From 8cc149aee52a944ece263e8bfa57fa1f80fe14f6 Mon Sep 17 00:00:00 2001 From: David Young Date: Wed, 25 Aug 2021 03:30:19 +1200 Subject: [PATCH] [harbor] Add upstream "ipFamily" parameters (#7292) * Add upstream "ipFamily" parameters Signed-off-by: David Young * Add params for readme generation Signed-off-by: David Young * Trim trailing spaces Signed-off-by: David Young * Bump chart version to keep up! Signed-off-by: David Young * Remove blank line (ct is fussy!) Signed-off-by: David Young * Add newline Signed-off-by: David Young --- bitnami/harbor/Chart.yaml | 2 +- bitnami/harbor/README.md | 6 ++++++ bitnami/harbor/templates/nginx/configmap-http.yaml | 4 ++++ bitnami/harbor/templates/nginx/configmap-https.yaml | 12 ++++++++++++ bitnami/harbor/templates/portal/portal-cm.yaml | 8 ++++++++ bitnami/harbor/values.yaml | 13 +++++++++++++ 6 files changed, 44 insertions(+), 1 deletion(-) diff --git a/bitnami/harbor/Chart.yaml b/bitnami/harbor/Chart.yaml index d025700d3..3f9343c65 100644 --- a/bitnami/harbor/Chart.yaml +++ b/bitnami/harbor/Chart.yaml @@ -34,4 +34,4 @@ sources: - https://github.com/bitnami/bitnami-docker-harbor-registry - https://github.com/bitnami/bitnami-docker-harbor-registryctl - https://goharbor.io/ -version: 10.2.8 +version: 10.2.9 diff --git a/bitnami/harbor/README.md b/bitnami/harbor/README.md index fdf6f2cf2..a82e28f13 100644 --- a/bitnami/harbor/README.md +++ b/bitnami/harbor/README.md @@ -124,6 +124,12 @@ Additionally, if `persistence.resourcePolicy` is set to `keep`, you should manua | `ingress.controller` | The ingress controller type. Currently supports `default`, `gce` and `ncp` | `default` | | `ingress.annotations` | Ingress annotations done as key:value pairs | `{}` | +### IP family parameters + +| Name | Description | Value | +| ------------------------- | ----------------------------------------------- | ----- | +| `ipFamily.ipv6.enabled` | Enable listening on IPv6 (`[::]`) for nginx-based components (nginx,portal) - Note that enabling ipv6 will cause nginx to crash on start on systems with IPv6 disabled using the `ipv6.disable` kernel flag | `true` +| `ipFamily.ipv4.enabled` | If ipv4 is enabled in cluster, all ipv4 related configs will set correspondly, but currently it only affects the nginx related components | `true` ### Persistence Parameters diff --git a/bitnami/harbor/templates/nginx/configmap-http.yaml b/bitnami/harbor/templates/nginx/configmap-http.yaml index 734ed7b51..d0382adcc 100644 --- a/bitnami/harbor/templates/nginx/configmap-http.yaml +++ b/bitnami/harbor/templates/nginx/configmap-http.yaml @@ -50,8 +50,12 @@ data: access_log /dev/stdout timed_combined; server { + {{- if .Values.ipFamily.ipv4.enabled}} listen 8080; + {{- end}} + {{- if .Values.ipFamily.ipv6.enabled }} listen [::]:8080; + {{- end }} server_tokens off; # disable any limits to avoid HTTP 413 for large image uploads client_max_body_size 0; diff --git a/bitnami/harbor/templates/nginx/configmap-https.yaml b/bitnami/harbor/templates/nginx/configmap-https.yaml index 5e25a1cd7..cf277af51 100644 --- a/bitnami/harbor/templates/nginx/configmap-https.yaml +++ b/bitnami/harbor/templates/nginx/configmap-https.yaml @@ -58,8 +58,12 @@ data: {{- if .Values.notary.enabled }} server { + {{- if .Values.ipFamily.ipv4.enabled }} listen 4443 ssl; + {{- end}} + {{- if .Values.ipFamily.ipv6.enabled}} listen [::]:4443 ssl; + {{- end }} server_tokens off; # ssl ssl_certificate /etc/nginx/cert/tls.crt; @@ -94,8 +98,12 @@ data: {{- end }} server { + {{- if .Values.ipFamily.ipv4.enabled }} listen 8443 ssl; + {{- end}} + {{- if .Values.ipFamily.ipv6.enabled }} listen [::]:8443 ssl; + {{- end }} server_tokens off; # SSL ssl_certificate /etc/nginx/cert/tls.crt; @@ -226,8 +234,12 @@ data: } } server { + {{- if .Values.ipFamily.ipv4.enabled }} listen 8080; + {{- end}} + {{- if .Values.ipFamily.ipv6.enabled }} listen [::]:8080; + {{- end}} return 301 https://$host$request_uri; } } diff --git a/bitnami/harbor/templates/portal/portal-cm.yaml b/bitnami/harbor/templates/portal/portal-cm.yaml index 71970de96..17a2098cb 100644 --- a/bitnami/harbor/templates/portal/portal-cm.yaml +++ b/bitnami/harbor/templates/portal/portal-cm.yaml @@ -25,8 +25,12 @@ data: scgi_temp_path /tmp/scgi_temp; server { {{- if .Values.internalTLS.enabled }} + {{- if .Values.ipFamily.ipv4.enabled}} listen {{ template "harbor.portal.containerPort" . }} ssl; + {{- end }} + {{- if .Values.ipFamily.ipv6.enabled}} listen [::]:{{ template "harbor.portal.containerPort" . }} ssl; + {{- end }} # SSL ssl_certificate /etc/harbor/ssl/portal/tls.crt; ssl_certificate_key /etc/harbor/ssl/portal/tls.key; @@ -37,9 +41,13 @@ data: ssl_prefer_server_ciphers on; ssl_session_cache shared:SSL:10m; {{- else }} + {{- if .Values.ipFamily.ipv4.enabled }} listen {{ template "harbor.portal.containerPort" . }}; + {{- end }} + {{- if .Values.ipFamily.ipv6.enabled}} listen [::]:{{ template "harbor.portal.containerPort" . }}; {{- end }} + {{- end }} server_name localhost; root /opt/bitnami/harbor; index index.html index.htm; diff --git a/bitnami/harbor/values.yaml b/bitnami/harbor/values.yaml index 6856e3264..0720c9956 100644 --- a/bitnami/harbor/values.yaml +++ b/bitnami/harbor/values.yaml @@ -88,6 +88,19 @@ volumePermissions: ## internalTLS: enabled: false + +ipFamily: + ## Enable listening on IPv6 ([::]) for nginx-based components (nginx,portal) + ## Note that enabling ipv6 will cause nginx to crash on start on systems + ## with IPv6 disabled using the `ipv6.disable` kernel flag) + ## @param ipFamily.ipv6.enabled Enable listening on IPv6 ([::]) for nginx-based components (nginx,portal) + ipv6: + enabled: true + ## ipv4Enabled set to true if ipv4 is enabled in cluster + ## @param ipFamily.ipv4.enabled Enable listening on IPv4 for nginx-based components (nginx,portal) + ipv4: + enabled: true + ## @param caBundleSecretName The custom ca bundle secret name, the secret must contain key named "ca.crt" which will be injected into the trust store for chartmuseum, clair, core, jobservice, registry, trivy components. ## caBundleSecretName: ""