` | Repository for database image | `goharbor/harbor-db` | +| `database.internal.image.tag` | Tag for database image | `dev` | +| `database.internal.password` | The password for database | `changeit` | +| `database.internal.resources` | The [resources] to allocate for container | undefined | +| `database.internal.nodeSelector` | Node labels for pod assignment | `{}` | +| `database.internal.tolerations` | Tolerations for pod assignment | `[]` | +| `database.internal.affinity` | Node/Pod affinities | `{}` | +| `database.external.host` | The hostname of external database | `192.168.0.1` | +| `database.external.port` | The port of external database | `5432` | +| `database.external.username` | The username of external database | `user` | +| `database.external.password` | The password of external database | `password` | +| `database.external.coreDatabase` | The database used by core service | `registry` | +| `database.external.clairDatabase` | The database used by clair | `clair` | +| `database.external.notaryServerDatabase` | The database used by Notary server | `notary_server` | +| `database.external.notarySignerDatabase` | The database used by Notary signer | `notary_signer` | +| `database.external.sslmode` | Connection method of external database (require | prefer | +| `database.podAnnotations` | Annotations to add to the database pod | `{}` | +| **Redis** | +| `redis.type` | If external redis is used, set it to `external` | `internal` | +| `redis.internal.image.repository` | Repository for redis image | `goharbor/redis-photon` | +| `redis.internal.image.tag` | Tag for redis image | `dev` | +| `redis.internal.resources` | The [resources] to allocate for container | undefined | +| `redis.internal.nodeSelector` | Node labels for pod assignment | `{}` | +| `redis.internal.tolerations` | Tolerations for pod assignment | `[]` | +| `redis.internal.affinity` | Node/Pod affinities | `{}` | +| `redis.external.host` | The hostname of external Redis | `192.168.0.2` | +| `redis.external.port` | The port of external Redis | `6379` | +| `redis.external.coreDatabaseIndex` | The database index for core | `0` | +| `redis.external.jobserviceDatabaseIndex` | The database index for jobservice | `1` | +| `redis.external.registryDatabaseIndex` | The database index for registry | `2` | +| `redis.external.chartmuseumDatabaseIndex` | The database index for chartmuseum | `3` | +| `redis.external.password` | The password of external Redis | `nil` | +| `redis.podAnnotations` | Annotations to add to the redis pod | `{}` | + +[resources]: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/ + +Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example, + +```console +$ helm install --name my-release \ + --set harborAdminPassword=password \ + bitnami/harbor +``` + +The above command sets the Harbor administrator account password to `password`. + +Alternatively, a YAML file that specifies the values for the above parameters can be provided while installing the chart. For example, + +```console +$ helm install --name my-release -f values.yaml bitnami/harbor +``` +### Production configuration + +This chart includes a `values-production.yaml` file where you can find some parameters oriented to production configuration in comparison to the regular `values.yaml`: + +- The way how to expose the service: `Ingress`, `ClusterIP`, `NodePort` or `LoadBalancer`: +```diff +- service.type: ClusterIP ++ service.type: Ingress +``` + +- The common name used to generate the certificate. It's necessary when the `service.type` is `ClusterIP` or `NodePort` and `service.tls.secretName` is null: +```diff +- service.tls.commonName: "core.harbor.domain" ++ service.tls.commonName: "" +``` + +- Option to ensure all passwords and keys are set by the user: +```diff +- forcePassword: false ++ forcePassword: true +``` + +- Option to deploy Redis cluster: +```diff +- redis.cluster.enabled: false ++ redis.cluster.enabled: true +``` + +- Option to deploy PostgreSQL replication cluster: +```diff +- postgresql.replication.enabled: false ++ postgresql.replication.enabled: true +``` + +### [Rolling VS Immutable tags](https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/) + +It is strongly recommended to use immutable tags in a production environment. This ensures your deployment does not change automatically if the same tag is updated with a different image. + +Bitnami will release a new chart updating its containers if a new version of the main container, significant changes, or critical vulnerabilities exist. \ No newline at end of file diff --git a/bitnami/harbor/cert/tls.crt b/bitnami/harbor/cert/tls.crt new file mode 100644 index 000000000..718fe9dc4 --- /dev/null +++ b/bitnami/harbor/cert/tls.crt @@ -0,0 +1,32 @@ +-----BEGIN CERTIFICATE----- +MIIFkzCCA3ugAwIBAgIJALr+LVOEsw+sMA0GCSqGSIb3DQEBCwUAMGAxCzAJBgNV +BAYTAkVTMRAwDgYDVQQIDAdTZXZpbGxlMRAwDgYDVQQHDAdTZXZpbGxlMRAwDgYD +VQQKDAdCaXRuYW1pMRswGQYDVQQDDBJoYXJib3IuYml0bmFtaS5jb20wHhcNMTkw +NTIwMTAwMTUzWhcNMjAwNTE5MTAwMTUzWjBgMQswCQYDVQQGEwJFUzEQMA4GA1UE +CAwHU2V2aWxsZTEQMA4GA1UEBwwHU2V2aWxsZTEQMA4GA1UECgwHQml0bmFtaTEb +MBkGA1UEAwwSaGFyYm9yLmJpdG5hbWkuY29tMIICIjANBgkqhkiG9w0BAQEFAAOC +Ag8AMIICCgKCAgEAqoG8fsnwCpf+mWY7ojxTCqasNVuDQv84klj1GkM7dJFNVp0J +W5uZIZR+vuDq4VIuvqeeucO9F1xMaFhGqfVibuewED2oWI4Y2Km3+T9a0r6tFKaj +aIyp57OHXysXchOJ8zytdlandii8zPAa/lH0bjOGGybNNMZ9EksDnNXM9YLP95DH +jsHRuoIt5iQoIJXqhao/DEwaBcdxWKO+wSEFneO0NIiiytvThu4l6h8DNVDXxsP0 +sj7dvVeqY10c1DD3JK+Z50rNYl5B95WHfTkmNsHJlb8v1st9t98y34+MkDMGQJKO +XeQPLwCDKImL7nwy+cjUiHlwEY39lEAc7AUl4QFwjS38R1Z9K5NKwQbAMuLiUeIm +y8VFo14c/AlLE9qHZLq38bFheJoByi8oY46e6CWJTMTsfrlgVWGSCUoOmpC3Ff+l +uCU+ptfkFHz2lQuVMj+U7vRkgKgrqtomJIPsqoKw1wKQpoX9kjnUCptg4Gm8sN/R +L9IeBIBxdWXle/glfMOR/WnkUgajsj7mXggt3r9nITh6ZRMYSR5uvcD3eul+bmXE +n1qf9WWCQJGg6+Dzbul8U00/sstiakoOHDLst8HaZy1NfNRPm7YNVguyqr6oX4CO +onM4m6yboF+jPLCufXU6EavT3E4KAS4RhTsowjc0r/pCSfNdc7EOD1bnpt0CAwEA +AaNQME4wHQYDVR0OBBYEFIQgwAN9VXy/1W0NXl7EDL8FE3gHMB8GA1UdIwQYMBaA +FIQgwAN9VXy/1W0NXl7EDL8FE3gHMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEL +BQADggIBADJi2GhrFMH2hAcJWbYFbJsnFRnC9PHG24hRiM62bBCcuzEerr7D3NRE +9qXav+KiZmVN/OcqwuHdUmp5tv8v8lLA13Z/X2VaHmsVkB+02JAScpjonE0L8UAp +4+Brq/tC15s+l6g6pHB9J9XP0IwnsPBDoVdAzIk/uztDERfjCAyoM4WqrjXIXp4u +yTWDoDQaHpQSdfZAJcv7t82JJe1J9vbe+tFmDgMcfIoeCqCt1fkYf/usFFM6mLa+ +gtHnIAIGLvGjDR/RtSlbvGcRrqvoyK3Xx4WoYzNOfC6e6nESlkTPjJ6PyRqqGhbL +FG+V6EPYDz/E63VGtxNaZ+MQcjHjk4q7c8pAL1FE19JpoeaEAHLKBRHAqJbKsOZh +WSmvCX23uNOrymagh7N6pGyBC5YJctroaXl+rPOdNjBnimZw9BlxlZLvQLTTiL4z +lSWPuzRdxblSLGEGPfY6wI9jeGJ6w/xOODAHNmPKLienH9TVUppoL/TcJDSo1L2T +q2+DPbrYJJ5sGmRuEqjopDdLOCstanOAzdGrI/vEQdKD/ZzkRKjKDY/kD2nXgsTO +fwaPvxjhMTRmSPRX10A6zC22Qu3OREDW48EL/E72IwnQPwHU3FGUrUd9ndaXa0vE +UqZiWtD+/SImPWMwPhqVqt/zwpmCZBXNwkv5fgHQco/eGjDXkixl +-----END CERTIFICATE----- diff --git a/bitnami/harbor/cert/tls.key b/bitnami/harbor/cert/tls.key new file mode 100644 index 000000000..c44b4e1bc --- /dev/null +++ b/bitnami/harbor/cert/tls.key @@ -0,0 +1,51 @@ +-----BEGIN RSA PRIVATE KEY----- +MIIJKAIBAAKCAgEAqoG8fsnwCpf+mWY7ojxTCqasNVuDQv84klj1GkM7dJFNVp0J +W5uZIZR+vuDq4VIuvqeeucO9F1xMaFhGqfVibuewED2oWI4Y2Km3+T9a0r6tFKaj +aIyp57OHXysXchOJ8zytdlandii8zPAa/lH0bjOGGybNNMZ9EksDnNXM9YLP95DH +jsHRuoIt5iQoIJXqhao/DEwaBcdxWKO+wSEFneO0NIiiytvThu4l6h8DNVDXxsP0 +sj7dvVeqY10c1DD3JK+Z50rNYl5B95WHfTkmNsHJlb8v1st9t98y34+MkDMGQJKO +XeQPLwCDKImL7nwy+cjUiHlwEY39lEAc7AUl4QFwjS38R1Z9K5NKwQbAMuLiUeIm +y8VFo14c/AlLE9qHZLq38bFheJoByi8oY46e6CWJTMTsfrlgVWGSCUoOmpC3Ff+l +uCU+ptfkFHz2lQuVMj+U7vRkgKgrqtomJIPsqoKw1wKQpoX9kjnUCptg4Gm8sN/R +L9IeBIBxdWXle/glfMOR/WnkUgajsj7mXggt3r9nITh6ZRMYSR5uvcD3eul+bmXE +n1qf9WWCQJGg6+Dzbul8U00/sstiakoOHDLst8HaZy1NfNRPm7YNVguyqr6oX4CO +onM4m6yboF+jPLCufXU6EavT3E4KAS4RhTsowjc0r/pCSfNdc7EOD1bnpt0CAwEA +AQKCAgAU/jY8Ehbo5v/k2S58chrzU8QeKa9Gn2/SrPs4iZCXcJBqGpmdWtIGzWax +j7W7mkfBF5g2XQA6ERYjPsMsh9bfusz1ovHIPW6XtoW9PWysR+e9hCrYY4FD0tnX +ANI5LGiutwjQaijiJm/gd6uLJoIG03cufp+DYPDjQLMoKza5/6olXAEF9Z0h7odC +L691G6AtZuGuXOxTS9QLytVgp/UuFGwKj8wjV996XHX0lm7psJNwmI3XKGBawKFs +7HjxMzoqnShAzvfspZhPqGxvIYsv8LomIsz8ED/hVKzJ073Fv1KEvsaijsLD0bdU +VWMSMN6B3JU2XGVM9AOFrkMhWBzqnKfR3qnmthY95Dmg5c5OJOAniY6CzVr/LZze +Fy7Yp6dho+GFd2iOo0LboiUVs+qPoLRGiaDisViCW74mDj+uavsx0FNalWOJ3oZb +QQfcC2EERcIJFeIUxnykpyvsq9mR6nlJA5m0UXL+yTp+ixGSkMx7hGxk7W4iI+TE +7SYkdpMprDtNd46CCpEjL4cp3wKqO83DHZbRiIBW4Lnmv8/Fk139xfaVKU1a8Oz6 +eIv7SAjJiCVpjiz7W2XvFIM6GIdivqJ5teDHUKVgbgHVVXWze9FLfUnWe6xXxk7P +7wAjhPA8KMX0/SkNO9sCo8O0bVLgmhQTZPedBn4/iVjj+63PQQKCAQEA2pmvKjDn +MdOqKw7cusWGB0LtdxzgYt8EVXFqcdwQIk8j2bjk9TfgGseAmAfwvl+pmz249KHa +995FjOSMIgABAA71lVCVPgS+9Y85egmyq6jUqmdlrrZPiAm4DO9Qz6xIFJTfLE1k +Wj8eeoO6EqMih7mQ0kk+x4hBSE/PEbqjMYDONq7wukp4nV/2xyLRTAkz8dzYQ4Eq +5UHAeH6WURRM4NcR/xsZx1Wg0YeMPcyFw/z+9gS4vp9Y6Gajx/9PrAhfJcipM/q8 +D6ZAfiH+lmm2oB3xd2QKG7BY7ZIxx/d4RzkloAUi9khmtsmfI95/5O65nY54BvIW +FCBV4H8zLnxHsQKCAQEAx62jVmKqqzcRty8yhSzmTwB+WQRCw1TOSWwX+5iEi2Ol +UPQX12ooSV9QwqoM8Km7gH6uTuXl9iK7x5cg0fXEyX2u6eYg8cFmoP/uWitRwiVr +rSc6RrC9p7/guTVPIHZj410OHMyi3jHde/MkOe3h2Uky3pxMe3cpBz52hQ41zn3X +RkPK9BE3chxN5UWtuY5vZXI1Daijb91XyZsEY3dEJIXy2U9Z/Ks/J2Ht7QWcpnZn +SrdqOB+OknPocOpz9GVmeTHu8r2JrYLWju+1hHsVQcOXSxVYfgWY7RW78oBRPijh +JO5xq/5sVGV0kz8J/+vcuVqpwGRpnPQlF8UqQAfI7QKCAQEAh3PNT2ZoC77tZara +6Tx1tVAqVrFk9L7eL5eMbqr+sFO7kjB4Zt5Nlipiq1HYQg6CyPfxAFy+kvJ+xDPm +BTddZ0zdrbz2DSzhqsUpx031EVsXE9Pn9N9w3omvKwyrVVOagm5Q72GxOh58Y0v2 +Y5AEWHeKnlLWfMsYMJeLZp/weT8oCEhUUArPPCz3fCM971CQiGDg/Msv6kjY25EM +0YazsGpz81A2pAaSFONZ6f0uMeg1j/oTA8M3UyIugEHae23gj0gMWHIYT9YjhkTI +PSmaCRMkyWcKwGeAYw1AnXjhZbiqcMJeDJ+GTeMXIiG/u/qUt2VNSHh/Z881h1sq +Ora1sQKCAQBIwfRqXbliecZywTffXuTslHl1ZiANnLEt/70daA2j3MM4JDkrvPrB +AYIj7GKarr4rq/1Hsm2AqldR+rdyyeLSqIE7qScH8Di9IYRwRqib3ZbGmSya5Xu1 +zCzOT6ZtZbYv+pBR3h7aZ8EUkRv6H7vTuOBYTQtxUZIZmaEGCo+AlkoCyGEDXeKe +KcIYcLNEkan1hQ/f0jr7X+PFCj8nHyYtSMGcfVWEw8FXUE+ptgnGfg5VI1AI8za4 +FpPz0Po/a1NTheZTfMzV9H7Jxn6Vr2OneuV97mE4SkHW4byCOE9iHvMqydeRnDtM +5Ur8/FNgdUkQIQEJoYz6K9v4NVeXzT5hAoIBAAoLtyr4GfN4N8y3WFx0qVWIeKro +znTJ3D9nGbGSKZDFTPNb8nPfY9KNJ5GHaLrVZLgCvuNkRmhy8DE5y06+DglcA/DE +tTx3u3oovj4uAumN+gqGBKD6VCG5jcuHveqIbDfsl1ZYySkk40+cfElyCtoML5JZ +GKTYSZ/Qy4CxmKWQcbHA12oEp/YbOsW0jLSnMVDF5T62FV6RGZ/adbaPz6/boKCY +tLtq93PxmhUd1eZzjodycEO32NpVy7OCXZXhrvAZezfJyt71qXzQHYUlLCPUkf/e +C7IwGaDMIq4gB+1UP7zlxWUIENqTVTDg7U6+BvXoKw2e7wyN1sYl9/zQroI= +-----END RSA PRIVATE KEY----- diff --git a/bitnami/harbor/requirements.lock b/bitnami/harbor/requirements.lock new file mode 100644 index 000000000..c5f582600 --- /dev/null +++ b/bitnami/harbor/requirements.lock @@ -0,0 +1,9 @@ +dependencies: +- name: postgresql + repository: https://charts.bitnami.com/bitnami + version: 4.2.2 +- name: redis + repository: https://charts.bitnami.com/bitnami + version: 7.1.1 +digest: sha256:df803216464c2e9422e4a97214aad873cc91214543ab8eb399da8005db862a95 +generated: 2019-05-28T18:02:33.507059362+02:00 diff --git a/bitnami/harbor/requirements.yaml b/bitnami/harbor/requirements.yaml new file mode 100644 index 000000000..33999c441 --- /dev/null +++ b/bitnami/harbor/requirements.yaml @@ -0,0 +1,9 @@ +dependencies: +- name: postgresql + version: 4.x.x + repository: https://charts.bitnami.com/bitnami + condition: postgresql.enabled +- name: redis + version: 7.x.x + repository: https://charts.bitnami.com/bitnami + condition: redis.enabled diff --git a/bitnami/harbor/templates/NOTES.txt b/bitnami/harbor/templates/NOTES.txt new file mode 100644 index 000000000..513b74355 --- /dev/null +++ b/bitnami/harbor/templates/NOTES.txt @@ -0,0 +1,46 @@ +** Please be patient while the chart is being deployed ** + +1. Get the Harbor URL: + +{{- if contains "Ingress" .Values.service.type }} + + You should be able to access your new Harbor installation through {{ .Values.externalURL }} + +{{- else if contains "LoadBalancer" .Values.service.type }} + + NOTE: It may take a few minutes for the LoadBalancer IP to be available. + Watch the status with: 'kubectl get svc --namespace {{ .Release.Namespace }} -w {{ .Values.service.loadBalancer.name }}' + +{{- $port:=.Values.service.loadBalancer.ports.httpPort | toString }} + export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ .Values.service.loadBalancer.name }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}") + echo "Harbor URL: http://$SERVICE_IP{{- if ne $port "80" }}:{{ .Values.loadBalancer.ports.httpPort }}{{ end }}/" + +{{- else if contains "ClusterIP" .Values.service.type }} + + {{- if .Values.service.tls.enabled }} + + echo "Harbor URL: https://127.0.0.1:8443/" + kubectl port-forward --namespace {{ .Release.Namespace }} svc/{{ .Values.service.clusterIP.name }} 8443:{{ .Values.service.clusterIP.ports.httpsPort }} + + {{- else }} + + echo "Harbor URL: http://127.0.0.1:8080/" + kubectl port-forward --namespace {{ .Release.Namespace }} svc/{{ .Values.service.clusterIP.name }} 8080:{{ .Values.service.clusterIP.ports.httpPort }} + + {{- end }} + +{{- else if contains "NodePort" .Values.service.type }} + + export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ .Values.service.nodePort.name }}) + export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}") + echo "Harbor URL: http://$NODE_IP:$NODE_PORT/" + +{{- end }} + +2. Login with the following credentials to see your Harbor application + + echo Username: "admin" + echo Password: $(kubectl get secret --namespace {{ .Release.Namespace }} {{ template "harbor.core" . }}-envvars -o jsonpath="{.data.HARBOR_ADMIN_PASSWORD}" | base64 --decode) + +{{ include "harbor.validateValues" . }} +{{ include "harbor.checkRollingTags" . }} \ No newline at end of file diff --git a/bitnami/harbor/templates/_helpers.tpl b/bitnami/harbor/templates/_helpers.tpl new file mode 100644 index 000000000..b4fa2b583 --- /dev/null +++ b/bitnami/harbor/templates/_helpers.tpl @@ -0,0 +1,638 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Expand the name of the chart. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +*/}} +{{- define "harbor.name" -}} +{{- default "harbor" .Values.nameOverride | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "harbor.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +*/}} +{{- define "harbor.fullname" -}} +{{- $name := default "harbor" .Values.nameOverride -}} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* Helm required labels */}} +{{- define "harbor.labels" -}} +app.kubernetes.io/name: {{ template "harbor.name" . }} +helm.sh/chart: {{ template "harbor.chart" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end -}} + +{{/* matchLabels */}} +{{- define "harbor.matchLabels" -}} +app.kubernetes.io/instance: {{ .Release.Name }} +app.kubernetes.io/name: {{ template "harbor.name" . }} +{{- end -}} + +{{- define "harbor.autoGenCert" -}} + {{- if and .Values.service.tls.enabled (not .Values.service.tls.secretName) -}} + {{- printf "true" -}} + {{- else -}} + {{- printf "false" -}} + {{- end -}} +{{- end -}} + +{{- define "harbor.autoGenCertForIngress" -}} + {{- if and (eq (include "harbor.autoGenCert" .) "true") (eq .Values.service.type "Ingress") -}} + {{- printf "true" -}} + {{- else -}} + {{- printf "false" -}} + {{- end -}} +{{- end -}} + +{{- define "harbor.autoGenCertForNginx" -}} + {{- if and (eq (include "harbor.autoGenCert" .) "true") (ne .Values.service.type "Ingress") -}} + {{- printf "true" -}} + {{- else -}} + {{- printf "false" -}} + {{- end -}} +{{- end -}} + +Create a default fully qualified postgresql name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +*/}} +{{- define "harbor.postgresql.fullname" -}} +{{- $name := default "postgresql" .Values.postgresql.nameOverride -}} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{- define "harbor.database.host" -}} + {{- if eq .Values.postgresql.enabled true -}} + {{- template "harbor.postgresql.fullname" . }} + {{- else -}} + {{- .Values.externalDatabase.host -}} + {{- end -}} +{{- end -}} + +{{- define "harbor.database.port" -}} + {{- if eq .Values.postgresql.enabled true -}} + {{- printf "%s" "5432" -}} + {{- else -}} + {{- .Values.externalDatabase.port -}} + {{- end -}} +{{- end -}} + +{{- define "harbor.database.username" -}} + {{- if eq .Values.postgresql.enabled true -}} + {{- printf "%s" "postgres" -}} + {{- else -}} + {{- .Values.externalDatabase.user -}} + {{- end -}} +{{- end -}} + +{{- define "harbor.database.rawPassword" -}} + {{- if eq .Values.postgresql.enabled true -}} + {{- .Values.postgresql.postgresqlPassword -}} + {{- else -}} + {{- .Values.externalDatabase.password -}} + {{- end -}} +{{- end -}} + +{{- define "harbor.database.escapedRawPassword" -}} + {{- include "harbor.database.rawPassword" . | urlquery | replace "+" "%20" -}} +{{- end -}} + +{{- define "harbor.database.encryptedPassword" -}} + {{- include "harbor.database.rawPassword" . | b64enc | quote -}} +{{- end -}} + +{{- define "harbor.database.coreDatabase" -}} + {{- if eq .Values.postgresql.enabled true -}} + {{- printf "%s" "registry" -}} + {{- else -}} + {{- .Values.externalDatabase.coreDatabase -}} + {{- end -}} +{{- end -}} + +{{- define "harbor.database.clairDatabase" -}} + {{- if eq .Values.postgresql.enabled true -}} + {{- printf "%s" "postgres" -}} + {{- else -}} + {{- .Values.externalDatabase.clairDatabase -}} + {{- end -}} +{{- end -}} + +{{- define "harbor.database.notaryServerDatabase" -}} + {{- if eq .Values.postgresql.enabled true -}} + {{- printf "%s" "notaryserver" -}} + {{- else -}} + {{- .Values.externalDatabase.notaryServerDatabase -}} + {{- end -}} +{{- end -}} + +{{- define "harbor.database.notarySignerDatabase" -}} + {{- if eq .Values.postgresql.enabled true -}} + {{- printf "%s" "notarysigner" -}} + {{- else -}} + {{- .Values.database.external.notarySignerDatabase -}} + {{- end -}} +{{- end -}} + +{{- define "harbor.database.sslmode" -}} + {{- if eq .Values.postgresql.enabled true -}} + {{- printf "%s" "disable" -}} + {{- else -}} + {{- .Values.database.external.sslmode -}} + {{- end -}} +{{- end -}} + +{{- define "harbor.database.clair" -}} +postgres://{{ template "harbor.database.username" . }}:{{ template "harbor.database.escapedRawPassword" . }}@{{ template "harbor.database.host" . }}:{{ template "harbor.database.port" . }}/{{ template "harbor.database.clairDatabase" . }}?sslmode={{ template "harbor.database.sslmode" . }} +{{- end -}} + +{{- define "harbor.database.notaryServer" -}} +postgres://{{ template "harbor.database.username" . }}:{{ template "harbor.database.escapedRawPassword" . }}@{{ template "harbor.database.host" . }}:{{ template "harbor.database.port" . }}/{{ template "harbor.database.notaryServerDatabase" . }}?sslmode={{ template "harbor.database.sslmode" . }} +{{- end -}} + +{{- define "harbor.database.notarySigner" -}} +postgres://{{ template "harbor.database.username" . }}:{{ template "harbor.database.escapedRawPassword" . }}@{{ template "harbor.database.host" . }}:{{ template "harbor.database.port" . }}/{{ template "harbor.database.notarySignerDatabase" . }}?sslmode={{ template "harbor.database.sslmode" . }} +{{- end -}} + +Create a default fully qualified redis name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +*/}} +{{- define "harbor.redis.fullname" -}} +{{- $name := default "redis" .Values.redis.nameOverride -}} +{{- printf "%s-%s-master" .Release.Name $name | trunc 63 | trimSuffix "-" -}} +{{- end -}} + + +{{- define "harbor.redis.host" -}} + {{- if eq .Values.redis.enabled true -}} + {{- template "harbor.redis.fullname" . -}} + {{- else -}} + {{- .Values.externalRedis.host -}} + {{- end -}} +{{- end -}} + +{{- define "harbor.redis.port" -}} + {{- if eq .Values.redis.enabled true -}} + {{- printf "%s" "6379" -}} + {{- else -}} + {{- .Values.externalRedis.port -}} + {{- end -}} +{{- end -}} + +{{- define "harbor.redis.coreDatabaseIndex" -}} + {{- if eq .Values.redis.enabled true -}} + {{- printf "%s" "0" }} + {{- else -}} + {{- .Values.externalRedis.coreDatabaseIndex -}} + {{- end -}} +{{- end -}} + +{{- define "harbor.redis.jobserviceDatabaseIndex" -}} + {{- if eq .Values.redis.enabled true -}} + {{- printf "%s" "1" }} + {{- else -}} + {{- .Values.externalRedis.jobserviceDatabaseIndex -}} + {{- end -}} +{{- end -}} + +{{- define "harbor.redis.registryDatabaseIndex" -}} + {{- if eq .Values.redis.enabled true -}} + {{- printf "%s" "2" }} + {{- else -}} + {{- .Values.externalRedis.registryDatabaseIndex -}} + {{- end -}} +{{- end -}} + +{{- define "harbor.redis.chartmuseumDatabaseIndex" -}} + {{- if eq .Values.redis.enabled true -}} + {{- printf "%s" "3" }} + {{- else -}} + {{- .Values.externalRedis.chartmuseumDatabaseIndex -}} + {{- end -}} +{{- end -}} + +{{- define "harbor.redis.rawPassword" -}} + {{- if and (eq .Values.redis.enabled false) .Values.externalRedis.password -}} + {{- .Values.externalRedis.password -}} + {{- end -}} +{{- end -}} + +{{- define "harbor.redis.escapedRawPassword" -}} + {{- if (include "harbor.redis.rawPassword" . ) -}} + {{- include "harbor.redis.rawPassword" . | urlquery | replace "+" "%20" -}} + {{- end -}} +{{- end -}} + +{{/*the username redis is used for a placeholder as no username needed in redis*/}} +{{- define "harbor.redisForJobservice" -}} + {{- if (include "harbor.redis.escapedRawPassword" . ) -}} + {{- printf "redis://redis:%s@%s:%s/%s" (include "harbor.redis.escapedRawPassword" . ) (include "harbor.redis.host" . ) (include "harbor.redis.port" . ) (include "harbor.redis.jobserviceDatabaseIndex" . ) }} + {{- else }} + {{- template "harbor.redis.host" . }}:{{ template "harbor.redis.port" . }}/{{ template "harbor.redis.jobserviceDatabaseIndex" . }} + {{- end -}} +{{- end -}} + +{{/*the username redis is used for a placeholder as no username needed in redis*/}} +{{- define "harbor.redisForGC" -}} + {{- if (include "harbor.redis.escapedRawPassword" . ) -}} + {{- printf "redis://redis:%s@%s:%s/%s" (include "harbor.redis.escapedRawPassword" . ) (include "harbor.redis.host" . ) (include "harbor.redis.port" . ) (include "harbor.redis.registryDatabaseIndex" . ) }} + {{- else }} + {{- printf "redis://%s:%s/%s" (include "harbor.redis.host" . ) (include "harbor.redis.port" . ) (include "harbor.redis.registryDatabaseIndex" . ) -}} + {{- end -}} +{{- end -}} + +{{/* +host:port,pool_size,password +100 is the default value of pool size +*/}} +{{- define "harbor.redisForCore" -}} + {{- template "harbor.redis.host" . }}:{{ template "harbor.redis.port" . }},100,{{ template "harbor.redis.rawPassword" . }} +{{- end -}} + +{{- define "harbor.portal" -}} + {{- printf "%s-portal" (include "harbor.fullname" .) -}} +{{- end -}} + +{{- define "harbor.core" -}} + {{- printf "%s-core" (include "harbor.fullname" .) -}} +{{- end -}} + +{{- define "harbor.redis" -}} + {{- printf "%s-redis" (include "harbor.fullname" .) -}} +{{- end -}} + +{{- define "harbor.jobservice" -}} + {{- printf "%s-jobservice" (include "harbor.fullname" .) -}} +{{- end -}} + +{{- define "harbor.registry" -}} + {{- printf "%s-registry" (include "harbor.fullname" .) -}} +{{- end -}} + +{{- define "harbor.chartmuseum" -}} + {{- printf "%s-chartmuseum" (include "harbor.fullname" .) -}} +{{- end -}} + +{{- define "harbor.database" -}} + {{- printf "%s-database" (include "harbor.fullname" .) -}} +{{- end -}} + +{{- define "harbor.clair" -}} + {{- printf "%s-clair" (include "harbor.fullname" .) -}} +{{- end -}} + +{{- define "harbor.notary-server" -}} + {{- printf "%s-notary-server" (include "harbor.fullname" .) -}} +{{- end -}} + +{{- define "harbor.notary-signer" -}} + {{- printf "%s-notary-signer" (include "harbor.fullname" .) -}} +{{- end -}} + +{{- define "harbor.nginx" -}} + {{- printf "%s-nginx" (include "harbor.fullname" .) -}} +{{- end -}} + +{{- define "harbor.ingress" -}} + {{- printf "%s-ingress" (include "harbor.fullname" .) -}} +{{- end -}} + +Create a default fully qualified nginx name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +*/}} +{{- define "harbor.nginx.fullname" -}} +{{- $name := default "nginx" .Values.nginx.nameOverride -}} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Return the proper Harbor Core image name +*/}} +{{- define "harbor.coreImage" -}} +{{- $registryName := .Values.coreImage.registry -}} +{{- $repositoryName := .Values.coreImage.repository -}} +{{- $tag := .Values.coreImage.tag | toString -}} +{{/* +Helm 2.11 supports the assignment of a value to a variable defined in a different scope, +but Helm 2.9 and 2.10 doesn't support it, so we need to implement this if-else logic. +Also, we can't use a single if because lazy evaluation is not an option +*/}} +{{- if .Values.global }} + {{- if .Values.global.imageRegistry }} + {{- printf "%s/%s:%s" .Values.global.imageRegistry $repositoryName $tag -}} + {{- else -}} + {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} + {{- end -}} +{{- else -}} + {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} +{{- end -}} +{{- end -}} + +{{/* +Return the proper Harbor Portal image name +*/}} +{{- define "harbor.portalImage" -}} +{{- $registryName := .Values.portalImage.registry -}} +{{- $repositoryName := .Values.portalImage.repository -}} +{{- $tag := .Values.portalImage.tag | toString -}} +{{/* +Helm 2.11 supports the assignment of a value to a variable defined in a different scope, +but Helm 2.9 and 2.10 doesn't support it, so we need to implement this if-else logic. +Also, we can't use a single if because lazy evaluation is not an option +*/}} +{{- if .Values.global }} + {{- if .Values.global.imageRegistry }} + {{- printf "%s/%s:%s" .Values.global.imageRegistry $repositoryName $tag -}} + {{- else -}} + {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} + {{- end -}} +{{- else -}} + {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} +{{- end -}} +{{- end -}} + +{{/* +Return the proper Harbor Job Service image name +*/}} +{{- define "harbor.jobserviceImage" -}} +{{- $registryName := .Values.jobserviceImage.registry -}} +{{- $repositoryName := .Values.jobserviceImage.repository -}} +{{- $tag := .Values.jobserviceImage.tag | toString -}} +{{/* +Helm 2.11 supports the assignment of a value to a variable defined in a different scope, +but Helm 2.9 and 2.10 doesn't support it, so we need to implement this if-else logic. +Also, we can't use a single if because lazy evaluation is not an option +*/}} +{{- if .Values.global }} + {{- if .Values.global.imageRegistry }} + {{- printf "%s/%s:%s" .Values.global.imageRegistry $repositoryName $tag -}} + {{- else -}} + {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} + {{- end -}} +{{- else -}} + {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} +{{- end -}} +{{- end -}} + +{{/* +Return the proper Harbor Notary Server image name +*/}} +{{- define "harbor.notaryServerImage" -}} +{{- $registryName := .Values.notaryServerImage.registry -}} +{{- $repositoryName := .Values.notaryServerImage.repository -}} +{{- $tag := .Values.notaryServerImage.tag | toString -}} +{{/* +Helm 2.11 supports the assignment of a value to a variable defined in a different scope, +but Helm 2.9 and 2.10 doesn't support it, so we need to implement this if-else logic. +Also, we can't use a single if because lazy evaluation is not an option +*/}} +{{- if .Values.global }} + {{- if .Values.global.imageRegistry }} + {{- printf "%s/%s:%s" .Values.global.imageRegistry $repositoryName $tag -}} + {{- else -}} + {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} + {{- end -}} +{{- else -}} + {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} +{{- end -}} +{{- end -}} + +{{/* +Return the proper Harbor Notary Signer image name +*/}} +{{- define "harbor.notarySignerImage" -}} +{{- $registryName := .Values.notarySignerImage.registry -}} +{{- $repositoryName := .Values.notarySignerImage.repository -}} +{{- $tag := .Values.notarySignerImage.tag | toString -}} +{{/* +Helm 2.11 supports the assignment of a value to a variable defined in a different scope, +but Helm 2.9 and 2.10 doesn't support it, so we need to implement this if-else logic. +Also, we can't use a single if because lazy evaluation is not an option +*/}} +{{- if .Values.global }} + {{- if .Values.global.imageRegistry }} + {{- printf "%s/%s:%s" .Values.global.imageRegistry $repositoryName $tag -}} + {{- else -}} + {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} + {{- end -}} +{{- else -}} + {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} +{{- end -}} +{{- end -}} + +{{/* +Return the proper Harbor Registry image name +*/}} +{{- define "harbor.registryImage" -}} +{{- $registryName := .Values.registryImage.registry -}} +{{- $repositoryName := .Values.registryImage.repository -}} +{{- $tag := .Values.registryImage.tag | toString -}} +{{/* +Helm 2.11 supports the assignment of a value to a variable defined in a different scope, +but Helm 2.9 and 2.10 doesn't support it, so we need to implement this if-else logic. +Also, we can't use a single if because lazy evaluation is not an option +*/}} +{{- if .Values.global }} + {{- if .Values.global.imageRegistry }} + {{- printf "%s/%s:%s" .Values.global.imageRegistry $repositoryName $tag -}} + {{- else -}} + {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} + {{- end -}} +{{- else -}} + {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} +{{- end -}} +{{- end -}} + +{{/* +Return the proper Harbor Registryctl image name +*/}} +{{- define "harbor.registryctlImage" -}} +{{- $registryName := .Values.registryctlImage.registry -}} +{{- $repositoryName := .Values.registryctlImage.repository -}} +{{- $tag := .Values.registryctlImage.tag | toString -}} +{{/* +Helm 2.11 supports the assignment of a value to a variable defined in a different scope, +but Helm 2.9 and 2.10 doesn't support it, so we need to implement this if-else logic. +Also, we can't use a single if because lazy evaluation is not an option +*/}} +{{- if .Values.global }} + {{- if .Values.global.imageRegistry }} + {{- printf "%s/%s:%s" .Values.global.imageRegistry $repositoryName $tag -}} + {{- else -}} + {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} + {{- end -}} +{{- else -}} + {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} +{{- end -}} +{{- end -}} + +{{/* +Return the proper Harbor Clair image name +*/}} +{{- define "harbor.clairImage" -}} +{{- $registryName := .Values.clairImage.registry -}} +{{- $repositoryName := .Values.clairImage.repository -}} +{{- $tag := .Values.clairImage.tag | toString -}} +{{/* +Helm 2.11 supports the assignment of a value to a variable defined in a different scope, +but Helm 2.9 and 2.10 doesn't support it, so we need to implement this if-else logic. +Also, we can't use a single if because lazy evaluation is not an option +*/}} +{{- if .Values.global }} + {{- if .Values.global.imageRegistry }} + {{- printf "%s/%s:%s" .Values.global.imageRegistry $repositoryName $tag -}} + {{- else -}} + {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} + {{- end -}} +{{- else -}} + {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} +{{- end -}} +{{- end -}} + +{{/* +Return the proper Nginx image name +*/}} +{{- define "harbor.nginxImage" -}} +{{- $registryName := .Values.nginxImage.registry -}} +{{- $repositoryName := .Values.nginxImage.repository -}} +{{- $tag := .Values.nginxImage.tag | toString -}} +{{/* +Helm 2.11 supports the assignment of a value to a variable defined in a different scope, +but Helm 2.9 and 2.10 doesn't support it, so we need to implement this if-else logic. +Also, we can't use a single if because lazy evaluation is not an option +*/}} +{{- if .Values.global }} + {{- if .Values.global.imageRegistry }} + {{- printf "%s/%s:%s" .Values.global.imageRegistry $repositoryName $tag -}} + {{- else -}} + {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} + {{- end -}} +{{- else -}} + {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} +{{- end -}} +{{- end -}} + +{{/* +Return the proper Docker Image Registry Secret Names +*/}} +{{- define "harbor.imagePullSecrets" -}} +{{/* +Helm 2.11 supports the assignment of a value to a variable defined in a different scope, +but Helm 2.9 and 2.10 does not support it, so we need to implement this if-else logic. +Also, we can not use a single if because lazy evaluation is not an option +*/}} +{{- if .Values.global }} +{{- if .Values.global.imagePullSecrets }} +imagePullSecrets: +{{- range .Values.global.imagePullSecrets }} + - name: {{ . }} +{{- end }} +{{- else if or .Values.harbor.coreImage.pullSecrets .Values.portalImage.pullSecrets .Values.jobserviceImage.pullSecrets .Values.registryImage.pullSecrets .Values.registryctlImage.pullSecrets .Values.nginxImage.pullSecrets}} +imagePullSecrets: +{{- range .Values.harbor.coreImage.pullSecrets }} + - name: {{ . }} +{{- end }} +{{- range .Values.portalImage.pullSecrets }} + - name: {{ . }} +{{- end }} +{{- range .Values.jobserviceImage.pullSecrets }} + - name: {{ . }} +{{- end }} +{{- range .Values.registryImage.pullSecrets }} + - name: {{ . }} +{{- end }} +{{- range .Values.registryctlImage.pullSecrets }} + - name: {{ . }} +{{- end }} +{{- range .Values.nginxImage.pullSecrets }} + - name: {{ . }} +{{- end }} +{{- end -}} +{{- else if or .Values.harbor.coreImage.pullSecrets .Values.portalImage.pullSecrets .Values.jobserviceImage.pullSecrets .Values.registryImage.pullSecrets .Values.registryctlImage.pullSecrets .Values.nginxImage.pullSecrets}} +imagePullSecrets: +{{- range .Values.harbor.coreImage.pullSecrets }} + - name: {{ . }} +{{- end }} +{{- range .Values.portalImage.pullSecrets }} + - name: {{ . }} +{{- end }} +{{- range .Values.jobserviceImage.pullSecrets }} + - name: {{ . }} +{{- end }} +{{- range .Values.registryImage.pullSecrets }} + - name: {{ . }} +{{- end }} +{{- range .Values.registryctlImage.pullSecrets }} + - name: {{ . }} +{{- end }} +{{- range .Values.nginxImage.pullSecrets }} + - name: {{ . }} +{{- end }} +{{- end -}} +{{- end -}} + +{{/* Check if there are rolling tags in the images */}} +{{- define "harbor.checkRollingTags" -}} +{{- if and (contains "bitnami/" .Values.coreImage.repository) (not (.Values.coreImage.tag | toString | regexFind "-r\\d+$|sha256:")) }} +WARNING: Rolling tag detected ({{ .Values.coreImage.repository }}:{{ .Values.coreImage.tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment. ++info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/ +{{- end }} +{{- if and (contains "bitnami/" .Values.portalImage.repository) (not (.Values.portalImage.tag | toString | regexFind "-r\\d+$|sha256:")) }} +WARNING: Rolling tag detected ({{ .Values.portalImage.repository }}:{{ .Values.portalImage.tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment. ++info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/ +{{- end }} +{{- if and (contains "bitnami/" .Values.jobserviceImage.repository) (not (.Values.jobserviceImage.tag | toString | regexFind "-r\\d+$|sha256:")) }} +WARNING: Rolling tag detected ({{ .Values.jobserviceImage.repository }}:{{ .Values.jobserviceImage.tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment. ++info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/ +{{- end }} +{{- if and (contains "bitnami/" .Values.registryImage.repository) (not (.Values.registryImage.tag | toString | regexFind "-r\\d+$|sha256:")) }} +WARNING: Rolling tag detected ({{ .Values.registryImage.repository }}:{{ .Values.registryImage.tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment. ++info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/ +{{- end }} +{{- if and (contains "bitnami/" .Values.registryctlImage.repository) (not (.Values.registryctlImage.tag | toString | regexFind "-r\\d+$|sha256:")) }} +WARNING: Rolling tag detected ({{ .Values.registryctlImage.repository }}:{{ .Values.registryctlImage.tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment. ++info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/ +{{- end }} +{{- if and (contains "bitnami/" .Values.nginxImage.repository) (not (.Values.nginxImage.tag | toString | regexFind "-r\\d+$|sha256:")) }} +WARNING: Rolling tag detected ({{ .Values.nginxImage.repository }}:{{ .Values.nginxImage.tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment. ++info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/ +{{- end }} +{{- end -}} + +{{/* +Compile all warnings into a single message, and call fail. +*/}} +{{- define "harbor.validateValues" -}} +{{- $messages := list -}} +{{- $messages := append $messages (include "harbor.validateValues.postgresqlPassword" .) -}} +{{- $messages := without $messages "" -}} +{{- $message := join "\n" $messages -}} + +{{- if $message -}} +{{- printf "\nVALUES VALIDATION:\n%s" $message | fail -}} +{{- end -}} +{{- end -}} + +{{/* Validate values of Harbor - must provide a password for PostgreSQL */}} +{{- define "harbor.validateValues.postgresqlPassword" -}} +{{- if eq .Values.postgresql.enabled true -}} + {{- if not .Values.postgresql.postgresqlPassword -}} +harbor: PostgreSQL password + A database password is required!. + Please set a passsord (--set postgresql.postgresqlPassword="xxxx") + {{- end -}} +{{- else -}} + {{- if not .Values.externalDatabase.password -}} +harbor: External PostgreSQL password + An external database password is required!. + Please set a passsord (--set externalDatabase.password="xxxx") + {{- end -}} +{{- end -}} +{{- end -}} diff --git a/bitnami/harbor/templates/clair/clair-cm.yaml b/bitnami/harbor/templates/clair/clair-cm.yaml new file mode 100644 index 000000000..125b591ed --- /dev/null +++ b/bitnami/harbor/templates/clair/clair-cm.yaml @@ -0,0 +1,35 @@ +{{ if .Values.clair.enabled }} +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ template "harbor.clair" . }} + labels: + {{ include "harbor.labels" . | nindent 4 }} + app.kubernetes.io/component: clair +data: + config.yaml: | + clair: + database: + type: pgsql + options: + source: "{{ template "harbor.database.clair" . }}" + # Number of elements kept in the cache + # Values unlikely to change (e.g. namespaces) are cached in order to save prevent needless roundtrips to the database. + cachesize: 16384 + + api: + # API server port + port: 6060 + healthport: 6061 + + # Deadline before an API request will respond with a 503 + timeout: 300s + updater: + interval: {{ .Values.clair.updatersInterval }}h + + notifier: + attempts: 3 + renotifyinterval: 2h + http: + endpoint: "http://{{ template "harbor.core" . }}/service/notifications/clair" +{{ end }} diff --git a/bitnami/harbor/templates/clair/clair-dpl.yaml b/bitnami/harbor/templates/clair/clair-dpl.yaml new file mode 100644 index 000000000..6eaa67570 --- /dev/null +++ b/bitnami/harbor/templates/clair/clair-dpl.yaml @@ -0,0 +1,89 @@ +{{ if .Values.clair.enabled }} +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ template "harbor.clair" . }} + labels: + {{ include "harbor.labels" . | nindent 4 }} + app.kubernetes.io/component: clair +spec: + replicas: {{ .Values.clair.replicas }} + selector: + matchLabels: + {{ include "harbor.matchLabels" . | nindent 6 }} + app.kubernetes.io/component: clair + template: + metadata: + labels: + {{ include "harbor.labels" . | nindent 8 }} + app.kubernetes.io/component: clair + annotations: + checksum/configmap: {{ include (print $.Template.BasePath "/clair/clair-cm.yaml") . | sha256sum }} + {{- if .Values.clair.podAnnotations }} + {{ toYaml .Values.clair.podAnnotations | nindent 8 }} + {{- end }} + spec: + {{- with .Values.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + containers: + - name: clair + image: "{{ template "harbor.clairImage" . }}" + imagePullPolicy: {{ .Values.clairImage.pullPolicy | quote }} + {{- if .Values.clair.livenessProbe.enabled }} + livenessProbe: + httpGet: + path: /health + port: 6061 + initialDelaySeconds: 30 + periodSeconds: 10 + {{- end }} + {{- if .Values.clair.readinessProbe.enabled }} + readinessProbe: + httpGet: + path: /health + port: 6061 + initialDelaySeconds: 30 + periodSeconds: 10 + {{- end }} + env: + - name: BITNAMI_DEBUG + value: {{ ternary "true" "false" .Values.registryImage.debug | quote }} + {{- if .Values.clair.httpProxy }} + - name: HTTP_PROXY + value: {{ .Values.clair.httpProxy }} + {{- end }} + {{- if .Values.clair.httpsProxy }} + - name: HTTPS_PROXY + value: {{ .Values.clair.httpsProxy }} + {{- end }} + - name: NO_PROXY + value: "{{ template "harbor.registry" . }},{{ template "harbor.core" . }}" + {{- if .Values.clair.resources }} + resources: + {{ toYaml .Values.clair.resources | nindent 10 }} + {{- end }} + ports: + - containerPort: 6060 + volumeMounts: + - name: clair-config + mountPath: /etc/clair/config.yaml + subPath: config.yaml + volumes: + - name: clair-config + configMap: + name: "{{ template "harbor.clair" . }}" + items: + - key: config.yaml + path: config.yaml + {{- with .Values.clair.nodeSelector }} + nodeSelector: {{ toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.clair.affinity }} + affinity: {{ toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.clair.tolerations }} + tolerations: {{ tpl (toYaml .) $ | nindent 8 }} + {{- end }} +{{ end }} diff --git a/bitnami/harbor/templates/clair/clair-svc.yaml b/bitnami/harbor/templates/clair/clair-svc.yaml new file mode 100644 index 000000000..508f7c793 --- /dev/null +++ b/bitnami/harbor/templates/clair/clair-svc.yaml @@ -0,0 +1,18 @@ +{{ if .Values.clair.enabled }} +apiVersion: v1 +kind: Service +metadata: + name: {{ template "harbor.clair" . }} + labels: + {{ include "harbor.labels" . | nindent 4 }} + app.kubernetes.io/component: clair +spec: + ports: + - name: clair + port: 6060 + - name: health + port: 6061 + selector: + {{ include "harbor.matchLabels" . | nindent 4 }} + app.kubernetes.io/component: clair +{{ end }} diff --git a/bitnami/harbor/templates/core/core-cm-envvars.yaml b/bitnami/harbor/templates/core/core-cm-envvars.yaml new file mode 100644 index 000000000..61cb19878 --- /dev/null +++ b/bitnami/harbor/templates/core/core-cm-envvars.yaml @@ -0,0 +1,43 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ template "harbor.core" . }}-envvars + labels: {{ include "harbor.labels" . | nindent 4 }} +data: + DATABASE_TYPE: "postgresql" + POSTGRESQL_HOST: "{{ template "harbor.postgresql.fullname" . }}" + POSTGRESQL_PORT: "{{ .Values.postgresql.service.port }}" + POSTGRESQL_USERNAME: "{{ .Values.postgresql.postgresqlUsername }}" + POSTGRESQL_DATABASE: "registry" + POSTGRESQL_SSLMODE: "{{ template "harbor.database.sslmode" . }}" + EXT_ENDPOINT: "{{ .Values.externalURL }}" + CORE_URL: "http://{{ template "harbor.core" . }}" + JOBSERVICE_URL: "http://{{ template "harbor.fullname" . }}-jobservice" + REGISTRY_URL: "http://{{ template "harbor.registry" . }}:5000" + TOKEN_SERVICE_URL: "http://{{ template "harbor.core" . }}/service/token" + WITH_NOTARY: "{{ .Values.notary.enabled }}" + NOTARY_URL: "http://{{ template "harbor.notary-server" . }}:4443" + CFG_EXPIRATION: "5" + ADMIRAL_URL: "NA" + WITH_CLAIR: "{{ .Values.clair.enabled }}" + CLAIR_DB_HOST: "{{ template "harbor.postgresql.fullname" . }}" + CLAIR_DB_PORT: "{{ .Values.postgresql.service.port }}" + CLAIR_DB_USERNAME: "{{ .Values.postgresql.postgresqlUsername }}" + CLAIR_DB: "{{ template "harbor.database.clairDatabase" . }}" + CLAIR_DB_SSLMODE: "{{ template "harbor.database.sslmode" . }}" + CLAIR_URL: "http://{{ template "harbor.fullname" . }}-clair:6060" + REGISTRY_STORAGE_PROVIDER_NAME: "{{ .Values.persistence.imageChartStorage.type }}" + WITH_CHARTMUSEUM: "{{ .Values.chartmuseum.enabled }}" + CHART_REPOSITORY_URL: "http://{{ template "harbor.chartmuseum" . }}" + LOG_LEVEL: "{{ .Values.logLevel }}" + CONFIG_PATH: "/etc/core/app.conf" + SYNC_REGISTRY: "false" + CHART_CACHE_DRIVER: "redis" + _REDIS_URL: "{{ template "harbor.redisForCore" . }}" + _REDIS_URL_REG: "{{ template "harbor.redisForGC" . }}" + PORTAL_URL: "http://{{ template "harbor.portal" . }}" + REGISTRYCTL_URL: "http://{{ template "harbor.registry" . }}:8080" + CLAIR_HEALTH_CHECK_SERVER_URL: "http://{{ template "harbor.clair" . }}:6061" + {{- if .Values.uaaSecretName }} + UAA_CA_ROOT: "/etc/core/ca/auth-ca.crt" + {{- end }} diff --git a/bitnami/harbor/templates/core/core-cm.yaml b/bitnami/harbor/templates/core/core-cm.yaml new file mode 100644 index 000000000..337882112 --- /dev/null +++ b/bitnami/harbor/templates/core/core-cm.yaml @@ -0,0 +1,13 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ template "harbor.core" . }} + labels: {{ include "harbor.labels" . | nindent 4 }} +data: + app.conf: |+ + appname = Harbor + runmode = dev + enablegzip = true + + [dev] + httpport = 8080 \ No newline at end of file diff --git a/bitnami/harbor/templates/core/core-dpl.yaml b/bitnami/harbor/templates/core/core-dpl.yaml new file mode 100644 index 000000000..b613c40a4 --- /dev/null +++ b/bitnami/harbor/templates/core/core-dpl.yaml @@ -0,0 +1,157 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ template "harbor.core" . }} + labels: + {{- include "harbor.labels" . | nindent 4 }} + app.kubernetes.io/component: core +spec: + replicas: {{ .Values.core.replicas }} + selector: + matchLabels: {{ include "harbor.matchLabels" . | nindent 6 }} + app.kubernetes.io/component: core + template: + metadata: + labels: + {{ include "harbor.matchLabels" . | nindent 8 }} + app.kubernetes.io/component: core + annotations: + checksum/configmap: {{ include (print $.Template.BasePath "/core/core-cm.yaml") . | sha256sum }} + checksum/configmap-envvars: {{ include (print $.Template.BasePath "/core/core-cm-envvars.yaml") . | sha256sum }} + checksum/secret: {{ include (print $.Template.BasePath "/core/core-secret.yaml") . | sha256sum }} + checksum/secret-envvars: {{ include (print $.Template.BasePath "/core/core-secret-envvars.yaml") . | sha256sum }} + checksum/secret-jobservice: {{ include (print $.Template.BasePath "/jobservice/jobservice-secrets.yaml") . | sha256sum }} + {{- if .Values.core.podAnnotations }} + {{- toYaml .Values.core.podAnnotations | nindent 8 }} + {{- end }} + spec: + {{- if .Values.securityContext.enabled }} + securityContext: + fsGroup: {{ .Values.securityContext.fsGroup }} + runAsUser: {{ .Values.securityContext.runAsUser }} + {{- end }} + containers: + - name: core + image: "{{ template "harbor.coreImage" . }}" + imagePullPolicy: {{ .Values.coreImage.pullPolicy | quote }} + {{- if .Values.core.livenessProbe.enabled }} + livenessProbe: + httpGet: + path: /api/ping + port: http + initialDelaySeconds: {{ .Values.core.livenessProbe.initialDelaySeconds }} + periodSeconds: {{ .Values.core.livenessProbe.periodSeconds }} + timeoutSeconds: {{ .Values.core.livenessProbe.timeoutSeconds }} + successThreshold: {{ .Values.core.livenessProbe.successThreshold }} + failureThreshold: {{ .Values.core.livenessProbe.failureThreshold }} + {{- end }} + {{- if .Values.core.readinessProbe.enabled }} + readinessProbe: + httpGet: + path: /api/ping + port: http + initialDelaySeconds: {{ .Values.core.readinessProbe.initialDelaySeconds }} + periodSeconds: {{ .Values.core.readinessProbe.periodSeconds }} + timeoutSeconds: {{ .Values.core.readinessProbe.timeoutSeconds }} + successThreshold: {{ .Values.core.readinessProbe.successThreshold }} + failureThreshold: {{ .Values.core.readinessProbe.failureThreshold }} + {{- end }} + envFrom: + - configMapRef: + name: "{{ template "harbor.core" . }}-envvars" + - secretRef: + name: "{{ template "harbor.core" . }}-envvars" + env: + - name: BITNAMI_DEBUG + value: {{ ternary "true" "false" .Values.coreImage.debug | quote }} + - name: CORE_SECRET + valueFrom: + secretKeyRef: + name: {{ template "harbor.core" . }} + key: secret + - name: JOBSERVICE_SECRET + valueFrom: + secretKeyRef: + name: "{{ template "harbor.jobservice" . }}" + key: secret + ports: + - containerPort: 8080 + name: http + volumeMounts: + - name: config + mountPath: /etc/core/app.conf + subPath: app.conf + - name: secret-key + mountPath: /etc/core/key + subPath: key + - name: token-service-private-key + mountPath: /etc/core/private_key.pem + subPath: tls.key + {{- if .Values.service.tls.enabled }} + - name: ca-download + mountPath: /etc/core/ca/ca.crt + subPath: ca.crt + {{- end }} + {{- if .Values.uaaSecretName }} + - name: auth-ca-cert + mountPath: /etc/core/ca/auth-ca.crt + subPath: auth-ca.crt + {{- end }} + - name: psc + mountPath: /etc/core/token + {{- if .Values.core.resources }} + resources: {{ toYaml .Values.core.resources | nindent 10 }} + {{- end }} + volumes: + - name: config + configMap: + name: {{ template "harbor.core" . }} + items: + - key: app.conf + path: app.conf + - name: secret-key + secret: + secretName: {{ template "harbor.core" . }} + items: + - key: secretKey + path: key + - name: token-service-private-key + secret: + {{- if .Values.core.secretName }} + secretName: {{ .Values.core.secretName }} + {{- else }} + secretName: {{ template "harbor.core" . }} + {{- end }} + {{- if .Values.service.tls.enabled }} + - name: ca-download + secret: + {{- if eq (include "harbor.autoGenCertForIngress" .) "true" }} + secretName: "{{ template "harbor.ingress" . }}" + {{- else if eq (include "harbor.autoGenCertForNginx" .) "true" }} + secretName: {{ template "harbor.nginx" . }} + {{- else }} + secretName: {{ .Values.service.tls.secretName }} + {{- end }} + items: + - key: ca.crt + path: ca.crt + {{- end }} + {{- if .Values.uaaSecretName }} + - name: auth-ca-cert + secret: + secretName: {{ .Values.uaaSecretName }} + items: + - key: ca.crt + path: auth-ca.crt + {{- end }} + - name: psc + emptyDir: {} + {{- with .Values.core.nodeSelector }} + nodeSelector: {{ tpl (toYaml .) $ | nindent 8 }} + {{- end }} + {{- with .Values.core.affinity }} + affinity: {{ tpl (toYaml .) $ | nindent 8 }} + {{- end }} + {{- with .Values.core.tolerations }} + tolerations: {{ tpl (toYaml .) $ | nindent 8 }} + {{- end }} diff --git a/bitnami/harbor/templates/core/core-secret-envvars.yaml b/bitnami/harbor/templates/core/core-secret-envvars.yaml new file mode 100644 index 000000000..6c8b6cc4c --- /dev/null +++ b/bitnami/harbor/templates/core/core-secret-envvars.yaml @@ -0,0 +1,18 @@ +apiVersion: v1 +kind: Secret +metadata: + name: {{ template "harbor.core" . }}-envvars + labels: {{ include "harbor.labels" . | nindent 4 }} +type: Opaque +data: + {{- if .Values.harborAdminPassword }} + HARBOR_ADMIN_PASSWORD: {{ .Values.harborAdminPassword | b64enc | quote }} + {{- else if (not .Values.forcePassword) }} + HARBOR_ADMIN_PASSWORD: "{{ randAlphaNum 10 | b64enc }}" + {{ else }} + HARBOR_ADMIN_PASSWORD: {{ required "A Harbor Admin Password is required!" .Values.harborAdminPassword }} + {{- end }} + POSTGRESQL_PASSWORD: {{ template "harbor.database.encryptedPassword" . }} + {{- if .Values.clair.enabled }} + CLAIR_DB_PASSWORD: {{ template "harbor.database.encryptedPassword" . }} + {{- end }} \ No newline at end of file diff --git a/bitnami/harbor/templates/core/core-secret.yaml b/bitnami/harbor/templates/core/core-secret.yaml new file mode 100644 index 000000000..410ed2ff0 --- /dev/null +++ b/bitnami/harbor/templates/core/core-secret.yaml @@ -0,0 +1,27 @@ +apiVersion: v1 +kind: Secret +metadata: + name: {{ template "harbor.core" . }} + labels: {{ include "harbor.labels" . | nindent 4 }} +type: Opaque +data: + {{- if .Values.secretKey }} + secretKey: {{ .Values.secretKey | b64enc | quote }} + {{- else if (not .Values.forcePassword) }} + secretKey: "{{ randAlphaNum 16 | b64enc }}" + {{ else }} + secretKey: {{ required "A secret key is required!" .Values.secretKey }} + {{- end }} + + {{- if .Values.core.secret }} + secret: {{ .Values.core.secret | b64enc | quote }} + {{- else if (not .Values.forcePassword) }} + secret: "{{ randAlphaNum 16 | b64enc }}" + {{ else }} + secret: {{ required "A secret is required!" .Values.core.secret }} + {{- end }} + + {{- if not .Values.core.secretName }} + tls.crt: {{ .Files.Get "cert/tls.crt" | b64enc }} + tls.key: {{ .Files.Get "cert/tls.key" | b64enc }} + {{- end }} \ No newline at end of file diff --git a/bitnami/harbor/templates/core/core-svc.yaml b/bitnami/harbor/templates/core/core-svc.yaml new file mode 100644 index 000000000..57d208706 --- /dev/null +++ b/bitnami/harbor/templates/core/core-svc.yaml @@ -0,0 +1,15 @@ +apiVersion: v1 +kind: Service +metadata: + name: {{ template "harbor.core" . }} + labels: {{ include "harbor.labels" . | nindent 4 }} +spec: + {{- if (eq .Values.service.ingress.controller "gce") }} + type: NodePort + {{- end }} + ports: + - port: 80 + targetPort: http + selector: + {{- include "harbor.matchLabels" . | nindent 4 }} + app.kubernetes.io/component: core diff --git a/bitnami/harbor/templates/ingress/ingress.yaml b/bitnami/harbor/templates/ingress/ingress.yaml new file mode 100644 index 000000000..0b1fa0edd --- /dev/null +++ b/bitnami/harbor/templates/ingress/ingress.yaml @@ -0,0 +1,122 @@ +{{- if eq .Values.service.type "Ingress" }} +{{- $ingress := .Values.service.ingress -}} +{{- $tls := .Values.service.tls -}} +apiVersion: extensions/v1beta1 +kind: Ingress +metadata: + name: "{{ template "harbor.ingress" . }}" + labels: {{ include "harbor.labels" . | nindent 4 }} + annotations: + {{ toYaml $ingress.annotations | nindent 4 }} +spec: + {{- if $tls.enabled }} + tls: + {{- if $tls.secretName }} + - secretName: "{{ $tls.secretName }}" + {{- else }} + - secretName: "{{ template "harbor.ingress" . }}" + {{- end }} + {{- if $ingress.hosts.core }} + hosts: + - {{ $ingress.hosts.core }} + {{- end }} + {{- if .Values.notary.enabled }} + {{- if $tls.notarySecretName }} + - secretName: "{{ $tls.notarySecretName }}" + {{- else if $tls.secretName }} + - secretName: "{{ $tls.secretName }}" + {{- else }} + - secretName: "{{ template "harbor.ingress" . }}" + {{- end }} + {{- if $ingress.hosts.notary }} + hosts: + - {{ $ingress.hosts.notary }} + {{- end }} + {{- end }} + {{- end }} +{{- if eq .Values.service.ingress.controller "gce" }} + rules: + - http: + paths: + - path: /* + backend: + serviceName: {{ template "harbor.portal" . }} + servicePort: 80 + - path: /api/* + backend: + serviceName: {{ template "harbor.core" . }} + servicePort: 80 + - path: /service/* + backend: + serviceName: {{ template "harbor.core" . }} + servicePort: 80 + - path: /v2/* + backend: + serviceName: {{ template "harbor.core" . }} + servicePort: 80 + - path: /chartrepo/* + backend: + serviceName: {{ template "harbor.core" . }} + servicePort: 80 + - path: /c/* + backend: + serviceName: {{ template "harbor.core" . }} + servicePort: 80 + {{- if $ingress.hosts.core }} + host: {{ $ingress.hosts.core }} + {{- end }} + {{- if .Values.notary.enabled }} + - http: + paths: + - path: / + backend: + serviceName: {{ template "harbor.notary-server" . }} + servicePort: 4443 + {{- if $ingress.hosts.notary }} + host: {{ $ingress.hosts.notary }} + {{- end }} + {{- end }} +{{- else }} + rules: + - http: + paths: + - path: / + backend: + serviceName: {{ template "harbor.portal" . }} + servicePort: 80 + - path: /api/ + backend: + serviceName: {{ template "harbor.core" . }} + servicePort: 80 + - path: /service/ + backend: + serviceName: {{ template "harbor.core" . }} + servicePort: 80 + - path: /v2/ + backend: + serviceName: {{ template "harbor.core" . }} + servicePort: 80 + - path: /chartrepo/ + backend: + serviceName: {{ template "harbor.core" . }} + servicePort: 80 + - path: /c/ + backend: + serviceName: {{ template "harbor.core" . }} + servicePort: 80 + {{- if $ingress.hosts.core }} + host: {{ $ingress.hosts.core }} + {{- end }} + {{- if .Values.notary.enabled }} + - http: + paths: + - path: / + backend: + serviceName: {{ template "harbor.notary-server" . }} + servicePort: 4443 + {{- if $ingress.hosts.notary }} + host: {{ $ingress.hosts.notary }} + {{- end }} + {{- end }} +{{- end }} +{{- end }} \ No newline at end of file diff --git a/bitnami/harbor/templates/ingress/secret.yaml b/bitnami/harbor/templates/ingress/secret.yaml new file mode 100644 index 000000000..e2ddac49b --- /dev/null +++ b/bitnami/harbor/templates/ingress/secret.yaml @@ -0,0 +1,14 @@ +{{- if eq (include "harbor.autoGenCertForIngress" .) "true" }} +{{- $ca := genCA "harbor-ca" 365 }} +{{- $cert := genSignedCert .Values.service.ingress.hosts.core nil (list .Values.service.ingress.hosts.core .Values.service.ingress.hosts.notary) 365 $ca }} +apiVersion: v1 +kind: Secret +metadata: + name: "{{ template "harbor.ingress" . }}" + labels: {{ include "harbor.labels" . | nindent 4 }} +type: kubernetes.io/tls +data: + tls.crt: {{ $cert.Cert | b64enc | quote }} + tls.key: {{ $cert.Key | b64enc | quote }} + ca.crt: {{ $ca.Cert | b64enc | quote }} +{{- end }} \ No newline at end of file diff --git a/bitnami/harbor/templates/jobservice/jobservice-cm.yaml b/bitnami/harbor/templates/jobservice/jobservice-cm.yaml new file mode 100644 index 000000000..35be36d87 --- /dev/null +++ b/bitnami/harbor/templates/jobservice/jobservice-cm.yaml @@ -0,0 +1,38 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: "{{ template "harbor.jobservice" . }}" + labels: {{ include "harbor.labels" . | nindent 4 }} +data: + config.yml: |+ + protocol: "http" + port: 8080 + worker_pool: + workers: {{ .Values.jobservice.maxJobWorkers }} + backend: "redis" + redis_pool: + redis_url: "{{ template "harbor.redisForJobservice" . }}" + namespace: "harbor_job_service_namespace" + job_loggers: + {{- if eq .Values.jobservice.jobLogger "file" }} + - name: "FILE" + level: {{ .Values.logLevel | upper }} + settings: # Customized settings of logger + base_dir: "/var/log/jobs" + sweeper: + duration: 14 #days + settings: # Customized settings of sweeper + work_dir: "/var/log/jobs" + {{- else if eq .Values.jobservice.jobLogger "database" }} + - name: "DB" + level: {{ .Values.logLevel | upper }} + sweeper: + duration: 14 #days + {{- else }} + - name: "STD_OUTPUT" + level: {{ .Values.logLevel | upper }} + {{- end }} + #Loggers for the job service + loggers: + - name: "STD_OUTPUT" + level: {{ .Values.logLevel | upper }} \ No newline at end of file diff --git a/bitnami/harbor/templates/jobservice/jobservice-dpl.yaml b/bitnami/harbor/templates/jobservice/jobservice-dpl.yaml new file mode 100644 index 000000000..60297111c --- /dev/null +++ b/bitnami/harbor/templates/jobservice/jobservice-dpl.yaml @@ -0,0 +1,108 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: "{{ template "harbor.jobservice" . }}" + labels: + {{- include "harbor.labels" . | nindent 4 }} + app.kubernetes.io/component: jobservice +spec: + replicas: {{ .Values.jobservice.replicas }} + selector: + matchLabels: {{ include "harbor.matchLabels" . | nindent 6 }} + app.kubernetes.io/component: jobservice + template: + metadata: + labels: + {{ include "harbor.labels" . | nindent 8 }} + app.kubernetes.io/component: jobservice + annotations: + checksum/configmap: {{ include (print $.Template.BasePath "/jobservice/jobservice-cm.yaml") . | sha256sum }} + checksum/secret: {{ include (print $.Template.BasePath "/jobservice/jobservice-secrets.yaml") . | sha256sum }} + checksum/secret-core: {{ include (print $.Template.BasePath "/core/core-secret.yaml") . | sha256sum }} + {{- if .Values.jobservice.podAnnotations }} + {{ toYaml .Values.jobservice.podAnnotations | nindent 8 }} + {{- end }} + spec: + {{- if .Values.securityContext.enabled }} + securityContext: + fsGroup: {{ .Values.securityContext.fsGroup }} + runAsUser: {{ .Values.securityContext.runAsUser }} + {{- end }} + containers: + - name: jobservice + image: "{{ template "harbor.jobserviceImage" . }}" + imagePullPolicy: {{ .Values.jobserviceImage.pullPolicy | quote }} + {{- if .Values.jobservice.livenessProbe.enabled }} + livenessProbe: + httpGet: + path: /api/v1/stats + port: http + initialDelaySeconds: {{ .Values.jobservice.livenessProbe.initialDelaySeconds }} + periodSeconds: {{ .Values.jobservice.livenessProbe.periodSeconds }} + timeoutSeconds: {{ .Values.jobservice.livenessProbe.timeoutSeconds }} + successThreshold: {{ .Values.jobservice.livenessProbe.successThreshold }} + failureThreshold: {{ .Values.jobservice.livenessProbe.failureThreshold }} + {{- end }} + {{- if .Values.jobservice.readinessProbe.enabled }} + readinessProbe: + httpGet: + path: /api/v1/stats + port: http + initialDelaySeconds: {{ .Values.jobservice.readinessProbe.initialDelaySeconds }} + periodSeconds: {{ .Values.jobservice.readinessProbe.periodSeconds }} + timeoutSeconds: {{ .Values.jobservice.readinessProbe.timeoutSeconds }} + successThreshold: {{ .Values.jobservice.readinessProbe.successThreshold }} + failureThreshold: {{ .Values.jobservice.readinessProbe.failureThreshold }} + {{- end }} + {{- if .Values.jobservice.resources }} + resources: {{ toYaml .Values.jobservice.resources | nindent 10 }} + {{- end }} + env: + - name: BITNAMI_DEBUG + value: {{ ternary "true" "false" .Values.jobserviceImage.debug | quote }} + - name: CORE_SECRET + valueFrom: + secretKeyRef: + name: {{ template "harbor.core" . }} + key: secret + - name: JOBSERVICE_SECRET + valueFrom: + secretKeyRef: + name: "{{ template "harbor.jobservice" . }}" + key: secret + - name: CORE_URL + value: "http://{{ template "harbor.core" . }}" + - name: REGISTRY_CONTROLLER_URL + value: "http://{{ template "harbor.registry" . }}:8080" + - name: LOG_LEVEL + value: debug + ports: + - containerPort: 8080 + name: http + volumeMounts: + - name: jobservice-config + mountPath: /etc/jobservice/config.yml + subPath: config.yml + - name: job-logs + mountPath: /var/log/jobs + subPath: {{ .Values.persistence.persistentVolumeClaim.jobservice.subPath }} + volumes: + - name: jobservice-config + configMap: + name: "{{ template "harbor.jobservice" . }}" + - name: job-logs + {{- if and .Values.persistence.enabled (eq .Values.jobservice.jobLogger "file") }} + persistentVolumeClaim: + claimName: {{ .Values.persistence.persistentVolumeClaim.jobservice.existingClaim | default (include "harbor.jobservice" .) }} + {{- else }} + emptyDir: {} + {{- end }} + {{- with .Values.jobservice.nodeSelector }} + nodeSelector: {{ tpl (toYaml .) $ | nindent 8 }} + {{- end }} + {{- with .Values.jobservice.affinity }} + affinity: {{ tpl (toYaml .) $ | nindent 8 }} + {{- end }} + {{- with .Values.jobservice.tolerations }} + tolerations: {{ tpl (toYaml .) $ | nindent 8 }} + {{- end }} diff --git a/bitnami/harbor/templates/jobservice/jobservice-pvc.yaml b/bitnami/harbor/templates/jobservice/jobservice-pvc.yaml new file mode 100644 index 000000000..26c7faf47 --- /dev/null +++ b/bitnami/harbor/templates/jobservice/jobservice-pvc.yaml @@ -0,0 +1,29 @@ +{{- $jobservice := .Values.persistence.persistentVolumeClaim.jobservice -}} +{{- if and .Values.persistence.enabled (not $jobservice.existingClaim) }} +{{- if eq .Values.jobservice.jobLogger "file" }} +kind: PersistentVolumeClaim +apiVersion: v1 +metadata: + name: {{ template "harbor.jobservice" . }} + {{- if eq .Values.persistence.resourcePolicy "keep" }} + annotations: + helm.sh/resource-policy: keep + {{- end }} + labels: + {{- include "harbor.labels" . | nindent 4 }} + app.kubernetes.io/component: jobservice +spec: + accessModes: + - {{ $jobservice.accessMode }} + resources: + requests: + storage: {{ $jobservice.size }} + {{- if $jobservice.storageClass }} + {{- if eq "-" $jobservice.storageClass }} + storageClassName: "" + {{- else }} + storageClassName: {{ $jobservice.storageClass }} + {{- end }} + {{- end }} +{{- end }} +{{- end }} \ No newline at end of file diff --git a/bitnami/harbor/templates/jobservice/jobservice-secrets.yaml b/bitnami/harbor/templates/jobservice/jobservice-secrets.yaml new file mode 100644 index 000000000..03d2c398d --- /dev/null +++ b/bitnami/harbor/templates/jobservice/jobservice-secrets.yaml @@ -0,0 +1,8 @@ +apiVersion: v1 +kind: Secret +metadata: + name: "{{ template "harbor.jobservice" . }}" + labels: {{ include "harbor.labels" . | nindent 4 }} +type: Opaque +data: + secret: {{ .Values.jobservice.secret | default (randAlphaNum 16) | b64enc | quote }} diff --git a/bitnami/harbor/templates/jobservice/jobservice-svc.yaml b/bitnami/harbor/templates/jobservice/jobservice-svc.yaml new file mode 100644 index 000000000..43dbd63ea --- /dev/null +++ b/bitnami/harbor/templates/jobservice/jobservice-svc.yaml @@ -0,0 +1,12 @@ +apiVersion: v1 +kind: Service +metadata: + name: "{{ template "harbor.jobservice" . }}" + labels: {{ include "harbor.labels" . | nindent 4 }} +spec: + ports: + - port: 80 + targetPort: http + selector: + {{- include "harbor.matchLabels" . | nindent 4 }} + app.kubernetes.io/component: jobservice diff --git a/bitnami/harbor/templates/nginx/configmap-http.yaml b/bitnami/harbor/templates/nginx/configmap-http.yaml new file mode 100644 index 000000000..6addbeb21 --- /dev/null +++ b/bitnami/harbor/templates/nginx/configmap-http.yaml @@ -0,0 +1,136 @@ +{{- if and (ne .Values.service.type "Ingress") (not .Values.service.tls.enabled) }} +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ template "harbor.nginx" . }} + labels: {{ include "harbor.labels" . | nindent 4 }} +data: + nginx.conf: |+ + worker_processes auto; + + events { + worker_connections 1024; + use epoll; + multi_accept on; + } + + http { + tcp_nodelay on; + + # this is necessary for us to be able to disable request buffering in all cases + proxy_http_version 1.1; + + upstream core { + server {{ template "harbor.core" . }}; + } + + upstream portal { + server {{ template "harbor.portal" . }}; + } + + log_format timed_combined '$remote_addr - ' + '"$request" $status $body_bytes_sent ' + '"$http_referer" "$http_user_agent" ' + '$request_time $upstream_response_time $pipe'; + + access_log /dev/stdout timed_combined; + + client_body_temp_path "/opt/bitnami/nginx/tmp/client_body" 1 2; + proxy_temp_path "/opt/bitnami/nginx/tmp/proxy" 1 2; + fastcgi_temp_path "/opt/bitnami/nginx/tmp/fastcgi" 1 2; + scgi_temp_path "/opt/bitnami/nginx/tmp/scgi" 1 2; + uwsgi_temp_path "/opt/bitnami/nginx/tmp/uwsgi" 1 2; + + server { + listen 8080; + server_tokens off; + # disable any limits to avoid HTTP 413 for large image uploads + client_max_body_size 0; + + location / { + proxy_pass http://portal/; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + + # When setting up Harbor behind other proxy, such as an Nginx instance, remove the below line if the proxy already has similar settings. + proxy_set_header X-Forwarded-Proto $scheme; + + proxy_buffering off; + proxy_request_buffering off; + } + + location /api/ { + proxy_pass http://core/api/; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + + # When setting up Harbor behind other proxy, such as an Nginx instance, remove the below line if the proxy already has similar settings. + proxy_set_header X-Forwarded-Proto $scheme; + + proxy_buffering off; + proxy_request_buffering off; + } + + location /chartrepo/ { + proxy_pass http://core/chartrepo/; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + + # When setting up Harbor behind other proxy, such as an Nginx instance, remove the below line if the proxy already has similar settings. + proxy_set_header X-Forwarded-Proto $scheme; + + proxy_buffering off; + proxy_request_buffering off; + } + + location /c/ { + proxy_pass http://core/c/; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + + # When setting up Harbor behind other proxy, such as an Nginx instance, remove the below line if the proxy already has similar settings. + proxy_set_header X-Forwarded-Proto $scheme; + + proxy_buffering off; + proxy_request_buffering off; + } + + location /v1/ { + return 404; + } + + location /v2/ { + proxy_pass http://core/v2/; + proxy_set_header Host $http_host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + + # When setting up Harbor behind other proxy, such as an Nginx instance, remove the below line if the proxy already has similar settings. + proxy_set_header X-Forwarded-Proto $scheme; + proxy_buffering off; + proxy_request_buffering off; + } + + location /service/ { + proxy_pass http://core/service/; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + + # When setting up Harbor behind other proxy, such as an Nginx instance, remove the below line if the proxy already has similar settings. + proxy_set_header X-Forwarded-Proto $scheme; + + proxy_buffering off; + proxy_request_buffering off; + } + + location /service/notifications { + return 404; + } + } + } +{{- end }} diff --git a/bitnami/harbor/templates/nginx/configmap-https.yaml b/bitnami/harbor/templates/nginx/configmap-https.yaml new file mode 100644 index 000000000..7770eb85c --- /dev/null +++ b/bitnami/harbor/templates/nginx/configmap-https.yaml @@ -0,0 +1,199 @@ +{{- if and (ne .Values.service.type "Ingress") .Values.service.tls.enabled }} +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ template "harbor.nginx" . }} + labels: {{ include "harbor.labels" . | nindent 4 }} +data: + nginx.conf: |+ + worker_processes auto; + + events { + worker_connections 1024; + use epoll; + multi_accept on; + } + + http { + tcp_nodelay on; + + # this is necessary for us to be able to disable request buffering in all cases + proxy_http_version 1.1; + + upstream core { + server {{ template "harbor.core" . }}; + } + + upstream portal { + server {{ template "harbor.portal" . }}; + } + + {{- if .Values.notary.enabled }} + upstream notary-server { + server {{ template "harbor.notary-server" . }}:4443; + } + {{- end }} + + log_format timed_combined 'remote_addr - ' + '"$request" $status $body_bytes_sent ' + '"$http_referer" "$http_user_agent" ' + '$request_time $upstream_response_time $pipe'; + + access_log /dev/stdout timed_combined; + + client_body_temp_path "/opt/bitnami/nginx/tmp/client_body" 1 2; + proxy_temp_path "/opt/bitnami/nginx/tmp/proxy" 1 2; + fastcgi_temp_path "/opt/bitnami/nginx/tmp/fastcgi" 1 2; + scgi_temp_path "/opt/bitnami/nginx/tmp/scgi" 1 2; + uwsgi_temp_path "/opt/bitnami/nginx/tmp/uwsgi" 1 2; + + {{- if .Values.notary.enabled }} + server { + listen 4443 ssl; + server_tokens off; + # ssl + ssl_certificate /etc/nginx/cert/tls.crt; + ssl_certificate_key /etc/nginx/cert/tls.key; + + # recommendations from https://raymii.org/s/tutorials/strong_ssl_security_on_nginx.html + ssl_protocols tlsv1.1 tlsv1.2; + ssl_ciphers '!aNULL:kECDH+AESGCM:ECDH+AESGCM:RSA+AESGCM:kECDH+AES:ECDH+AES:RSA+AES:'; + ssl_prefer_server_ciphers on; + ssl_session_cache shared:ssl:10m; + + # disable any limits to avoid http 413 for large image uploads + client_max_body_size 0; + + # required to avoid http 411: see issue #1486 (https://github.com/docker/docker/issues/1486) + chunked_transfer_encoding on; + + location /v2/ { + proxy_pass http://notary-server/v2/; + proxy_set_header Host $http_host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + + # When setting up Harbor behind other proxy, such as an Nginx instance, remove the below line if the proxy already has similar settings. + proxy_set_header X-Forwarded-Proto $scheme; + + proxy_buffering off; + proxy_request_buffering off; + } + } + {{- end }} + + server { + listen 8443 ssl; + # server_name harbordomain.com; + server_tokens off; + # SSL + ssl_certificate /etc/nginx/cert/tls.crt; + ssl_certificate_key /etc/nginx/cert/tls.key; + + # Recommendations from https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html + ssl_protocols TLSv1.1 TLSv1.2; + ssl_ciphers '!aNULL:kECDH+AESGCM:ECDH+AESGCM:RSA+AESGCM:kECDH+AES:ECDH+AES:RSA+AES:'; + ssl_prefer_server_ciphers on; + ssl_session_cache shared:SSL:10m; + + # disable any limits to avoid HTTP 413 for large image uploads + client_max_body_size 0; + + # required to avoid HTTP 411: see Issue #1486 (https://github.com/docker/docker/issues/1486) + chunked_transfer_encoding on; + + location / { + proxy_pass http://portal/; + proxy_set_header Host $http_host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + + # When setting up Harbor behind other proxy, such as an Nginx instance, remove the below line if the proxy already has similar settings. + proxy_set_header X-Forwarded-Proto $scheme; + + # Add Secure flag when serving HTTPS + proxy_cookie_path / "/; secure"; + + proxy_buffering off; + proxy_request_buffering off; + } + + location /api/ { + proxy_pass http://core/api/; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + + # When setting up Harbor behind other proxy, such as an Nginx instance, remove the below line if the proxy already has similar settings. + proxy_set_header X-Forwarded-Proto $scheme; + + proxy_buffering off; + proxy_request_buffering off; + } + + location /chartrepo/ { + proxy_pass http://core/chartrepo/; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + + # When setting up Harbor behind other proxy, such as an Nginx instance, remove the below line if the proxy already has similar settings. + proxy_set_header X-Forwarded-Proto $scheme; + + proxy_buffering off; + proxy_request_buffering off; + } + + location /c/ { + proxy_pass http://core/c/; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + + # When setting up Harbor behind other proxy, such as an Nginx instance, remove the below line if the proxy already has similar settings. + proxy_set_header X-Forwarded-Proto $scheme; + + proxy_buffering off; + proxy_request_buffering off; + } + + location /v1/ { + return 404; + } + + location /v2/ { + proxy_pass http://core/v2/; + proxy_set_header Host $http_host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + + # When setting up Harbor behind other proxy, such as an Nginx instance, remove the below line if the proxy already has similar settings. + proxy_set_header X-Forwarded-Proto $scheme; + proxy_buffering off; + proxy_request_buffering off; + } + + location /service/ { + proxy_pass http://core/service/; + proxy_set_header Host $http_host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + + # When setting up Harbor behind other proxy, such as an Nginx instance, remove the below line if the proxy already has similar settings. + proxy_set_header X-Forwarded-Proto $scheme; + + proxy_buffering off; + proxy_request_buffering off; + } + + location /service/notifications { + return 404; + } + } + server { + listen 8080; + #server_name harbordomain.com; + return 301 https://$host$request_uri:8443; + } + } +{{- end }} diff --git a/bitnami/harbor/templates/nginx/deployment.yaml b/bitnami/harbor/templates/nginx/deployment.yaml new file mode 100644 index 000000000..ad45d99c2 --- /dev/null +++ b/bitnami/harbor/templates/nginx/deployment.yaml @@ -0,0 +1,112 @@ +{{- if ne .Values.service.type "Ingress" }} +apiVersion: extensions/v1beta1 +kind: Deployment +metadata: + name: {{ template "harbor.nginx" . }} + labels: + {{- include "harbor.labels" . | nindent 4 }} + app.kubernetes.io/component: nginx +spec: + replicas: 1 + selector: + matchLabels: {{ include "harbor.matchLabels" . | nindent 6 }} + app.kubernetes.io/component: nginx + template: + metadata: + labels: + {{ include "harbor.labels" . | nindent 8 }} + app.kubernetes.io/component: nginx + annotations: + {{- if not .Values.service.tls.enabled }} + checksum/configmap: {{ include (print $.Template.BasePath "/nginx/configmap-http.yaml") . | sha256sum }} + {{- else }} + checksum/configmap: {{ include (print $.Template.BasePath "/nginx/configmap-https.yaml") . | sha256sum }} + {{- end }} + {{- if eq (include "harbor.autoGenCertForNginx" .) "true" }} + checksum/secret: {{ include (print $.Template.BasePath "/nginx/secret.yaml") . | sha256sum }} + {{- end }} + {{- if .Values.nginx.podAnnotations }} + {{ toYaml .Values.nginx.podAnnotations | nindent 8 }} + {{- end }} + spec: + {{- if .Values.securityContext.enabled }} + securityContext: + fsGroup: {{ .Values.securityContext.fsGroup }} + runAsUser: {{ .Values.securityContext.runAsUser }} + {{- end }} + containers: + - name: nginx + image: "{{ template "harbor.nginxImage" . }}" + imagePullPolicy: {{ .Values.nginxImage.pullPolicy | quote }} + {{- if .Values.nginx.livenessProbe.enabled }} + livenessProbe: + httpGet: + path: / + port: {{ ternary "https" "http" .Values.service.tls.enabled }} + {{- if .Values.service.tls.enabled }} + scheme: HTTPS + {{- end }} + initialDelaySeconds: {{ .Values.nginx.livenessProbe.initialDelaySeconds }} + periodSeconds: {{ .Values.nginx.livenessProbe.periodSeconds }} + timeoutSeconds: {{ .Values.nginx.livenessProbe.timeoutSeconds }} + successThreshold: {{ .Values.nginx.livenessProbe.successThreshold }} + failureThreshold: {{ .Values.nginx.livenessProbe.failureThreshold }} + {{- end }} + {{- if .Values.nginx.readinessProbe.enabled }} + readinessProbe: + httpGet: + path: / + port: {{ ternary "https" "http" .Values.service.tls.enabled }} + {{- if .Values.service.tls.enabled }} + scheme: HTTPS + {{- end }} + initialDelaySeconds: {{ .Values.nginx.readinessProbe.initialDelaySeconds }} + periodSeconds: {{ .Values.nginx.readinessProbe.periodSeconds }} + timeoutSeconds: {{ .Values.nginx.readinessProbe.timeoutSeconds }} + successThreshold: {{ .Values.nginx.readinessProbe.successThreshold }} + failureThreshold: {{ .Values.nginx.readinessProbe.failureThreshold }} + {{- end }} + env: + - name: BITNAMI_DEBUG + value: {{ ternary "true" "false" .Values.nginxImage.debug | quote }} + {{- if .Values.nginx.resources }} + resources: {{ toYaml .Values.nginx.resources | nindent 10 }} + {{- end }} + ports: + - containerPort: 8080 + name: http + - containerPort: 8443 + name: https + - containerPort: 4443 + name: notary + volumeMounts: + - name: config + mountPath: /opt/bitnami/nginx/conf/nginx.conf + subPath: nginx.conf + {{- if .Values.service.tls.enabled }} + - name: certificate + mountPath: /etc/nginx/cert + {{- end }} + volumes: + - name: config + configMap: + name: {{ template "harbor.nginx" . }} + {{- if .Values.service.tls.enabled }} + - name: certificate + secret: + {{- if .Values.service.tls.secretName }} + secretName: {{ .Values.service.tls.secretName }} + {{- else }} + secretName: {{ template "harbor.nginx" . }} + {{- end }} + {{- end }} + {{- with .Values.nginx.nodeSelector }} + nodeSelector: {{ tpl (toYaml .) $ | nindent 8 }} + {{- end }} + {{- with .Values.nginx.affinity }} + affinity: {{ tpl (toYaml .) $ | nindent 8 }} + {{- end }} + {{- with .Values.nginx.tolerations }} + tolerations: {{ tpl (toYaml .) $ | nindent 8 }} + {{- end }} + {{- end }} \ No newline at end of file diff --git a/bitnami/harbor/templates/nginx/secret.yaml b/bitnami/harbor/templates/nginx/secret.yaml new file mode 100644 index 000000000..ec7ee5099 --- /dev/null +++ b/bitnami/harbor/templates/nginx/secret.yaml @@ -0,0 +1,22 @@ +{{- if eq (include "harbor.autoGenCertForNginx" .) "true" }} +{{- $ca := genCA "harbor-ca" 365 }} +{{- $cn := (required "The \"service.tls.commonName\" is required!" .Values.service.tls.commonName) }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ template "harbor.nginx" . }} + labels: {{ include "harbor.labels" . | nindent 4 }} +type: Opaque +data: + {{- if regexMatch `^((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$` $cn }} + {{- $cert := genSignedCert $cn (list $cn) nil 365 $ca }} + tls.crt: {{ $cert.Cert | b64enc | quote }} + tls.key: {{ $cert.Key | b64enc | quote }} + ca.crt: {{ $ca.Cert | b64enc | quote }} + {{- else }} + {{- $cert := genSignedCert $cn nil (list $cn) 365 $ca }} + tls.crt: {{ $cert.Cert | b64enc | quote }} + tls.key: {{ $cert.Key | b64enc | quote }} + ca.crt: {{ $ca.Cert | b64enc | quote }} + {{- end }} +{{- end }} \ No newline at end of file diff --git a/bitnami/harbor/templates/nginx/service.yaml b/bitnami/harbor/templates/nginx/service.yaml new file mode 100644 index 000000000..c29db0032 --- /dev/null +++ b/bitnami/harbor/templates/nginx/service.yaml @@ -0,0 +1,80 @@ +{{- if ne .Values.service.type "Ingress" }} +apiVersion: v1 +kind: Service +metadata: +{{- if eq .Values.service.type "ClusterIP" }} +{{- $clusterIP := .Values.service.clusterIP }} + name: {{ $clusterIP.name }} + labels: {{ include "harbor.labels" . | nindent 4 }} +spec: + type: ClusterIP + ports: + - name: http + port: {{ $clusterIP.ports.httpPort }} + targetPort: 8080 + {{- if .Values.service.tls.enabled }} + - name: https + port: {{ $clusterIP.ports.httpsPort }} + targetPort: 8443 + {{- end }} + {{- if .Values.notary.enabled }} + - name: notary + port: {{ $clusterIP.ports.notaryPort }} + targetPort: 4443 + {{- end }} +{{- else if eq .Values.service.type "NodePort" }} +{{- $nodePort := .Values.service.nodePort }} + name: {{ $nodePort.name }} + labels: + {{ include "harbor.labels" . | nindent 4 }} +spec: + type: NodePort + ports: + - name: http + port: {{ $nodePort.ports.http.port }} + targetPort: 8080 + {{- if $nodePort.ports.http.nodePort }} + nodePort: {{ $nodePort.ports.http.nodePort }} + {{- end }} + {{- if .Values.service.tls.enabled }} + - name: https + port: {{ $nodePort.ports.https.port }} + targetPort: 8443 + {{- if $nodePort.ports.https.nodePort }} + nodePort: {{ $nodePort.ports.https.nodePort }} + {{- end }} + {{- end }} + {{- if .Values.notary.enabled }} + - name: notary + port: {{ $nodePort.ports.notary.port }} + targetPort: 4443 + {{- if $nodePort.ports.notary.nodePort }} + nodePort: {{ $nodePort.ports.notary.nodePort }} + {{- end }} + {{- end }} +{{- else if eq .Values.service.type "LoadBalancer" }} +{{- $loadBalancer := .Values.service.loadBalancer }} + name: {{ $loadBalancer.name }} + labels: + {{ include "harbor.labels" . | nindent 4 }} +spec: + type: LoadBalancer + ports: + - name: http + port: {{ $loadBalancer.ports.httpPort }} + targetPort: 8080 + {{- if .Values.service.tls.enabled }} + - name: https + port: {{ $loadBalancer.ports.httpsPort }} + targetPort: 8443 + {{- end }} + {{- if .Values.notary.enabled }} + - name: notary + port: {{ $loadBalancer.ports.notaryPort }} + targetPort: 4443 + {{- end }} +{{- end }} + selector: + {{- include "harbor.matchLabels" . | nindent 4 }} + app.kubernetes.io/component: nginx +{{- end }} \ No newline at end of file diff --git a/bitnami/harbor/templates/notary/notary-cm.yaml b/bitnami/harbor/templates/notary/notary-cm.yaml new file mode 100644 index 000000000..732372fb9 --- /dev/null +++ b/bitnami/harbor/templates/notary/notary-cm.yaml @@ -0,0 +1,73 @@ +{{ if .Values.notary.enabled }} +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ template "harbor.notary-server" . }} + labels: {{ include "harbor.labels" . | nindent 4 }} + component: notary +data: + {{ $ca := genCA "harbor-notary-ca" 365 }} + {{ $cert := genSignedCert (include "harbor.notary-signer" .) nil nil 365 $ca }} + {{- if not .Values.notary.secretName }} + notary-signer-ca.crt: | + {{ $ca.Cert | nindent 4 }} + notary-signer.crt: | + {{ $cert.Cert | nindent 4 }} + notary-signer.key: | + {{ $cert.Key | nindent 4 }} + {{- end }} + server-config.postgres.json: | + { + "server": { + "http_addr": ":4443" + }, + "trust_service": { + "type": "remote", + "hostname": "{{ template "harbor.notary-signer" . }}", + "port": "7899", +{{- if not .Values.notary.secretName }} + "tls_ca_file": "./notary-signer-ca.crt", +{{- else }} + "tls_ca_file": "/etc/ssl/notary/cert/notary-signer-ca.crt", +{{- end }} + "key_algorithm": "ecdsa" + }, + "logging": { + "level": "{{ .Values.logLevel }}" + }, + "storage": { + "backend": "postgres", + "db_url": "{{ template "harbor.database.notaryServer" . }}" + }, + "auth": { + "type": "token", + "options": { + "realm": "{{ .Values.externalURL }}/service/token", + "service": "harbor-notary", + "issuer": "harbor-token-issuer", + "rootcertbundle": "/root.crt" + } + } + } + signer-config.postgres.json: | + { + "server": { + "grpc_addr": ":7899", +{{- if not .Values.notary.secretName }} + "tls_cert_file": "./notary-signer.crt", + "tls_key_file": "./notary-signer.key" +{{- else }} + "tls_cert_file": "/etc/ssl/notary/cert/notary-signer.crt", + "tls_key_file": "/etc/ssl/notary/cert/notary-signer.key" +{{- end }} + }, + "logging": { + "level": "{{ .Values.logLevel }}" + }, + "storage": { + "backend": "postgres", + "db_url": "{{ template "harbor.database.notarySigner" . }}", + "default_alias": "defaultalias" + } + } +{{ end }} diff --git a/bitnami/harbor/templates/notary/notary-server.yaml b/bitnami/harbor/templates/notary/notary-server.yaml new file mode 100644 index 000000000..e95d458ac --- /dev/null +++ b/bitnami/harbor/templates/notary/notary-server.yaml @@ -0,0 +1,79 @@ +{{ if .Values.notary.enabled }} +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ template "harbor.notary-server" . }} + labels: {{ include "harbor.labels" . | nindent 4 }} + component: notary-server +spec: + replicas: {{ .Values.notary.server.replicas }} + selector: + matchLabels: {{ include "harbor.matchLabels" . | nindent 6 }} + component: notary-server + template: + metadata: + labels: {{ include "harbor.labels" . | nindent 8 }} + component: notary-server + annotations: + checksum/configmap: {{ include (print $.Template.BasePath "/notary/notary-cm.yaml") . | sha256sum }} + checksum/secret-core: {{ include (print $.Template.BasePath "/core/core-secret.yaml") . | sha256sum }} + {{- if .Values.notary.podAnnotations }} + {{ toYaml .Values.notary.podAnnotations | nindent 8 }} + {{- end }} + spec: + {{- if .Values.securityContext.enabled }} + securityContext: + fsGroup: {{ .Values.securityContext.fsGroup }} + runAsUser: {{ .Values.securityContext.runAsUser }} + {{- end }} + containers: + - name: notary-server + image: {{ template "harbor.notaryServerImage" . }} + imagePullPolicy: {{ .Values.notaryServerImage.pullPolicy }} + {{- if .Values.notary.server.resources }} + resources: {{ toYaml .Values.notary.server.resources | nindent 10 }} + {{- end }} + env: + - name: BITNAMI_DEBUG + value: {{ ternary "true" "false" .Values.notaryServerImage.debug | quote }} + - name: MIGRATIONS_PATH + value: migrations/server/postgresql + - name: DB_URL + value: {{ template "harbor.database.notaryServer" . }} + volumeMounts: + - name: notary-config + mountPath: /etc/notary + - name: root-certificate + mountPath: /root.crt + subPath: tls.crt + {{- if .Values.notary.secretName }} + - name: notary-ca + mountPath: /etc/ssl/notary/cert/notary-signer-ca.crt + subPath: ca + {{- end }} + volumes: + - name: notary-config + configMap: + name: "{{ template "harbor.notary-server" . }}" + - name: root-certificate + secret: + {{- if .Values.core.secretName }} + secretName: {{ .Values.core.secretName }} + {{- else }} + secretName: {{ template "harbor.core" . }} + {{- end }} + {{- if .Values.notary.secretName }} + - name: notary-ca + secret: + secretName: {{ .Values.notary.secretName }} + {{- end }} + {{- with .Values.notary.nodeSelector }} + nodeSelector: {{ toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.notary.affinity }} + affinity: {{ toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.notary.tolerations }} + tolerations: {{ toYaml . | nindent 8 }} + {{- end }} +{{ end }} diff --git a/bitnami/harbor/templates/notary/notary-signer.yaml b/bitnami/harbor/templates/notary/notary-signer.yaml new file mode 100644 index 000000000..cfb200b5d --- /dev/null +++ b/bitnami/harbor/templates/notary/notary-signer.yaml @@ -0,0 +1,77 @@ +{{ if .Values.notary.enabled }} +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ template "harbor.notary-signer" . }} + labels: {{ include "harbor.labels" . | nindent 4 }} + component: notary-signer +spec: + replicas: {{ .Values.notary.signer.replicas }} + selector: + matchLabels: {{ include "harbor.matchLabels" . | nindent 6 }} + component: notary-signer + template: + metadata: + labels: {{ include "harbor.labels" . | nindent 8 }} + component: notary-signer + annotations: + checksum/configmap: {{ include (print $.Template.BasePath "/notary/notary-cm.yaml") . | sha256sum }} + spec: + {{- if .Values.securityContext.enabled }} + securityContext: + fsGroup: {{ .Values.securityContext.fsGroup }} + runAsUser: {{ .Values.securityContext.runAsUser }} + {{- end }} + containers: + - name: notary-signer + image: {{ template "harbor.notarySignerImage" . }} + imagePullPolicy: {{ .Values.notarySignerImage.pullPolicy }} + {{- if .Values.notary.signer.resources }} + resources: + {{ toYaml .Values.notary.signer.resources | nindent 10 }} + {{- end }} + env: + - name: BITNAMI_DEBUG + value: {{ ternary "true" "false" .Values.notarySignerImage.debug | quote }} + - name: MIGRATIONS_PATH + value: migrations/signer/postgresql + - name: DB_URL + value: {{ template "harbor.database.notarySigner" . }} + - name: NOTARY_SIGNER_DEFAULTALIAS + value: defaultalias + volumeMounts: + - name: notary-config + mountPath: /etc/notary + {{- if .Values.notary.secretName }} + - name: notary-cert + mountPath: /etc/ssl/notary/cert/notary-signer-ca.crt + subPath: ca + - name: notary-cert + mountPath: /etc/ssl/notary/cert/notary-signer.crt + subPath: crt + - name: notary-cert + mountPath: /etc/ssl/notary/cert/notary-signer.key + subPath: key + {{- end }} + volumes: + - name: notary-config + configMap: + name: {{ template "harbor.notary-server" . }} + {{- if .Values.notary.secretName }} + - name: notary-cert + secret: + secretName: {{ .Values.notary.secretName }} + {{- end }} + {{- with .Values.notary.nodeSelector }} + nodeSelector: + {{ toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.notary.affinity }} + affinity: + {{ toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.notary.tolerations }} + tolerations: + {{ toYaml . | nindent 8 }} + {{- end }} +{{ end }} diff --git a/bitnami/harbor/templates/notary/notary-svc.yaml b/bitnami/harbor/templates/notary/notary-svc.yaml new file mode 100644 index 000000000..763910679 --- /dev/null +++ b/bitnami/harbor/templates/notary/notary-svc.yaml @@ -0,0 +1,29 @@ +{{ if .Values.notary.enabled }} +apiVersion: v1 +kind: Service +metadata: + name: {{ template "harbor.notary-server" . }} + labels: {{ include "harbor.labels" . | nindent 4 }} +spec: +{{- if (eq .Values.service.ingress.controller "gce") }} + type: NodePort +{{- end }} + ports: + - port: 4443 + selector: + {{ include "harbor.matchLabels" . | nindent 4 }} + component: notary-server + +--- +apiVersion: v1 +kind: Service +metadata: + name: {{ template "harbor.notary-signer" . }} + labels: {{ include "harbor.labels" . | nindent 4 }} +spec: + ports: + - port: 7899 + selector: + {{ include "harbor.matchLabels" . | nindent 4 }} + component: notary-signer +{{ end }} diff --git a/bitnami/harbor/templates/portal/portal-dpl.yaml b/bitnami/harbor/templates/portal/portal-dpl.yaml new file mode 100644 index 000000000..18134e8d5 --- /dev/null +++ b/bitnami/harbor/templates/portal/portal-dpl.yaml @@ -0,0 +1,71 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: "{{ template "harbor.portal" . }}" + labels: + {{- include "harbor.labels" . | nindent 4 }} + app.kubernetes.io/component: portal +spec: + replicas: {{ .Values.portal.replicas }} + selector: + matchLabels: {{ include "harbor.matchLabels" . | nindent 6 }} + app.kubernetes.io/component: portal + template: + metadata: + labels: + {{ include "harbor.matchLabels" . | nindent 8 }} + app.kubernetes.io/component: portal + annotations: + {{- if .Values.portal.podAnnotations }} + {{ toYaml .Values.portal.podAnnotations | nindent 8 }} + {{- end }} + spec: + {{- if .Values.securityContext.enabled }} + securityContext: + fsGroup: {{ .Values.securityContext.fsGroup }} + runAsUser: {{ .Values.securityContext.runAsUser }} + {{- end }} + containers: + - name: portal + image: "{{ template "harbor.portalImage" . }}" + imagePullPolicy: {{ .Values.portalImage.pullPolicy | quote }} + {{- if .Values.portal.resources }} + resources: {{ toYaml .Values.portal.resources | nindent 10 }} + {{- end }} + {{- if .Values.portal.livenessProbe.enabled }} + livenessProbe: + httpGet: + path: / + port: http + initialDelaySeconds: {{ .Values.portal.livenessProbe.initialDelaySeconds }} + periodSeconds: {{ .Values.portal.livenessProbe.periodSeconds }} + timeoutSeconds: {{ .Values.portal.livenessProbe.timeoutSeconds }} + successThreshold: {{ .Values.portal.livenessProbe.successThreshold }} + failureThreshold: {{ .Values.portal.livenessProbe.failureThreshold }} + {{- end }} + {{- if .Values.portal.readinessProbe.enabled }} + readinessProbe: + httpGet: + path: / + port: http + initialDelaySeconds: {{ .Values.portal.readinessProbe.initialDelaySeconds }} + periodSeconds: {{ .Values.portal.readinessProbe.periodSeconds }} + timeoutSeconds: {{ .Values.portal.readinessProbe.timeoutSeconds }} + successThreshold: {{ .Values.portal.readinessProbe.successThreshold }} + failureThreshold: {{ .Values.portal.readinessProbe.failureThreshold }} + {{- end }} + env: + - name: BITNAMI_DEBUG + value: {{ ternary "true" "false" .Values.portalImage.debug | quote }} + ports: + - containerPort: 8080 + name: http + {{- with .Values.portal.nodeSelector }} + nodeSelector: {{ tpl (toYaml .) $ | indent 8 }} + {{- end }} + {{- with .Values.portal.affinity }} + affinity: {{ tpl (toYaml .) $ | indent 8 }} + {{- end }} + {{- with .Values.portal.tolerations }} + tolerations: {{ tpl (toYaml .) $ | indent 8 }} + {{- end }} diff --git a/bitnami/harbor/templates/portal/portal-svc.yaml b/bitnami/harbor/templates/portal/portal-svc.yaml new file mode 100644 index 000000000..d744b9192 --- /dev/null +++ b/bitnami/harbor/templates/portal/portal-svc.yaml @@ -0,0 +1,15 @@ +apiVersion: v1 +kind: Service +metadata: + name: "{{ template "harbor.portal" . }}" + labels: {{ include "harbor.labels" . | nindent 4 }} +spec: + {{- if (eq .Values.service.ingress.controller "gce") }} + type: NodePort + {{- end }} + ports: + - port: 80 + targetPort: http + selector: + {{- include "harbor.matchLabels" . | nindent 4 }} + app.kubernetes.io/component: portal diff --git a/bitnami/harbor/templates/registry/registry-cm.yaml b/bitnami/harbor/templates/registry/registry-cm.yaml new file mode 100644 index 000000000..23fb97d73 --- /dev/null +++ b/bitnami/harbor/templates/registry/registry-cm.yaml @@ -0,0 +1,170 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ template "harbor.registry" . }} + labels: {{ include "harbor.labels" . | nindent 4 }} +data: + config.yml: |+ + version: 0.1 + log: + level: {{ .Values.logLevel }} + fields: + service: registry + storage: + {{- $storage := .Values.persistence.imageChartStorage }} + {{- $type := $storage.type }} + {{- if eq $type "filesystem" }} + filesystem: + rootdirectory: {{ $storage.filesystem.rootdirectory }} + {{- if $storage.filesystem.maxthreads }} + maxthreads: {{ $storage.filesystem.maxthreads }} + {{- end }} + {{- else if eq $type "azure" }} + azure: + accountname: {{ $storage.azure.accountname }} + container: {{ $storage.azure.container }} + {{- if $storage.azure.realm }} + realm: {{ $storage.azure.realm }} + {{- end }} + {{- else if eq $type "gcs" }} + gcs: + bucket: {{ $storage.gcs.bucket }} + keyfile: /etc/registry/gcs-key.json + {{- if $storage.gcs.rootdirectory }} + rootdirectory: {{ $storage.gcs.rootdirectory }} + {{- end }} + {{- if $storage.gcs.chunksize }} + chunksize: {{ $storage.gcs.chunksize }} + {{- end }} + {{- else if eq $type "s3" }} + s3: + region: {{ $storage.s3.region }} + bucket: {{ $storage.s3.bucket }} + {{- if $storage.s3.regionendpoint }} + regionendpoint: {{ $storage.s3.regionendpoint }} + {{- end }} + {{- if $storage.s3.encrypt }} + encrypt: {{ $storage.s3.encrypt }} + {{- end }} + {{- if $storage.s3.secure }} + secure: {{ $storage.s3.secure }} + {{- end }} + {{- if $storage.s3.v4auth }} + v4auth: {{ $storage.s3.v4auth }} + {{- end }} + {{- if $storage.s3.chunksize }} + chunksize: {{ $storage.s3.chunksize }} + {{- end }} + {{- if $storage.s3.rootdirectory }} + rootdirectory: {{ $storage.s3.rootdirectory }} + {{- end }} + {{- if $storage.s3.storageclass }} + storageclass: {{ $storage.s3.storageclass }} + {{- end }} + {{- else if eq $type "swift" }} + swift: + authurl: {{ $storage.swift.authurl }} + username: {{ $storage.swift.username }} + container: {{ $storage.swift.container }} + {{- if $storage.swift.region }} + region: {{ $storage.swift.region }} + {{- end }} + {{- if $storage.swift.tenant }} + tenant: {{ $storage.swift.tenant }} + {{- end }} + {{- if $storage.swift.tenantid }} + tenantid: {{ $storage.swift.tenantid }} + {{- end }} + {{- if $storage.swift.domain }} + domain: {{ $storage.swift.domain }} + {{- end }} + {{- if $storage.swift.domainid }} + domainid: {{ $storage.swift.domainid }} + {{- end }} + {{- if $storage.swift.trustid }} + trustid: {{ $storage.swift.trustid }} + {{- end }} + {{- if $storage.swift.insecureskipverify }} + insecureskipverify: {{ $storage.swift.insecureskipverify }} + {{- end }} + {{- if $storage.swift.chunksize }} + chunksize: {{ $storage.swift.chunksize }} + {{- end }} + {{- if $storage.swift.prefix }} + prefix: {{ $storage.swift.prefix }} + {{- end }} + {{- if $storage.swift.authversion }} + authversion: {{ $storage.swift.authversion }} + {{- end }} + {{- if $storage.swift.endpointtype }} + endpointtype: {{ $storage.swift.endpointtype }} + {{- end }} + {{- if $storage.swift.tempurlcontainerkey }} + tempurlcontainerkey: {{ $storage.swift.tempurlcontainerkey }} + {{- end }} + {{- if $storage.swift.tempurlmethods }} + tempurlmethods: {{ $storage.swift.tempurlmethods }} + {{- end }} + {{- else if eq $type "oss" }} + oss: + accesskeyid: {{ $storage.oss.accesskeyid }} + region: {{ $storage.oss.region }} + bucket: {{ $storage.oss.bucket }} + {{- if $storage.oss.endpoint }} + endpoint: {{ $storage.oss.endpoint }} + {{- end }} + {{- if $storage.oss.internal }} + internal: {{ $storage.oss.internal }} + {{- end }} + {{- if $storage.oss.encrypt }} + encrypt: {{ $storage.oss.encrypt }} + {{- end }} + {{- if $storage.oss.secure }} + secure: {{ $storage.oss.secure }} + {{- end }} + {{- if $storage.oss.chunksize }} + chunksize: {{ $storage.oss.chunksize }} + {{- end }} + {{- if $storage.oss.rootdirectory }} + rootdirectory: {{ $storage.oss.rootdirectory }} + {{- end }} + {{- end }} + cache: + layerinfo: redis + maintenance: + uploadpurging: + enabled: false + delete: + enabled: true + redirect: + disable: {{ $storage.disableredirect }} + redis: + addr: "{{ template "harbor.redis.host" . }}:{{ template "harbor.redis.port" . }}" + db: {{ template "harbor.redis.registryDatabaseIndex" . }} + http: + addr: :5000 + # set via environment variable + # secret: placeholder + debug: + addr: localhost:5001 + auth: + token: + issuer: harbor-token-issuer + realm: "{{ .Values.externalURL }}/service/token" + rootcertbundle: /etc/registry/root.crt + service: harbor-registry + validation: + disabled: true + notifications: + endpoints: + - name: harbor + disabled: false + url: http://{{ template "harbor.core" . }}/service/notifications + timeout: 3000ms + threshold: 5 + backoff: 1s + ctl-config.yml: |+ + --- + protocol: "http" + port: 8080 + log_level: {{ .Values.logLevel }} diff --git a/bitnami/harbor/templates/registry/registry-dpl.yaml b/bitnami/harbor/templates/registry/registry-dpl.yaml new file mode 100644 index 000000000..cc9b2da3f --- /dev/null +++ b/bitnami/harbor/templates/registry/registry-dpl.yaml @@ -0,0 +1,178 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: "{{ template "harbor.registry" . }}" + labels: + {{- include "harbor.labels" . | nindent 4 }} + app.kubernetes.io/component: registry +spec: + replicas: {{ .Values.registry.replicas }} + selector: + matchLabels: {{ include "harbor.matchLabels" . | nindent 6 }} + app.kubernetes.io/component: registry + template: + metadata: + labels: + {{ include "harbor.labels" . | nindent 8 }} + app.kubernetes.io/component: registry + annotations: + checksum/configmap: {{ include (print $.Template.BasePath "/registry/registry-cm.yaml") . | sha256sum }} + checksum/secret: {{ include (print $.Template.BasePath "/registry/registry-secret.yaml") . | sha256sum }} + checksum/secret-jobservice: {{ include (print $.Template.BasePath "/jobservice/jobservice-secrets.yaml") . | sha256sum }} + checksum/secret-core: {{ include (print $.Template.BasePath "/core/core-secret.yaml") . | sha256sum }} + {{- if .Values.registry.podAnnotations }} + {{ toYaml .Values.registry.podAnnotations | nindent 8 }} + {{- end }} + spec: + {{- if .Values.securityContext.enabled }} + securityContext: + fsGroup: {{ .Values.securityContext.fsGroup }} + runAsUser: {{ .Values.securityContext.runAsUser }} + {{- end }} + containers: + - name: registry + image: "{{ template "harbor.registryImage" . }}" + imagePullPolicy: {{ .Values.registryImage.pullPolicy | quote }} + {{- if .Values.registry.registry.livenessProbe.enabled }} + livenessProbe: + httpGet: + path: / + port: registry + initialDelaySeconds: {{ .Values.registry.registry.livenessProbe.initialDelaySeconds }} + periodSeconds: {{ .Values.registry.registry.livenessProbe.periodSeconds }} + timeoutSeconds: {{ .Values.registry.registry.livenessProbe.timeoutSeconds }} + successThreshold: {{ .Values.registry.registry.livenessProbe.successThreshold }} + failureThreshold: {{ .Values.registry.registry.livenessProbe.failureThreshold }} + {{- end }} + {{- if .Values.registry.registry.readinessProbe.enabled }} + readinessProbe: + httpGet: + path: / + port: registry + initialDelaySeconds: {{ .Values.registry.registry.readinessProbe.initialDelaySeconds }} + periodSeconds: {{ .Values.registry.registry.readinessProbe.periodSeconds }} + timeoutSeconds: {{ .Values.registry.registry.readinessProbe.timeoutSeconds }} + successThreshold: {{ .Values.registry.registry.readinessProbe.successThreshold }} + failureThreshold: {{ .Values.registry.registry.readinessProbe.failureThreshold }} + {{- end }} + {{- if .Values.registry.registry.resources }} + resources: {{ toYaml .Values.registry.registry.resources | nindent 10 }} + {{- end }} + env: + - name: BITNAMI_DEBUG + value: {{ ternary "true" "false" .Values.registryImage.debug | quote }} + envFrom: + - secretRef: + name: "{{ template "harbor.registry" . }}" + ports: + - containerPort: 5000 + name: registry + - containerPort: 5001 + name: debug + volumeMounts: + - name: registry-data + mountPath: {{ .Values.persistence.imageChartStorage.filesystem.rootdirectory }} + subPath: {{ .Values.persistence.persistentVolumeClaim.registry.subPath }} + - name: registry-root-certificate + mountPath: /etc/registry/root.crt + subPath: tls.crt + - name: registry-config + mountPath: /etc/registry/config.yml + subPath: config.yml + {{- if and .Values.persistence.enabled (eq .Values.persistence.imageChartStorage.type "gcs") }} + - name: gcs-key + mountPath: /etc/registry/gcs-key.json + subPath: gcs-key.json + {{- end }} + - name: registryctl + image: "{{ template "harbor.registryctlImage" . }}" + imagePullPolicy: {{ .Values.registryctlImage.pullPolicy | quote }} + {{- if .Values.registry.controller.livenessProbe.enabled }} + livenessProbe: + httpGet: + path: /api/health + port: registryctl + initialDelaySeconds: {{ .Values.registry.controller.livenessProbe.initialDelaySeconds }} + periodSeconds: {{ .Values.registry.controller.livenessProbe.periodSeconds }} + timeoutSeconds: {{ .Values.registry.controller.livenessProbe.timeoutSeconds }} + successThreshold: {{ .Values.registry.controller.livenessProbe.successThreshold }} + failureThreshold: {{ .Values.registry.controller.livenessProbe.failureThreshold }} + {{- end }} + {{- if .Values.registry.controller.readinessProbe.enabled }} + readinessProbe: + httpGet: + path: /api/health + port: registryctl + initialDelaySeconds: {{ .Values.registry.controller.readinessProbe.initialDelaySeconds }} + periodSeconds: {{ .Values.registry.controller.readinessProbe.periodSeconds }} + timeoutSeconds: {{ .Values.registry.controller.readinessProbe.timeoutSeconds }} + successThreshold: {{ .Values.registry.controller.readinessProbe.successThreshold }} + failureThreshold: {{ .Values.registry.controller.readinessProbe.failureThreshold }} + {{- end }} + {{- if .Values.registry.controller.resources }} + resources: {{ toYaml .Values.registry.controller.resources | nindent 10 }} + {{- end }} + envFrom: + - secretRef: + name: "{{ template "harbor.registry" . }}" + env: + - name: BITNAMI_DEBUG + value: {{ ternary "true" "false" .Values.registryctlImage.debug | quote }} + - name: CORE_SECRET + valueFrom: + secretKeyRef: + name: {{ template "harbor.core" . }} + key: secret + - name: JOBSERVICE_SECRET + valueFrom: + secretKeyRef: + name: {{ template "harbor.jobservice" . }} + key: secret + ports: + - containerPort: 8080 + name: registryctl + volumeMounts: + - name: registry-data + mountPath: {{ .Values.persistence.imageChartStorage.filesystem.rootdirectory }} + subPath: {{ .Values.persistence.persistentVolumeClaim.registry.subPath }} + - name: registry-config + mountPath: /etc/registry/config.yml + subPath: config.yml + - name: registry-config + mountPath: /etc/registryctl/config.yml + subPath: ctl-config.yml + volumes: + - name: registry-root-certificate + secret: + {{- if .Values.core.secretName }} + secretName: {{ .Values.core.secretName }} + {{- else }} + secretName: {{ template "harbor.core" . }} + {{- end }} + - name: registry-config + configMap: + name: "{{ template "harbor.registry" . }}" + - name: registry-data + {{- if and .Values.persistence.enabled (eq .Values.persistence.imageChartStorage.type "filesystem") }} + persistentVolumeClaim: + claimName: {{ .Values.persistence.persistentVolumeClaim.registry.existingClaim | default (include "harbor.registry" .) }} + {{- else }} + emptyDir: {} + {{- end }} + {{- if and .Values.persistence.enabled (eq .Values.persistence.imageChartStorage.type "gcs") }} + - name: gcs-key + secret: + secretName: {{ template "harbor.registry" . }} + items: + - key: GCS_KEY_DATA + path: gcs-key.json + {{- end }} + {{- with .Values.registry.nodeSelector }} + nodeSelector: {{ tpl (toYaml .) $ | nindent 8 }} + {{- end }} + {{- with .Values.registry.affinity }} + affinity: {{ tpl (toYaml .) $ | nindent 8 }} + {{- end }} + {{- with .Values.registry.tolerations }} + tolerations: {{ tpl (toYaml .) $ | nindent 8 }} + {{- end }} diff --git a/bitnami/harbor/templates/registry/registry-pvc.yaml b/bitnami/harbor/templates/registry/registry-pvc.yaml new file mode 100644 index 000000000..a31485ab0 --- /dev/null +++ b/bitnami/harbor/templates/registry/registry-pvc.yaml @@ -0,0 +1,29 @@ +{{- if .Values.persistence.enabled }} +{{- $registry := .Values.persistence.persistentVolumeClaim.registry -}} +{{- if and (not $registry.existingClaim) (eq .Values.persistence.imageChartStorage.type "filesystem") }} +kind: PersistentVolumeClaim +apiVersion: v1 +metadata: + name: {{ template "harbor.registry" . }} + {{- if eq .Values.persistence.resourcePolicy "keep" }} + annotations: + helm.sh/resource-policy: keep + {{- end }} + labels: + {{- include "harbor.labels" . | nindent 4 }} + app.kubernetes.io/component: registry +spec: + accessModes: + - {{ $registry.accessMode }} + resources: + requests: + storage: {{ $registry.size }} + {{- if $registry.storageClass }} + {{- if eq "-" $registry.storageClass }} + storageClassName: "" + {{- else }} + storageClassName: {{ $registry.storageClass }} + {{- end }} + {{- end }} +{{- end }} +{{- end }} \ No newline at end of file diff --git a/bitnami/harbor/templates/registry/registry-secret.yaml b/bitnami/harbor/templates/registry/registry-secret.yaml new file mode 100644 index 000000000..f7ed36efa --- /dev/null +++ b/bitnami/harbor/templates/registry/registry-secret.yaml @@ -0,0 +1,33 @@ +apiVersion: v1 +kind: Secret +metadata: + name: "{{ template "harbor.registry" . }}" + labels: {{ include "harbor.labels" . | nindent 4 }} +type: Opaque +data: + REGISTRY_HTTP_SECRET: {{ .Values.registry.secret | default (randAlphaNum 16) | b64enc | quote }} + REGISTRY_REDIS_PASSWORD: {{ (include "harbor.redis.rawPassword" .) | b64enc | quote }} + {{- $storage := .Values.persistence.imageChartStorage }} + {{- $type := $storage.type }} + {{- if eq $type "azure" }} + REGISTRY_STORAGE_AZURE_ACCOUNTKEY: {{ $storage.azure.accountkey | b64enc | quote }} + {{- else if eq $type "gcs" }} + GCS_KEY_DATA: {{ $storage.gcs.encodedkey | quote }} + {{- else if eq $type "s3" }} + {{- if $storage.s3.accesskey }} + REGISTRY_STORAGE_S3_ACCESSKEY: {{ $storage.s3.accesskey | b64enc | quote }} + {{- end }} + {{- if $storage.s3.secretkey }} + REGISTRY_STORAGE_S3_SECRETKEY: {{ $storage.s3.secretkey | b64enc | quote }} + {{- end }} + {{- else if eq $type "swift" }} + REGISTRY_STORAGE_SWIFT_PASSWORD: {{ $storage.swift.password | b64enc | quote }} + {{- if $storage.swift.secretkey }} + REGISTRY_STORAGE_SWIFT_SECRETKEY: {{ $storage.swift.secretkey | b64enc | quote }} + {{- end }} + {{- if $storage.swift.accesskey }} + REGISTRY_STORAGE_SWIFT_ACCESSKEY: {{ $storage.swift.accesskey | b64enc | quote }} + {{- end }} + {{- else if eq $type "oss" }} + REGISTRY_STORAGE_OSS_ACCESSKEYSECRET: {{ $storage.oss.accesskeysecret | b64enc | quote }} + {{- end }} diff --git a/bitnami/harbor/templates/registry/registry-svc.yaml b/bitnami/harbor/templates/registry/registry-svc.yaml new file mode 100644 index 000000000..edc3c13b0 --- /dev/null +++ b/bitnami/harbor/templates/registry/registry-svc.yaml @@ -0,0 +1,14 @@ +apiVersion: v1 +kind: Service +metadata: + name: "{{ template "harbor.registry" . }}" + labels: {{ include "harbor.labels" . | nindent 4 }} +spec: + ports: + - name: registry + port: 5000 + - name: controller + port: 8080 + selector: + {{- include "harbor.matchLabels" . | nindent 4 }} + app.kubernetes.io/component: registry \ No newline at end of file diff --git a/bitnami/harbor/values-production.yaml b/bitnami/harbor/values-production.yaml new file mode 100644 index 000000000..4a870fee0 --- /dev/null +++ b/bitnami/harbor/values-production.yaml @@ -0,0 +1,836 @@ +## Global Docker image parameters +## Please, note that this will override the image parameters, including dependencies, configured to use the global value +## Current available global Docker image parameters: imageRegistry and imagePullSecrets +## +# global: +# imageRegistry: myRegistryName +# imagePullSecrets: +# - myRegistryKeySecretName + +## Bitnami Harbor Core image +## ref: https://hub.docker.com/r/bitnami/harbor-core/tags/ +## +coreImage: + registry: docker.io + repository: bitnami/harbor-core + tag: 1.8.1-debian-9-r3 + ## Specify a imagePullPolicy + ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' + ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images + ## + pullPolicy: IfNotPresent + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## + # pullSecrets: + # - myRegistryKeySecretName + + ## Set to true if you would like to see extra information on logs + ## It turns BASH and NAMI debugging in minideb + ## ref: https://github.com/bitnami/minideb-extras/#turn-on-bash-debugging + debug: false + +## Bitnami Harbor Portal image +## ref: https://hub.docker.com/r/bitnami/harbor-portal/tags/ +## +portalImage: + registry: docker.io + repository: bitnami/harbor-portal + tag: 1.8.1-debian-9-r0 + ## Specify a imagePullPolicy + ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' + ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images + ## + pullPolicy: IfNotPresent + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## + # pullSecrets: + # - myRegistryKeySecretName + + ## Set to true if you would like to see extra information on logs + ## It turns BASH and NAMI debugging in minideb + ## ref: https://github.com/bitnami/minideb-extras/#turn-on-bash-debugging + debug: false + +## Bitnami Harbor Job Service image +## ref: https://hub.docker.com/r/bitnami/harbor-jobservice/tags/ +## +jobserviceImage: + registry: docker.io + repository: bitnami/harbor-jobservice + tag: 1.8.1-debian-9-r3 + ## Specify a imagePullPolicy + ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' + ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images + ## + pullPolicy: IfNotPresent + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## + # pullSecrets: + # - myRegistryKeySecretName + + ## Set to true if you would like to see extra information on logs + ## It turns BASH and NAMI debugging in minideb + ## ref: https://github.com/bitnami/minideb-extras/#turn-on-bash-debugging + debug: false + +## Bitnami Harbor Registry image +## ref: https://hub.docker.com/r/bitnami/harbor-registry/tags/ +## +registryImage: + registry: docker.io + repository: bitnami/harbor-registry + tag: 1.8.1-debian-9-r3 + ## Specify a imagePullPolicy + ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' + ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images + ## + pullPolicy: IfNotPresent + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## + # pullSecrets: + # - myRegistryKeySecretName + + ## Set to true if you would like to see extra information on logs + ## It turns BASH and NAMI debugging in minideb + ## ref: https://github.com/bitnami/minideb-extras/#turn-on-bash-debugging + debug: false + +## Bitnami Harbor Registryctl image +## ref: https://hub.docker.com/r/bitnami/harbor-registryctl/tags/ +## +registryctlImage: + registry: docker.io + repository: bitnami/harbor-registryctl + tag: 1.8.1-debian-9-r3 + ## Specify a imagePullPolicy + ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' + ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images + ## + pullPolicy: IfNotPresent + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## + # pullSecrets: + # - myRegistryKeySecretName + + ## Set to true if you would like to see extra information on logs + ## It turns BASH and NAMI debugging in minideb + ## ref: https://github.com/bitnami/minideb-extras/#turn-on-bash-debugging + debug: false + +## Bitnami Harbor Clair image +## ref: https://hub.docker.com/r/bitnami/harbor-clair/tags/ +## +clairImage: + registry: docker.io + repository: bitnami/harbor-clair + tag: 1.8.1-debian-9-r3 + ## Specify a imagePullPolicy + ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' + ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images + ## + pullPolicy: IfNotPresent + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## + # pullSecrets: + # - myRegistryKeySecretName + + ## Set to true if you would like to see extra information on logs + ## It turns BASH and NAMI debugging in minideb + ## ref: https://github.com/bitnami/minideb-extras/#turn-on-bash-debugging + debug: false + +## Bitnami Harbor Notary Server image +## ref: https://hub.docker.com/r/bitnami/harbor-notary-server/tags/ +## +notaryServerImage: + registry: docker.io + repository: bitnami/harbor-notary-server + tag: 1.8.1-debian-9-r3 + ## Specify a imagePullPolicy + ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' + ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images + ## + pullPolicy: IfNotPresent + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## + # pullSecrets: + # - myRegistryKeySecretName + + ## Set to true if you would like to see extra information on logs + ## It turns BASH and NAMI debugging in minideb + ## ref: https://github.com/bitnami/minideb-extras/#turn-on-bash-debugging + debug: false + +## Bitnami Harbor Notary Signer image +## ref: https://hub.docker.com/r/bitnami/harbor-notary-signer/tags/ +## +notarySignerImage: + registry: docker.io + repository: bitnami/harbor-notary-signer + tag: 1.8.1-debian-9-r3 + ## Specify a imagePullPolicy + ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' + ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images + ## + pullPolicy: IfNotPresent + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## + # pullSecrets: + # - myRegistryKeySecretName + + ## Set to true if you would like to see extra information on logs + ## It turns BASH and NAMI debugging in minideb + ## ref: https://github.com/bitnami/minideb-extras/#turn-on-bash-debugging + debug: false + +## Bitnami Nginx image +## ref: https://hub.docker.com/r/bitnami/nginx/tags/ +## +nginxImage: + registry: docker.io + repository: bitnami/nginx + tag: 1.16.0-debian-9-r72 + ## Specify a imagePullPolicy + ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' + ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images + ## + pullPolicy: IfNotPresent + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## + # pullSecrets: + # - myRegistryKeySecretName + + ## Set to true if you would like to see extra information on logs + ## It turns BASH and NAMI debugging in minideb + ## ref: https://github.com/bitnami/minideb-extras/#turn-on-bash-debugging + debug: false + +service: + # Set the way how to expose the service. Set the type as "Ingress", + # "ClusterIP", "NodePort" or "LoadBalancer" and fill the information + # in the corresponding section + type: Ingress + tls: + # Enable the tls or not. Note: if the type is "ingress" and the tls + # is disabled, the port must be included in the command when pull/push + # images. Refer to https://github.com/goharbor/harbor/issues/5291 + # for the detail. + enabled: true + # Fill the name of secret if you want to use your own TLS certificate. + # The secret must contain keys named: + # "tls.crt" - the certificate + # "tls.key" - the private key + # "ca.crt" - the certificate of CA + # These files will be generated automatically if the "secretName" is not set + secretName: "" + # By default, the Notary service will use the same cert and key as + # described above. Fill the name of secret if you want to use a + # separated one. Only needed when the type is "ingress". + notarySecretName: "" + # The commmon name used to generate the certificate, it's necessary + # when the type isn't "ingress" and "secretName" is null + commonName: "" + ingress: + hosts: + core: core.harbor.domain + notary: notary.harbor.domain + # set to the type of ingress controller if it has specific requirements. + # leave as `default` for most ingress controllers. + # set to `gce` if using the GCE ingress controller + controller: default + annotations: + ingress.kubernetes.io/ssl-redirect: "true" + ingress.kubernetes.io/proxy-body-size: "0" + nginx.ingress.kubernetes.io/ssl-redirect: "true" + nginx.ingress.kubernetes.io/proxy-body-size: "0" + clusterIP: + # The name of ClusterIP service + name: harbor + ports: + # The service port Harbor listens on when serving with HTTP + httpPort: 80 + # The service port Harbor listens on when serving with HTTPS + httpsPort: 443 + # The service port Notary listens on. Only needed when notary.enabled + # is set to true + notaryPort: 4443 + nodePort: + # The name of NodePort service + name: harbor + ports: + http: + # The service port Harbor listens on when serving with HTTP + port: 80 + # The node port Harbor listens on when serving with HTTP + nodePort: 30002 + https: + # The service port Harbor listens on when serving with HTTPS + port: 443 + # The node port Harbor listens on when serving with HTTPS + nodePort: 30003 + # Only needed when notary.enabled is set to true + notary: + # The service port Notary listens on + port: 4443 + # The node port Notary listens on + nodePort: 30004 + loadBalancer: + # The name of LoadBalancer service + name: harbor + ports: + # The service port Harbor listens on when serving with HTTP + httpPort: 80 + # The service port Harbor listens on when serving with HTTPS + httpsPort: 443 + # The service port Notary listens on. Only needed when notary.enabled + # is set to true + notaryPort: 4443 + +# The external URL for Harbor core service. It is used to +# 1) populate the docker/helm commands showed on portal +# 2) populate the token service URL returned to docker/notary client +# +# Format: protocol://domain[:port]. Usually: +# 1) if "service.type" is "ingress", the "domain" should be +# the value of "service.ingress.hosts.core" +# 2) if "service.type" is "clusterIP", the "domain" should be +# the value of "service.clusterIP.name" +# 3) if "service.type" is "nodePort", the "domain" should be +# the IP address of k8s node +# +# If Harbor is deployed behind the proxy, set it as the URL of proxy +externalURL: https://core.harbor.domain + +## Kubernetes Security Context +## https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ +## +securityContext: + enabled: true + fsGroup: 1001 + runAsUser: 1001 + +# The persistence is enabled by default and a default StorageClass +# is needed in the k8s cluster to provision volumes dynamicly. +# Specify another StorageClass in the "storageClass" or set "existingClaim" +# if you have already existing persistent volumes to use +# +# For storing images and charts, you can also use "azure", "gcs", "s3", +# "swift" or "oss". Set it in the "imageChartStorage" section +persistence: + enabled: true + # Setting it to "keep" to avoid removing PVCs during a helm delete + # operation. Leaving it empty will delete PVCs after the chart deleted + resourcePolicy: "keep" + persistentVolumeClaim: + registry: + # Use the existing PVC which must be created manually before bound, + # and specify the "subPath" if the PVC is shared with other components + # If your storage type is `filesystem` and you deploy more than 1 registry replica, the existing PVC must be ReadWriteMany. + existingClaim: "" + # Specify the "storageClass" used to provision the volume. Or the default + # StorageClass will be used(the default). + # Set it to "-" to disable dynamic provisioning + storageClass: "" + subPath: "" + accessMode: ReadWriteOnce + size: 5Gi + jobservice: + # Use the existing PVC which must be created manually before bound, + # and specify the "subPath" if the PVC is shared with other components + # If you deploy more than 1 jobservice replica, the existing PVC must be ReadWriteMany. + existingClaim: "" + storageClass: "" + subPath: "" + accessMode: ReadWriteOnce + size: 1Gi + # Define which storage backend is used for registry and chartmuseum to store + # images and charts. Refer to + # https://github.com/docker/distribution/blob/master/docs/configuration.md#storage + # for the detail. + imageChartStorage: + # Specify whether to disable `redirect` for images and chart storage, for + # backends which not supported it (such as using minio for `s3` storage type), please disable + # it. To disable redirects, simply set `disableredirect` to `true` instead. + # Refer to + # https://github.com/docker/distribution/blob/master/docs/configuration.md#redirect + # for the detail. + disableredirect: false + # Specify the type of storage: "filesystem", "azure", "gcs", "s3", "swift", + # "oss" and fill the information needed in the corresponding section. The type + # must be "filesystem" if you want to use persistent volumes for registry + # and chartmuseum + type: filesystem + filesystem: + rootdirectory: /storage + #maxthreads: 100 + azure: + accountname: accountname + accountkey: base64encodedaccountkey + container: containername + #realm: core.windows.net + gcs: + bucket: bucketname + # The base64 encoded json file which contains the key + encodedkey: base64-encoded-json-key-file + #rootdirectory: /gcs/object/name/prefix + #chunksize: "5242880" + s3: + region: us-west-1 + bucket: bucketname + #accesskey: awsaccesskey + #secretkey: awssecretkey + #regionendpoint: http://myobjects.local + #encrypt: false + #keyid: mykeyid + #secure: true + #v4auth: true + #chunksize: "5242880" + #rootdirectory: /s3/object/name/prefix + #storageclass: STANDARD + swift: + authurl: https://storage.myprovider.com/v3/auth + username: username + password: password + container: containername + #region: fr + #tenant: tenantname + #tenantid: tenantid + #domain: domainname + #domainid: domainid + #trustid: trustid + #insecureskipverify: false + #chunksize: 5M + #prefix: + #secretkey: secretkey + #accesskey: accesskey + #authversion: 3 + #endpointtype: public + #tempurlcontainerkey: false + #tempurlmethods: + oss: + accesskeyid: accesskeyid + accesskeysecret: accesskeysecret + region: regionname + bucket: bucketname + #endpoint: endpoint + #internal: false + #encrypt: false + #secure: true + #chunksize: 10M + #rootdirectory: rootdirectory + +## The log level used for Harbor services. Possible values are [ fatal | error | warn | info | debug | trace ] +## +logLevel: debug + +## Option to force users to specify passwords (core.secret, harborAdminPassword, and secretKey). That is required for 'helm upgrade' to work properly. +## If it is not forced, random values will be generated. +## +forcePassword: true + +## The initial password of Harbor admin. Change it from portal after launching Harbor +## +## harborAdminPassword: + +## The secret key used for encryption. Must be a string of 16 chars. +## +## secretKey: "not-a-secure-key" + +# If expose the service via "ingress", the Nginx will not be used +nginx: + replicas: 1 + # resources: + # requests: + # memory: 256Mi + # cpu: 100m + ## These values are evaluated as a template (nodeSelector, tolerations and affinity) + nodeSelector: {} + tolerations: [] + affinity: {} + ## Additional deployment annotations + podAnnotations: {} + ## Configure extra options for liveness and readiness probes + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes) + ## + livenessProbe: + enabled: true + initialDelaySeconds: 20 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 6 + successThreshold: 1 + readinessProbe: + enabled: true + initialDelaySeconds: 20 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 6 + successThreshold: 1 + +portal: + replicas: 1 + # resources: + # requests: + # memory: 256Mi + # cpu: 100m + ## These values are evaluated as a template (nodeSelector, tolerations and affinity) + nodeSelector: {} + tolerations: [] + affinity: {} + ## Additional deployment annotations + podAnnotations: {} + ## Configure extra options for liveness and readiness probes + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes) + ## + livenessProbe: + enabled: true + initialDelaySeconds: 20 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 6 + successThreshold: 1 + readinessProbe: + enabled: true + initialDelaySeconds: 20 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 6 + successThreshold: 1 + +core: + replicas: 1 + # resources: + # requests: + # memory: 256Mi + # cpu: 100m + ## These values are evaluated as a template (nodeSelector, tolerations and affinity) + nodeSelector: {} + tolerations: [] + affinity: {} + ## Additional deployment annotations + podAnnotations: {} + # Secret is used when core server communicates with other components. + # If a secret key is not specified, Helm will generate one. + # Must be a string of 16 chars. + secret: "" + # Fill the name of a kubernetes secret if you want to use your own + # TLS certificate and private key for token encryption/decryption. + # The secret must contain keys named: + # "tls.crt" - the certificate + # "tls.key" - the private key + # The default key pair will be used if it isn't set + secretName: "" + ## Configure extra options for liveness and readiness probes + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes) + ## + livenessProbe: + enabled: true + initialDelaySeconds: 20 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 6 + successThreshold: 1 + readinessProbe: + enabled: true + initialDelaySeconds: 20 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 6 + successThreshold: 1 + +jobservice: + replicas: 1 + maxJobWorkers: 10 + # The logger for jobs: "file", "database" or "stdout" + jobLogger: file + # resources: + # requests: + # memory: 256Mi + # cpu: 100m + ## These values are evaluated as a template (nodeSelector, tolerations and affinity) + nodeSelector: {} + tolerations: [] + affinity: {} + ## Additional deployment annotations + podAnnotations: {} + # Secret is used when job service communicates with other components. + # If a secret key is not specified, Helm will generate one. + # Must be a string of 16 chars. + secret: "" + ## Configure extra options for liveness and readiness probes + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes) + ## + livenessProbe: + enabled: true + initialDelaySeconds: 20 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 6 + successThreshold: 1 + readinessProbe: + enabled: true + initialDelaySeconds: 20 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 6 + successThreshold: 1 + +registry: + registry: + ## Configure extra options for liveness and readiness probes + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes) + ## + livenessProbe: + enabled: true + initialDelaySeconds: 10 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 6 + successThreshold: 1 + readinessProbe: + enabled: true + initialDelaySeconds: 10 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 6 + successThreshold: 1 + # resources: + # requests: + # memory: 256Mi + # cpu: 100m + controller: + ## Configure extra options for liveness and readiness probes + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes) + ## + livenessProbe: + enabled: true + initialDelaySeconds: 10 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 6 + successThreshold: 1 + readinessProbe: + enabled: true + initialDelaySeconds: 10 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 6 + successThreshold: 1 + # resources: + # requests: + # memory: 256Mi + # cpu: 100m + replicas: 1 + ## These values are evaluated as a template (nodeSelector, tolerations and affinity) + nodeSelector: {} + tolerations: [] + affinity: {} + ## Additional deployment annotations + podAnnotations: {} + # Secret is used to secure the upload state from client + # and registry storage backend. + # See: https://github.com/docker/distribution/blob/master/docs/configuration.md#http + # If a secret key is not specified, Helm will generate one. + # Must be a string of 16 chars. + secret: "" + +# Enable Chartmuseum is not supported yet. +chartmuseum: + enabled: false + +clair: + enabled: true + replicas: 1 + # The http(s) proxy used to update vulnerabilities database from internet + httpProxy: + httpsProxy: + # The interval of clair updaters, the unit is hour, set to 0 to + # disable the updaters + updatersInterval: 12 + # resources: + # requests: + # memory: 256Mi + # cpu: 100m + nodeSelector: {} + tolerations: [] + affinity: {} + ## Additional deployment annotations + podAnnotations: {} + ## Configure extra options for liveness and readiness probes + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes) + ## + livenessProbe: + enabled: true + initialDelaySeconds: 20 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 6 + successThreshold: 1 + readinessProbe: + enabled: true + initialDelaySeconds: 20 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 6 + successThreshold: 1 + +notary: + enabled: true + server: + ## Configure extra options for liveness and readiness probes + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes) + ## + livenessProbe: + enabled: true + initialDelaySeconds: 10 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 6 + successThreshold: 1 + readinessProbe: + enabled: true + initialDelaySeconds: 10 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 6 + successThreshold: 1 + # resources: + # requests: + # memory: 256Mi + # cpu: 100m + signer: + ## Configure extra options for liveness and readiness probes + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes) + ## + livenessProbe: + enabled: true + initialDelaySeconds: 10 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 6 + successThreshold: 1 + readinessProbe: + enabled: true + initialDelaySeconds: 10 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 6 + successThreshold: 1 + # resources: + # requests: + # memory: 256Mi + # cpu: 100m + replicas: 1 + +## +## Redis chart configuration +## +## https://github.com/helm/charts/blob/master/stable/redis/values.yaml +## +redis: + enabled: true + # image: + # tag: + # password: "" + usePassword: false + cluster: + enabled: true + master: + persistence: + enabled: true + slave: + persistence: + enabled: true + +## If the Redis included in the chart is disabled, Harbor will use below +## Redis parameters to connect to an external Redis server. +## +externalRedis: + ## All of these values are only used when redis.enabled is set to false + ## Redis host + host: localhost + ## Redis port number + port: 6379 + ## Redis password + password: "" + # The "coreDatabaseIndex" must be "0" as the library Harbor + # used doesn't support configuring it + coreDatabaseIndex: "0" + jobserviceDatabaseIndex: "1" + registryDatabaseIndex: "2" + chartmuseumDatabaseIndex: "3" + +## +## PostgreSQL chart configuration +## +## https://github.com/helm/charts/blob/master/stable/postgresql/values.yaml +## +postgresql: + enabled: true + # image: + # tag: + postgresqlUsername: postgres + postgresqlPassword: not-secure-database-password + replication: + enabled: true + persistence: + enabled: true + initdbScripts: + initial-notaryserver.sql: | + CREATE DATABASE notaryserver; + CREATE USER server; + alter user server with encrypted password 'password'; + GRANT ALL PRIVILEGES ON DATABASE notaryserver TO server; + initial-notarysigner.sql: | + CREATE DATABASE notarysigner; + CREATE USER signer; + alter user signer with encrypted password 'password'; + GRANT ALL PRIVILEGES ON DATABASE notarysigner TO signer; + initial-registry.sql: | + CREATE DATABASE registry ENCODING 'UTF8'; + \c registry; + CREATE TABLE schema_migrations(version bigint not null primary key, dirty boolean not null); + +## If the PostgreSQL database included in the chart is disabled, Harbor will +## use below parameters to connect to an external PostgreSQL server. +## +externalDatabase: + ## All of these values are only used when postgresql.enabled is set to false + ## Database host + host: localhost + ## non-root Username for portal Database + user: bn_harbor + ## Database password + password: "" + ## Database name + database: bitnami_harbor + ## Database port number + port: 5432 + ## External database ssl mode + ##sslmode: + ## External database name for core + ##coreDatabase: + ## External database name for clair + ##clairDatabase: + ## External database name for notaryserver + ##notaryServerDatabase: + ## External database name for notaryserver + ##notarySignerDatabase: diff --git a/bitnami/harbor/values.yaml b/bitnami/harbor/values.yaml new file mode 100644 index 000000000..2b303f6ca --- /dev/null +++ b/bitnami/harbor/values.yaml @@ -0,0 +1,836 @@ +## Global Docker image parameters +## Please, note that this will override the image parameters, including dependencies, configured to use the global value +## Current available global Docker image parameters: imageRegistry and imagePullSecrets +## +# global: +# imageRegistry: myRegistryName +# imagePullSecrets: +# - myRegistryKeySecretName + +## Bitnami Harbor Core image +## ref: https://hub.docker.com/r/bitnami/harbor-core/tags/ +## +coreImage: + registry: docker.io + repository: bitnami/harbor-core + tag: 1.8.1-debian-9-r3 + ## Specify a imagePullPolicy + ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' + ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images + ## + pullPolicy: IfNotPresent + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## + # pullSecrets: + # - myRegistryKeySecretName + + ## Set to true if you would like to see extra information on logs + ## It turns BASH and NAMI debugging in minideb + ## ref: https://github.com/bitnami/minideb-extras/#turn-on-bash-debugging + debug: false + +## Bitnami Harbor Portal image +## ref: https://hub.docker.com/r/bitnami/harbor-portal/tags/ +## +portalImage: + registry: docker.io + repository: bitnami/harbor-portal + tag: 1.8.1-debian-9-r0 + ## Specify a imagePullPolicy + ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' + ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images + ## + pullPolicy: IfNotPresent + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## + # pullSecrets: + # - myRegistryKeySecretName + + ## Set to true if you would like to see extra information on logs + ## It turns BASH and NAMI debugging in minideb + ## ref: https://github.com/bitnami/minideb-extras/#turn-on-bash-debugging + debug: false + +## Bitnami Harbor Job Service image +## ref: https://hub.docker.com/r/bitnami/harbor-jobservice/tags/ +## +jobserviceImage: + registry: docker.io + repository: bitnami/harbor-jobservice + tag: 1.8.1-debian-9-r3 + ## Specify a imagePullPolicy + ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' + ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images + ## + pullPolicy: IfNotPresent + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## + # pullSecrets: + # - myRegistryKeySecretName + + ## Set to true if you would like to see extra information on logs + ## It turns BASH and NAMI debugging in minideb + ## ref: https://github.com/bitnami/minideb-extras/#turn-on-bash-debugging + debug: false + +## Bitnami Harbor Registry image +## ref: https://hub.docker.com/r/bitnami/harbor-registry/tags/ +## +registryImage: + registry: docker.io + repository: bitnami/harbor-registry + tag: 1.8.1-debian-9-r3 + ## Specify a imagePullPolicy + ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' + ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images + ## + pullPolicy: IfNotPresent + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## + # pullSecrets: + # - myRegistryKeySecretName + + ## Set to true if you would like to see extra information on logs + ## It turns BASH and NAMI debugging in minideb + ## ref: https://github.com/bitnami/minideb-extras/#turn-on-bash-debugging + debug: false + +## Bitnami Harbor Registryctl image +## ref: https://hub.docker.com/r/bitnami/harbor-registryctl/tags/ +## +registryctlImage: + registry: docker.io + repository: bitnami/harbor-registryctl + tag: 1.8.1-debian-9-r3 + ## Specify a imagePullPolicy + ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' + ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images + ## + pullPolicy: IfNotPresent + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## + # pullSecrets: + # - myRegistryKeySecretName + + ## Set to true if you would like to see extra information on logs + ## It turns BASH and NAMI debugging in minideb + ## ref: https://github.com/bitnami/minideb-extras/#turn-on-bash-debugging + debug: false + +## Bitnami Harbor Clair image +## ref: https://hub.docker.com/r/bitnami/harbor-clair/tags/ +## +clairImage: + registry: docker.io + repository: bitnami/harbor-clair + tag: 1.8.1-debian-9-r3 + ## Specify a imagePullPolicy + ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' + ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images + ## + pullPolicy: IfNotPresent + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## + # pullSecrets: + # - myRegistryKeySecretName + + ## Set to true if you would like to see extra information on logs + ## It turns BASH and NAMI debugging in minideb + ## ref: https://github.com/bitnami/minideb-extras/#turn-on-bash-debugging + debug: false + +## Bitnami Harbor Notary Server image +## ref: https://hub.docker.com/r/bitnami/harbor-notary-server/tags/ +## +notaryServerImage: + registry: docker.io + repository: bitnami/harbor-notary-server + tag: 1.8.1-debian-9-r3 + ## Specify a imagePullPolicy + ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' + ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images + ## + pullPolicy: IfNotPresent + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## + # pullSecrets: + # - myRegistryKeySecretName + + ## Set to true if you would like to see extra information on logs + ## It turns BASH and NAMI debugging in minideb + ## ref: https://github.com/bitnami/minideb-extras/#turn-on-bash-debugging + debug: false + +## Bitnami Harbor Notary Signer image +## ref: https://hub.docker.com/r/bitnami/harbor-notary-signer/tags/ +## +notarySignerImage: + registry: docker.io + repository: bitnami/harbor-notary-signer + tag: 1.8.1-debian-9-r3 + ## Specify a imagePullPolicy + ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' + ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images + ## + pullPolicy: IfNotPresent + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## + # pullSecrets: + # - myRegistryKeySecretName + + ## Set to true if you would like to see extra information on logs + ## It turns BASH and NAMI debugging in minideb + ## ref: https://github.com/bitnami/minideb-extras/#turn-on-bash-debugging + debug: false + +## Bitnami Nginx image +## ref: https://hub.docker.com/r/bitnami/nginx/tags/ +## +nginxImage: + registry: docker.io + repository: bitnami/nginx + tag: 1.16.0-debian-9-r72 + ## Specify a imagePullPolicy + ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' + ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images + ## + pullPolicy: IfNotPresent + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## + # pullSecrets: + # - myRegistryKeySecretName + + ## Set to true if you would like to see extra information on logs + ## It turns BASH and NAMI debugging in minideb + ## ref: https://github.com/bitnami/minideb-extras/#turn-on-bash-debugging + debug: false + +service: + # Set the way how to expose the service. Set the type as "Ingress", + # "ClusterIP", "NodePort" or "LoadBalancer" and fill the information + # in the corresponding section + type: ClusterIP + tls: + # Enable the tls or not. Note: if the type is "ingress" and the tls + # is disabled, the port must be included in the command when pull/push + # images. Refer to https://github.com/goharbor/harbor/issues/5291 + # for the detail. + enabled: true + # Fill the name of secret if you want to use your own TLS certificate. + # The secret must contain keys named: + # "tls.crt" - the certificate + # "tls.key" - the private key + # "ca.crt" - the certificate of CA + # These files will be generated automatically if the "secretName" is not set + secretName: "" + # By default, the Notary service will use the same cert and key as + # described above. Fill the name of secret if you want to use a + # separated one. Only needed when the type is "ingress". + notarySecretName: "" + # The commmon name used to generate the certificate, it's necessary + # when the type isn't "ingress" and "secretName" is null + commonName: "" + ingress: + hosts: + core: core.harbor.domain + notary: notary.harbor.domain + # set to the type of ingress controller if it has specific requirements. + # leave as `default` for most ingress controllers. + # set to `gce` if using the GCE ingress controller + controller: default + annotations: + ingress.kubernetes.io/ssl-redirect: "true" + ingress.kubernetes.io/proxy-body-size: "0" + nginx.ingress.kubernetes.io/ssl-redirect: "true" + nginx.ingress.kubernetes.io/proxy-body-size: "0" + clusterIP: + # The name of ClusterIP service + name: harbor + ports: + # The service port Harbor listens on when serving with HTTP + httpPort: 80 + # The service port Harbor listens on when serving with HTTPS + httpsPort: 443 + # The service port Notary listens on. Only needed when notary.enabled + # is set to true + notaryPort: 4443 + nodePort: + # The name of NodePort service + name: harbor + ports: + http: + # The service port Harbor listens on when serving with HTTP + port: 80 + # The node port Harbor listens on when serving with HTTP + nodePort: 30002 + https: + # The service port Harbor listens on when serving with HTTPS + port: 443 + # The node port Harbor listens on when serving with HTTPS + nodePort: 30003 + # Only needed when notary.enabled is set to true + notary: + # The service port Notary listens on + port: 4443 + # The node port Notary listens on + nodePort: 30004 + loadBalancer: + # The name of LoadBalancer service + name: harbor + ports: + # The service port Harbor listens on when serving with HTTP + httpPort: 80 + # The service port Harbor listens on when serving with HTTPS + httpsPort: 443 + # The service port Notary listens on. Only needed when notary.enabled + # is set to true + notaryPort: 4443 + +# The external URL for Harbor core service. It is used to +# 1) populate the docker/helm commands showed on portal +# 2) populate the token service URL returned to docker/notary client +# +# Format: protocol://domain[:port]. Usually: +# 1) if "service.type" is "ingress", the "domain" should be +# the value of "service.ingress.hosts.core" +# 2) if "service.type" is "clusterIP", the "domain" should be +# the value of "service.clusterIP.name" +# 3) if "service.type" is "nodePort", the "domain" should be +# the IP address of k8s node +# +# If Harbor is deployed behind the proxy, set it as the URL of proxy +externalURL: https://core.harbor.domain + +## Kubernetes Security Context +## https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ +## +securityContext: + enabled: true + fsGroup: 1001 + runAsUser: 1001 + +# The persistence is enabled by default and a default StorageClass +# is needed in the k8s cluster to provision volumes dynamicly. +# Specify another StorageClass in the "storageClass" or set "existingClaim" +# if you have already existing persistent volumes to use +# +# For storing images and charts, you can also use "azure", "gcs", "s3", +# "swift" or "oss". Set it in the "imageChartStorage" section +persistence: + enabled: true + # Setting it to "keep" to avoid removing PVCs during a helm delete + # operation. Leaving it empty will delete PVCs after the chart deleted + resourcePolicy: "keep" + persistentVolumeClaim: + registry: + # Use the existing PVC which must be created manually before bound, + # and specify the "subPath" if the PVC is shared with other components + # If your storage type is `filesystem` and you deploy more than 1 registry replica, the existing PVC must be ReadWriteMany. + existingClaim: "" + # Specify the "storageClass" used to provision the volume. Or the default + # StorageClass will be used(the default). + # Set it to "-" to disable dynamic provisioning + storageClass: "" + subPath: "" + accessMode: ReadWriteOnce + size: 5Gi + jobservice: + # Use the existing PVC which must be created manually before bound, + # and specify the "subPath" if the PVC is shared with other components + # If you deploy more than 1 jobservice replica, the existing PVC must be ReadWriteMany. + existingClaim: "" + storageClass: "" + subPath: "" + accessMode: ReadWriteOnce + size: 1Gi + # Define which storage backend is used for registry and chartmuseum to store + # images and charts. Refer to + # https://github.com/docker/distribution/blob/master/docs/configuration.md#storage + # for the detail. + imageChartStorage: + # Specify whether to disable `redirect` for images and chart storage, for + # backends which not supported it (such as using minio for `s3` storage type), please disable + # it. To disable redirects, simply set `disableredirect` to `true` instead. + # Refer to + # https://github.com/docker/distribution/blob/master/docs/configuration.md#redirect + # for the detail. + disableredirect: false + # Specify the type of storage: "filesystem", "azure", "gcs", "s3", "swift", + # "oss" and fill the information needed in the corresponding section. The type + # must be "filesystem" if you want to use persistent volumes for registry + # and chartmuseum + type: filesystem + filesystem: + rootdirectory: /storage + #maxthreads: 100 + azure: + accountname: accountname + accountkey: base64encodedaccountkey + container: containername + #realm: core.windows.net + gcs: + bucket: bucketname + # The base64 encoded json file which contains the key + encodedkey: base64-encoded-json-key-file + #rootdirectory: /gcs/object/name/prefix + #chunksize: "5242880" + s3: + region: us-west-1 + bucket: bucketname + #accesskey: awsaccesskey + #secretkey: awssecretkey + #regionendpoint: http://myobjects.local + #encrypt: false + #keyid: mykeyid + #secure: true + #v4auth: true + #chunksize: "5242880" + #rootdirectory: /s3/object/name/prefix + #storageclass: STANDARD + swift: + authurl: https://storage.myprovider.com/v3/auth + username: username + password: password + container: containername + #region: fr + #tenant: tenantname + #tenantid: tenantid + #domain: domainname + #domainid: domainid + #trustid: trustid + #insecureskipverify: false + #chunksize: 5M + #prefix: + #secretkey: secretkey + #accesskey: accesskey + #authversion: 3 + #endpointtype: public + #tempurlcontainerkey: false + #tempurlmethods: + oss: + accesskeyid: accesskeyid + accesskeysecret: accesskeysecret + region: regionname + bucket: bucketname + #endpoint: endpoint + #internal: false + #encrypt: false + #secure: true + #chunksize: 10M + #rootdirectory: rootdirectory + +## The log level used for Harbor services. Possible values are [ fatal | error | warn | info | debug | trace ] +## +logLevel: debug + +## Option to force users to specify passwords (core.secret, harborAdminPassword, and secretKey). That is required for 'helm upgrade' to work properly. +## If it is not forced, random values will be generated. +## +forcePassword: false + +## The initial password of Harbor admin. Change it from portal after launching Harbor +## +## harborAdminPassword: + +## The secret key used for encryption. Must be a string of 16 chars. +## +## secretKey: "not-a-secure-key" + +# If expose the service via "ingress", the Nginx will not be used +nginx: + replicas: 1 + # resources: + # requests: + # memory: 256Mi + # cpu: 100m + ## These values are evaluated as a template (nodeSelector, tolerations and affinity) + nodeSelector: {} + tolerations: [] + affinity: {} + ## Additional deployment annotations + podAnnotations: {} + ## Configure extra options for liveness and readiness probes + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes) + ## + livenessProbe: + enabled: true + initialDelaySeconds: 20 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 6 + successThreshold: 1 + readinessProbe: + enabled: true + initialDelaySeconds: 20 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 6 + successThreshold: 1 + +portal: + replicas: 1 + # resources: + # requests: + # memory: 256Mi + # cpu: 100m + ## These values are evaluated as a template (nodeSelector, tolerations and affinity) + nodeSelector: {} + tolerations: [] + affinity: {} + ## Additional deployment annotations + podAnnotations: {} + ## Configure extra options for liveness and readiness probes + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes) + ## + livenessProbe: + enabled: true + initialDelaySeconds: 20 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 6 + successThreshold: 1 + readinessProbe: + enabled: true + initialDelaySeconds: 20 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 6 + successThreshold: 1 + +core: + replicas: 1 + # resources: + # requests: + # memory: 256Mi + # cpu: 100m + ## These values are evaluated as a template (nodeSelector, tolerations and affinity) + nodeSelector: {} + tolerations: [] + affinity: {} + ## Additional deployment annotations + podAnnotations: {} + # Secret is used when core server communicates with other components. + # If a secret key is not specified, Helm will generate one. + # Must be a string of 16 chars. + secret: "" + # Fill the name of a kubernetes secret if you want to use your own + # TLS certificate and private key for token encryption/decryption. + # The secret must contain keys named: + # "tls.crt" - the certificate + # "tls.key" - the private key + # The default key pair will be used if it isn't set + secretName: "" + ## Configure extra options for liveness and readiness probes + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes) + ## + livenessProbe: + enabled: true + initialDelaySeconds: 20 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 6 + successThreshold: 1 + readinessProbe: + enabled: true + initialDelaySeconds: 20 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 6 + successThreshold: 1 + +jobservice: + replicas: 1 + maxJobWorkers: 10 + # The logger for jobs: "file", "database" or "stdout" + jobLogger: file + # resources: + # requests: + # memory: 256Mi + # cpu: 100m + ## These values are evaluated as a template (nodeSelector, tolerations and affinity) + nodeSelector: {} + tolerations: [] + affinity: {} + ## Additional deployment annotations + podAnnotations: {} + # Secret is used when job service communicates with other components. + # If a secret key is not specified, Helm will generate one. + # Must be a string of 16 chars. + secret: "" + ## Configure extra options for liveness and readiness probes + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes) + ## + livenessProbe: + enabled: true + initialDelaySeconds: 20 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 6 + successThreshold: 1 + readinessProbe: + enabled: true + initialDelaySeconds: 20 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 6 + successThreshold: 1 + +registry: + registry: + ## Configure extra options for liveness and readiness probes + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes) + ## + livenessProbe: + enabled: true + initialDelaySeconds: 10 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 6 + successThreshold: 1 + readinessProbe: + enabled: true + initialDelaySeconds: 10 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 6 + successThreshold: 1 + # resources: + # requests: + # memory: 256Mi + # cpu: 100m + controller: + ## Configure extra options for liveness and readiness probes + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes) + ## + livenessProbe: + enabled: true + initialDelaySeconds: 10 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 6 + successThreshold: 1 + readinessProbe: + enabled: true + initialDelaySeconds: 10 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 6 + successThreshold: 1 + # resources: + # requests: + # memory: 256Mi + # cpu: 100m + replicas: 1 + ## These values are evaluated as a template (nodeSelector, tolerations and affinity) + nodeSelector: {} + tolerations: [] + affinity: {} + ## Additional deployment annotations + podAnnotations: {} + # Secret is used to secure the upload state from client + # and registry storage backend. + # See: https://github.com/docker/distribution/blob/master/docs/configuration.md#http + # If a secret key is not specified, Helm will generate one. + # Must be a string of 16 chars. + secret: "" + +# Enable Chartmuseum is not supported yet. +chartmuseum: + enabled: false + +clair: + enabled: true + replicas: 1 + # The http(s) proxy used to update vulnerabilities database from internet + httpProxy: + httpsProxy: + # The interval of clair updaters, the unit is hour, set to 0 to + # disable the updaters + updatersInterval: 12 + # resources: + # requests: + # memory: 256Mi + # cpu: 100m + nodeSelector: {} + tolerations: [] + affinity: {} + ## Additional deployment annotations + podAnnotations: {} + ## Configure extra options for liveness and readiness probes + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes) + ## + livenessProbe: + enabled: true + initialDelaySeconds: 20 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 6 + successThreshold: 1 + readinessProbe: + enabled: true + initialDelaySeconds: 20 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 6 + successThreshold: 1 + +notary: + enabled: true + server: + ## Configure extra options for liveness and readiness probes + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes) + ## + livenessProbe: + enabled: true + initialDelaySeconds: 10 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 6 + successThreshold: 1 + readinessProbe: + enabled: true + initialDelaySeconds: 10 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 6 + successThreshold: 1 + # resources: + # requests: + # memory: 256Mi + # cpu: 100m + signer: + ## Configure extra options for liveness and readiness probes + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes) + ## + livenessProbe: + enabled: true + initialDelaySeconds: 10 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 6 + successThreshold: 1 + readinessProbe: + enabled: true + initialDelaySeconds: 10 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 6 + successThreshold: 1 + # resources: + # requests: + # memory: 256Mi + # cpu: 100m + replicas: 1 + +## +## Redis chart configuration +## +## https://github.com/helm/charts/blob/master/stable/redis/values.yaml +## +redis: + enabled: true + # image: + # tag: + # password: "" + usePassword: false + cluster: + enabled: false + master: + persistence: + enabled: true + slave: + persistence: + enabled: true + +## If the Redis included in the chart is disabled, Harbor will use below +## Redis parameters to connect to an external Redis server. +## +externalRedis: + ## All of these values are only used when redis.enabled is set to false + ## Redis host + host: localhost + ## Redis port number + port: 6379 + ## Redis password + password: "" + # The "coreDatabaseIndex" must be "0" as the library Harbor + # used doesn't support configuring it + coreDatabaseIndex: "0" + jobserviceDatabaseIndex: "1" + registryDatabaseIndex: "2" + chartmuseumDatabaseIndex: "3" + +## +## PostgreSQL chart configuration +## +## https://github.com/helm/charts/blob/master/stable/postgresql/values.yaml +## +postgresql: + enabled: true + # image: + # tag: + postgresqlUsername: postgres + postgresqlPassword: not-secure-database-password + replication: + enabled: false + persistence: + enabled: true + initdbScripts: + initial-notaryserver.sql: | + CREATE DATABASE notaryserver; + CREATE USER server; + alter user server with encrypted password 'password'; + GRANT ALL PRIVILEGES ON DATABASE notaryserver TO server; + initial-notarysigner.sql: | + CREATE DATABASE notarysigner; + CREATE USER signer; + alter user signer with encrypted password 'password'; + GRANT ALL PRIVILEGES ON DATABASE notarysigner TO signer; + initial-registry.sql: | + CREATE DATABASE registry ENCODING 'UTF8'; + \c registry; + CREATE TABLE schema_migrations(version bigint not null primary key, dirty boolean not null); + +## If the PostgreSQL database included in the chart is disabled, Harbor will +## use below parameters to connect to an external PostgreSQL server. +## +externalDatabase: + ## All of these values are only used when postgresql.enabled is set to false + ## Database host + host: localhost + ## non-root Username for portal Database + user: bn_harbor + ## Database password + password: "" + ## Database name + database: bitnami_harbor + ## Database port number + port: 5432 + ## External database ssl mode + ##sslmode: + ## External database name for core + ##coreDatabase: + ## External database name for clair + ##clairDatabase: + ## External database name for notaryserver + ##notaryServerDatabase: + ## External database name for notaryserver + ##notarySignerDatabase: