home/charts
2
0
Fork 0
mirror of https://github.com/wahyd4/charts.git synced 2026-08-22 19:48:25 +10:00
Code Issues Packages Projects Releases Wiki Activity

[bitnami/harbor] Chart standardized (#9263)

Browse Source 
* [bitnami/harbor] Chart standardized

Signed-off-by: juan131 <juanariza@vmware.com>

* Update Clair image

Signed-off-by: juan131 <juanariza@vmware.com>

* Requested changes

Signed-off-by: juan131 <juanariza@vmware.com>

* Remove unused parameter

Signed-off-by: juan131 <juanariza@vmware.com>

* Apply suggestions from code review

Co-authored-by: Fran Mulero <fmulero@vmware.com>
Signed-off-by: juan131 <juanariza@vmware.com>

* Update bitnami/harbor/templates/notary/notary-svc.yaml

Co-authored-by: Fran Mulero <fmulero@vmware.com>
Signed-off-by: juan131 <juanariza@vmware.com>

* Fix checksum

Signed-off-by: juan131 <juanariza@vmware.com>

* Add parameters to configure service ports

Signed-off-by: juan131 <juanariza@vmware.com>

* Update README.md

Signed-off-by: juan131 <juanariza@vmware.com>

* Fix NGINX config

Signed-off-by: juan131 <juanariza@vmware.com>

* Rebase master

Signed-off-by: juan131 <juanariza@vmware.com>

* Fix typo in clair probes

Signed-off-by: juan131 <juanariza@vmware.com>

* Fix printf

Signed-off-by: juan131 <juanariza@vmware.com>

* Fix printf

Signed-off-by: juan131 <juanariza@vmware.com>

* Fix port + run readme-generator

Signed-off-by: juan131 <juanariza@vmware.com>

* Update Chart.yaml

* Update Chart.lock

* Recalculate Chart.lock

Signed-off-by: juan131 <juanariza@vmware.com>

* [bitnami/harbor] Update components versions

Signed-off-by: Bitnami Containers <containers@bitnami.com>

Co-authored-by: Fran Mulero <fmulero@vmware.com>
Co-authored-by: Carlos Rodríguez Hernández <carlosrh@vmware.com>
Co-authored-by: Bitnami Containers <containers@bitnami.com>
This commit is contained in:
Juan Ariza Toledano
2022-03-04 18:47:45 +01:00
committed by GitHub
co-authored by Fran Mulero Carlos Rodríguez Hernández Bitnami Containers
parent fd4d96a889
commit fd8ac4929d
57 changed files with 5282 additions and 4506 deletions
Download Patch File Download Diff File Expand all files Collapse all files
bitnami/harbor/Chart.lock
+4 -4
View File
@@ -1,12 +1,12 @@
dependencies:
- name: redis
repository: https://charts.bitnami.com/bitnami
version: 15.7.6
version: 16.4.5
- name: postgresql
repository: https://charts.bitnami.com/bitnami
version: 10.16.2
version: 11.1.3
- name: common
repository: https://charts.bitnami.com/bitnami
version: 1.11.3
digest: sha256:1f02461905972fa5b358f14eb441ac4558d26a9a3c9c1fb26df3c6da6e807057
generated: "2022-03-04T15:36:54.029938649Z"
digest: sha256:d769f97794c944c9962ed65f8cceda3b0bee7a740a06310aca12c2455f7afca1
generated: "2022-03-04T18:35:03.666442+01:00"
bitnami/harbor/Chart.yaml
+3 -3
View File
@@ -6,11 +6,11 @@ dependencies:
- condition: redis.enabled
name: redis
repository: https://charts.bitnami.com/bitnami
version: 15.x.x
version: 16.x.x
- condition: postgresql.enabled
name: postgresql
repository: https://charts.bitnami.com/bitnami
version: 10.x.x
version: 11.x.x
- name: common
repository: https://charts.bitnami.com/bitnami
version: 1.x.x
@@ -34,4 +34,4 @@ sources:
- https://github.com/bitnami/bitnami-docker-harbor-registry
- https://github.com/bitnami/bitnami-docker-harbor-registryctl
- https://goharbor.io/
version: 11.2.6
version: 12.0.0
bitnami/harbor/README.md
+1013 -926
View File
File diff suppressed because it is too large Load Diff
bitnami/harbor/ci/values-production.yaml
+24 -7
View File
@@ -1,15 +1,32 @@
# Test values file for generating all of the yaml and check that
# the rendering is correct
ingress:
enabled: true
volumePermissions:
enabled: true
exposureType: ingress
internalTLS:
enabled: true
redis:
ingress:
core:
hostname: core.harbor.domain
annotations:
kubernetes.io/ingress.class: nginx
ingress.kubernetes.io/ssl-redirect: 'true'
ingress.kubernetes.io/proxy-body-size: '0'
nginx.ingress.kubernetes.io/ssl-redirect: 'true'
nginx.ingress.kubernetes.io/proxy-body-size: '0'
tls: true
selfSigned: true
notary:
hostname: notary.harbor.domain
annotations:
ingress.kubernetes.io/ssl-redirect: 'true'
ingress.kubernetes.io/proxy-body-size: '0'
nginx.ingress.kubernetes.io/ssl-redirect: 'true'
nginx.ingress.kubernetes.io/proxy-body-size: '0'
kubernetes.io/ingress.class: nginx
tls: true
selfSigned: true
volumePermissions:
enabled: true
architecture: standalone
bitnami/harbor/conf/clair.yaml
+3 -3
View File
@@ -8,9 +8,9 @@ clair:
cachesize: 16384
api:
# API server port
port: 6060
healthport: 6061
port: {{ .Values.clair.server.containerPorts.api }}
healthport: {{ .Values.clair.server.containerPorts.health }}
# Deadline before an API request will respond with a 503
timeout: 300s
updater:
interval: {{ .Values.clair.updatersInterval }}h
interval: {{ .Values.clair.updatersInterval }}
bitnami/harbor/templates/NOTES.txt
+16 -36
View File
@@ -6,45 +6,45 @@ APP VERSION: {{ .Chart.AppVersion }}
1. Get the Harbor URL:
{{- if .Values.ingress.enabled }}
{{- if eq .Values.exposureType "ingress" }}
You should be able to access your new Harbor installation through {{ include "harbor.externalUrl" . }}
{{- else if contains "LoadBalancer" .Values.service.type }}
{{- else if and (eq .Values.exposureType "proxy") (eq .Values.service.type "LoadBalancer") }}
NOTE: It may take a few minutes for the LoadBalancer IP to be available.
Watch the status with: 'kubectl get svc --namespace {{ .Release.Namespace }} -w {{ include "common.names.fullname" . }}'
{{- $port:=.Values.service.ports.http | toString }}
export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "common.names.fullname" . }} --template "{{ "{{ range (index .status.loadBalancer.ingress 0) }}{{ . }}{{ end }}" }}")
echo "Harbor URL: http://$SERVICE_IP{{- if ne $port "80" }}:{{ .Values.service.ports.http }}{{ end }}/"
{{- $port:=.Values.service.ports.http | toString }}
export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "common.names.fullname" . }} --template "{{ "{{ range (index .status.loadBalancer.ingress 0) }}{{ . }}{{ end }}" }}")
echo "Harbor URL: http://$SERVICE_IP{{- if ne $port "80" }}:{{ .Values.service.ports.http }}{{ end }}/"
{{- else if contains "ClusterIP" .Values.service.type }}
{{- else if and (eq .Values.exposureType "proxy") (eq .Values.service.type "ClusterIP") }}
{{- if .Values.service.tls.enabled }}
{{- if .Values.nginx.tls.enabled }}
echo "Harbor URL: https://127.0.0.1:8443/"
kubectl port-forward --namespace {{ .Release.Namespace }} svc/{{ include "common.names.fullname" . }} 8443:{{ .Values.service.ports.https }}
echo "Harbor URL: https://127.0.0.1:8443/"
kubectl port-forward --namespace {{ .Release.Namespace }} svc/{{ include "common.names.fullname" . }} 8443:{{ .Values.service.ports.https }}
{{- else }}
echo "Harbor URL: http://127.0.0.1:8080/"
kubectl port-forward --namespace {{ .Release.Namespace }} svc/{{ include "common.names.fullname" . }} 8080:{{ .Values.service.ports.http }}
echo "Harbor URL: http://127.0.0.1:8080/"
kubectl port-forward --namespace {{ .Release.Namespace }} svc/{{ include "common.names.fullname" . }} 8080:{{ .Values.service.ports.http }}
{{- end }}
{{- else if contains "NodePort" .Values.service.type }}
{{- else if and (eq .Values.exposureType "proxy") (eq .Values.service.type "NodePort") }}
export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "common.names.fullname" . }})
export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
echo "Harbor URL: http://$NODE_IP:$NODE_PORT/"
export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "common.names.fullname" . }})
export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
echo "Harbor URL: http://$NODE_IP:$NODE_PORT/"
{{- end }}
2. Login with the following credentials to see your Harbor application
echo Username: "admin"
echo Password: $(kubectl get secret --namespace {{ .Release.Namespace }} {{ template "harbor.core" . }}-envvars -o jsonpath="{.data.HARBOR_ADMIN_PASSWORD}" | base64 --decode)
echo Password: $(kubectl get secret --namespace {{ .Release.Namespace }} {{ printf "%s-envvars" (include "harbor.core" .) }} -o jsonpath="{.data.HARBOR_ADMIN_PASSWORD}" | base64 --decode)
{{- if .Values.clair.enabled }}
@@ -59,23 +59,3 @@ https://goharbor.io/docs/latest/administration/vulnerability-scanning/pluggable-
{{ include "harbor.validateValues" . }}
{{ include "harbor.checkRollingTags" . }}
{{- $passwordValidationErrors := list -}}
{{- $harborSecretName := printf "%s-envvars" (include "harbor.core" .) -}}
{{- $requiredAdminPassword := dict "valueKey" "harborAdminPassword" "secret" $harborSecretName "field" "HARBOR_ADMIN_PASSWORD" -}}
{{- $requiredHarborErrors := include "common.validations.values.multiple.empty" (dict "required" (list $requiredAdminPassword) "context" $) -}}
{{- $passwordValidationErrors = append $passwordValidationErrors $requiredHarborErrors -}}
{{- $postgresqlSecretName := include "harbor.postgresql.fullname" . -}}
{{- $postgresqlPasswordValidationErrors := include "common.validations.values.postgresql.passwords" (dict "secret" $postgresqlSecretName "subchart" true "context" $) -}}
{{- $passwordValidationErrors = append $passwordValidationErrors $postgresqlPasswordValidationErrors -}}
{{- if .Values.redis.auth.enabled -}}
{{- $redisSecretName := printf "%s-%s" .Release.Name "redis" -}}
{{- $requiredRedisPassword := dict "valueKey" "redis.auth.password" "secret" $redisSecretName "field" "redis-password" -}}
{{- $redisPasswordValidationErrors := include "common.validations.values.multiple.empty" (dict "required" (list $requiredRedisPassword) "context" $) -}}
{{- $passwordValidationErrors = append $passwordValidationErrors $redisPasswordValidationErrors -}}
{{- end -}}
{{- include "common.errors.upgrade.passwords.empty" (dict "validationErrors" $passwordValidationErrors "context" $) -}}
bitnami/harbor/templates/_helpers.tpl
+146 -437
View File
@@ -4,34 +4,31 @@ Expand the name of the chart.
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
*/}}
{{- define "harbor.autoGenCert" -}}
{{- if and .Values.service.tls.enabled (not .Values.service.tls.existingSecret) -}}
{{- printf "true" -}}
{{- else -}}
{{- printf "false" -}}
{{- end -}}
{{/*
Set the http prefix if the externalURl doesn't have it
*/}}
{{- define "harbor.externalUrl" -}}
{{- if hasPrefix "http" .Values.externalURL -}}
{{- print .Values.externalURL -}}
{{- else if and (eq .Values.exposureType "proxy") .Values.nginx.tls.enabled -}}
{{- printf "https://%s" .Values.externalURL -}}
{{- else if and (eq .Values.exposureType "ingress") .Values.ingress.core.tls -}}
{{- printf "https://%s" .Values.externalURL -}}
{{- else -}}
{{- printf "http://%s" .Values.externalURL -}}
{{- end -}}
{{- define "harbor.autoGenCertForIngress" -}}
{{- if and (eq (include "harbor.autoGenCert" .) "true") .Values.ingress.enabled -}}
{{- printf "true" -}}
{{- else -}}
{{- printf "false" -}}
{{- end -}}
{{- end -}}
{{- define "harbor.autoGenCertForNginx" -}}
{{- if and (eq (include "harbor.autoGenCert" .) "true") (not .Values.ingress.enabled) -}}
{{- printf "true" -}}
{{- else -}}
{{- printf "false" -}}
{{- end -}}
{{- if and (eq .Values.exposureType "proxy") .Values.nginx.tls.enabled (not .Values.nginx.tls.existingSecret) -}}
{{- true -}}
{{- end -}}
{{- end -}}
{{- define "harbor.caBundleVolume" -}}
- name: ca-bundle-certs
secret:
secretName: {{ .Values.caBundleSecretName }}
secretName: {{ .Values.internalTLS.caBundleSecret }}
{{- end -}}
{{- define "harbor.caBundleVolumeMount" -}}
@@ -40,187 +37,34 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this
subPath: ca.crt
{{- end -}}
{{/* Scheme for all components except notary because it only support http mode */}}
{{- define "harbor.component.scheme" -}}
{{- if .Values.internalTLS.enabled -}}
{{- printf "https" -}}
{{- else -}}
{{- printf "http" -}}
{{- end -}}
{{- end -}}
{{/* Chartmuseum component container port */}}
{{- define "harbor.chartmuseum.containerPort" -}}
{{- if .Values.internalTLS.enabled -}}
{{- printf "9443" -}}
{{- else -}}
{{- printf "9999" -}}
{{- end -}}
{{- end -}}
{{/* Chartmuseum component service port */}}
{{- define "harbor.chartmuseum.servicePort" -}}
{{- if .Values.internalTLS.enabled -}}
{{- printf "443" -}}
{{- else -}}
{{- printf "80" -}}
{{- end -}}
{{- end -}}
{{/* Clair Adapter component container port */}}
{{- define "harbor.clairAdapter.containerPort" -}}
{{- if .Values.internalTLS.enabled -}}
{{- printf "8443" -}}
{{- else -}}
{{- printf "8080" -}}
{{- end -}}
{{- end -}}
{{/* Clair Adapter component service port */}}
{{- define "harbor.clairAdapter.servicePort" -}}
{{- if .Values.internalTLS.enabled -}}
{{- printf "8443" -}}
{{- else -}}
{{- printf "8080" -}}
{{- end -}}
{{- end -}}
{{/* Core component container port */}}
{{- define "harbor.core.containerPort" -}}
{{- if .Values.internalTLS.enabled -}}
{{- printf "8443" -}}
{{- else -}}
{{- printf "8080" -}}
{{- end -}}
{{- end -}}
{{/* Core component service port */}}
{{- define "harbor.core.servicePort" -}}
{{- if .Values.internalTLS.enabled -}}
{{- printf "443" -}}
{{- else -}}
{{- printf "80" -}}
{{- end -}}
{{- end -}}
{{/* Jobservice component container port */}}
{{- define "harbor.jobservice.containerPort" -}}
{{- if .Values.internalTLS.enabled -}}
{{- printf "8443" -}}
{{- else -}}
{{- printf "8080" -}}
{{- end -}}
{{- end -}}
{{/* Jobservice component service port */}}
{{- define "harbor.jobservice.servicePort" -}}
{{- if .Values.internalTLS.enabled -}}
{{- printf "443" -}}
{{- else -}}
{{- printf "80" -}}
{{- end -}}
{{- end -}}
{{/* Portal component container port */}}
{{- define "harbor.portal.containerPort" -}}
{{- if .Values.internalTLS.enabled -}}
{{- printf "8443" -}}
{{- else -}}
{{- printf "8080" -}}
{{- end -}}
{{- end -}}
{{/* Portal component service port */}}
{{- define "harbor.portal.servicePort" -}}
{{- if .Values.internalTLS.enabled -}}
{{- printf "443" -}}
{{- else -}}
{{- printf "80" -}}
{{- end -}}
{{- end -}}
{{/* Registry server component container port */}}
{{- define "harbor.registry.containerPort" -}}
{{- if .Values.internalTLS.enabled -}}
{{- printf "5443" -}}
{{- else -}}
{{- printf "5000" -}}
{{- end -}}
{{- end -}}
{{/* Registry server component service port */}}
{{- define "harbor.registry.servicePort" -}}
{{- if .Values.internalTLS.enabled -}}
{{- printf "5443" -}}
{{- else -}}
{{- printf "5000" -}}
{{- end -}}
{{- end -}}
{{/* RegistryCtl component container port */}}
{{- define "harbor.registryCtl.containerPort" -}}
{{- if .Values.internalTLS.enabled -}}
{{- printf "8443" -}}
{{- else -}}
{{- printf "8080" -}}
{{- end -}}
{{- end -}}
{{/* RegistryCtl component service port */}}
{{- define "harbor.registryctl.servicePort" -}}
{{- if .Values.internalTLS.enabled -}}
{{- printf "8443" -}}
{{- else -}}
{{- printf "8080" -}}
{{- end -}}
{{- end -}}
{{/* Trivy component container port */}}
{{- define "harbor.trivy.containerPort" -}}
{{- if .Values.internalTLS.enabled -}}
{{- printf "8443" -}}
{{- else -}}
{{- printf "8080" -}}
{{- end -}}
{{- end -}}
{{/* Trivy component service port */}}
{{- define "harbor.trivy.servicePort" -}}
{{- if .Values.internalTLS.enabled -}}
{{- printf "8443" -}}
{{- else -}}
{{- printf "8080" -}}
{{- end -}}
{{- end -}}
{{/* Clair Adadpter URL */}}
{{/* Harbor Adapter for Clair URL */}}
{{- define "harbor.clairAdapter.url" -}}
{{- printf "%s://%s:%s" (include "harbor.component.scheme" .) (include "harbor.clair" .) (include "harbor.clairAdapter.servicePort" .) -}}
{{- printf "%s://%s:%d" (ternary "https" "http" .Values.internalTLS.enabled) (include "harbor.clair" .) (ternary .Values.clair.adapter.service.ports.https .Values.clair.adapter.service.ports.http .Values.internalTLS.enabled | int ) -}}
{{- end -}}
{{/* port is included in this url as a workaround for issue https://github.com/aquasecurity/harbor-scanner-trivy/issues/108 */}}
{{- define "harbor.core.url" -}}
{{- printf "%s://%s:%s" (include "harbor.component.scheme" .) (include "harbor.core" .) (include "harbor.core.servicePort" .) -}}
{{- printf "%s://%s:%d" (ternary "https" "http" .Values.internalTLS.enabled) (include "harbor.core" .) (ternary .Values.core.service.ports.https .Values.core.service.ports.http .Values.internalTLS.enabled | int) -}}
{{- end -}}
{{- define "harbor.jobservice.url" -}}
{{- printf "%s://%s-jobservice" (include "harbor.component.scheme" .) (include "common.names.fullname" .) -}}
{{- printf "%s://%s-jobservice:%d" (ternary "https" "http" .Values.internalTLS.enabled) (include "common.names.fullname" .) (ternary .Values.jobservice.service.ports.https .Values.jobservice.service.ports.http .Values.internalTLS.enabled | int) -}}
{{- end -}}
{{- define "harbor.portal.url" -}}
{{- printf "%s://%s" (include "harbor.component.scheme" .) (include "harbor.portal" .) -}}
{{- printf "%s://%s:%d" (ternary "https" "http" .Values.internalTLS.enabled) (include "harbor.portal" .) (ternary .Values.portal.service.ports.https .Values.portal.service.ports.http .Values.internalTLS.enabled | int) -}}
{{- end -}}
{{- define "harbor.chartmuseum.url" -}}
{{- printf "%s://%s" (include "harbor.component.scheme" .) (include "harbor.chartmuseum" .) -}}
{{- printf "%s://%s:%d" (ternary "https" "http" .Values.internalTLS.enabled) (include "harbor.chartmuseum" .) (ternary .Values.chartmuseum.service.ports.https .Values.chartmuseum.service.ports.http .Values.internalTLS.enabled | int) -}}
{{- end -}}
{{- define "harbor.registry.url" -}}
{{- printf "%s://%s:%s" (include "harbor.component.scheme" .) (include "harbor.registry" .) (include "harbor.registry.servicePort" .) -}}
{{- printf "%s://%s:%d" (ternary "https" "http" .Values.internalTLS.enabled) (include "harbor.registry" .) (ternary .Values.registry.server.service.ports.https .Values.registry.server.service.ports.http .Values.internalTLS.enabled | int ) -}}
{{- end -}}
{{- define "harbor.registryCtl.url" -}}
{{- printf "%s://%s:%s" (include "harbor.component.scheme" .) (include "harbor.registry" .) (include "harbor.registryctl.servicePort" .) -}}
{{- printf "%s://%s:%d" (ternary "https" "http" .Values.internalTLS.enabled) (include "harbor.registry" .) (ternary .Values.registry.controller.service.ports.https .Values.registry.controller.service.ports.http .Values.internalTLS.enabled | int ) -}}
{{- end -}}
{{- define "harbor.tokenService.url" -}}
@@ -228,7 +72,7 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this
{{- end -}}
{{- define "harbor.trivy.url" -}}
{{- printf "%s://%s:%s" (include "harbor.component.scheme" .) (include "harbor.trivy" .) (include "harbor.trivy.servicePort" .) -}}
{{- printf "%s://%s:%d" (ternary "https" "http" .Values.internalTLS.enabled) (include "harbor.trivy" .) (ternary .Values.trivy.service.ports.https .Values.trivy.service.ports.http .Values.internalTLS.enabled | int) -}}
{{- end -}}
{{- define "harbor.core.tls.secretName" -}}
@@ -270,112 +114,63 @@ Create a default fully qualified postgresql name.
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
*/}}
{{- define "harbor.postgresql.fullname" -}}
{{- $name := default "postgresql" .Values.postgresql.nameOverride -}}
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
{{- include "common.names.dependency.fullname" (dict "chartName" "postgresql" "chartValues" .Values.postgresql "context" $) -}}
{{- end -}}
{{- define "harbor.database.host" -}}
{{- if eq .Values.postgresql.enabled true -}}
{{- template "harbor.postgresql.fullname" . }}
{{- else -}}
{{- .Values.externalDatabase.host -}}
{{- end -}}
{{- if eq .Values.postgresql.architecture "replication" }}
{{- ternary (printf "%s-primary" (include "harbor.postgresql.fullname" .)) .Values.externalDatabase.host .Values.postgresql.enabled -}}
{{- else }}
{{- ternary (include "harbor.postgresql.fullname" .) .Values.externalDatabase.host .Values.postgresql.enabled -}}
{{- end -}}
{{- end -}}
{{- define "harbor.database.port" -}}
{{- if eq .Values.postgresql.enabled true -}}
{{- printf "%s" "5432" -}}
{{- else -}}
{{- .Values.externalDatabase.port -}}
{{- end -}}
{{- ternary "5432" .Values.externalDatabase.port .Values.postgresql.enabled -}}
{{- end -}}
{{- define "harbor.database.username" -}}
{{- if eq .Values.postgresql.enabled true -}}
{{- .Values.postgresql.postgresqlUsername -}}
{{- else -}}
{{- .Values.externalDatabase.user -}}
{{- end -}}
{{- ternary "postgres" .Values.externalDatabase.user .Values.postgresql.enabled -}}
{{- end -}}
{{- define "harbor.database.clairUsername" -}}
{{- if eq .Values.postgresql.enabled true -}}
{{- .Values.postgresql.postgresqlUsername -}}
{{- else -}}
{{- if .Values.externalDatabase.clairUsername -}}
{{- .Values.externalDatabase.clairUsername -}}
{{- else -}}
{{- .Values.externalDatabase.user -}}
{{- end -}}
{{- end -}}
{{- ternary "postgres" (default .Values.externalDatabase.user .Values.externalDatabase.clairUsername) .Values.postgresql.enabled -}}
{{- end -}}
{{- define "harbor.database.notaryServerUsername" -}}
{{- if eq .Values.postgresql.enabled true -}}
{{- .Values.postgresql.postgresqlUsername -}}
{{- else -}}
{{- if .Values.externalDatabase.notaryServerUsername -}}
{{- .Values.externalDatabase.notaryServerUsername -}}
{{- else -}}
{{- .Values.externalDatabase.user -}}
{{- end -}}
{{- end -}}
{{- ternary "postgres" (default .Values.externalDatabase.user .Values.externalDatabase.notaryServerUsername) .Values.postgresql.enabled -}}
{{- end -}}
{{- define "harbor.database.notarySignerUsername" -}}
{{- if eq .Values.postgresql.enabled true -}}
{{- .Values.postgresql.postgresqlUsername -}}
{{- else -}}
{{- if .Values.externalDatabase.notarySignerUsername -}}
{{- .Values.externalDatabase.notarySignerUsername -}}
{{- else -}}
{{- .Values.externalDatabase.user -}}
{{- end -}}
{{- end -}}
{{- ternary "postgres" (default .Values.externalDatabase.user .Values.externalDatabase.notarySignerUsername) .Values.postgresql.enabled -}}
{{- end -}}
{{- define "harbor.database.rawPassword" -}}
{{- if eq .Values.postgresql.enabled true -}}
{{- .Values.postgresql.postgresqlPassword -}}
{{- else -}}
{{- .Values.externalDatabase.password -}}
{{- end -}}
{{- if .Values.postgresql.enabled }}
{{- if .Values.global.postgresql }}
{{- if .Values.global.postgresql.auth }}
{{- coalesce .Values.global.postgresql.auth.postgresPassword .Values.postgresql.auth.postgresPassword -}}
{{- else -}}
{{- .Values.postgresql.auth.postgresPassword -}}
{{- end -}}
{{- else -}}
{{- .Values.postgresql.auth.postgresPassword -}}
{{- end -}}
{{- else -}}
{{- .Values.externalDatabase.password -}}
{{- end -}}
{{- end -}}
{{- define "harbor.database.clairRawPassword" -}}
{{- if eq .Values.postgresql.enabled true -}}
{{- .Values.postgresql.postgresqlPassword -}}
{{- else -}}
{{- if .Values.externalDatabase.clairPassword -}}
{{- .Values.externalDatabase.clairPassword -}}
{{- else -}}
{{- .Values.externalDatabase.password -}}
{{- end -}}
{{- end -}}
{{- ternary (include "harbor.database.rawPassword" .) (default .Values.externalDatabase.password .Values.externalDatabase.clairPassword) .Values.postgresql.enabled -}}
{{- end -}}
{{- define "harbor.database.notaryServerRawPassword" -}}
{{- if eq .Values.postgresql.enabled true -}}
{{- .Values.postgresql.postgresqlPassword -}}
{{- else -}}
{{- if .Values.externalDatabase.notaryServerPassword -}}
{{- .Values.externalDatabase.notaryServerPassword -}}
{{- else -}}
{{- .Values.externalDatabase.password -}}
{{- end -}}
{{- end -}}
{{- ternary (include "harbor.database.rawPassword" .) (default .Values.externalDatabase.password .Values.externalDatabase.notaryServerPassword) .Values.postgresql.enabled -}}
{{- end -}}
{{- define "harbor.database.notarySignerRawPassword" -}}
{{- if eq .Values.postgresql.enabled true -}}
{{- .Values.postgresql.postgresqlPassword -}}
{{- else -}}
{{- if .Values.externalDatabase.notarySignerPassword -}}
{{- .Values.externalDatabase.notarySignerPassword -}}
{{- else -}}
{{- .Values.externalDatabase.password -}}
{{- end -}}
{{- end -}}
{{- ternary (include "harbor.database.rawPassword" .) (default .Values.externalDatabase.password .Values.externalDatabase.notarySignerPassword) .Values.postgresql.enabled -}}
{{- end -}}
{{- define "harbor.database.escapedClairRawPassword" -}}
@@ -399,43 +194,23 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this
{{- end -}}
{{- define "harbor.database.coreDatabase" -}}
{{- if eq .Values.postgresql.enabled true -}}
{{- printf "%s" "registry" -}}
{{- else -}}
{{- .Values.externalDatabase.coreDatabase -}}
{{- end -}}
{{- ternary "registry" .Values.externalDatabase.coreDatabase .Values.postgresql.enabled -}}
{{- end -}}
{{- define "harbor.database.clairDatabase" -}}
{{- if eq .Values.postgresql.enabled true -}}
{{- printf "%s" "postgres" -}}
{{- else -}}
{{- .Values.externalDatabase.clairDatabase -}}
{{- end -}}
{{- ternary "postgres" .Values.externalDatabase.clairDatabase .Values.postgresql.enabled -}}
{{- end -}}
{{- define "harbor.database.notaryServerDatabase" -}}
{{- if eq .Values.postgresql.enabled true -}}
{{- printf "%s" "notaryserver" -}}
{{- else -}}
{{- .Values.externalDatabase.notaryServerDatabase -}}
{{- end -}}
{{- ternary "notaryserver" .Values.externalDatabase.notaryServerDatabase .Values.postgresql.enabled -}}
{{- end -}}
{{- define "harbor.database.notarySignerDatabase" -}}
{{- if eq .Values.postgresql.enabled true -}}
{{- printf "%s" "notarysigner" -}}
{{- else -}}
{{- .Values.externalDatabase.notarySignerDatabase -}}
{{- end -}}
{{- ternary "notarysigner" .Values.externalDatabase.notarySignerDatabase .Values.postgresql.enabled -}}
{{- end -}}
{{- define "harbor.database.sslmode" -}}
{{- if eq .Values.postgresql.enabled true -}}
{{- printf "%s" "disable" -}}
{{- else -}}
{{- .Values.externalDatabase.sslmode -}}
{{- end -}}
{{- ternary "disable" .Values.externalDatabase.sslmode .Values.postgresql.enabled -}}
{{- end -}}
{{- define "harbor.database.clair" -}}
@@ -450,79 +225,51 @@ postgres://{{ template "harbor.database.notaryServerUsername" . }}:{{ template "
postgres://{{ template "harbor.database.notarySignerUsername" . }}:{{ template "harbor.database.escapedNotarySignerRawPassword" . }}@{{ template "harbor.database.host" . }}:{{ template "harbor.database.port" . }}/{{ template "harbor.database.notarySignerDatabase" . }}?sslmode={{ template "harbor.database.sslmode" . }}
{{- end -}}
Create a default fully qualified redis name.
{{/*
Create a default fully qualified app name
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
*/}}
{{- define "harbor.redis.fullname" -}}
{{- $name := default "redis" .Values.redis.nameOverride -}}
{{- printf "%s-%s-master" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
{{- include "common.names.dependency.fullname" (dict "chartName" "redis" "chartValues" .Values.redis "context" $) -}}
{{- end -}}
{{- define "harbor.redis.host" -}}
{{- if eq .Values.redis.enabled true -}}
{{- template "harbor.redis.fullname" . -}}
{{- else -}}
{{- if eq .Values.externalRedis.sentinel.enabled true -}}
{{- .Values.externalRedis.sentinel.hosts -}}/{{- .Values.externalRedis.sentinel.masterSet -}}
{{- else -}}
{{- .Values.externalRedis.host -}}
{{- end -}}
{{- end -}}
{{- ternary (printf "%s-master" (include "harbor.redis.fullname" .)) (ternary (printf "%s/%s" .Values.externalRedis.sentinel.hosts .Values.externalRedis.sentinel.masterSet) .Values.externalRedis.host .Values.externalRedis.sentinel.enabled) .Values.redis.enabled -}}
{{- end -}}
{{- define "harbor.redis.port" -}}
{{- if eq .Values.redis.enabled true -}}
{{- printf "%s" "6379" -}}
{{- else -}}
{{- .Values.externalRedis.port -}}
{{- end -}}
{{- ternary "6379" .Values.externalRedis.port .Values.redis.enabled -}}
{{- end -}}
{{- define "harbor.redis.coreDatabaseIndex" -}}
{{- if eq .Values.redis.enabled true -}}
{{- printf "%s" "0" }}
{{- else -}}
{{- .Values.externalRedis.coreDatabaseIndex -}}
{{- end -}}
{{- ternary "0" .Values.externalRedis.coreDatabaseIndex .Values.redis.enabled -}}
{{- end -}}
{{- define "harbor.redis.jobserviceDatabaseIndex" -}}
{{- if eq .Values.redis.enabled true -}}
{{- printf "%s" "1" }}
{{- else -}}
{{- .Values.externalRedis.jobserviceDatabaseIndex -}}
{{- end -}}
{{- ternary "1" .Values.externalRedis.jobserviceDatabaseIndex .Values.redis.enabled -}}
{{- end -}}
{{- define "harbor.redis.registryDatabaseIndex" -}}
{{- if eq .Values.redis.enabled true -}}
{{- printf "%s" "2" }}
{{- else -}}
{{- .Values.externalRedis.registryDatabaseIndex -}}
{{- end -}}
{{- ternary "2" .Values.externalRedis.registryDatabaseIndex .Values.redis.enabled -}}
{{- end -}}
{{- define "harbor.redis.chartmuseumDatabaseIndex" -}}
{{- if eq .Values.redis.enabled true -}}
{{- printf "%s" "3" }}
{{- else -}}
{{- .Values.externalRedis.chartmuseumDatabaseIndex -}}
{{- end -}}
{{- ternary "3" .Values.externalRedis.chartmuseumDatabaseIndex .Values.redis.enabled -}}
{{- end -}}
{{- define "harbor.redis.clairAdapterDatabaseIndex" -}}
{{- if eq .Values.redis.enabled true -}}
{{- printf "%s" "4" -}}
{{- else -}}
{{- .Values.externalRedis.clairAdapterDatabaseIndex -}}
{{- end -}}
{{- ternary "4" .Values.externalRedis.clairAdapterDatabaseIndex .Values.redis.enabled -}}
{{- end -}}
{{- define "harbor.redis.trivyAdapterDatabaseIndex" -}}
{{- ternary "5" .Values.externalRedis.trivyAdapterDatabaseIndex .Values.redis.enabled -}}
{{- end -}}
{{/*
Return whether Redis&trade; uses password authentication or not
*/}}
{{- define "harbor.redis.auth.enabled" -}}
{{- if or (and .Values.redis.enabled .Values.redis.auth.enabled) (and (not .Values.redis.enabled) (or .Values.externalRedis.password .Values.externalRedis.existingSecret)) }}
{{- if or .Values.redis.auth.enabled (and (not .Values.redis.enabled) .Values.externalRedis.password) }}
{{- true -}}
{{- end -}}
{{- end -}}
@@ -536,14 +283,6 @@ Return whether Redis&trade; uses password authentication or not
{{- end -}}
{{- end -}}
{{- define "harbor.redis.trivyAdapterDatabaseIndex" -}}
{{- if .Values.redis.enabled -}}
{{- printf "%s" "5" -}}
{{- else -}}
{{- .Values.externalRedis.trivyAdapterDatabaseIndex -}}
{{- end -}}
{{- end -}}
{{- define "harbor.redis.escapedRawPassword" -}}
{{- if (include "harbor.redis.rawPassword" . ) -}}
{{- include "harbor.redis.rawPassword" . | urlquery | replace "+" "%20" -}}
@@ -696,136 +435,85 @@ Return whether Redis&trade; uses password authentication or not
{{/*
Return the proper Harbor Core image name
*/}}
{{- define "harbor.coreImage" -}}
{{- include "common.images.image" ( dict "imageRoot" .Values.coreImage "global" .Values.global ) -}}
{{- define "harbor.core.image" -}}
{{- include "common.images.image" ( dict "imageRoot" .Values.core.image "global" .Values.global ) -}}
{{- end -}}
{{/*
Return the proper Harbor Portal image name
*/}}
{{- define "harbor.portalImage" -}}
{{- include "common.images.image" ( dict "imageRoot" .Values.portalImage "global" .Values.global ) -}}
{{- define "harbor.portal.image" -}}
{{- include "common.images.image" ( dict "imageRoot" .Values.portal.image "global" .Values.global ) -}}
{{- end -}}
{{/*
Return the proper Harbor Trivy Adapter image name
*/}}
{{- define "harbor.trivyImage" -}}
{{- include "common.images.image" ( dict "imageRoot" .Values.trivyImage "global" .Values.global ) -}}
{{- define "harbor.trivy.image" -}}
{{- include "common.images.image" ( dict "imageRoot" .Values.trivy.image "global" .Values.global ) -}}
{{- end -}}
{{/*
Return the proper Harbor Job Service image name
*/}}
{{- define "harbor.jobserviceImage" -}}
{{- include "common.images.image" ( dict "imageRoot" .Values.jobserviceImage "global" .Values.global ) -}}
{{- define "harbor.jobservice.image" -}}
{{- include "common.images.image" ( dict "imageRoot" .Values.jobservice.image "global" .Values.global ) -}}
{{- end -}}
{{/*
Return the proper ChartMuseum image name
*/}}
{{- define "harbor.chartMuseumImage" -}}
{{- include "common.images.image" ( dict "imageRoot" .Values.chartMuseumImage "global" .Values.global ) -}}
{{- define "harbor.chartmuseum.image" -}}
{{- include "common.images.image" ( dict "imageRoot" .Values.chartmuseum.image "global" .Values.global ) -}}
{{- end -}}
{{/*
Return the proper Harbor Notary Server image name
*/}}
{{- define "harbor.notaryServerImage" -}}
{{- include "common.images.image" ( dict "imageRoot" .Values.notaryServerImage "global" .Values.global ) -}}
{{- define "harbor.notary.server.image" -}}
{{- include "common.images.image" ( dict "imageRoot" .Values.notary.server.image "global" .Values.global ) -}}
{{- end -}}
{{/*
Return the proper Harbor Notary Signer image name
*/}}
{{- define "harbor.notarySignerImage" -}}
{{- include "common.images.image" ( dict "imageRoot" .Values.notarySignerImage "global" .Values.global ) -}}
{{- define "harbor.notary.signer.image" -}}
{{- include "common.images.image" ( dict "imageRoot" .Values.notary.signer.image "global" .Values.global ) -}}
{{- end -}}
{{/*
Return the proper Harbor Registry image name
*/}}
{{- define "harbor.registryImage" -}}
{{- include "common.images.image" ( dict "imageRoot" .Values.registryImage "global" .Values.global ) -}}
{{- define "harbor.registry.server.image" -}}
{{- include "common.images.image" ( dict "imageRoot" .Values.registry.server.image "global" .Values.global ) -}}
{{- end -}}
{{/*
Return the proper Harbor Registryctl image name
*/}}
{{- define "harbor.registryctlImage" -}}
{{- include "common.images.image" ( dict "imageRoot" .Values.registryctlImage "global" .Values.global ) -}}
{{- define "harbor.registry.controller.image" -}}
{{- include "common.images.image" ( dict "imageRoot" .Values.registry.controller.image "global" .Values.global ) -}}
{{- end -}}
{{/*
Return the proper Harbor Clair image name
*/}}
{{- define "harbor.clairImage" -}}
{{- include "common.images.image" ( dict "imageRoot" .Values.clairImage "global" .Values.global ) -}}
{{- define "harbor.clair.server.image" -}}
{{- include "common.images.image" ( dict "imageRoot" .Values.clair.server.image "global" .Values.global ) -}}
{{- end -}}
{{/*
Return the proper Harbor Clair image name
*/}}
{{- define "harbor.clairAdapterImage" -}}
{{- include "common.images.image" ( dict "imageRoot" .Values.clairAdapterImage "global" .Values.global ) -}}
{{- define "harbor.clair.adapter.image" -}}
{{- include "common.images.image" ( dict "imageRoot" .Values.clair.adapter.image "global" .Values.global ) -}}
{{- end -}}
{{/*
Return the proper Nginx image name
*/}}
{{- define "harbor.nginxImage" -}}
{{- include "common.images.image" ( dict "imageRoot" .Values.nginxImage "global" .Values.global ) -}}
{{- end -}}
{{/*
Return the proper Docker Image Registry Secret Names
*/}}
{{- define "harbor.imagePullSecrets" -}}
{{- include "common.images.pullSecrets" (dict "images" (list .Values.coreImage .Values.portalImage .Values.jobserviceImage .Values.clairImage .Values.clairAdapterImage .Values.trivyImage .Values.notaryServerImage .Values.notarySignerImage .Values.registryImage .Values.registryctlImage .Values.nginxImage .Values.volumePermissions.image) "global" .Values.global) -}}
{{- end -}}
{{/* Check if there are rolling tags in the images */}}
{{- define "harbor.checkRollingTags" -}}
{{- include "common.warnings.rollingTag" .Values.coreImage -}}
{{- include "common.warnings.rollingTag" .Values.portalImage -}}
{{- include "common.warnings.rollingTag" .Values.jobserviceImage -}}
{{- include "common.warnings.rollingTag" .Values.registryImage -}}
{{- include "common.warnings.rollingTag" .Values.registryctlImage -}}
{{- include "common.warnings.rollingTag" .Values.clairImage -}}
{{- include "common.warnings.rollingTag" .Values.clairAdapterImage -}}
{{- include "common.warnings.rollingTag" .Values.trivyImage -}}
{{- include "common.warnings.rollingTag" .Values.volumePermissions.image -}}
{{- end -}}
{{/*
Compile all warnings into a single message, and call fail.
*/}}
{{- define "harbor.validateValues" -}}
{{- $messages := list -}}
{{- $messages := append $messages (include "harbor.validateValues.postgresqlPassword" .) -}}
{{- $messages := without $messages "" -}}
{{- $message := join "\n" $messages -}}
{{- if $message -}}
{{- printf "\nVALUES VALIDATION:\n%s" $message | fail -}}
{{- end -}}
{{- end -}}
{{/* Validate .Values of Harbor - must provide a password for PostgreSQL */}}
{{- define "harbor.validateValues.postgresqlPassword" -}}
{{- if eq .Values.postgresql.enabled true -}}
{{- if not .Values.postgresql.postgresqlPassword -}}
harbor: PostgreSQL password
A database password is required!.
Please set a passsord (--set postgresql.postgresqlPassword="xxxx")
{{- end -}}
{{- else -}}
{{- if not .Values.externalDatabase.password -}}
harbor: External PostgreSQL password
An external database password is required!.
Please set a passsord (--set externalDatabase.password="xxxx")
{{- end -}}
{{- end -}}
{{- define "harbor.nginx.image" -}}
{{- include "common.images.image" ( dict "imageRoot" .Values.nginx.image "global" .Values.global ) -}}
{{- end -}}
{{/*
@@ -836,42 +524,63 @@ Return the proper image name (for the init container volume-permissions image)
{{- end -}}
{{/*
Return the proper Storage Class for chartmuseum
Return the proper Docker Image Registry Secret Names
*/}}
{{- define "harbor.chartmuseum.storageClass" -}}
{{- include "common.storage.class" ( dict "persistence" .Values.persistence.persistentVolumeClaim.chartmuseum "global" .Values.global ) -}}
{{- define "harbor.imagePullSecrets" -}}
{{- include "common.images.pullSecrets" (dict "images" (list .Values.core.image .Values.portal.image .Values.jobservice.image .Values.clair.server.image .Values.clair.adapter.image .Values.chartmuseum.image .Values.trivy.image .Values.notary.server.image .Values.notary.signer.image .Values.registry.server.image .Values.registry.controller.image .Values.nginx.image .Values.volumePermissions.image) "global" .Values.global) -}}
{{- end -}}
{{/* Check if there are rolling tags in the images */}}
{{- define "harbor.checkRollingTags" -}}
{{- include "common.warnings.rollingTag" .Values.core.image -}}
{{- include "common.warnings.rollingTag" .Values.portal.image -}}
{{- include "common.warnings.rollingTag" .Values.jobservice.image -}}
{{- include "common.warnings.rollingTag" .Values.registry.server.image -}}
{{- include "common.warnings.rollingTag" .Values.registry.controller.image -}}
{{- include "common.warnings.rollingTag" .Values.clair.server.image -}}
{{- include "common.warnings.rollingTag" .Values.clair.adapter.image -}}
{{- include "common.warnings.rollingTag" .Values.chartmuseum.image -}}
{{- include "common.warnings.rollingTag" .Values.trivy.image -}}
{{- include "common.warnings.rollingTag" .Values.volumePermissions.image -}}
{{- end -}}
{{/*
Return the proper Storage Class for jobservice
Compile all warnings into a single message, and call fail.
*/}}
{{- define "harbor.jobservice.storageClass" -}}
{{- include "common.storage.class" ( dict "persistence" .Values.persistence.persistentVolumeClaim.jobservice "global" .Values.global ) -}}
{{- define "harbor.validateValues" -}}
{{- $messages := list -}}
{{- $messages := append $messages (include "harbor.validateValues.postgresqlPassword" .) -}}
{{- $messages := append $messages (include "harbor.validateValues.exposureType" .) -}}
{{- $messages := without $messages "" -}}
{{- $message := join "\n" $messages -}}
{{- if $message -}}
{{- printf "\nVALUES VALIDATION:\n%s" $message | fail -}}
{{- end -}}
{{- end -}}
{{/*
Return the proper Storage Class for registry
*/}}
{{- define "harbor.registry.storageClass" -}}
{{- include "common.storage.class" ( dict "persistence" .Values.persistence.persistentVolumeClaim.registry "global" .Values.global ) -}}
{{- end -}}
{{/*
Return the proper Storage Class for trivy
*/}}
{{- define "harbor.trivy.storageClass" -}}
{{- include "common.storage.class" ( dict "persistence" .Values.persistence.persistentVolumeClaim.trivy "global" .Values.global ) -}}
{{- end -}}
{{/*
Set the http prefix if the externalURl dont have it
*/}}
{{- define "harbor.externalUrl" -}}
{{- if hasPrefix "http" .Values.externalURL -}}
{{- print .Values.externalURL -}}
{{- else if .Values.service.tls.enabled -}}
{{- printf "https://%s" .Values.externalURL -}}
{{/* Validate values of Harbor - must provide a password for PostgreSQL */}}
{{- define "harbor.validateValues.postgresqlPassword" -}}
{{- if .Values.postgresql.enabled -}}
{{- if empty (include "harbor.database.rawPassword" .) -}}
harbor: PostgreSQL password
A database password is required!.
Please set a password (--set postgresql.auth.postgresPassword="xxxx")
{{- end -}}
{{- else -}}
{{- printf "http://%s" .Values.externalURL -}}
{{- if not .Values.externalDatabase.password -}}
harbor: External PostgreSQL password
An external database password is required!.
Please set a password (--set externalDatabase.password="xxxx")
{{- end -}}
{{- end -}}
{{- end -}}
{{/* Validate values of Harbor - must provide a valid exposureType */}}
{{- define "harbor.validateValues.exposureType" -}}
{{- if and (ne .Values.exposureType "ingress") (ne .Values.exposureType "proxy") -}}
harbor: exposureType
Invalid exposureType selected. Valid values are "ingress" and
"proxy". Please set a valid exposureType (--set exposureType="xxxx")
{{- end -}}
{{- end -}}
bitnami/harbor/templates/chartmuseum/chartmuseum-cm-envvars.yaml
+4 -3
View File
@@ -2,7 +2,8 @@
apiVersion: v1
kind: ConfigMap
metadata:
name: {{ include "harbor.chartmuseum" . }}-envvars
name: {{ printf "%s-envvars" (include "harbor.chartmuseum" .) }}
namespace: {{ .Release.Namespace | quote }}
labels: {{- include "common.labels.standard" . | nindent 4 }}
{{- if .Values.commonLabels }}
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
@@ -12,7 +13,7 @@ metadata:
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
data:
PORT: {{ include "harbor.chartmuseum.containerPort" . | quote }}
PORT: {{ ternary .Values.chartmuseum.containerPorts.https .Values.chartmuseum.containerPorts.http .Values.internalTLS.enabled | quote }}
{{- if .Values.internalTLS.enabled }}
TLS_CERT: "/etc/harbor/ssl/chartmuseum/tls.crt"
TLS_KEY: "/etc/harbor/ssl/chartmuseum/tls.key"
@@ -28,7 +29,7 @@ data:
CHART_URL: {{ printf "%s/%s" ( include "harbor.externalUrl" . ) .Values.chartmuseum.chartRepoName | quote }}
{{- end }}
DEPTH: {{ .Values.chartmuseum.depth | quote }}
{{- if or (eq .Values.logLevel "debug") .Values.chartMuseumImage.debug }}
{{- if or (eq .Values.logLevel "debug") .Values.chartmuseum.image.debug }}
DEBUG: "true"
{{- else }}
DEBUG: "false"
bitnami/harbor/templates/chartmuseum/chartmuseum-dpl.yaml
+88 -78
View File
@@ -3,6 +3,7 @@ apiVersion: {{ template "common.capabilities.deployment.apiVersion" . }}
kind: Deployment
metadata:
name: {{ include "harbor.chartmuseum" . }}
namespace: {{ .Release.Namespace | quote }}
labels: {{- include "common.labels.standard" . | nindent 4 }}
{{- if .Values.commonLabels }}
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
@@ -12,13 +13,13 @@ metadata:
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
spec:
replicas: {{ .Values.chartmuseum.replicas }}
{{- if .Values.chartmuseum.updateStrategy }}
strategy: {{- toYaml .Values.chartmuseum.updateStrategy | nindent 4 }}
{{- end }}
replicas: {{ .Values.chartmuseum.replicaCount }}
selector:
matchLabels: {{- include "common.labels.matchLabels" . | nindent 6 }}
app.kubernetes.io/component: chartmuseum
{{- if .Values.chartmuseum.updateStrategy }}
strategy: {{- toYaml .Values.chartmuseum.updateStrategy | nindent 4 }}
{{- end }}
template:
metadata:
labels: {{- include "common.labels.matchLabels" . | nindent 8 }}
@@ -41,10 +42,10 @@ spec:
{{- end }}
spec:
{{- include "harbor.imagePullSecrets" . | nindent 6 }}
automountServiceAccountToken: {{ .Values.chartmuseum.automountServiceAccountToken }}
{{- if .Values.chartmuseum.priorityClassName }}
priorityClassName: {{ .Values.chartmuseum.priorityClassName | quote }}
{{- if .Values.chartmuseum.hostAliases }}
hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.chartmuseum.hostAliases "context" $) | nindent 8 }}
{{- end }}
automountServiceAccountToken: {{ .Values.chartmuseum.automountServiceAccountToken }}
{{- if .Values.chartmuseum.affinity }}
affinity: {{- include "common.tplvalues.render" (dict "value" .Values.chartmuseum.affinity "context" $) | nindent 8 }}
{{- else }}
@@ -59,78 +60,41 @@ spec:
{{- if .Values.chartmuseum.tolerations }}
tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.chartmuseum.tolerations "context" $) | nindent 8 }}
{{- end }}
{{- if .Values.podSecurityContext }}
securityContext: {{- include "common.tplvalues.render" (dict "value" .Values.podSecurityContext "context" $) | nindent 8 }}
{{- if .Values.chartmuseum.topologySpreadConstraints }}
topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.chartmuseum.topologySpreadConstraints "context" .) | nindent 8 }}
{{- end }}
{{- if .Values.chartmuseum.priorityClassName }}
priorityClassName: {{ .Values.chartmuseum.priorityClassName | quote }}
{{- end }}
{{- if .Values.chartmuseum.schedulerName }}
schedulerName: {{ .Values.chartmuseum.schedulerName }}
{{- end }}
{{- if .Values.chartmuseum.podSecurityContext.enabled }}
securityContext: {{- omit .Values.chartmuseum.podSecurityContext "enabled" | toYaml | nindent 8 }}
{{- end }}
{{- if .Values.chartmuseum.initContainers }}
initContainers: {{- include "common.tplvalues.render" (dict "value" .Values.chartmuseum.initContainers "context" $) | nindent 8 }}
{{- end }}
{{- if .Values.chartmuseum.hostAliases }}
hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.chartmuseum.hostAliases "context" $) | nindent 8 }}
{{- end }}
containers:
- name: chartmuseum
image: {{ include "harbor.chartMuseumImage" . }}
imagePullPolicy: {{ .Values.chartMuseumImage.pullPolicy | quote }}
{{- if .Values.containerSecurityContext }}
securityContext: {{- include "common.tplvalues.render" (dict "value" .Values.containerSecurityContext "context" $) | nindent 12 }}
image: {{ include "harbor.chartmuseum.image" . }}
imagePullPolicy: {{ .Values.chartmuseum.image.pullPolicy | quote }}
{{- if .Values.chartmuseum.containerSecurityContext.enabled }}
securityContext: {{- omit .Values.chartmuseum.containerSecurityContext "enabled" | toYaml | nindent 12 }}
{{- end }}
{{- if .Values.chartmuseum.command }}
{{- if .Values.diagnosticMode.enabled }}
command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }}
{{- else if .Values.chartmuseum.command }}
command: {{- include "common.tplvalues.render" (dict "value" .Values.chartmuseum.command "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.chartmuseum.args }}
{{- if .Values.diagnosticMode.enabled }}
args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }}
{{- else if .Values.chartmuseum.args }}
args: {{- include "common.tplvalues.render" (dict "value" .Values.chartmuseum.args "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.chartmuseum.lifecycleHooks }}
lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.chartmuseum.lifecycleHooks "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.chartmuseum.resources }}
resources: {{- toYaml .Values.chartmuseum.resources | nindent 12 }}
{{- end }}
{{- if .Values.chartmuseum.livenessProbe.enabled }}
livenessProbe:
httpGet:
path: /health
port: http
scheme: {{ include "harbor.component.scheme" . | upper }}
initialDelaySeconds: {{ .Values.chartmuseum.livenessProbe.initialDelaySeconds }}
periodSeconds: {{ .Values.chartmuseum.livenessProbe.periodSeconds }}
timeoutSeconds: {{ .Values.chartmuseum.livenessProbe.timeoutSeconds }}
successThreshold: {{ .Values.chartmuseum.livenessProbe.successThreshold }}
failureThreshold: {{ .Values.chartmuseum.livenessProbe.failureThreshold }}
{{- else if .Values.chartmuseum.customLivenessProbe }}
livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.chartmuseum.customLivenessProbe "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.chartmuseum.readinessProbe.enabled }}
readinessProbe:
httpGet:
path: /health
port: http
scheme: {{ include "harbor.component.scheme" . | upper }}
initialDelaySeconds: {{ .Values.chartmuseum.readinessProbe.initialDelaySeconds }}
periodSeconds: {{ .Values.chartmuseum.readinessProbe.periodSeconds }}
timeoutSeconds: {{ .Values.chartmuseum.readinessProbe.timeoutSeconds }}
successThreshold: {{ .Values.chartmuseum.readinessProbe.successThreshold }}
failureThreshold: {{ .Values.chartmuseum.readinessProbe.failureThreshold }}
{{- else if .Values.chartmuseum.customReadinessProbe }}
readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.chartmuseum.customReadinessProbe "context" $) | nindent 12 }}
{{- end }}
envFrom:
- configMapRef:
name: {{ include "harbor.chartmuseum" . }}-envvars
- secretRef:
name: {{ include "harbor.chartmuseum" . }}-secret
{{- if .Values.chartmuseum.extraEnvVarsCM }}
- configMapRef:
name: {{ include "common.tplvalues.render" (dict "value" .Values.chartmuseum.extraEnvVarsCM "context" $) }}
{{- end }}
{{- if .Values.chartmuseum.extraEnvVarsSecret }}
- secretRef:
name: {{ include "common.tplvalues.render" (dict "value" .Values.chartmuseum.extraEnvVarsSecret "context" $) }}
{{- end }}
env:
- name: DEBUG
value: {{ ternary "1" "0" .Values.chartMuseumImage.debug | quote }}
value: {{ ternary "1" "0" .Values.chartmuseum.image.debug | quote }}
{{- if has "chartmuseum" .Values.proxy.components }}
- name: HTTP_PROXY
value: {{ .Values.proxy.httpProxy | quote }}
@@ -149,18 +113,64 @@ spec:
- name: INTERNAL_TLS_TRUST_CA_PATH
value: /etc/harbor/ssl/chartmuseum/ca.crt
{{- end }}
{{- if .Values.chartmuseum.extraEnvVars }}
{{- include "common.tplvalues.render" (dict "value" .Values.chartmuseum.extraEnvVars "context" $) | nindent 12 }}
{{- end }}
- name: BASIC_AUTH_PASS
valueFrom:
secretKeyRef:
# Take the password from the core component secret
name: {{ include "harbor.core" . }}
key: secret
{{- if .Values.chartmuseum.extraEnvVars }}
{{- include "common.tplvalues.render" (dict "value" .Values.chartmuseum.extraEnvVars "context" $) | nindent 12 }}
{{- end }}
envFrom:
- configMapRef:
name: {{ printf "%s-envvars" (include "harbor.chartmuseum" .) }}
- secretRef:
name: {{ printf "%s-secret" (include "harbor.chartmuseum" .) }}
{{- if .Values.chartmuseum.extraEnvVarsCM }}
- configMapRef:
name: {{ include "common.tplvalues.render" (dict "value" .Values.chartmuseum.extraEnvVarsCM "context" $) }}
{{- end }}
{{- if .Values.chartmuseum.extraEnvVarsSecret }}
- secretRef:
name: {{ include "common.tplvalues.render" (dict "value" .Values.chartmuseum.extraEnvVarsSecret "context" $) }}
{{- end }}
ports:
- containerPort: {{ include "harbor.chartmuseum.containerPort" . }}
name: http
- containerPort: {{ ternary .Values.chartmuseum.containerPorts.https .Values.chartmuseum.containerPorts.http .Values.internalTLS.enabled }}
name: {{ ternary "https" "http" .Values.internalTLS.enabled }}
{{- if not .Values.diagnosticMode.enabled }}
{{- if .Values.chartmuseum.startupProbe.enabled }}
startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.chartmuseum.startupProbe "enabled") "context" $) | nindent 12 }}
tcpSocket:
port: {{ ternary "https" "http" .Values.internalTLS.enabled }}
{{- else if .Values.chartmuseum.customStartupProbe }}
startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.chartmuseum.customStartupProbe "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.chartmuseum.livenessProbe.enabled }}
livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.chartmuseum.livenessProbe "enabled") "context" $) | nindent 12 }}
httpGet:
path: /health
port: {{ ternary "https" "http" .Values.internalTLS.enabled }}
scheme: {{ ternary "https" "http" .Values.internalTLS.enabled | upper }}
{{- else if .Values.chartmuseum.customLivenessProbe }}
livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.chartmuseum.customLivenessProbe "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.chartmuseum.readinessProbe.enabled }}
readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.chartmuseum.readinessProbe "enabled") "context" $) | nindent 12 }}
httpGet:
path: /health
port: {{ ternary "https" "http" .Values.internalTLS.enabled }}
scheme: {{ ternary "https" "http" .Values.internalTLS.enabled | upper }}
{{- else if .Values.chartmuseum.customReadinessProbe }}
readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.chartmuseum.customReadinessProbe "context" $) | nindent 12 }}
{{- end }}
{{- end }}
{{- if .Values.chartmuseum.lifecycleHooks }}
lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.chartmuseum.lifecycleHooks "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.chartmuseum.resources }}
resources: {{- toYaml .Values.chartmuseum.resources | nindent 12 }}
{{- end }}
volumeMounts:
- name: chartmuseum-data
mountPath: /bitnami/data
@@ -174,12 +184,12 @@ spec:
- name: internal-tls-certs
mountPath: /etc/harbor/ssl/chartmuseum
{{- end }}
{{- if .Values.persistence.imageChartStorage.caBundleSecretName }}
{{- if .Values.persistence.imageChartStorage.caBundleSecret }}
- name: storage-service-ca
mountPath: /harbor_cust_cert/ca-bundle.crt
subPath: ca.crt
{{- if .Values.caBundleSecretName }}
{{ include "harbor.caBundleVolumeMount" . | indent 12 }}
{{- if .Values.internalTLS.caBundleSecret }}
{{- include "harbor.caBundleVolumeMount" . | nindent 12 }}
{{- end }}
{{- end }}
{{- if .Values.chartmuseum.extraVolumeMounts }}
@@ -204,13 +214,13 @@ spec:
- key: GCS_KEY_DATA
path: gcs-key.json
{{- end }}
{{- if .Values.persistence.imageChartStorage.caBundleSecretName }}
{{- if .Values.persistence.imageChartStorage.caBundleSecret }}
- name: storage-service-ca
secret:
secretName: {{ .Values.persistence.imageChartStorage.caBundleSecretName }}
secretName: {{ .Values.persistence.imageChartStorage.caBundleSecret }}
{{- end }}
{{- if .Values.caBundleSecretName }}
{{ include "harbor.caBundleVolume" . | indent 8 }}
{{- if .Values.internalTLS.caBundleSecret }}
{{- include "harbor.caBundleVolume" . | nindent 8 }}
{{- end }}
{{- if .Values.internalTLS.enabled }}
- name: internal-tls-certs
bitnami/harbor/templates/chartmuseum/chartmuseum-pvc.yaml
+15 -6
View File
@@ -5,25 +5,34 @@ kind: PersistentVolumeClaim
apiVersion: v1
metadata:
name: {{ include "harbor.chartmuseum" . }}
namespace: {{ .Release.Namespace | quote }}
labels: {{- include "common.labels.standard" . | nindent 4 }}
{{- if .Values.commonLabels }}
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- end }}
app.kubernetes.io/component: chartmuseum
{{- if eq .Values.persistence.resourcePolicy "keep" }}
annotations:
{{- if eq .Values.persistence.resourcePolicy "keep" }}
helm.sh/resource-policy: keep
{{- end }}
{{- if .Values.commonAnnotations }}
{{- end }}
{{- if .Values.commonAnnotations }}
{{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
{{- end }}
{{- if .Values.persistence.persistentVolumeClaim.chartmuseum.annotations }}
{{- toYaml .Values.persistence.persistentVolumeClaim.chartmuseum.annotations | nindent 4 }}
{{- end }}
spec:
accessModes:
- {{ .Values.persistence.persistentVolumeClaim.chartmuseum.accessMode }}
{{- range .Values.persistence.persistentVolumeClaim.chartmuseum.accessModes }}
- {{ . | quote }}
{{- end }}
resources:
requests:
storage: {{ .Values.persistence.persistentVolumeClaim.chartmuseum.size }}
{{ include "harbor.chartmuseum.storageClass" . }}
{{- if .Values.persistence.persistentVolumeClaim.chartmuseum.selector }}
selector: {{- include "common.tplvalues.render" (dict "value" .Values.persistence.persistentVolumeClaim.chartmuseum.selector "context" $) | nindent 2 }}
{{- end }}
{{- include "common.storage.class" ( dict "persistence" .Values.persistence.persistentVolumeClaim.chartmuseum "global" .Values.global ) | nindent 2 }}
{{- end }}
{{- end }}
{{- end }}
bitnami/harbor/templates/chartmuseum/chartmuseum-secret.yaml
+2 -1
View File
@@ -2,7 +2,8 @@
apiVersion: v1
kind: Secret
metadata:
name: {{ include "harbor.chartmuseum" . }}-secret
name: {{ printf "%s-secret" (include "harbor.chartmuseum" .) }}
namespace: {{ .Release.Namespace | quote }}
labels: {{- include "common.labels.standard" . | nindent 4 }}
{{- if .Values.commonLabels }}
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
bitnami/harbor/templates/chartmuseum/chartmuseum-svc.yaml
+4 -3
View File
@@ -3,6 +3,7 @@ apiVersion: v1
kind: Service
metadata:
name: {{ include "harbor.chartmuseum" . }}
namespace: {{ .Release.Namespace | quote }}
labels: {{- include "common.labels.standard" . | nindent 4 }}
{{- if .Values.commonLabels }}
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
@@ -13,9 +14,9 @@ metadata:
{{- end }}
spec:
ports:
- port: {{ include "harbor.chartmuseum.servicePort" . }}
name: http
targetPort: http
- name: {{ ternary "https" "http" .Values.internalTLS.enabled }}
port: {{ ternary .Values.chartmuseum.service.ports.https .Values.chartmuseum.service.ports.http .Values.internalTLS.enabled }}
targetPort: {{ ternary "https" "http" .Values.internalTLS.enabled }}
selector: {{- include "common.labels.matchLabels" . | nindent 4 }}
app.kubernetes.io/component: chartmuseum
{{- end }}
bitnami/harbor/templates/clair/clair-dpl.yaml
+117 -98
View File
@@ -3,6 +3,7 @@ apiVersion: {{ template "common.capabilities.deployment.apiVersion" . }}
kind: Deployment
metadata:
name: {{ include "harbor.clair" . }}
namespace: {{ .Release.Namespace | quote }}
labels: {{- include "common.labels.standard" . | nindent 4 }}
{{- if .Values.commonLabels }}
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
@@ -12,13 +13,13 @@ metadata:
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
spec:
replicas: {{ .Values.clair.replicas }}
{{- if .Values.clair.updateStrategy }}
strategy: {{- toYaml .Values.clair.updateStrategy | nindent 4 }}
{{- end }}
replicas: {{ .Values.clair.replicaCount }}
selector:
matchLabels: {{- include "common.labels.matchLabels" . | nindent 6 }}
app.kubernetes.io/component: clair
{{- if .Values.clair.updateStrategy }}
strategy: {{- toYaml .Values.clair.updateStrategy | nindent 4 }}
{{- end }}
template:
metadata:
labels: {{- include "common.labels.standard" . | nindent 8 }}
@@ -39,10 +40,10 @@ spec:
{{- end }}
spec:
{{- include "harbor.imagePullSecrets" . | nindent 6 }}
automountServiceAccountToken: {{ .Values.clair.automountServiceAccountToken }}
{{- if .Values.clair.priorityClassName }}
priorityClassName: {{ .Values.clair.priorityClassName | quote }}
{{- if .Values.clair.hostAliases }}
hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.clair.hostAliases "context" $) | nindent 8 }}
{{- end }}
automountServiceAccountToken: {{ .Values.clair.automountServiceAccountToken }}
{{- if .Values.clair.affinity }}
affinity: {{- include "common.tplvalues.render" (dict "value" .Values.clair.affinity "context" $) | nindent 8 }}
{{- else }}
@@ -60,57 +61,41 @@ spec:
{{- if .Values.clair.tolerations }}
tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.clair.tolerations "context" $) | nindent 8 }}
{{- end }}
{{- if .Values.clair.topologySpreadConstraints }}
topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.clair.topologySpreadConstraints "context" .) | nindent 8 }}
{{- end }}
{{- if .Values.clair.priorityClassName }}
priorityClassName: {{ .Values.clair.priorityClassName | quote }}
{{- end }}
{{- if .Values.clair.schedulerName }}
schedulerName: {{ .Values.clair.schedulerName }}
{{- end }}
{{- if .Values.clair.podSecurityContext.enabled }}
securityContext: {{- omit .Values.clair.podSecurityContext "enabled" | toYaml | nindent 8 }}
{{- end }}
{{- if .Values.clair.initContainers }}
initContainers: {{- include "common.tplvalues.render" (dict "value" .Values.clair.initContainers "context" $) | nindent 8 }}
{{- end }}
{{- if .Values.clair.hostAliases }}
hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.clair.hostAliases "context" $) | nindent 8 }}
{{- end }}
containers:
- name: clair
image: {{ include "harbor.clairImage" . }}
imagePullPolicy: {{ .Values.clairImage.pullPolicy | quote }}
{{- if .Values.containerSecurityContext }}
securityContext: {{- include "common.tplvalues.render" (dict "value" .Values.containerSecurityContext "context" $) | nindent 12 }}
image: {{ include "harbor.clair.server.image" . }}
imagePullPolicy: {{ .Values.clair.server.image.pullPolicy | quote }}
{{- if .Values.clair.server.containerSecurityContext.enabled }}
securityContext: {{- omit .Values.clair.server.containerSecurityContext "enabled" | toYaml | nindent 12 }}
{{- end }}
{{- if .Values.clair.server.command }}
{{- if .Values.diagnosticMode.enabled }}
command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }}
{{- else if .Values.clair.server.command }}
command: {{- include "common.tplvalues.render" (dict "value" .Values.clair.server.command "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.clair.server.args }}
{{- if .Values.diagnosticMode.enabled }}
args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }}
{{- else if .Values.clair.server.args }}
args: {{- include "common.tplvalues.render" (dict "value" .Values.clair.server.args "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.clair.server.lifecycleHooks }}
lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.clair.server.lifecycleHooks "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.clair.server.livenessProbe.enabled }}
livenessProbe:
httpGet:
path: /health
port: 6061
initialDelaySeconds: {{ .Values.clair.server.livenessProbe.initialDelaySeconds }}
periodSeconds: {{ .Values.clair.server.livenessProbe.periodSeconds }}
timeoutSeconds: {{ .Values.clair.server.livenessProbe.timeoutSeconds }}
successThreshold: {{ .Values.clair.server.livenessProbe.successThreshold }}
failureThreshold: {{ .Values.clair.server.livenessProbe.failureThreshold }}
{{- else if .Values.clair.server.customLivenessProbe }}
livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.clair.server.customLivenessProbe "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.clair.server.readinessProbe.enabled }}
readinessProbe:
httpGet:
path: /health
port: 6061
initialDelaySeconds: {{ .Values.clair.server.readinessProbe.initialDelaySeconds }}
periodSeconds: {{ .Values.clair.server.readinessProbe.periodSeconds }}
timeoutSeconds: {{ .Values.clair.server.readinessProbe.timeoutSeconds }}
successThreshold: {{ .Values.clair.server.readinessProbe.successThreshold }}
failureThreshold: {{ .Values.clair.server.readinessProbe.failureThreshold }}
{{- else if .Values.clair.server.customReadinessProbe }}
readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.clair.server.customReadinessProbe "context" $) | nindent 12 }}
{{- end }}
env:
- name: BITNAMI_DEBUG
value: {{ ternary "true" "false" .Values.clairImage.debug | quote }}
value: {{ ternary "true" "false" .Values.clair.server.image.debug | quote }}
{{- if has "clair" .Values.proxy.components }}
{{- if .Values.clair.httpProxy }}
- name: HTTP_PROXY
@@ -135,17 +120,48 @@ spec:
- secretRef:
name: {{ include "common.tplvalues.render" (dict "value" .Values.clair.server.extraEnvVarsSecret "context" $) }}
{{- end }}
ports:
- containerPort: {{ .Values.clair.server.containerPorts.api }}
name: api
- containerPort: {{ .Values.clair.server.containerPorts.health }}
name: health
{{- if not .Values.diagnosticMode.enabled }}
{{- if .Values.clair.server.startupProbe.enabled }}
startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.clair.server.startupProbe "enabled") "context" $) | nindent 12 }}
tcpSocket:
port: health
{{- else if .Values.clair.server.customStartupProbe }}
startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.clair.server.customStartupProbe "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.clair.server.livenessProbe.enabled }}
livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.clair.server.livenessProbe "enabled") "context" $) | nindent 12 }}
httpGet:
path: /health
port: health
{{- else if .Values.clair.server.customLivenessProbe }}
livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.clair.server.customLivenessProbe "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.clair.server.readinessProbe.enabled }}
readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.clair.server.readinessProbe "enabled") "context" $) | nindent 12 }}
httpGet:
path: /health
port: health
{{- else if .Values.clair.server.customReadinessProbe }}
readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.clair.server.customReadinessProbe "context" $) | nindent 12 }}
{{- end }}
{{- end }}
{{- if .Values.clair.server.lifecycleHooks }}
lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.clair.server.lifecycleHooks "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.clair.server.resources }}
resources: {{- toYaml .Values.clair.server.resources | nindent 12 }}
{{- end }}
ports:
- containerPort: 6060
volumeMounts:
- name: config
mountPath: /etc/clair/config.yaml
subPath: config.yaml
{{- if .Values.caBundleSecretName }}
{{ include "harbor.caBundleVolumeMount" . | indent 12 }}
{{- if .Values.internalTLS.caBundleSecret }}
{{- include "harbor.caBundleVolumeMount" . | nindent 12 }}
{{- end }}
{{- if .Values.internalTLS.enabled }}
- name: internal-tls-certs
@@ -155,54 +171,27 @@ spec:
{{- include "common.tplvalues.render" (dict "value" .Values.clair.server.extraVolumeMounts "context" $) | nindent 12 }}
{{- end }}
- name: adapter
image: {{ include "harbor.clairAdapterImage" . }}
imagePullPolicy: {{ .Values.clairAdapterImage.pullPolicy }}
{{- if .Values.clair.adapter.command }}
image: {{ include "harbor.clair.adapter.image" . }}
imagePullPolicy: {{ .Values.clair.adapter.image.pullPolicy }}
{{- if .Values.clair.adapter.containerSecurityContext.enabled }}
securityContext: {{- omit .Values.clair.adapter.containerSecurityContext "enabled" | toYaml | nindent 12 }}
{{- end }}
{{- if .Values.diagnosticMode.enabled }}
command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }}
{{- else if .Values.clair.adapter.command }}
command: {{- include "common.tplvalues.render" (dict "value" .Values.clair.adapter.command "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.clair.adapter.args }}
{{- if .Values.diagnosticMode.enabled }}
args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }}
{{- else if .Values.clair.adapter.args }}
args: {{- include "common.tplvalues.render" (dict "value" .Values.clair.adapter.args "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.clair.adapter.lifecycleHooks }}
lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.clair.adapter.lifecycleHooks "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.containerSecurityContext }}
securityContext: {{- include "common.tplvalues.render" (dict "value" .Values.containerSecurityContext "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.clair.adapter.livenessProbe.enabled }}
livenessProbe:
httpGet:
path: /probe/healthy
port: {{ include "harbor.clairAdapter.containerPort" . }}
scheme: {{ include "harbor.component.scheme" . | upper }}
initialDelaySeconds: {{ .Values.clair.adapter.livenessProbe.initialDelaySeconds }}
periodSeconds: {{ .Values.clair.adapter.livenessProbe.periodSeconds }}
timeoutSeconds: {{ .Values.clair.adapter.livenessProbe.timeoutSeconds }}
successThreshold: {{ .Values.clair.adapter.livenessProbe.successThreshold }}
failureThreshold: {{ .Values.clair.adapter.livenessProbe.failureThreshold }}
{{- else if .Values.clair.adapter.customLivenessProbe }}
livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.clair.adapter.customLivenessProbe "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.clair.adapter.readinessProbe.enabled }}
readinessProbe:
httpGet:
path: /probe/ready
port: {{ include "harbor.clairAdapter.containerPort" . }}
scheme: {{ include "harbor.component.scheme" . | upper }}
initialDelaySeconds: {{ .Values.clair.adapter.readinessProbe.initialDelaySeconds }}
periodSeconds: {{ .Values.clair.adapter.readinessProbe.periodSeconds }}
timeoutSeconds: {{ .Values.clair.adapter.readinessProbe.timeoutSeconds }}
successThreshold: {{ .Values.clair.adapter.readinessProbe.successThreshold }}
failureThreshold: {{ .Values.clair.adapter.readinessProbe.failureThreshold }}
{{- else if .Values.clair.adapter.customReadinessProbe }}
readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.clair.adapter.customReadinessProbe "context" $) | nindent 12 }}
{{- end }}
env:
- name: BITNAMI_DEBUG
value: {{ ternary "true" "false" .Values.clairAdapterImage.debug | quote }}
value: {{ ternary "true" "false" .Values.clair.adapter.image.debug | quote }}
- name: SCANNER_CLAIR_URL
# To avoid a pod cannot reach itself via service IP when the clusters disable hairpin
value: "http://127.0.0.1:6060"
value: {{ printf "http://127.0.0.1:%d" (int .Values.clair.server.containerPorts.api) | quote }}
- name: SCANNER_STORE_REDIS_URL
value: {{ include "harbor.redisForClairAdapter" . }}
- name: SCANNER_CLAIR_DATABASE_URL
@@ -214,7 +203,7 @@ spec:
- name: INTERNAL_TLS_ENABLED
value: "true"
- name: SCANNER_API_SERVER_ADDR
value: {{ printf ":%s" ( include "harbor.clairAdapter.containerPort" . ) | quote }}
value: {{ printf ":%d" (ternary .Values.clair.adapter.containerPorts.https .Values.clair.adapter.containerPorts.http .Values.internalTLS.enabled | int) | quote }}
- name: SCANNER_API_SERVER_TLS_KEY
value: /etc/harbor/ssl/clair/tls.key
- name: SCANNER_API_SERVER_TLS_CERTIFICATE
@@ -232,23 +221,53 @@ spec:
- secretRef:
name: {{ include "common.tplvalues.render" (dict "value" .Values.clair.adapter.extraEnvVarsSecret "context" $) }}
{{- end }}
ports:
- containerPort: {{ ternary .Values.clair.adapter.containerPorts.https .Values.clair.adapter.containerPorts.http .Values.internalTLS.enabled }}
name: {{ ternary "https" "http" .Values.internalTLS.enabled }}
{{- if not .Values.diagnosticMode.enabled }}
{{- if .Values.clair.adapter.startupProbe.enabled }}
startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.clair.adapter.startupProbe "enabled") "context" $) | nindent 12 }}
tcpSocket:
port: {{ ternary "https" "http" .Values.internalTLS.enabled }}
{{- else if .Values.clair.adapter.customStartupProbe }}
startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.clair.adapter.customStartupProbe "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.clair.adapter.livenessProbe.enabled }}
livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.clair.adapter.livenessProbe "enabled") "context" $) | nindent 12 }}
httpGet:
path: /probe/healthy
port: {{ ternary "https" "http" .Values.internalTLS.enabled }}
scheme: {{ ternary "https" "http" .Values.internalTLS.enabled | upper }}
{{- else if .Values.clair.adapter.customLivenessProbe }}
livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.clair.adapter.customLivenessProbe "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.clair.adapter.readinessProbe.enabled }}
readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.clair.adapter.readinessProbe "enabled") "context" $) | nindent 12 }}
httpGet:
path: /probe/ready
port: {{ ternary "https" "http" .Values.internalTLS.enabled }}
scheme: {{ ternary "https" "http" .Values.internalTLS.enabled | upper }}
{{- else if .Values.clair.adapter.customReadinessProbe }}
readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.clair.adapter.customReadinessProbe "context" $) | nindent 12 }}
{{- end }}
{{- end }}
{{- if .Values.clair.adapter.lifecycleHooks }}
lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.clair.adapter.lifecycleHooks "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.clair.adapter.resources }}
resources: {{- toYaml .Values.clair.adapter.resources | nindent 12 }}
{{- end }}
ports:
- containerPort: 8080
volumeMounts:
{{- if .Values.internalTLS.enabled }}
- name: internal-tls-certs
mountPath: /etc/harbor/ssl/clair
{{- end }}
{{- if .Values.caBundleSecretName }}
{{ include "harbor.caBundleVolumeMount" . | indent 12 }}
{{- if .Values.internalTLS.caBundleSecret }}
{{- include "harbor.caBundleVolumeMount" . | nindent 12 }}
{{- end }}
{{- if .Values.clair.adapter.extraVolumeMounts }}
{{- include "common.tplvalues.render" (dict "value" .Values.clair.adapter.extraVolumeMounts "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.clair.sidecars }}
{{- include "common.tplvalues.render" (dict "value" .Values.clair.sidecars "context" $) | nindent 8 }}
{{- end }}
@@ -261,8 +280,8 @@ spec:
secret:
secretName: {{ template "harbor.clair.tls.secretName" . }}
{{- end }}
{{- if .Values.caBundleSecretName }}
{{ include "harbor.caBundleVolume" . | indent 8 }}
{{- if .Values.internalTLS.caBundleSecret }}
{{- include "harbor.caBundleVolume" . | nindent 8 }}
{{- end }}
{{- if .Values.clair.extraVolumes }}
{{- include "common.tplvalues.render" (dict "value" .Values.clair.extraVolumes "context" $) | nindent 8 }}
bitnami/harbor/templates/clair/clair-secret.yaml
+1
View File
@@ -3,6 +3,7 @@ apiVersion: v1
kind: Secret
metadata:
name: {{ template "harbor.clair" . }}
namespace: {{ .Release.Namespace | quote }}
labels: {{- include "common.labels.standard" . | nindent 4 }}
{{- if .Values.commonLabels }}
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
bitnami/harbor/templates/clair/clair-svc.yaml
+5 -4
View File
@@ -3,6 +3,7 @@ apiVersion: v1
kind: Service
metadata:
name: {{ include "harbor.clair" . }}
namespace: {{ .Release.Namespace | quote }}
labels: {{- include "common.labels.standard" . | nindent 4 }}
{{- if .Values.commonLabels }}
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
@@ -13,12 +14,12 @@ metadata:
{{- end }}
spec:
ports:
- name: clair
port: 6060
- name: api
port: {{ .Values.clair.server.service.ports.api }}
- name: health
port: 6061
port: {{ .Values.clair.server.service.ports.health }}
- name: adapter
port: {{ include "harbor.clairAdapter.servicePort" . }}
port: {{ ternary .Values.clair.adapter.service.ports.https .Values.clair.adapter.service.ports.http .Values.internalTLS.enabled }}
selector: {{- include "common.labels.matchLabels" . | nindent 4 }}
app.kubernetes.io/component: clair
{{- end }}
bitnami/harbor/templates/core/core-cm-envvars.yaml
+7 -4
View File
@@ -1,7 +1,10 @@
{{- $scheme := ternary "https" "http" .Values.internalTLS.enabled -}}
{{- $port := ternary .Values.core.containerPorts.https .Values.core.containerPorts.http .Values.internalTLS.enabled | int -}}
apiVersion: v1
kind: ConfigMap
metadata:
name: {{ include "harbor.core" . }}-envvars
name: {{ printf "%s-envvars" (include "harbor.core" .) }}
namespace: {{ .Release.Namespace | quote }}
labels: {{- include "common.labels.standard" . | nindent 4 }}
{{- if .Values.commonLabels }}
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
@@ -11,7 +14,7 @@ metadata:
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
data:
PORT: {{ include "harbor.core.containerPort" . | quote }}
PORT: {{ $port | quote }}
DATABASE_TYPE: "postgresql"
POSTGRESQL_HOST: {{ include "harbor.database.host" . | quote }}
POSTGRESQL_PORT: {{ include "harbor.database.port" . | quote }}
@@ -25,7 +28,7 @@ data:
TOKEN_SERVICE_URL: {{ include "harbor.tokenService.url" . | quote }}
WITH_NOTARY: {{ .Values.notary.enabled | quote }}
NOTARY_URL: {{ printf "http://%s:4443" (include "harbor.notary-server" .) | quote }}
CORE_LOCAL_URL: "{{ ternary "https://127.0.0.1:8443" "http://127.0.0.1:8080" .Values.internalTLS.enabled }}"
CORE_LOCAL_URL: {{ printf "%s://127.0.0.1:%d" $scheme $port | quote }}
CFG_EXPIRATION: "5"
ADMIRAL_URL: "NA"
WITH_TRIVY: {{ .Values.trivy.enabled | quote }}
@@ -41,7 +44,7 @@ data:
REGISTRY_CONTROLLER_URL: {{ include "harbor.registryCtl.url" . | quote }}
REGISTRY_CREDENTIAL_USERNAME: {{ .Values.registry.credentials.username | quote }}
PERMITTED_REGISTRY_TYPES_FOR_PROXY_CACHE: "docker-hub,harbor,azure-acr,aws-ecr,google-gcr,quay,docker-registry"
{{- if .Values.core.uaaSecretName }}
{{- if .Values.core.uaaSecret }}
UAA_CA_ROOT: "/etc/core/auth-ca/auth-ca.crt"
{{- end }}
{{- if has "core" .Values.proxy.components }}
bitnami/harbor/templates/core/core-cm.yaml
+2 -1
View File
@@ -2,6 +2,7 @@ apiVersion: v1
kind: ConfigMap
metadata:
name: {{ include "harbor.core" . }}
namespace: {{ .Release.Namespace | quote }}
labels: {{- include "common.labels.standard" . | nindent 4 }}
{{- if .Values.commonLabels }}
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
@@ -17,4 +18,4 @@ data:
enablegzip = true
[prod]
httpport = {{ include "harbor.core.containerPort" . | quote }}
httpport = {{ ternary .Values.core.containerPorts.https .Values.core.containerPorts.http .Values.internalTLS.enabled | quote }}
bitnami/harbor/templates/core/core-dpl.yaml
+96 -96
View File
@@ -2,6 +2,7 @@ apiVersion: {{ template "common.capabilities.deployment.apiVersion" . }}
kind: Deployment
metadata:
name: {{ include "harbor.core" . }}
namespace: {{ .Release.Namespace | quote }}
labels: {{- include "common.labels.standard" . | nindent 4 }}
{{- if .Values.commonLabels }}
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
@@ -11,13 +12,13 @@ metadata:
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
spec:
replicas: {{ .Values.core.replicas }}
{{- if .Values.core.updateStrategy }}
strategy: {{- toYaml .Values.core.updateStrategy | nindent 4 }}
{{- end }}
replicas: {{ .Values.core.replicaCount }}
selector:
matchLabels: {{- include "common.labels.matchLabels" . | nindent 6 }}
app.kubernetes.io/component: core
{{- if .Values.core.updateStrategy }}
strategy: {{- toYaml .Values.core.updateStrategy | nindent 4 }}
{{- end }}
template:
metadata:
labels: {{- include "common.labels.matchLabels" . | nindent 8 }}
@@ -43,8 +44,8 @@ spec:
spec:
{{- include "harbor.imagePullSecrets" . | nindent 6 }}
automountServiceAccountToken: {{ .Values.core.automountServiceAccountToken }}
{{- if .Values.core.priorityClassName }}
priorityClassName: {{ .Values.core.priorityClassName | quote }}
{{- if .Values.core.hostAliases }}
hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.core.hostAliases "context" $) | nindent 8 }}
{{- end }}
{{- if .Values.core.affinity }}
affinity: {{- include "common.tplvalues.render" (dict "value" .Values.core.affinity "context" $) | nindent 8 }}
@@ -60,89 +61,41 @@ spec:
{{- if .Values.core.tolerations }}
tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.core.tolerations "context" $) | nindent 8 }}
{{- end }}
{{- if .Values.podSecurityContext }}
securityContext: {{- include "common.tplvalues.render" (dict "value" .Values.podSecurityContext "context" $) | nindent 8 }}
{{- if .Values.core.topologySpreadConstraints }}
topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.core.topologySpreadConstraints "context" .) | nindent 8 }}
{{- end }}
{{- if .Values.core.priorityClassName }}
priorityClassName: {{ .Values.core.priorityClassName | quote }}
{{- end }}
{{- if .Values.core.schedulerName }}
schedulerName: {{ .Values.core.schedulerName }}
{{- end }}
{{- if .Values.core.podSecurityContext.enabled }}
securityContext: {{- omit .Values.core.podSecurityContext "enabled" | toYaml | nindent 8 }}
{{- end }}
{{- if .Values.core.initContainers }}
initContainers: {{- include "common.tplvalues.render" (dict "value" .Values.core.initContainers "context" $) | nindent 8 }}
{{- end }}
{{- if .Values.core.hostAliases }}
hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.core.hostAliases "context" $) | nindent 8 }}
{{- end }}
containers:
- name: core
image: {{ include "harbor.coreImage" . }}
imagePullPolicy: {{ .Values.coreImage.pullPolicy | quote }}
{{- if .Values.core.command }}
image: {{ include "harbor.core.image" . }}
imagePullPolicy: {{ .Values.core.image.pullPolicy | quote }}
{{- if .Values.core.containerSecurityContext.enabled }}
securityContext: {{- omit .Values.core.containerSecurityContext "enabled" | toYaml | nindent 12 }}
{{- end }}
{{- if .Values.diagnosticMode.enabled }}
command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }}
{{- else if .Values.core.command }}
command: {{- include "common.tplvalues.render" (dict "value" .Values.core.command "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.core.args }}
{{- if .Values.diagnosticMode.enabled }}
args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }}
{{- else if .Values.core.args }}
args: {{- include "common.tplvalues.render" (dict "value" .Values.core.args "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.containerSecurityContext }}
securityContext: {{- include "common.tplvalues.render" (dict "value" .Values.containerSecurityContext "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.core.lifecycleHooks }}
lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.core.lifecycleHooks "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.core.livenessProbe.enabled }}
livenessProbe:
httpGet:
path: /api/v2.0/ping
scheme: {{ include "harbor.component.scheme" . | upper }}
port: http
initialDelaySeconds: {{ .Values.core.livenessProbe.initialDelaySeconds }}
periodSeconds: {{ .Values.core.livenessProbe.periodSeconds }}
timeoutSeconds: {{ .Values.core.livenessProbe.timeoutSeconds }}
successThreshold: {{ .Values.core.livenessProbe.successThreshold }}
failureThreshold: {{ .Values.core.livenessProbe.failureThreshold }}
{{- else if .Values.core.customLivenessProbe }}
livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.core.customLivenessProbe "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.core.readinessProbe.enabled }}
readinessProbe:
httpGet:
path: /api/v2.0/ping
scheme: {{ include "harbor.component.scheme" . | upper }}
port: http
initialDelaySeconds: {{ .Values.core.readinessProbe.initialDelaySeconds }}
periodSeconds: {{ .Values.core.readinessProbe.periodSeconds }}
timeoutSeconds: {{ .Values.core.readinessProbe.timeoutSeconds }}
successThreshold: {{ .Values.core.readinessProbe.successThreshold }}
failureThreshold: {{ .Values.core.readinessProbe.failureThreshold }}
{{- else if .Values.core.customReadinessProbe }}
readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.core.customReadinessProbe "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.core.startupProbe.enabled }}
startupProbe:
httpGet:
path: /api/v2.0/ping
scheme: {{ include "harbor.component.scheme" . | upper }}
port: http
initialDelaySeconds: {{ .Values.core.startupProbe.initialDelaySeconds }}
periodSeconds: {{ .Values.core.startupProbe.periodSeconds }}
timeoutSeconds: {{ .Values.core.startupProbe.timeoutSeconds }}
successThreshold: {{ .Values.core.startupProbe.successThreshold }}
failureThreshold: {{ .Values.core.startupProbe.failureThreshold }}
{{- else if .Values.core.customStartupProbe }}
startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.core.customStartupProbe "context" $) | nindent 12 }}
{{- end }}
envFrom:
- configMapRef:
name: {{ include "harbor.core" . }}-envvars
- secretRef:
name: {{ include "harbor.core" . }}-envvars
{{- if .Values.core.extraEnvVarsCM }}
- configMapRef:
name: {{ include "common.tplvalues.render" (dict "value" .Values.core.extraEnvVarsCM "context" $) }}
{{- end }}
{{- if .Values.core.extraEnvVarsSecret }}
- secretRef:
name: {{ include "common.tplvalues.render" (dict "value" .Values.core.extraEnvVarsSecret "context" $) }}
{{- end }}
env:
- name: BITNAMI_DEBUG
value: {{ ternary "true" "false" .Values.coreImage.debug | quote }}
value: {{ ternary "true" "false" .Values.core.image.debug | quote }}
- name: CORE_SECRET
valueFrom:
secretKeyRef:
@@ -166,9 +119,57 @@ spec:
{{- if .Values.core.extraEnvVars }}
{{- include "common.tplvalues.render" (dict "value" .Values.core.extraEnvVars "context" $) | nindent 12 }}
{{- end }}
envFrom:
- configMapRef:
name: {{ printf "%s-envvars" (include "harbor.core" .) }}
- secretRef:
name: {{ printf "%s-envvars" (include "harbor.core" .) }}
{{- if .Values.core.extraEnvVarsCM }}
- configMapRef:
name: {{ include "common.tplvalues.render" (dict "value" .Values.core.extraEnvVarsCM "context" $) }}
{{- end }}
{{- if .Values.core.extraEnvVarsSecret }}
- secretRef:
name: {{ include "common.tplvalues.render" (dict "value" .Values.core.extraEnvVarsSecret "context" $) }}
{{- end }}
ports:
- containerPort: {{ include "harbor.core.containerPort" . }}
name: http
- containerPort: {{ ternary .Values.core.containerPorts.https .Values.core.containerPorts.http .Values.internalTLS.enabled }}
name: {{ ternary "https" "http" .Values.internalTLS.enabled }}
{{- if not .Values.diagnosticMode.enabled }}
{{- if .Values.core.startupProbe.enabled }}
startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.core.startupProbe "enabled") "context" $) | nindent 12 }}
httpGet:
path: /api/v2.0/ping
scheme: {{ ternary "https" "http" .Values.internalTLS.enabled | upper }}
port: {{ ternary "https" "http" .Values.internalTLS.enabled }}
{{- else if .Values.core.customStartupProbe }}
startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.core.customStartupProbe "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.core.livenessProbe.enabled }}
livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.core.livenessProbe "enabled") "context" $) | nindent 12 }}
httpGet:
path: /api/v2.0/ping
scheme: {{ ternary "https" "http" .Values.internalTLS.enabled | upper }}
port: {{ ternary "https" "http" .Values.internalTLS.enabled }}
{{- else if .Values.core.customLivenessProbe }}
livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.core.customLivenessProbe "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.core.readinessProbe.enabled }}
readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.core.readinessProbe "enabled") "context" $) | nindent 12 }}
httpGet:
path: /api/v2.0/ping
scheme: {{ ternary "https" "http" .Values.internalTLS.enabled | upper }}
port: {{ ternary "https" "http" .Values.internalTLS.enabled }}
{{- else if .Values.core.customReadinessProbe }}
readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.core.customReadinessProbe "context" $) | nindent 12 }}
{{- end }}
{{- end }}
{{- if .Values.core.lifecycleHooks }}
lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.core.lifecycleHooks "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.core.resources }}
resources: {{- toYaml .Values.core.resources | nindent 12 }}
{{- end }}
volumeMounts:
- name: config
mountPath: /etc/core/app.conf
@@ -183,26 +184,23 @@ spec:
- name: internal-tls-certs
mountPath: /etc/harbor/ssl/core
{{- end }}
{{- if .Values.service.tls.enabled }}
{{- if or (and (eq .Values.exposureType "proxy") .Values.nginx.tls.enabled) (and (eq .Values.exposureType "ingress") .Values.ingress.core.tls) }}
- name: ca-download
mountPath: /etc/core/ca
{{- end }}
{{- if .Values.core.uaaSecretName }}
{{- if .Values.core.uaaSecret }}
- name: auth-ca-cert
mountPath: /etc/core/auth-ca/auth-ca.crt
subPath: auth-ca.crt
{{- end }}
- name: psc
mountPath: /etc/core/token
{{- if .Values.caBundleSecretName }}
{{ include "harbor.caBundleVolumeMount" . | indent 12 }}
{{- if .Values.internalTLS.caBundleSecret }}
{{- include "harbor.caBundleVolumeMount" . | nindent 12 }}
{{- end }}
{{- if .Values.core.extraVolumeMounts }}
{{- include "common.tplvalues.render" (dict "value" .Values.core.extraVolumeMounts "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.core.resources }}
resources: {{- toYaml .Values.core.resources | nindent 12 }}
{{- end }}
{{- if .Values.core.sidecars }}
{{- include "common.tplvalues.render" (dict "value" .Values.core.sidecars "context" $) | nindent 8 }}
{{- end }}
@@ -219,8 +217,8 @@ spec:
items:
- key: secretKey
path: key
{{- if .Values.caBundleSecretName }}
{{ include "harbor.caBundleVolume" . | indent 8 }}
{{- if .Values.internalTLS.caBundleSecret }}
{{- include "harbor.caBundleVolume" . | nindent 8 }}
{{- end }}
- name: token-service-private-key
secret:
@@ -234,21 +232,23 @@ spec:
secret:
secretName: {{ include "harbor.core.tls.secretName" . }}
{{- end }}
{{- if .Values.service.tls.enabled }}
{{- if or (and (eq .Values.exposureType "proxy") .Values.nginx.tls.enabled) (and (eq .Values.exposureType "ingress") .Values.ingress.core.tls) }}
- name: ca-download
secret:
{{- if eq (include "harbor.autoGenCertForIngress" .) "true" }}
secretName: {{ include "harbor.ingress" . }}
{{- else if eq (include "harbor.autoGenCertForNginx" .) "true" }}
{{- if and (eq .Values.exposureType "proxy") .Values.nginx.tls.enabled }}
{{- if (include "harbor.autoGenCertForNginx" .) }}
secretName: {{ include "harbor.nginx" . }}
{{- else }}
secretName: {{ .Values.service.tls.existingSecret }}
{{- else }}
secretName: {{ .Values.nginx.tls.existingSecret }}
{{- end }}
{{- else if and (eq .Values.exposureType "ingress") .Values.ingress.core.tls }}
secretName: {{ printf "%s-tls" .Values.ingress.core.hostname }}
{{- end }}
{{- end }}
{{- if .Values.core.uaaSecretName }}
{{- if .Values.core.uaaSecret }}
- name: auth-ca-cert
secret:
secretName: {{ .Values.core.uaaSecretName }}
secretName: {{ .Values.core.uaaSecret }}
items:
- key: ca.crt
path: auth-ca.crt
bitnami/harbor/templates/core/core-secret-envvars.yaml
+4 -13
View File
@@ -1,7 +1,8 @@
apiVersion: v1
kind: Secret
metadata:
name: {{ include "harbor.core" . }}-envvars
name: {{ printf "%s-envvars" (include "harbor.core" .) }}
namespace: {{ .Release.Namespace | quote }}
labels: {{- include "common.labels.standard" . | nindent 4 }}
{{- if .Values.commonLabels }}
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
@@ -16,16 +17,6 @@ data:
_REDIS_URL_REG: {{ include "harbor.redisForGC" . | b64enc | quote }}
REGISTRY_CREDENTIAL_USERNAME: {{ .Values.registry.credentials.username | b64enc | quote }}
REGISTRY_CREDENTIAL_PASSWORD: {{ .Values.registry.credentials.password | b64enc | quote }}
{{- if .Values.core.csrfKey }}
CSRF_KEY: {{ .Values.core.csrfKey | b64enc | quote }}
{{- else }}
CSRF_KEY: {{ randAlphaNum 32 | b64enc | quote }}
{{- end }}
{{- if .Values.harborAdminPassword }}
HARBOR_ADMIN_PASSWORD: {{ .Values.harborAdminPassword | b64enc | quote }}
{{- else if (not .Values.forcePassword) }}
HARBOR_ADMIN_PASSWORD: {{ randAlphaNum 10 | b64enc | quote }}
{{ else }}
HARBOR_ADMIN_PASSWORD: {{ required "A Harbor Admin Password is required!" .Values.harborAdminPassword }}
{{- end }}
CSRF_KEY: {{ include "common.secrets.passwords.manage" (dict "secret" (printf "%s-envvars" (include "harbor.core" .)) "key" "CSRF_KEY" "length" 32 "providedValues" (list "core.csrfKey") "context" $) }}
HARBOR_ADMIN_PASSWORD: {{ include "common.secrets.passwords.manage" (dict "secret" (printf "%s-envvars" (include "harbor.core" .)) "key" "HARBOR_ADMIN_PASSWORD" "length" 10 "providedValues" (list "adminPassword") "context" $) }}
POSTGRESQL_PASSWORD: {{ template "harbor.database.encryptedPassword" . }}
bitnami/harbor/templates/core/core-secret.yaml
+3 -16
View File
@@ -2,6 +2,7 @@ apiVersion: v1
kind: Secret
metadata:
name: {{ include "harbor.core" . }}
namespace: {{ .Release.Namespace | quote }}
labels: {{- include "common.labels.standard" . | nindent 4 }}
{{- if .Values.commonLabels }}
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
@@ -12,22 +13,8 @@ metadata:
{{- end }}
type: Opaque
data:
{{- if .Values.core.secretKey }}
secretKey: {{ .Values.core.secretKey | b64enc | quote }}
{{- else if (not .Values.forcePassword) }}
secretKey: {{ randAlphaNum 16 | b64enc | quote }}
{{- else }}
secretKey: {{ required "A secret key is required!" .Values.core.secretKey }}
{{- end }}
{{- if .Values.core.secret }}
secret: {{ .Values.core.secret | b64enc | quote }}
{{- else if (not .Values.forcePassword) }}
secret: {{ randAlphaNum 16 | b64enc | quote }}
{{- else }}
secret: {{ required "A secret is required!" .Values.core.secret }}
{{- end }}
secretKey: {{ include "common.secrets.passwords.manage" (dict "secret" (include "harbor.core" .) "key" "secretKey" "length" 16 "providedValues" (list "core.secretKey") "context" $) }}
secret: {{ include "common.secrets.passwords.manage" (dict "secret" (include "harbor.core" .) "key" "secret" "length" 16 "providedValues" (list "core.secret") "context" $) }}
{{- if not .Values.core.secretName }}
tls.crt: {{ .Files.Get "cert/tls.crt" | b64enc }}
tls.key: {{ .Files.Get "cert/tls.key" | b64enc }}
bitnami/harbor/templates/core/core-svc.yaml
+5 -4
View File
@@ -2,6 +2,7 @@ apiVersion: v1
kind: Service
metadata:
name: {{ include "harbor.core" . }}
namespace: {{ .Release.Namespace | quote }}
labels: {{- include "common.labels.standard" . | nindent 4 }}
{{- if .Values.commonLabels }}
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
@@ -11,12 +12,12 @@ metadata:
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
spec:
{{- if (eq .Values.ingress.controller "gce") }}
{{- if (eq .Values.ingress.core.controller "gce") }}
type: NodePort
{{- end }}
ports:
- name: http
port: {{ include "harbor.core.servicePort" . }}
targetPort: http
- name: {{ ternary "https" "http" .Values.internalTLS.enabled }}
port: {{ ternary .Values.core.service.ports.https .Values.core.service.ports.http .Values.internalTLS.enabled }}
targetPort: {{ ternary "https" "http" .Values.internalTLS.enabled }}
selector: {{- include "common.labels.matchLabels" . | nindent 4 }}
app.kubernetes.io/component: core
bitnami/harbor/templates/ingress/core-ingress.yaml
+116
View File
@@ -0,0 +1,116 @@
{{- if eq .Values.exposureType "ingress" }}
{{- if eq .Values.ingress.core.controller "gce" }}
{{- $_ := set . "portal_path" "/*" -}}
{{- $_ := set . "api_path" "/api/*" -}}
{{- $_ := set . "service_path" "/service/*" -}}
{{- $_ := set . "v2_path" "/v2/*" -}}
{{- $_ := set . "chartrepo_path" "/chartrepo/*" -}}
{{- $_ := set . "controller_path" "/c/*" -}}
{{- else if eq .Values.ingress.core.controller "ncp" }}
{{- $_ := set . "portal_path" "/.*" -}}
{{- $_ := set . "api_path" "/api/.*" -}}
{{- $_ := set . "service_path" "/service/.*" -}}
{{- $_ := set . "v2_path" "/v2/.*" -}}
{{- $_ := set . "chartrepo_path" "/chartrepo/.*" -}}
{{- $_ := set . "controller_path" "/c/.*" -}}
{{- else }}
{{- $_ := set . "portal_path" "/" -}}
{{- $_ := set . "api_path" "/api/" -}}
{{- $_ := set . "service_path" "/service/" -}}
{{- $_ := set . "v2_path" "/v2" -}}
{{- $_ := set . "chartrepo_path" "/chartrepo/" -}}
{{- $_ := set . "controller_path" "/c/" -}}
{{- end }}
apiVersion: {{ template "common.capabilities.ingress.apiVersion" . }}
kind: Ingress
metadata:
name: {{ include "harbor.ingress" . }}
namespace: {{ .Release.Namespace | quote }}
labels: {{- include "common.labels.standard" . | nindent 4 }}
{{- if .Values.commonLabels }}
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- end }}
annotations:
{{- if .Values.internalTLS.enabled }}
nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
{{- end }}
{{- if eq .Values.ingress.core.controller "ncp" }}
ncp/use-regex: "true"
{{- if .Values.internalTLS.enabled }}
ncp/http-redirect: "true"
{{- end }}
{{- end }}
{{- if .Values.ingress.core.annotations }}
{{- include "common.tplvalues.render" (dict "value" .Values.ingress.core.annotations "context" .) | nindent 4 }}
{{- end }}
{{- if .Values.commonAnnotations }}
{{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" .) | nindent 4 }}
{{- end }}
spec:
{{- if eq .Values.ingress.core.controller "ncp" }}
backend: {{- include "common.ingress.backend" (dict "serviceName" (include "harbor.portal" .) "servicePort" (ternary "https" "http" .Values.internalTLS.enabled) "context" $) | nindent 4 }}
{{- end }}
{{- if and .Values.ingress.core.ingressClassName (eq "true" (include "common.ingress.supportsIngressClassname" .)) }}
ingressClassName: {{ .Values.ingress.core.ingressClassName | quote }}
{{- end }}
rules:
{{- if .Values.ingress.core.hostname }}
- host: {{ include "common.tplvalues.render" ( dict "value" .Values.ingress.core.hostname "context" $ ) }}
http:
paths:
{{- if .Values.ingress.core.extraPaths }}
{{- toYaml .Values.ingress.core.extraPaths | nindent 10 }}
{{- end }}
- path: {{ .portal_path }}
{{- if eq "true" (include "common.ingress.supportsPathType" .) }}
pathType: {{ .Values.ingress.core.pathType }}
{{- end }}
backend: {{- include "common.ingress.backend" (dict "serviceName" (include "harbor.portal" .) "servicePort" (ternary "https" "http" .Values.internalTLS.enabled) "context" $) | nindent 14 }}
- path: {{ .api_path }}
{{- if eq "true" (include "common.ingress.supportsPathType" .) }}
pathType: {{ .Values.ingress.core.pathType }}
{{- end }}
backend: {{- include "common.ingress.backend" (dict "serviceName" (include "harbor.core" .) "servicePort" (ternary "https" "http" .Values.internalTLS.enabled) "context" $) | nindent 14 }}
- path: {{ .service_path }}
{{- if eq "true" (include "common.ingress.supportsPathType" .) }}
pathType: {{ .Values.ingress.core.pathType }}
{{- end }}
backend: {{- include "common.ingress.backend" (dict "serviceName" (include "harbor.core" .) "servicePort" (ternary "https" "http" .Values.internalTLS.enabled) "context" $) | nindent 14 }}
- path: {{ .v2_path }}
{{- if eq "true" (include "common.ingress.supportsPathType" .) }}
pathType: {{ .Values.ingress.core.pathType }}
{{- end }}
backend: {{- include "common.ingress.backend" (dict "serviceName" (include "harbor.core" .) "servicePort" (ternary "https" "http" .Values.internalTLS.enabled) "context" $) | nindent 14 }}
- path: {{ .chartrepo_path }}
{{- if eq "true" (include "common.ingress.supportsPathType" .) }}
pathType: {{ .Values.ingress.core.pathType }}
{{- end }}
backend: {{- include "common.ingress.backend" (dict "serviceName" (include "harbor.core" .) "servicePort" (ternary "https" "http" .Values.internalTLS.enabled) "context" $) | nindent 14 }}
- path: {{ .controller_path }}
{{- if eq "true" (include "common.ingress.supportsPathType" .) }}
pathType: {{ .Values.ingress.core.pathType }}
{{- end }}
backend: {{- include "common.ingress.backend" (dict "serviceName" (include "harbor.core" .) "servicePort" (ternary "https" "http" .Values.internalTLS.enabled) "context" $) | nindent 14 }}
{{- end }}
{{- range .Values.ingress.core.extraHosts }}
- host: {{ include "common.tplvalues.render" ( dict "value" .name "context" $ ) }}
http:
paths:
- path: {{ default "/" .path }}
{{- if eq "true" (include "common.ingress.supportsPathType" $) }}
pathType: {{ default "ImplementationSpecific" .pathType }}
{{- end }}
backend: {{- include "common.ingress.backend" (dict "serviceName" (include "harbor.core" .) "servicePort" (ternary "https" "http" .Values.internalTLS.enabled) "context" $) | nindent 14 }}
{{- end }}
{{- if or (and .Values.ingress.core.tls (or (include "common.ingress.certManagerRequest" ( dict "annotations" .Values.ingress.core.annotations )) .Values.ingress.core.selfSigned)) .Values.ingress.core.extraTls }}
tls:
{{- if and .Values.ingress.core.tls (or (include "common.ingress.certManagerRequest" ( dict "annotations" .Values.ingress.core.annotations )) .Values.ingress.core.selfSigned) }}
- hosts:
- {{ .Values.ingress.core.hostname | quote }}
secretName: {{ printf "%s-tls" .Values.ingress.core.hostname }}
{{- end }}
{{- if .Values.ingress.core.extraTls }}
{{- include "common.tplvalues.render" (dict "value" .Values.ingress.core.extraTls "context" $) | nindent 4 }}
{{- end }}
{{- end }}
{{- end }}
bitnami/harbor/templates/ingress/ingress.yaml
-162
View File
@@ -1,162 +0,0 @@
{{- if .Values.ingress.enabled }}
{{- if eq .Values.ingress.controller "gce" }}
{{- $_ := set . "portal_path" "/*" -}}
{{- $_ := set . "api_path" "/api/*" -}}
{{- $_ := set . "service_path" "/service/*" -}}
{{- $_ := set . "v2_path" "/v2/*" -}}
{{- $_ := set . "chartrepo_path" "/chartrepo/*" -}}
{{- $_ := set . "controller_path" "/c/*" -}}
{{- $_ := set . "notary_path" "/" -}}
{{- else if eq .Values.ingress.controller "ncp" }}
{{- $_ := set . "portal_path" "/.*" -}}
{{- $_ := set . "api_path" "/api/.*" -}}
{{- $_ := set . "service_path" "/service/.*" -}}
{{- $_ := set . "v2_path" "/v2/.*" -}}
{{- $_ := set . "chartrepo_path" "/chartrepo/.*" -}}
{{- $_ := set . "controller_path" "/c/.*" -}}
{{- $_ := set . "notary_path" "/.*" -}}
{{- else }}
{{- $_ := set . "portal_path" "/" -}}
{{- $_ := set . "api_path" "/api/" -}}
{{- $_ := set . "service_path" "/service/" -}}
{{- $_ := set . "v2_path" "/v2" -}}
{{- $_ := set . "chartrepo_path" "/chartrepo/" -}}
{{- $_ := set . "controller_path" "/c/" -}}
{{- $_ := set . "notary_path" "/" -}}
{{- end }}
---
apiVersion: {{ template "common.capabilities.ingress.apiVersion" . }}
kind: Ingress
metadata:
name: {{ include "harbor.ingress" . }}
labels: {{- include "common.labels.standard" . | nindent 4 }}
{{- if .Values.commonLabels }}
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- end }}
annotations:
{{- if .Values.internalTLS.enabled }}
nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
{{- end }}
{{- if .Values.ingress.certManager }}
kubernetes.io/tls-acme: "true"
{{- end }}
{{- if eq .Values.ingress.controller "ncp" }}
ncp/use-regex: "true"
{{- if .Values.internalTLS.enabled }}
ncp/http-redirect: "true"
{{- end }}
{{- end }}
{{- if .Values.ingress.annotations }}
{{- toYaml .Values.ingress.annotations | nindent 4 }}
{{- end }}
{{- if .Values.commonAnnotations }}
{{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
spec:
{{- if .Values.service.tls.enabled }}
tls:
{{- if .Values.service.tls.existingSecret }}
- secretName: {{ .Values.service.tls.existingSecret }}
{{- else }}
- secretName: {{ include "harbor.ingress" . }}
{{- end }}
{{- if .Values.ingress.hosts.core }}
hosts:
- {{ .Values.ingress.hosts.core }}
{{- end }}
{{- end }}
{{- if eq .Values.ingress.controller "ncp" }}
backend: {{- include "common.ingress.backend" (dict "serviceName" (include "harbor.portal" .) "servicePort" "http" "context" $) | nindent 4 }}
{{- end }}
rules:
- http:
paths:
- path: {{ .portal_path }}
{{- if eq "true" (include "common.ingress.supportsPathType" .) }}
pathType: {{ .Values.ingress.pathType }}
{{- end }}
backend: {{- include "common.ingress.backend" (dict "serviceName" (include "harbor.portal" .) "servicePort" "http" "context" $) | nindent 14 }}
- path: {{ .api_path }}
{{- if eq "true" (include "common.ingress.supportsPathType" .) }}
pathType: {{ .Values.ingress.pathType }}
{{- end }}
backend: {{- include "common.ingress.backend" (dict "serviceName" (include "harbor.core" .) "servicePort" "http" "context" $) | nindent 14 }}
- path: {{ .service_path }}
{{- if eq "true" (include "common.ingress.supportsPathType" .) }}
pathType: {{ .Values.ingress.pathType }}
{{- end }}
backend: {{- include "common.ingress.backend" (dict "serviceName" (include "harbor.core" .) "servicePort" "http" "context" $) | nindent 14 }}
- path: {{ .v2_path }}
{{- if eq "true" (include "common.ingress.supportsPathType" .) }}
pathType: {{ .Values.ingress.pathType }}
{{- end }}
backend: {{- include "common.ingress.backend" (dict "serviceName" (include "harbor.core" .) "servicePort" "http" "context" $) | nindent 14 }}
- path: {{ .chartrepo_path }}
{{- if eq "true" (include "common.ingress.supportsPathType" .) }}
pathType: {{ .Values.ingress.pathType }}
{{- end }}
backend: {{- include "common.ingress.backend" (dict "serviceName" (include "harbor.core" .) "servicePort" "http" "context" $) | nindent 14 }}
- path: {{ .controller_path }}
{{- if eq "true" (include "common.ingress.supportsPathType" .) }}
pathType: {{ .Values.ingress.pathType }}
{{- end }}
backend: {{- include "common.ingress.backend" (dict "serviceName" (include "harbor.core" .) "servicePort" "http" "context" $) | nindent 14 }}
{{- if .Values.ingress.hosts.core }}
host: {{ .Values.ingress.hosts.core }}
{{- end }}
{{- if .Values.notary.enabled }}
---
apiVersion: {{ template "common.capabilities.ingress.apiVersion" . }}
kind: Ingress
metadata:
name: {{ include "harbor.ingress-notary" . }}
labels: {{- include "common.labels.standard" . | nindent 4 }}
{{- if .Values.commonLabels }}
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- end }}
annotations:
{{- if eq .Values.ingress.controller "ncp" }}
ncp/use-regex: "true"
{{- if .Values.internalTLS.enabled }}
ncp/http-redirect: "true"
{{- end }}
{{- end }}
{{- if .Values.ingress.annotations }}
{{- toYaml .Values.ingress.annotations | nindent 4 }}
{{- end }}
{{- if .Values.commonAnnotations }}
{{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
spec:
{{- if .Values.service.tls.enabled }}
tls:
{{- if .Values.service.tls.notaryExistingSecret }}
- secretName: {{ .Values.service.tls.notaryExistingSecret }}
{{- else if .Values.service.tls.existingSecret }}
- secretName: {{ .Values.service.tls.existingSecret }}
{{- else }}
- secretName: {{ include "harbor.ingress-notary" . }}
{{- end }}
{{- if .Values.ingress.hosts.notary }}
hosts:
- {{ .Values.ingress.hosts.notary }}
{{- end }}
{{- end }}
{{- if eq .Values.ingress.controller "ncp" }}
backend: {{- include "common.ingress.backend" (dict "serviceName" (include "harbor.notary-server" .) "servicePort" 4443 "context" $) | nindent 4 }}
{{- end }}
rules:
- http:
paths:
- path: {{ .notary_path }}
{{- if eq "true" (include "common.ingress.supportsPathType" .) }}
pathType: {{ .Values.ingress.pathType }}
{{- end }}
backend: {{- include "common.ingress.backend" (dict "serviceName" (include "harbor.notary-server" .) "servicePort" 4443 "context" $) | nindent 14 }}
{{- if .Values.ingress.hosts.notary }}
host: {{ .Values.ingress.hosts.notary }}
{{- end }}
{{- end }}
{{- end }}
bitnami/harbor/templates/ingress/notary-ingress.yaml
+64
View File
@@ -0,0 +1,64 @@
{{- if and .Values.notary.enabled (eq .Values.exposureType "ingress") }}
apiVersion: {{ template "common.capabilities.ingress.apiVersion" . }}
kind: Ingress
metadata:
name: {{ include "harbor.ingress-notary" . }}
namespace: {{ .Release.Namespace | quote }}
labels: {{- include "common.labels.standard" . | nindent 4 }}
{{- if .Values.commonLabels }}
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- end }}
annotations:
{{- if .Values.ingress.notary.annotations }}
{{- include "common.tplvalues.render" (dict "value" .Values.ingress.notary.annotations "context" .) | nindent 4 }}
{{- end }}
{{- if .Values.commonAnnotations }}
{{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" .) | nindent 4 }}
{{- end }}
spec:
{{- if eq .Values.ingress.notary.controller "ncp" }}
backend: {{- include "common.ingress.backend" (dict "serviceName" (include "harbor.notary-server" .) "servicePort" "notary-server" "context" $) | nindent 4 }}
{{- end }}
{{- if and .Values.ingress.notary.ingressClassName (eq "true" (include "common.ingress.supportsIngressClassname" .)) }}
ingressClassName: {{ .Values.ingress.notary.ingressClassName | quote }}
{{- end }}
rules:
{{- if .Values.ingress.notary.hostname }}
- host: {{ include "common.tplvalues.render" ( dict "value" .Values.ingress.notary.hostname "context" $ ) }}
http:
paths:
{{- if .Values.ingress.notary.extraPaths }}
{{- toYaml .Values.ingress.notary.extraPaths | nindent 10 }}
{{- end }}
{{- if eq .Values.ingress.notary.controller "ncp" }}
- path: /.*
{{- else }}
- path: /
{{- end }}
{{- if eq "true" (include "common.ingress.supportsPathType" .) }}
pathType: {{ .Values.ingress.notary.pathType }}
{{- end }}
backend: {{- include "common.ingress.backend" (dict "serviceName" (include "harbor.notary-server" .) "servicePort" "notary-server" "context" $) | nindent 14 }}
{{- end }}
{{- range .Values.ingress.notary.extraHosts }}
- host: {{ include "common.tplvalues.render" ( dict "value" .name "context" $ ) }}
http:
paths:
- path: {{ default "/" .path }}
{{- if eq "true" (include "common.ingress.supportsPathType" $) }}
pathType: {{ default "ImplementationSpecific" .pathType }}
{{- end }}
backend: {{- include "common.ingress.backend" (dict "serviceName" (include "harbor.notary-server" .) "servicePort" "notary-server" "context" $) | nindent 14 }}
{{- end }}
{{- if or (and .Values.ingress.notary.tls (or (include "common.ingress.certManagerRequest" ( dict "annotations" .Values.ingress.notary.annotations )) .Values.ingress.notary.selfSigned)) .Values.ingress.notary.extraTls }}
tls:
{{- if and .Values.ingress.notary.tls (or (include "common.ingress.certManagerRequest" ( dict "annotations" .Values.ingress.notary.annotations )) .Values.ingress.notary.selfSigned) }}
- hosts:
- {{ .Values.ingress.notary.hostname | quote }}
secretName: {{ printf "%s-tls" .Values.ingress.notary.hostname }}
{{- end }}
{{- if .Values.ingress.notary.extraTls }}
{{- include "common.tplvalues.render" (dict "value" .Values.ingress.notary.extraTls "context" $) | nindent 4 }}
{{- end }}
{{- end }}
{{- end }}
bitnami/harbor/templates/ingress/secret.yaml
-38
View File
@@ -1,38 +0,0 @@
{{- if eq (include "harbor.autoGenCertForIngress" .) "true" }}
{{- $ca := genCA "harbor-ca" 365 }}
{{- $cert := genSignedCert .Values.ingress.hosts.core nil (list .Values.ingress.hosts.core ) 365 $ca }}
apiVersion: v1
kind: Secret
metadata:
name: {{ include "harbor.ingress" . }}
labels: {{- include "common.labels.standard" . | nindent 4 }}
{{- if .Values.commonLabels }}
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- end }}
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
type: kubernetes.io/tls
data:
tls.crt: {{ $cert.Cert | b64enc | quote }}
tls.key: {{ $cert.Key | b64enc | quote }}
ca.crt: {{ $ca.Cert | b64enc | quote }}
---
{{- $cert := genSignedCert .Values.ingress.hosts.notary nil (list .Values.ingress.hosts.notary) 365 $ca }}
apiVersion: v1
kind: Secret
metadata:
name: {{ include "harbor.ingress-notary" . }}
labels: {{- include "common.labels.standard" . | nindent 4 }}
{{- if .Values.commonLabels }}
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- end }}
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
type: kubernetes.io/tls
data:
tls.crt: {{ $cert.Cert | b64enc | quote }}
tls.key: {{ $cert.Key | b64enc | quote }}
ca.crt: {{ $ca.Cert | b64enc | quote }}
{{- end }}
bitnami/harbor/templates/ingress/tls-secret.yaml
+85
View File
@@ -0,0 +1,85 @@
{{- if eq .Values.exposureType "ingress" }}
{{- $ca := genCA "harbor-ca" 365 }}
{{- range .Values.ingress.core.secrets }}
apiVersion: v1
kind: Secret
metadata:
name: {{ .name }}
namespace: {{ $.Release.Namespace | quote | quote }}
labels: {{- include "common.labels.standard" $ | nindent 4 }}
{{- if $.Values.commonLabels }}
{{- include "common.tplvalues.render" ( dict "value" $.Values.commonLabels "context" $ ) | nindent 4 }}
{{- end }}
{{- if $.Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" $.Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
type: kubernetes.io/tls
data:
tls.crt: {{ .certificate | b64enc }}
tls.key: {{ .key | b64enc }}
---
{{- end }}
{{- if and .Values.ingress.core.tls .Values.ingress.core.selfSigned }}
{{- $cert := genSignedCert .Values.ingress.core.hostname nil (list .Values.ingress.core.hostname) 365 $ca }}
apiVersion: v1
kind: Secret
metadata:
name: {{ printf "%s-tls" .Values.ingress.core.hostname }}
namespace: {{ .Release.Namespace | quote | quote }}
labels: {{- include "common.labels.standard" . | nindent 4 }}
{{- if .Values.commonLabels }}
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- end }}
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
type: kubernetes.io/tls
data:
tls.crt: {{ $cert.Cert | b64enc | quote }}
tls.key: {{ $cert.Key | b64enc | quote }}
ca.crt: {{ $ca.Cert | b64enc | quote }}
---
{{- end }}
{{- if .Values.notary.enabled }}
{{- range .Values.ingress.notary.secrets }}
apiVersion: v1
kind: Secret
metadata:
name: {{ .name }}
namespace: {{ $.Release.Namespace | quote | quote }}
labels: {{- include "common.labels.standard" $ | nindent 4 }}
{{- if $.Values.commonLabels }}
{{- include "common.tplvalues.render" ( dict "value" $.Values.commonLabels "context" $ ) | nindent 4 }}
{{- end }}
{{- if $.Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" $.Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
type: kubernetes.io/tls
data:
tls.crt: {{ .certificate | b64enc }}
tls.key: {{ .key | b64enc }}
---
{{- end }}
{{- if and .Values.ingress.notary.tls .Values.ingress.notary.selfSigned }}
{{- $cert := genSignedCert .Values.ingress.notary.hostname nil (list .Values.ingress.notary.hostname) 365 $ca }}
apiVersion: v1
kind: Secret
metadata:
name: {{ printf "%s-tls" .Values.ingress.notary.hostname }}
namespace: {{ .Release.Namespace | quote | quote }}
labels: {{- include "common.labels.standard" . | nindent 4 }}
{{- if .Values.commonLabels }}
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- end }}
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
type: kubernetes.io/tls
data:
tls.crt: {{ $cert.Cert | b64enc | quote }}
tls.key: {{ $cert.Key | b64enc | quote }}
ca.crt: {{ $ca.Cert | b64enc | quote }}
---
{{- end }}
{{- end }}
{{- end }}
bitnami/harbor/templates/internal/internal-crt-secret.yaml
+7
View File
@@ -9,6 +9,7 @@ apiVersion: v1
kind: Secret
metadata:
name: {{ include "harbor.core" . }}-crt
namespace: {{ .Release.Namespace | quote }}
labels: {{- include "common.labels.standard" . | nindent 4 }}
{{- if .Values.commonLabels }}
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
@@ -28,6 +29,7 @@ apiVersion: v1
kind: Secret
metadata:
name: {{ include "harbor.jobservice" . }}-crt
namespace: {{ .Release.Namespace | quote }}
labels: {{- include "common.labels.standard" . | nindent 4 }}
{{- if .Values.commonLabels }}
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
@@ -47,6 +49,7 @@ apiVersion: v1
kind: Secret
metadata:
name: {{ include "harbor.registry" . }}-crt
namespace: {{ .Release.Namespace | quote }}
labels: {{- include "common.labels.standard" . | nindent 4 }}
{{- if .Values.commonLabels }}
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
@@ -66,6 +69,7 @@ apiVersion: v1
kind: Secret
metadata:
name: {{ include "harbor.portal" . }}-crt
namespace: {{ .Release.Namespace | quote }}
labels: {{- include "common.labels.standard" . | nindent 4 }}
{{- if .Values.commonLabels }}
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
@@ -85,6 +89,7 @@ apiVersion: v1
kind: Secret
metadata:
name: {{ include "harbor.chartmuseum" . }}-crt
namespace: {{ .Release.Namespace | quote }}
labels: {{- include "common.labels.standard" . | nindent 4 }}
{{- if .Values.commonLabels }}
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
@@ -105,6 +110,7 @@ apiVersion: v1
kind: Secret
metadata:
name: {{ include "harbor.clair" . }}-crt
namespace: {{ .Release.Namespace | quote }}
labels: {{- include "common.labels.standard" . | nindent 4 }}
{{- if .Values.commonLabels }}
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
@@ -125,6 +131,7 @@ apiVersion: v1
kind: Secret
metadata:
name: {{ include "harbor.trivy" . }}-crt
namespace: {{ .Release.Namespace | quote }}
labels: {{- include "common.labels.standard" . | nindent 4 }}
{{- if .Values.commonLabels }}
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
bitnami/harbor/templates/jobservice/jobservice-cm-envvars.yaml
+2 -1
View File
@@ -1,7 +1,8 @@
apiVersion: v1
kind: ConfigMap
metadata:
name: {{ template "harbor.jobservice" . }}-envvars
name: {{ printf "%s-envvars" (include "harbor.jobservice" .) }}
namespace: {{ .Release.Namespace | quote }}
labels: {{- include "common.labels.standard" . | nindent 4 }}
{{- if .Values.commonLabels }}
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
bitnami/harbor/templates/jobservice/jobservice-cm.yaml
+3 -2
View File
@@ -2,6 +2,7 @@ apiVersion: v1
kind: ConfigMap
metadata:
name: {{ include "harbor.jobservice" . }}
namespace: {{ .Release.Namespace | quote }}
labels: {{- include "common.labels.standard" . | nindent 4 }}
{{- if .Values.commonLabels }}
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
@@ -13,8 +14,8 @@ metadata:
data:
config.yml: |+
#Server listening port
protocol: {{ include "harbor.component.scheme" . | quote }}
port: {{ include "harbor.jobservice.containerPort" . }}
protocol: {{ ternary "https" "http" .Values.internalTLS.enabled | quote }}
port: {{ ternary .Values.jobservice.containerPorts.https .Values.jobservice.containerPorts.http .Values.internalTLS.enabled }}
{{- if .Values.internalTLS.enabled }}
https_config:
cert: "/etc/harbor/ssl/jobservice/tls.crt"
bitnami/harbor/templates/jobservice/jobservice-dpl.yaml
+84 -70
View File
@@ -2,6 +2,7 @@ apiVersion: {{ template "common.capabilities.deployment.apiVersion" . }}
kind: Deployment
metadata:
name: {{ include "harbor.jobservice" . }}
namespace: {{ .Release.Namespace | quote }}
labels: {{- include "common.labels.standard" . | nindent 4 }}
{{- if .Values.commonLabels }}
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
@@ -12,12 +13,12 @@ metadata:
{{- end }}
spec:
replicas: {{ .Values.jobservice.replicas }}
{{- if .Values.jobservice.updateStrategy }}
strategy: {{- toYaml .Values.jobservice.updateStrategy | nindent 4 }}
{{- end }}
selector:
matchLabels: {{- include "common.labels.matchLabels" . | nindent 6 }}
app.kubernetes.io/component: jobservice
{{- if .Values.jobservice.updateStrategy }}
strategy: {{- toYaml .Values.jobservice.updateStrategy | nindent 4 }}
{{- end }}
template:
metadata:
labels: {{- include "common.labels.standard" . | nindent 8 }}
@@ -43,10 +44,12 @@ spec:
spec:
{{- include "harbor.imagePullSecrets" . | nindent 6 }}
automountServiceAccountToken: {{ .Values.jobservice.automountServiceAccountToken }}
{{- if .Values.jobservice.hostAliases }}
hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.jobservice.hostAliases "context" $) | nindent 8 }}
{{- end }}
{{- if .Values.jobservice.affinity }}
affinity: {{- include "common.tplvalues.render" (dict "value" .Values.jobservice.affinity "context" $) | nindent 8 }}
{{- else }}
priorityClassName: {{ .Values.jobservice.priorityClassName | quote }}
affinity:
podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.jobservice.podAffinityPreset "component" "jobservice" "context" $) | nindent 10 }}
podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.jobservice.podAntiAffinityPreset "component" "jobservice" "context" $) | nindent 10 }}
@@ -58,22 +61,33 @@ spec:
{{- if .Values.jobservice.tolerations }}
tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.jobservice.tolerations "context" $) | nindent 8 }}
{{- end }}
{{- if .Values.podSecurityContext }}
securityContext: {{- include "common.tplvalues.render" (dict "value" .Values.podSecurityContext "context" $) | nindent 8 }}
{{- if .Values.jobservice.topologySpreadConstraints }}
topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.jobservice.topologySpreadConstraints "context" .) | nindent 8 }}
{{- end }}
{{- if .Values.jobservice.priorityClassName }}
priorityClassName: {{ .Values.jobservice.priorityClassName | quote }}
{{- end }}
{{- if .Values.jobservice.schedulerName }}
schedulerName: {{ .Values.jobservice.schedulerName }}
{{- end }}
{{- if .Values.jobservice.podSecurityContext.enabled }}
securityContext: {{- omit .Values.jobservice.podSecurityContext "enabled" | toYaml | nindent 8 }}
{{- end }}
initContainers:
{{- if and .Values.volumePermissions.enabled .Values.persistence.enabled }}
{{- if and .Values.volumePermissions.enabled .Values.persistence.enabled }}
- name: volume-permissions
image: {{ include "harbor.volumePermissions.image" . }}
imagePullPolicy: {{ .Values.volumePermissions.image.pullPolicy | quote }}
command:
- sh
- -c
- /bin/bash
args:
- -ec
- |
mkdir -p "/var/log/jobs"
chown -R "{{ .Values.containerSecurityContext.runAsUser }}:{{ .Values.podSecurityContext.fsGroup }}" "/var/log/jobs"
securityContext:
runAsUser: 0
mkdir -p /var/log/jobs
find /var/log/jobs -mindepth 1 -maxdepth 1 -not -name ".snapshot" -not -name "lost+found" | xargs -r chown -R {{ .Values.jobservice.containerSecurityContext.runAsUser }}:{{ .Values.jobservice.podSecurityContext.fsGroup }}
{{- if .Values.volumePermissions.containerSecurityContext.enabled }}
securityContext: {{- omit .Values.volumePermissions.containerSecurityContext "enabled" | toYaml | nindent 12 }}
{{- end }}
{{- if .Values.volumePermissions.resources }}
resources: {{- toYaml .Values.volumePermissions.resources | nindent 12 }}
{{- end }}
@@ -81,63 +95,30 @@ spec:
- name: job-logs
mountPath: /var/log/jobs
subPath: {{ .Values.persistence.persistentVolumeClaim.jobservice.subPath }}
{{- end }}
{{- if .Values.jobservice.initContainers }}
{{- include "common.tplvalues.render" (dict "value" .Values.jobservice.initContainers "context" $) | nindent 8 }}
{{- end }}
{{- if .Values.jobservice.hostAliases }}
hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.jobservice.hostAliases "context" $) | nindent 8 }}
{{- end }}
{{- end }}
{{- if .Values.jobservice.initContainers }}
{{- include "common.tplvalues.render" (dict "value" .Values.jobservice.initContainers "context" $) | nindent 8 }}
{{- end }}
containers:
- name: jobservice
image: {{ include "harbor.jobserviceImage" . }}
imagePullPolicy: {{ .Values.jobserviceImage.pullPolicy | quote }}
{{- if .Values.jobservice.command }}
image: {{ include "harbor.jobservice.image" . }}
imagePullPolicy: {{ .Values.jobservice.image.pullPolicy | quote }}
{{- if .Values.jobservice.containerSecurityContext.enabled }}
securityContext: {{- omit .Values.jobservice.containerSecurityContext "enabled" | toYaml | nindent 12 }}
{{- end }}
{{- if .Values.diagnosticMode.enabled }}
command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }}
{{- else if .Values.jobservice.command }}
command: {{- include "common.tplvalues.render" (dict "value" .Values.jobservice.command "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.containerSecurityContext }}
securityContext: {{- include "common.tplvalues.render" (dict "value" .Values.containerSecurityContext "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.jobservice.args }}
{{- if .Values.diagnosticMode.enabled }}
args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }}
{{- else if .Values.jobservice.args }}
args: {{- include "common.tplvalues.render" (dict "value" .Values.jobservice.args "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.jobservice.livenessProbe.enabled }}
livenessProbe:
httpGet:
path: /api/v1/stats
port: http
scheme: {{ include "harbor.component.scheme" . | upper }}
initialDelaySeconds: {{ .Values.jobservice.livenessProbe.initialDelaySeconds }}
periodSeconds: {{ .Values.jobservice.livenessProbe.periodSeconds }}
timeoutSeconds: {{ .Values.jobservice.livenessProbe.timeoutSeconds }}
successThreshold: {{ .Values.jobservice.livenessProbe.successThreshold }}
failureThreshold: {{ .Values.jobservice.livenessProbe.failureThreshold }}
{{- else if .Values.jobservice.customLivenessProbe }}
livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.jobservice.customLivenessProbe "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.jobservice.readinessProbe.enabled }}
readinessProbe:
httpGet:
path: /api/v1/stats
port: http
scheme: {{ include "harbor.component.scheme" . | upper }}
initialDelaySeconds: {{ .Values.jobservice.readinessProbe.initialDelaySeconds }}
periodSeconds: {{ .Values.jobservice.readinessProbe.periodSeconds }}
timeoutSeconds: {{ .Values.jobservice.readinessProbe.timeoutSeconds }}
successThreshold: {{ .Values.jobservice.readinessProbe.successThreshold }}
failureThreshold: {{ .Values.jobservice.readinessProbe.failureThreshold }}
{{- else if .Values.jobservice.customReadinessProbe }}
readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.jobservice.customReadinessProbe "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.jobservice.lifecycleHooks }}
lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.jobservice.lifecycleHooks "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.jobservice.resources }}
resources: {{- toYaml .Values.jobservice.resources | nindent 12 }}
{{- end }}
env:
- name: BITNAMI_DEBUG
value: {{ ternary "true" "false" .Values.jobserviceImage.debug | quote }}
value: {{ ternary "true" "false" .Values.jobservice.image.debug | quote }}
- name: CORE_SECRET
valueFrom:
secretKeyRef:
@@ -163,9 +144,9 @@ spec:
{{- end }}
envFrom:
- configMapRef:
name: {{ template "harbor.jobservice" . }}-envvars
name: {{ printf "%s-envvars" (include "harbor.jobservice" .) }}
- secretRef:
name: {{ template "harbor.jobservice" . }}-envvars
name: {{ printf "%s-envvars" (include "harbor.jobservice" .) }}
{{- if .Values.jobservice.extraEnvVarsCM }}
- configMapRef:
name: {{ include "common.tplvalues.render" (dict "value" .Values.jobservice.extraEnvVarsCM "context" $) }}
@@ -175,8 +156,41 @@ spec:
name: {{ include "common.tplvalues.render" (dict "value" .Values.jobservice.extraEnvVarsSecret "context" $) }}
{{- end }}
ports:
- containerPort: {{ include "harbor.jobservice.containerPort" . }}
name: http
- containerPort: {{ ternary .Values.jobservice.containerPorts.https .Values.jobservice.containerPorts.http .Values.internalTLS.enabled }}
name: {{ ternary "https" "http" .Values.internalTLS.enabled }}
{{- if not .Values.diagnosticMode.enabled }}
{{- if .Values.jobservice.startupProbe.enabled }}
startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.jobservice.startupProbe "enabled") "context" $) | nindent 12 }}
tcpSocket:
port: {{ ternary "https" "http" .Values.internalTLS.enabled }}
{{- else if .Values.jobservice.customStartupProbe }}
startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.jobservice.customStartupProbe "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.jobservice.livenessProbe.enabled }}
livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.jobservice.livenessProbe "enabled") "context" $) | nindent 12 }}
httpGet:
path: /api/v1/stats
port: {{ ternary "https" "http" .Values.internalTLS.enabled }}
scheme: {{ ternary "https" "http" .Values.internalTLS.enabled | upper }}
{{- else if .Values.jobservice.customLivenessProbe }}
livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.jobservice.customLivenessProbe "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.jobservice.readinessProbe.enabled }}
readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.jobservice.readinessProbe "enabled") "context" $) | nindent 12 }}
httpGet:
path: /api/v1/stats
port: {{ ternary "https" "http" .Values.internalTLS.enabled }}
scheme: {{ ternary "https" "http" .Values.internalTLS.enabled | upper }}
{{- else if .Values.jobservice.customReadinessProbe }}
readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.jobservice.customReadinessProbe "context" $) | nindent 12 }}
{{- end }}
{{- end }}
{{- if .Values.jobservice.lifecycleHooks }}
lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.jobservice.lifecycleHooks "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.jobservice.resources }}
resources: {{- toYaml .Values.jobservice.resources | nindent 12 }}
{{- end }}
volumeMounts:
- name: jobservice-config
mountPath: /etc/jobservice/config.yml
@@ -188,8 +202,8 @@ spec:
- name: internal-tls-certs
mountPath: /etc/harbor/ssl/jobservice
{{- end }}
{{- if .Values.caBundleSecretName }}
{{ include "harbor.caBundleVolumeMount" . | indent 12 }}
{{- if .Values.internalTLS.caBundleSecret }}
{{- include "harbor.caBundleVolumeMount" . | nindent 12 }}
{{- end }}
{{- if .Values.jobservice.extraVolumeMounts }}
{{- include "common.tplvalues.render" (dict "value" .Values.jobservice.extraVolumeMounts "context" $) | nindent 12 }}
@@ -208,8 +222,8 @@ spec:
{{- else }}
emptyDir: {}
{{- end }}
{{- if .Values.caBundleSecretName }}
{{ include "harbor.caBundleVolume" . | indent 8 }}
{{- if .Values.internalTLS.caBundleSecret }}
{{- include "harbor.caBundleVolume" . | nindent 8 }}
{{- end }}
{{- if .Values.internalTLS.enabled }}
- name: internal-tls-certs
bitnami/harbor/templates/jobservice/jobservice-pvc.yaml
+15 -6
View File
@@ -4,24 +4,33 @@ kind: PersistentVolumeClaim
apiVersion: v1
metadata:
name: {{ include "harbor.jobservice" . }}
namespace: {{ .Release.Namespace | quote }}
labels: {{- include "common.labels.standard" . | nindent 4 }}
{{- if .Values.commonLabels }}
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- end }}
app.kubernetes.io/component: jobservice
annotations:
{{- if eq .Values.persistence.resourcePolicy "keep" }}
{{- if eq .Values.persistence.resourcePolicy "keep" }}
helm.sh/resource-policy: keep
{{- end }}
{{- if .Values.commonAnnotations }}
{{- end }}
{{- if .Values.commonAnnotations }}
{{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
{{- end }}
{{- if .Values.persistence.persistentVolumeClaim.jobservice.annotations }}
{{- toYaml .Values.persistence.persistentVolumeClaim.jobservice.annotations | nindent 4 }}
{{- end }}
spec:
accessModes:
- {{ .Values.persistence.persistentVolumeClaim.jobservice.accessMode }}
{{- range .Values.persistence.persistentVolumeClaim.jobservice.accessModes }}
- {{ . | quote }}
{{- end }}
resources:
requests:
storage: {{ .Values.persistence.persistentVolumeClaim.jobservice.size }}
{{- include "harbor.jobservice.storageClass" . | nindent 2 }}
{{- if .Values.persistence.persistentVolumeClaim.jobservice.selector }}
selector: {{- include "common.tplvalues.render" (dict "value" .Values.persistence.persistentVolumeClaim.jobservice.selector "context" $) | nindent 2 }}
{{- end }}
{{- include "common.storage.class" ( dict "persistence" .Values.persistence.persistentVolumeClaim.jobservice "global" .Values.global ) | nindent 2 }}
{{- end }}
{{- end }}
bitnami/harbor/templates/jobservice/jobservice-secret-envvars.yaml
+2 -1
View File
@@ -1,7 +1,8 @@
apiVersion: v1
kind: Secret
metadata:
name: {{ include "harbor.jobservice" . }}-envvars
name: {{ printf "%s-envvars" (include "harbor.jobservice" .) }}
namespace: {{ .Release.Namespace | quote }}
labels: {{- include "common.labels.standard" . | nindent 4 }}
{{- if .Values.commonLabels }}
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
bitnami/harbor/templates/jobservice/jobservice-secrets.yaml
+3 -2
View File
@@ -1,7 +1,8 @@
apiVersion: v1
kind: Secret
metadata:
name: {{ template "harbor.jobservice" . }}
name: {{ include "harbor.jobservice" . }}
namespace: {{ .Release.Namespace | quote }}
labels: {{- include "common.labels.standard" . | nindent 4 }}
{{- if .Values.commonLabels }}
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
@@ -12,4 +13,4 @@ metadata:
{{- end }}
type: Opaque
data:
secret: {{ .Values.jobservice.secret | default (randAlphaNum 16) | b64enc | quote }}
secret: {{ include "common.secrets.passwords.manage" (dict "secret" (include "harbor.jobservice" .) "key" "secret" "length" 16 "providedValues" (list "jobservice.secret") "context" $) }}
bitnami/harbor/templates/jobservice/jobservice-svc.yaml
+4 -3
View File
@@ -2,6 +2,7 @@ apiVersion: v1
kind: Service
metadata:
name: {{ include "harbor.jobservice" . }}
namespace: {{ .Release.Namespace | quote }}
labels: {{- include "common.labels.standard" . | nindent 4 }}
{{- if .Values.commonLabels }}
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
@@ -12,8 +13,8 @@ metadata:
{{- end }}
spec:
ports:
- name: http
port: {{ include "harbor.jobservice.servicePort" . }}
targetPort: http
- name: {{ ternary "https" "http" .Values.internalTLS.enabled }}
port: {{ ternary .Values.jobservice.service.ports.https .Values.jobservice.service.ports.http .Values.internalTLS.enabled }}
targetPort: {{ ternary "https" "http" .Values.internalTLS.enabled }}
selector: {{- include "common.labels.matchLabels" . | nindent 4 }}
app.kubernetes.io/component: jobservice
bitnami/harbor/templates/nginx/configmap-http.yaml
+7 -6
View File
@@ -1,9 +1,10 @@
{{- if and (not .Values.ingress.enabled) (not .Values.service.tls.enabled) }}
{{- $scheme := include "harbor.component.scheme" . -}}
{{- if and (eq .Values.exposureType "proxy") (not .Values.nginx.tls.enabled) }}
{{- $scheme := ternary "https" "http" .Values.internalTLS.enabled -}}
apiVersion: v1
kind: ConfigMap
metadata:
name: {{ include "harbor.nginx" . }}
namespace: {{ .Release.Namespace | quote }}
labels: {{- include "common.labels.standard" . | nindent 4 }}
{{- if .Values.commonLabels }}
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
@@ -35,11 +36,11 @@ data:
proxy_http_version 1.1;
upstream core {
server {{ template "harbor.core" . }}:{{ template "harbor.core.servicePort" . }};
server {{ printf "%s:%d" (include "harbor.core" .) (ternary .Values.core.service.ports.https .Values.core.service.ports.http .Values.internalTLS.enabled | int) }};
}
upstream portal {
server {{ template "harbor.portal" . }}:{{ template "harbor.portal.servicePort" . }};
server {{ printf "%s:%d" (include "harbor.portal" .) (ternary .Values.portal.service.ports.https .Values.portal.service.ports.http .Values.internalTLS.enabled | int) }};
}
log_format timed_combined '[$time_local]:$remote_addr - '
@@ -51,10 +52,10 @@ data:
server {
{{- if .Values.ipFamily.ipv4.enabled }}
listen 8080;
listen {{ .Values.nginx.containerPorts.http }};
{{- end }}
{{- if .Values.ipFamily.ipv6.enabled }}
listen [::]:8080;
listen [::]:{{ .Values.nginx.containerPorts.http }};
{{- end }}
server_tokens off;
# disable any limits to avoid HTTP 413 for large image uploads
bitnami/harbor/templates/nginx/configmap-https.yaml
+10 -9
View File
@@ -1,9 +1,10 @@
{{- if and (not .Values.ingress.enabled) .Values.service.tls.enabled }}
{{- $scheme := (include "harbor.component.scheme" .) -}}
{{- if and (eq .Values.exposureType "proxy") .Values.nginx.tls.enabled }}
{{- $scheme := ternary "https" "http" .Values.internalTLS.enabled -}}
apiVersion: v1
kind: ConfigMap
metadata:
name: {{ include "harbor.nginx" . }}
namespace: {{ .Release.Namespace | quote }}
labels: {{- include "common.labels.standard" . | nindent 4 }}
{{- if .Values.commonLabels }}
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
@@ -36,16 +37,16 @@ data:
proxy_http_version 1.1;
upstream core {
server "{{ template "harbor.core" . }}:{{ template "harbor.core.servicePort" . }}";
server {{ printf "%s:%d" (include "harbor.core" .) (ternary .Values.core.service.ports.https .Values.core.service.ports.http .Values.internalTLS.enabled | int) }};
}
upstream portal {
server "{{ template "harbor.portal" . }}:{{ template "harbor.portal.servicePort" . }}";
server {{ printf "%s:%d" (include "harbor.portal" .) (ternary .Values.portal.service.ports.https .Values.portal.service.ports.http .Values.internalTLS.enabled | int) }};
}
{{- if .Values.notary.enabled }}
upstream notary-server {
server {{ template "harbor.notary-server" . }}:4443;
server {{ printf "%s:%d" (include "harbor.notary-server" .) (.Values.notary.service.ports.server | int) }};
}
{{- end }}
@@ -59,10 +60,10 @@ data:
{{- if .Values.notary.enabled }}
server {
{{- if .Values.ipFamily.ipv4.enabled }}
listen 4443 ssl;
listen {{ .Values.nginx.containerPorts.notary }} ssl;
{{- end }}
{{- if .Values.ipFamily.ipv6.enabled }}
listen [::]:4443 ssl;
listen [::]:{{ .Values.nginx.containerPorts.notary }} ssl;
{{- end }}
server_tokens off;
# ssl
@@ -99,10 +100,10 @@ data:
server {
{{- if .Values.ipFamily.ipv4.enabled }}
listen 8443 ssl;
listen {{ .Values.nginx.containerPorts.https }} ssl;
{{- end }}
{{- if .Values.ipFamily.ipv6.enabled }}
listen [::]:8443 ssl;
listen [::]:{{ .Values.nginx.containerPorts.https }} ssl;
{{- end }}
server_tokens off;
# SSL
bitnami/harbor/templates/nginx/deployment.yaml
+72 -66
View File
@@ -1,8 +1,9 @@
{{- if not .Values.ingress.enabled }}
{{- if eq .Values.exposureType "proxy" }}
apiVersion: {{ template "common.capabilities.deployment.apiVersion" . }}
kind: Deployment
metadata:
name: {{ include "harbor.nginx" . }}
namespace: {{ .Release.Namespace | quote }}
labels: {{- include "common.labels.standard" . | nindent 4 }}
{{- if .Values.commonLabels }}
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
@@ -12,13 +13,13 @@ metadata:
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
spec:
replicas: {{ .Values.nginx.replicas }}
{{- if .Values.nginx.updateStrategy }}
strategy: {{- toYaml .Values.nginx.updateStrategy | nindent 4 }}
{{- end }}
replicas: {{ .Values.nginx.replicaCount }}
selector:
matchLabels: {{- include "common.labels.matchLabels" . | nindent 6 }}
app.kubernetes.io/component: nginx
{{- if .Values.nginx.updateStrategy }}
strategy: {{- toYaml .Values.nginx.updateStrategy | nindent 4 }}
{{- end }}
template:
metadata:
labels: {{- include "common.labels.standard" . | nindent 8 }}
@@ -30,21 +31,21 @@ spec:
{{- end }}
app.kubernetes.io/component: nginx
annotations:
{{- if not .Values.service.tls.enabled }}
{{- if not .Values.nginx.tls.enabled }}
checksum/configmap: {{ include (print $.Template.BasePath "/nginx/configmap-http.yaml") . | sha256sum }}
{{- else }}
checksum/configmap: {{ include (print $.Template.BasePath "/nginx/configmap-https.yaml") . | sha256sum }}
{{- end }}
{{- if eq (include "harbor.autoGenCertForNginx" .) "true" }}
checksum/secret: {{ include (print $.Template.BasePath "/nginx/secret.yaml") . | sha256sum }}
{{- if (include "harbor.autoGenCertForNginx" .) }}
checksum/tls-secret: {{ include (print $.Template.BasePath "/nginx/tls-secret.yaml") . | sha256sum }}
{{- end }}
{{- if .Values.nginx.podAnnotations }}
annotations: {{- include "common.tplvalues.render" (dict "value" .Values.nginx.podAnnotations "context" $) | nindent 8 }}
{{- end }}
spec:
{{- include "harbor.imagePullSecrets" . | nindent 6 }}
{{- if .Values.nginx.priorityClassName }}
priorityClassName: {{ .Values.nginx.priorityClassName | quote }}
{{- if .Values.nginx.hostAliases }}
hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.nginx.hostAliases "context" $) | nindent 8 }}
{{- end }}
{{- if .Values.nginx.affinity }}
affinity: {{- include "common.tplvalues.render" (dict "value" .Values.nginx.affinity "context" $) | nindent 8 }}
@@ -60,63 +61,41 @@ spec:
{{- if .Values.nginx.tolerations }}
tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.nginx.tolerations "context" $) | nindent 8 }}
{{- end }}
{{- if .Values.podSecurityContext }}
securityContext: {{- include "common.tplvalues.render" (dict "value" .Values.podSecurityContext "context" $) | nindent 8 }}
{{- if .Values.nginx.topologySpreadConstraints }}
topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.nginx.topologySpreadConstraints "context" .) | nindent 8 }}
{{- end }}
{{- if .Values.nginx.priorityClassName }}
priorityClassName: {{ .Values.nginx.priorityClassName | quote }}
{{- end }}
{{- if .Values.nginx.schedulerName }}
schedulerName: {{ .Values.nginx.schedulerName }}
{{- end }}
{{- if .Values.nginx.podSecurityContext.enabled }}
securityContext: {{- omit .Values.nginx.podSecurityContext "enabled" | toYaml | nindent 8 }}
{{- end }}
{{- if .Values.nginx.initContainers }}
initContainers: {{- include "common.tplvalues.render" (dict "value" .Values.nginx.initContainers "context" $) | nindent 8 }}
{{- end }}
{{- if .Values.nginx.hostAliases }}
hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.nginx.hostAliases "context" $) | nindent 8 }}
{{- end }}
containers:
- name: nginx
image: {{ include "harbor.nginxImage" . }}
imagePullPolicy: {{ .Values.nginxImage.pullPolicy | quote }}
{{- if .Values.nginx.command }}
image: {{ include "harbor.nginx.image" . }}
imagePullPolicy: {{ .Values.nginx.image.pullPolicy | quote }}
{{- if .Values.nginx.containerSecurityContext.enabled }}
securityContext: {{- omit .Values.nginx.containerSecurityContext "enabled" | toYaml | nindent 12 }}
{{- end }}
{{- if .Values.diagnosticMode.enabled }}
command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }}
{{- else if .Values.nginx.command }}
command: {{- include "common.tplvalues.render" (dict "value" .Values.nginx.command "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.nginx.args }}
{{- if .Values.diagnosticMode.enabled }}
args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }}
{{- else if .Values.nginx.args }}
args: {{- include "common.tplvalues.render" (dict "value" .Values.nginx.args "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.containerSecurityContext }}
securityContext: {{- include "common.tplvalues.render" (dict "value" .Values.containerSecurityContext "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.nginx.livenessProbe.enabled }}
livenessProbe:
httpGet:
path: /
port: {{ ternary "https" "http" .Values.service.tls.enabled }}
{{- if .Values.service.tls.enabled }}
scheme: HTTPS
{{- end }}
initialDelaySeconds: {{ .Values.nginx.livenessProbe.initialDelaySeconds }}
periodSeconds: {{ .Values.nginx.livenessProbe.periodSeconds }}
timeoutSeconds: {{ .Values.nginx.livenessProbe.timeoutSeconds }}
successThreshold: {{ .Values.nginx.livenessProbe.successThreshold }}
failureThreshold: {{ .Values.nginx.livenessProbe.failureThreshold }}
{{- else if .Values.nginx.customLivenessProbe }}
livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.nginx.customLivenessProbe "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.nginx.readinessProbe.enabled }}
readinessProbe:
httpGet:
path: /
port: {{ ternary "https" "http" .Values.service.tls.enabled }}
{{- if .Values.service.tls.enabled }}
scheme: HTTPS
{{- end }}
initialDelaySeconds: {{ .Values.nginx.readinessProbe.initialDelaySeconds }}
periodSeconds: {{ .Values.nginx.readinessProbe.periodSeconds }}
timeoutSeconds: {{ .Values.nginx.readinessProbe.timeoutSeconds }}
successThreshold: {{ .Values.nginx.readinessProbe.successThreshold }}
failureThreshold: {{ .Values.nginx.readinessProbe.failureThreshold }}
{{- else if .Values.nginx.customReadinessProbe }}
readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.nginx.customReadinessProbe "context" $) | nindent 12 }}
{{- end }}
env:
- name: BITNAMI_DEBUG
value: {{ ternary "true" "false" .Values.nginxImage.debug | quote }}
value: {{ ternary "true" "false" .Values.nginx.image.debug | quote }}
{{- if .Values.nginx.extraEnvVars }}
{{- include "common.tplvalues.render" (dict "value" .Values.nginx.extraEnvVars "context" $) | nindent 12 }}
{{- end }}
@@ -132,21 +111,48 @@ spec:
{{- if .Values.nginx.lifecycleHooks }}
lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.nginx.lifecycleHooks "context" $) | nindent 12 }}
{{- end }}
ports:
- containerPort: {{ .Values.nginx.containerPorts.http }}
name: http
- containerPort: {{ .Values.nginx.containerPorts.https }}
name: https
- containerPort: {{ .Values.nginx.containerPorts.notary }}
name: notary
{{- if not .Values.diagnosticMode.enabled }}
{{- if .Values.nginx.startupProbe.enabled }}
startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.nginx.startupProbe "enabled") "context" $) | nindent 12 }}
tcpSocket:
port: {{ ternary "https" "http" .Values.nginx.tls.enabled }}
{{- else if .Values.nginx.customStartupProbe }}
startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.nginx.customStartupProbe "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.nginx.livenessProbe.enabled }}
livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.nginx.livenessProbe "enabled") "context" $) | nindent 12 }}
httpGet:
path: /
port: {{ ternary "https" "http" .Values.nginx.tls.enabled }}
scheme: {{ ternary "https" "http" .Values.nginx.tls.enabled | upper }}
{{- else if .Values.nginx.customLivenessProbe }}
livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.nginx.customLivenessProbe "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.nginx.readinessProbe.enabled }}
readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.nginx.readinessProbe "enabled") "context" $) | nindent 12 }}
httpGet:
path: /
port: {{ ternary "https" "http" .Values.nginx.tls.enabled }}
scheme: {{ ternary "https" "http" .Values.nginx.tls.enabled | upper }}
{{- else if .Values.nginx.customReadinessProbe }}
readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.nginx.customReadinessProbe "context" $) | nindent 12 }}
{{- end }}
{{- end }}
{{- if .Values.nginx.resources }}
resources: {{- toYaml .Values.nginx.resources | nindent 12 }}
{{- end }}
ports:
- containerPort: 8080
name: http
- containerPort: 8443
name: https
- containerPort: 4443
name: notary
volumeMounts:
- name: config
mountPath: /opt/bitnami/nginx/conf/nginx.conf
subPath: nginx.conf
{{- if .Values.service.tls.enabled }}
{{- if .Values.nginx.tls.enabled }}
- name: certificate
mountPath: /etc/nginx/cert
{{- end }}
@@ -160,11 +166,11 @@ spec:
- name: config
configMap:
name: {{ include "harbor.nginx" . }}
{{- if .Values.service.tls.enabled }}
{{- if .Values.nginx.tls.enabled }}
- name: certificate
secret:
{{- if .Values.service.tls.existingSecret }}
secretName: {{ .Values.service.tls.existingSecret }}
{{- if .Values.nginx.tls.existingSecret }}
secretName: {{ .Values.nginx.tls.existingSecret }}
{{- else }}
secretName: {{ include "harbor.nginx" . }}
{{- end }}
bitnami/harbor/templates/nginx/service.yaml
+17 -7
View File
@@ -1,8 +1,9 @@
{{- if not .Values.ingress.enabled }}
{{- if eq .Values.exposureType "proxy" }}
apiVersion: v1
kind: Service
metadata:
name: {{ include "common.names.fullname" . }}
namespace: {{ .Release.Namespace | quote }}
labels: {{- include "common.labels.standard" . | nindent 4 }}
{{- if .Values.commonLabels }}
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
@@ -17,29 +18,35 @@ metadata:
{{- end }}
spec:
type: {{ .Values.service.type }}
sessionAffinity: {{ .Values.service.sessionAffinity }}
{{- if and .Values.service.clusterIP (eq .Values.service.type "ClusterIP") }}
clusterIP: {{ .Values.service.clusterIP }}
{{- end }}
{{- if (or (eq .Values.service.type "LoadBalancer") (eq .Values.service.type "NodePort")) }}
externalTrafficPolicy: {{ .Values.service.externalTrafficPolicy | quote }}
{{- end }}
{{- if (and (eq .Values.service.type "LoadBalancer") .Values.service.loadBalancerSourceRanges) }}
loadBalancerSourceRanges: {{- toYaml .Values.service.loadBalancerSourceRanges | nindent 4 }}
{{- with .Values.service.loadBalancerSourceRanges }}
loadBalancerSourceRanges: {{- toYaml . | nindent 4 }}
{{- end }}
{{- if (and (eq .Values.service.type "LoadBalancer") .Values.service.loadBalancerIP) }}
{{- end }}
{{- if (and (eq .Values.service.type "LoadBalancer") (not (empty .Values.service.loadBalancerIP))) }}
loadBalancerIP: {{ .Values.service.loadBalancerIP }}
{{- end }}
ports:
- name: http
port: {{ .Values.service.ports.http }}
targetPort: http
{{- if and .Values.service.nodePorts.http }}
{{- if and (or (eq .Values.service.type "NodePort") (eq .Values.service.type "LoadBalancer")) (not (empty .Values.service.nodePorts.http)) }}
nodePort: {{ .Values.service.nodePorts.http }}
{{- else if eq .Values.service.type "ClusterIP" }}
nodePort: null
{{- end }}
{{- if .Values.service.tls.enabled }}
{{- if .Values.nginx.tls.enabled }}
- name: https
port: {{ .Values.service.ports.https }}
targetPort: https
{{- if and .Values.service.nodePorts.https }}
{{- if and (or (eq .Values.service.type "NodePort") (eq .Values.service.type "LoadBalancer")) (not (empty .Values.service.nodePorts.https)) }}
nodePort: {{ .Values.service.nodePorts.https }}
{{- else if eq .Values.service.type "ClusterIP" }}
nodePort: null
@@ -49,12 +56,15 @@ spec:
- name: notary
port: {{ .Values.service.ports.notary }}
targetPort: notary
{{- if and .Values.service.nodePorts.notary }}
{{- if and (or (eq .Values.service.type "NodePort") (eq .Values.service.type "LoadBalancer")) (not (empty .Values.service.nodePorts.notary)) }}
nodePort: {{ .Values.service.nodePorts.notary }}
{{- else if eq .Values.service.type "ClusterIP" }}
nodePort: null
{{- end }}
{{- end }}
{{- if .Values.service.extraPorts }}
{{- include "common.tplvalues.render" (dict "value" .Values.service.extraPorts "context" $) | nindent 4 }}
{{- end }}
selector: {{- include "common.labels.matchLabels" . | nindent 4 }}
app.kubernetes.io/component: nginx
{{- end }}
bitnami/harbor/templates/nginx/secret.yaml → bitnami/harbor/templates/nginx/tls-secret.yaml
+3 -2
View File
@@ -1,10 +1,11 @@
{{- if eq (include "harbor.autoGenCertForNginx" .) "true" }}
{{- if (include "harbor.autoGenCertForNginx" .) }}
{{- $ca := genCA "harbor-ca" 365 }}
{{- $cn := (required "The \"service.tls.commonName\" is required!" .Values.service.tls.commonName) }}
{{- $cn := (required "The \"nginx.tls.commonName\" is required!" .Values.nginx.tls.commonName) }}
apiVersion: v1
kind: Secret
metadata:
name: {{ include "harbor.nginx" . }}
namespace: {{ .Release.Namespace | quote }}
labels: {{- include "common.labels.standard" . | nindent 4 }}
{{- if .Values.commonLabels }}
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
bitnami/harbor/templates/notary/notary-secret-envvars.yaml
+2 -1
View File
@@ -2,7 +2,8 @@
apiVersion: v1
kind: Secret
metadata:
name: {{ include "harbor.notary-server" . }}-envvars
name: {{ printf "%s-envvars" (include "harbor.notary-server" .) }}
namespace: {{ .Release.Namespace | quote }}
labels: {{- include "common.labels.standard" . | nindent 4 }}
{{- if .Values.commonLabels }}
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
bitnami/harbor/templates/notary/notary-secret.yaml
+2 -1
View File
@@ -3,6 +3,7 @@ apiVersion: v1
kind: Secret
metadata:
name: {{ include "harbor.notary-server" . }}
namespace: {{ .Release.Namespace | quote }}
labels: {{- include "common.labels.standard" . | nindent 4 }}
{{- if .Values.commonLabels }}
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
@@ -15,7 +16,7 @@ type: Opaque
data:
{{- if not .Values.notary.secretName }}
{{- $ca := genCA "harbor-notary-ca" 365 }}
{{- $altNames := list (printf "%s.%s.svc" (include "harbor.notary-signer" .) .Release.Namespace) (printf "%s.%s" (include "harbor.notary-signer" .) .Release.Namespace) (include "harbor.notary-signer" .) -}}
{{- $altNames := list (printf "%s.%s.svc" (include "harbor.notary-signer" .) .Release.Namespace | quote) (printf "%s.%s" (include "harbor.notary-signer" .) .Release.Namespace | quote) (include "harbor.notary-signer" .) -}}
{{- $cert := genSignedCert (include "harbor.notary-signer" .) nil $altNames 365 $ca }}
notary-signer-ca.crt: {{ $ca.Cert | b64enc | quote }}
notary-signer.crt: {{ $cert.Cert | b64enc | quote }}
bitnami/harbor/templates/notary/notary-server.yaml
+62 -52
View File
@@ -3,6 +3,7 @@ apiVersion: apps/v1
kind: Deployment
metadata:
name: {{ include "harbor.notary-server" . }}
namespace: {{ .Release.Namespace | quote }}
labels: {{- include "common.labels.standard" . | nindent 4 }}
{{- if .Values.commonLabels }}
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
@@ -12,13 +13,13 @@ metadata:
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
spec:
replicas: {{ .Values.notary.server.replicas }}
{{- if .Values.notary.server.updateStrategy }}
strategy: {{- toYaml .Values.notary.server.updateStrategy | nindent 4 }}
{{- end }}
replicas: {{ .Values.notary.server.replicaCount }}
selector:
matchLabels: {{- include "common.labels.matchLabels" . | nindent 6 }}
app.kubernetes.io/component: notary-server
{{- if .Values.notary.server.updateStrategy }}
strategy: {{- toYaml .Values.notary.server.updateStrategy | nindent 4 }}
{{- end }}
template:
metadata:
labels: {{- include "common.labels.standard" . | nindent 8 }}
@@ -38,8 +39,8 @@ spec:
spec:
{{- include "harbor.imagePullSecrets" . | nindent 6 }}
automountServiceAccountToken: {{ .Values.notary.server.automountServiceAccountToken }}
{{- if .Values.notary.server.priorityClassName }}
priorityClassName: {{ .Values.notary.server.priorityClassName | quote }}
{{- if .Values.notary.server.hostAliases }}
hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.notary.server.hostAliases "context" $) | nindent 8 }}
{{- end }}
{{- if .Values.notary.server.affinity }}
affinity: {{- include "common.tplvalues.render" (dict "value" .Values.notary.server.affinity "context" $) | nindent 8 }}
@@ -55,43 +56,47 @@ spec:
{{- if .Values.notary.server.tolerations }}
tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.notary.server.tolerations "context" $) | nindent 8 }}
{{- end }}
{{- if .Values.podSecurityContext }}
securityContext: {{- include "common.tplvalues.render" (dict "value" .Values.podSecurityContext "context" $) | nindent 8 }}
{{- if .Values.notary.server.topologySpreadConstraints }}
topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.notary.server.topologySpreadConstraints "context" .) | nindent 8 }}
{{- end }}
{{- if .Values.notary.server.priorityClassName }}
priorityClassName: {{ .Values.notary.server.priorityClassName | quote }}
{{- end }}
{{- if .Values.notary.server.schedulerName }}
schedulerName: {{ .Values.notary.server.schedulerName }}
{{- end }}
{{- if .Values.notary.server.podSecurityContext.enabled }}
securityContext: {{- omit .Values.notary.server.podSecurityContext "enabled" | toYaml | nindent 8 }}
{{- end }}
{{- if .Values.notary.server.initContainers }}
initContainers: {{- include "common.tplvalues.render" (dict "value" .Values.notary.server.initContainers "context" $) | nindent 8 }}
{{- end }}
{{- if .Values.notary.server.hostAliases }}
hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.notary.server.hostAliases "context" $) | nindent 8 }}
{{- end }}
containers:
- name: notary-server
image: {{ include "harbor.notaryServerImage" . | quote }}
imagePullPolicy: {{ .Values.notaryServerImage.pullPolicy | quote }}
{{- if .Values.containerSecurityContext }}
securityContext: {{- include "common.tplvalues.render" (dict "value" .Values.containerSecurityContext "context" $) | nindent 12 }}
image: {{ include "harbor.notary.server.image" . | quote }}
imagePullPolicy: {{ .Values.notary.server.image.pullPolicy | quote }}
{{- if .Values.notary.server.containerSecurityContext.enabled }}
securityContext: {{- omit .Values.notary.server.containerSecurityContext "enabled" | toYaml | nindent 12 }}
{{- end }}
{{- if .Values.notary.server.command }}
{{- if .Values.diagnosticMode.enabled }}
command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }}
{{- else if .Values.notary.server.command }}
command: {{- include "common.tplvalues.render" (dict "value" .Values.notary.server.command "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.notary.server.args }}
{{- if .Values.diagnosticMode.enabled }}
args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }}
{{- else if .Values.notary.server.args }}
args: {{- include "common.tplvalues.render" (dict "value" .Values.notary.server.args "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.notary.server.resources }}
resources: {{- toYaml .Values.notary.server.resources | nindent 12 }}
{{- end }}
{{- if .Values.notary.server.lifecycleHooks }}
lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.notary.server.lifecycleHooks "context" $) | nindent 12 }}
{{- end }}
env:
- name: BITNAMI_DEBUG
value: {{ ternary "true" "false" .Values.notaryServerImage.debug | quote }}
value: {{ ternary "true" "false" .Values.notary.server.image.debug | quote }}
- name: MIGRATIONS_PATH
value: migrations/server/postgresql
- name: DB_URL
valueFrom:
secretKeyRef:
name: {{ include "harbor.notary-server" . }}-envvars
name: {{ printf "%s-envvars" (include "harbor.notary-server" .) }}
key: server_db_url
{{- if .Values.notary.server.extraEnvVars }}
{{- include "common.tplvalues.render" (dict "value" .Values.notary.server.extraEnvVars "context" $) | nindent 12 }}
@@ -105,6 +110,38 @@ spec:
- secretRef:
name: {{ include "common.tplvalues.render" (dict "value" .Values.notary.server.extraEnvVarsSecret "context" $) }}
{{- end }}
ports:
- containerPort: {{ .Values.notary.server.containerPorts.server }}
name: notary-server
{{- if not .Values.diagnosticMode.enabled }}
{{- if .Values.notary.server.startupProbe.enabled }}
startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.notary.server.startupProbe "enabled") "context" $) | nindent 12 }}
tcpSocket:
port: notary-server
{{- else if .Values.notary.server.customStartupProbe }}
startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.notary.server.customStartupProbe "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.notary.server.livenessProbe.enabled }}
livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.notary.server.livenessProbe "enabled") "context" $) | nindent 12 }}
tcpSocket:
port: notary-server
{{- else if .Values.notary.server.customLivenessProbe }}
livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.notary.server.customLivenessProbe "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.notary.server.readinessProbe.enabled }}
readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.notary.server.readinessProbe "enabled") "context" $) | nindent 12 }}
tcpSocket:
port: notary-server
{{- else if .Values.notary.server.customReadinessProbe }}
readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.notary.server.customReadinessProbe "context" $) | nindent 12 }}
{{- end }}
{{- end }}
{{- if .Values.notary.server.lifecycleHooks }}
lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.notary.server.lifecycleHooks "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.notary.server.resources }}
resources: {{- toYaml .Values.notary.server.resources | nindent 12 }}
{{- end }}
volumeMounts:
- name: notary-config
mountPath: /etc/notary
@@ -119,33 +156,6 @@ spec:
{{- if .Values.notary.server.extraVolumeMounts }}
{{- include "common.tplvalues.render" (dict "value" .Values.notary.server.extraVolumeMounts "context" $) | nindent 12 }}
{{- end }}
ports:
- containerPort: 4443
name: notary-server
{{- if .Values.notary.server.livenessProbe.enabled }}
livenessProbe:
tcpSocket:
port: notary-server
initialDelaySeconds: {{ .Values.notary.server.livenessProbe.initialDelaySeconds }}
periodSeconds: {{ .Values.notary.server.livenessProbe.periodSeconds }}
timeoutSeconds: {{ .Values.notary.server.livenessProbe.timeoutSeconds }}
successThreshold: {{ .Values.notary.server.livenessProbe.successThreshold }}
failureThreshold: {{ .Values.notary.server.livenessProbe.failureThreshold }}
{{- else if .Values.notary.server.customLivenessProbe }}
livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.notary.server.customLivenessProbe "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.notary.server.readinessProbe.enabled }}
readinessProbe:
tcpSocket:
port: notary-server
initialDelaySeconds: {{ .Values.notary.server.readinessProbe.initialDelaySeconds }}
periodSeconds: {{ .Values.notary.server.readinessProbe.periodSeconds }}
timeoutSeconds: {{ .Values.notary.server.readinessProbe.timeoutSeconds }}
successThreshold: {{ .Values.notary.server.readinessProbe.successThreshold }}
failureThreshold: {{ .Values.notary.server.readinessProbe.failureThreshold }}
{{- else if .Values.notary.server.customReadinessProbe }}
readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.notary.server.customReadinessProbe "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.notary.server.sidecars }}
{{- include "common.tplvalues.render" (dict "value" .Values.notary.server.sidecars "context" $) | nindent 8 }}
{{- end }}
bitnami/harbor/templates/notary/notary-signer.yaml
+63 -53
View File
@@ -3,6 +3,7 @@ apiVersion: apps/v1
kind: Deployment
metadata:
name: {{ include "harbor.notary-signer" . }}
namespace: {{ .Release.Namespace | quote }}
labels: {{- include "common.labels.standard" . | nindent 4 }}
{{- if .Values.commonLabels }}
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
@@ -12,13 +13,13 @@ metadata:
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
spec:
replicas: {{ .Values.notary.signer.replicas }}
{{- if .Values.notary.signer.updateStrategy }}
strategy: {{- toYaml .Values.notary.signer.updateStrategy | nindent 4 }}
{{- end }}
replicas: {{ .Values.notary.signer.replicaCount }}
selector:
matchLabels: {{- include "common.labels.matchLabels" . | nindent 6 }}
app.kubernetes.io/component: notary-signer
{{- if .Values.notary.signer.updateStrategy }}
strategy: {{- toYaml .Values.notary.signer.updateStrategy | nindent 4 }}
{{- end }}
template:
metadata:
labels: {{- include "common.labels.standard" . | nindent 8 }}
@@ -37,8 +38,8 @@ spec:
spec:
{{- include "harbor.imagePullSecrets" . | nindent 6 }}
automountServiceAccountToken: {{ .Values.notary.signer.automountServiceAccountToken }}
{{- if .Values.notary.signer.priorityClassName }}
priorityClassName: {{ .Values.notary.signer.priorityClassName | quote }}
{{- if .Values.notary.signer.hostAliases }}
hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.notary.signer.hostAliases "context" $) | nindent 8 }}
{{- end }}
{{- if .Values.notary.signer.affinity }}
affinity: {{- include "common.tplvalues.render" (dict "value" .Values.notary.signer.affinity "context" $) | nindent 8 }}
@@ -54,43 +55,47 @@ spec:
{{- if .Values.notary.signer.tolerations }}
tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.notary.signer.tolerations "context" $) | nindent 8 }}
{{- end }}
{{- if .Values.podSecurityContext }}
securityContext: {{- include "common.tplvalues.render" (dict "value" .Values.podSecurityContext "context" $) | nindent 8 }}
{{- if .Values.notary.signer.topologySpreadConstraints }}
topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.notary.signer.topologySpreadConstraints "context" .) | nindent 8 }}
{{- end }}
{{- if .Values.notary.signer.priorityClassName }}
priorityClassName: {{ .Values.notary.signer.priorityClassName | quote }}
{{- end }}
{{- if .Values.notary.signer.schedulerName }}
schedulerName: {{ .Values.notary.signer.schedulerName }}
{{- end }}
{{- if .Values.notary.signer.podSecurityContext.enabled }}
securityContext: {{- omit .Values.notary.signer.podSecurityContext "enabled" | toYaml | nindent 8 }}
{{- end }}
{{- if .Values.notary.signer.initContainers }}
initContainers: {{- include "common.tplvalues.render" (dict "value" .Values.notary.signer.initContainers "context" $) | nindent 8 }}
{{- end }}
{{- if .Values.notary.signer.hostAliases }}
hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.notary.signer.hostAliases "context" $) | nindent 8 }}
{{- end }}
containers:
- name: notary-signer
image: {{ include "harbor.notarySignerImage" . }}
imagePullPolicy: {{ .Values.notarySignerImage.pullPolicy | quote }}
{{- if .Values.notary.signer.command }}
image: {{ include "harbor.notary.signer.image" . }}
imagePullPolicy: {{ .Values.notary.signer.image.pullPolicy | quote }}
{{- if .Values.notary.signer.containerSecurityContext.enabled }}
securityContext: {{- omit .Values.notary.signer.containerSecurityContext "enabled" | toYaml | nindent 12 }}
{{- end }}
{{- if .Values.diagnosticMode.enabled }}
command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }}
{{- else if .Values.notary.signer.command }}
command: {{- include "common.tplvalues.render" (dict "value" .Values.notary.signer.command "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.notary.signer.args }}
{{- if .Values.diagnosticMode.enabled }}
args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }}
{{- else if .Values.notary.signer.args }}
args: {{- include "common.tplvalues.render" (dict "value" .Values.notary.signer.args "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.notary.signer.lifecycleHooks }}
lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.notary.signer.lifecycleHooks "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.containerSecurityContext }}
securityContext: {{- include "common.tplvalues.render" (dict "value" .Values.containerSecurityContext "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.notary.signer.resources }}
resources: {{- toYaml .Values.notary.signer.resources | nindent 12 }}
{{- end }}
env:
- name: BITNAMI_DEBUG
value: {{ ternary "true" "false" .Values.notarySignerImage.debug | quote }}
value: {{ ternary "true" "false" .Values.notary.signer.image.debug | quote }}
- name: MIGRATIONS_PATH
value: migrations/signer/postgresql
- name: DB_URL
valueFrom:
secretKeyRef:
name: {{ include "harbor.notary-server" . }}-envvars
name: {{ printf "%s-envvars" (include "harbor.notary-server" .) }}
key: signer_db_url
- name: NOTARY_SIGNER_DEFAULTALIAS
value: defaultalias
@@ -106,6 +111,38 @@ spec:
- secretRef:
name: {{ include "common.tplvalues.render" (dict "value" .Values.notary.signer.extraEnvVarsSecret "context" $) }}
{{- end }}
ports:
- containerPort: {{ .Values.notary.signer.containerPorts.signer }}
name: notary-signer
{{- if not .Values.diagnosticMode.enabled }}
{{- if .Values.notary.signer.startupProbe.enabled }}
startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.notary.signer.startupProbe "enabled") "context" $) | nindent 12 }}
tcpSocket:
port: notary-signer
{{- else if .Values.notary.signer.customStartupProbe }}
startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.notary.signer.customStartupProbe "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.notary.signer.livenessProbe.enabled }}
livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.notary.signer.livenessProbe "enabled") "context" $) | nindent 12 }}
tcpSocket:
port: notary-signer
{{- else if .Values.notary.signer.customLivenessProbe }}
livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.notary.signer.customLivenessProbe "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.notary.signer.readinessProbe.enabled }}
readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.notary.signer.readinessProbe "enabled") "context" $) | nindent 12 }}
tcpSocket:
port: notary-signer
{{- else if .Values.notary.signer.customReadinessProbe }}
readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.notary.signer.customReadinessProbe "context" $) | nindent 12 }}
{{- end }}
{{- end }}
{{- if .Values.notary.signer.lifecycleHooks }}
lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.notary.signer.lifecycleHooks "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.notary.signer.resources }}
resources: {{- toYaml .Values.notary.signer.resources | nindent 12 }}
{{- end }}
volumeMounts:
- name: notary-config
mountPath: /etc/notary
@@ -123,33 +160,6 @@ spec:
{{- if .Values.notary.signer.extraVolumeMounts }}
{{- include "common.tplvalues.render" (dict "value" .Values.notary.signer.extraVolumeMounts "context" $) | nindent 12 }}
{{- end }}
ports:
- containerPort: 7899
name: notary-signer
{{- if .Values.notary.signer.livenessProbe.enabled }}
livenessProbe:
tcpSocket:
port: notary-signer
initialDelaySeconds: {{ .Values.notary.signer.livenessProbe.initialDelaySeconds }}
periodSeconds: {{ .Values.notary.signer.livenessProbe.periodSeconds }}
timeoutSeconds: {{ .Values.notary.signer.livenessProbe.timeoutSeconds }}
successThreshold: {{ .Values.notary.signer.livenessProbe.successThreshold }}
failureThreshold: {{ .Values.notary.signer.livenessProbe.failureThreshold }}
{{- else if .Values.notary.signer.customLivenessProbe }}
livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.notary.signer.customLivenessProbe "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.notary.signer.readinessProbe.enabled }}
readinessProbe:
tcpSocket:
port: notary-signer
initialDelaySeconds: {{ .Values.notary.signer.readinessProbe.initialDelaySeconds }}
periodSeconds: {{ .Values.notary.signer.readinessProbe.periodSeconds }}
timeoutSeconds: {{ .Values.notary.signer.readinessProbe.timeoutSeconds }}
successThreshold: {{ .Values.notary.signer.readinessProbe.successThreshold }}
failureThreshold: {{ .Values.notary.signer.readinessProbe.failureThreshold }}
{{- else if .Values.notary.signer.customReadinessProbe }}
readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.notary.signer.customReadinessProbe "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.notary.signer.sidecars }}
{{- include "common.tplvalues.render" (dict "value" .Values.notary.signer.sidecars "context" $) | nindent 8 }}
{{- end }}
bitnami/harbor/templates/notary/notary-svc.yaml
+5 -4
View File
@@ -3,6 +3,7 @@ apiVersion: v1
kind: Service
metadata:
name: {{ include "harbor.notary-server" . }}
namespace: {{ .Release.Namespace | quote }}
labels: {{- include "common.labels.standard" . | nindent 4 }}
{{- if .Values.commonLabels }}
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
@@ -11,12 +12,12 @@ metadata:
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
spec:
{{- if (eq .Values.ingress.controller "gce") }}
{{- if (eq .Values.ingress.notary.controller "gce") }}
type: NodePort
{{- end }}
{{- end }}
ports:
- name: notary-server
port: 4443
port: {{ .Values.notary.service.ports.server }}
targetPort: notary-server
selector: {{- include "common.labels.matchLabels" . | nindent 4 }}
app.kubernetes.io/component: notary-server
@@ -35,7 +36,7 @@ metadata:
spec:
ports:
- name: notary-signer
port: 7899
port: {{ .Values.notary.service.ports.signer }}
targetPort: notary-signer
selector: {{- include "common.labels.matchLabels" . | nindent 4 }}
app.kubernetes.io/component: notary-signer
bitnami/harbor/templates/portal/portal-cm.yaml
+6 -4
View File
@@ -1,7 +1,9 @@
{{- $port := ternary .Values.portal.containerPorts.https .Values.portal.containerPorts.http .Values.internalTLS.enabled | int -}}
apiVersion: v1
kind: ConfigMap
metadata:
name: {{ include "harbor.portal" . }}
namespace: {{ .Release.Namespace | quote }}
labels: {{- include "common.labels.standard" . | nindent 4 }}
{{- if .Values.commonLabels }}
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
@@ -26,10 +28,10 @@ data:
server {
{{- if .Values.internalTLS.enabled }}
{{- if .Values.ipFamily.ipv4.enabled }}
listen {{ template "harbor.portal.containerPort" . }} ssl;
listen {{ $port }} ssl;
{{- end }}
{{- if .Values.ipFamily.ipv6.enabled }}
listen [::]:{{ template "harbor.portal.containerPort" . }} ssl;
listen [::]:{{ $port }} ssl;
{{- end }}
# SSL
ssl_certificate /etc/harbor/ssl/portal/tls.crt;
@@ -42,10 +44,10 @@ data:
ssl_session_cache shared:SSL:10m;
{{- else }}
{{- if .Values.ipFamily.ipv4.enabled }}
listen {{ template "harbor.portal.containerPort" . }};
listen {{ $port }};
{{- end }}
{{- if .Values.ipFamily.ipv6.enabled }}
listen [::]:{{ template "harbor.portal.containerPort" . }};
listen [::]:{{ $port }};
{{- end }}
{{- end }}
server_name localhost;
bitnami/harbor/templates/portal/portal-dpl.yaml
+65 -55
View File
@@ -2,6 +2,7 @@ apiVersion: {{ template "common.capabilities.deployment.apiVersion" . }}
kind: Deployment
metadata:
name: {{ include "harbor.portal" . }}
namespace: {{ .Release.Namespace | quote }}
labels: {{- include "common.labels.standard" . | nindent 4 }}
{{- if .Values.commonLabels }}
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
@@ -11,13 +12,13 @@ metadata:
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
spec:
replicas: {{ .Values.portal.replicas }}
{{- if .Values.portal.updateStrategy }}
strategy: {{- toYaml .Values.portal.updateStrategy | nindent 4 }}
{{- end }}
replicas: {{ .Values.portal.replicaCount }}
selector:
matchLabels: {{- include "common.labels.matchLabels" . | nindent 6 }}
app.kubernetes.io/component: portal
{{- if .Values.portal.updateStrategy }}
strategy: {{- toYaml .Values.portal.updateStrategy | nindent 4 }}
{{- end }}
template:
metadata:
labels: {{- include "common.labels.standard" . | nindent 8 }}
@@ -38,8 +39,8 @@ spec:
spec:
{{- include "harbor.imagePullSecrets" . | nindent 6 }}
automountServiceAccountToken: {{ .Values.portal.automountServiceAccountToken }}
{{- if .Values.portal.priorityClassName }}
priorityClassName: {{ .Values.portal.priorityClassName | quote }}
{{- if .Values.portal.hostAliases }}
hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.portal.hostAliases "context" $) | nindent 8 }}
{{- end }}
{{- if .Values.portal.affinity }}
affinity: {{- include "common.tplvalues.render" (dict "value" .Values.portal.affinity "context" $) | nindent 8 }}
@@ -55,65 +56,41 @@ spec:
{{- if .Values.portal.tolerations }}
tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.portal.tolerations "context" $) | nindent 8 }}
{{- end }}
{{- if .Values.podSecurityContext }}
securityContext: {{- include "common.tplvalues.render" (dict "value" .Values.podSecurityContext "context" $) | nindent 8 }}
{{- if .Values.portal.topologySpreadConstraints }}
topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.portal.topologySpreadConstraints "context" .) | nindent 8 }}
{{- end }}
{{- if .Values.portal.priorityClassName }}
priorityClassName: {{ .Values.portal.priorityClassName | quote }}
{{- end }}
{{- if .Values.portal.schedulerName }}
schedulerName: {{ .Values.portal.schedulerName }}
{{- end }}
{{- if .Values.portal.podSecurityContext.enabled }}
securityContext: {{- omit .Values.portal.podSecurityContext "enabled" | toYaml | nindent 8 }}
{{- end }}
{{- if .Values.portal.initContainers }}
initContainers: {{- include "common.tplvalues.render" (dict "value" .Values.portal.initContainers "context" $) | nindent 8 }}
{{- end }}
{{- if .Values.portal.hostAliases }}
hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.portal.hostAliases "context" $) | nindent 8 }}
{{- end }}
containers:
- name: portal
image: {{ include "harbor.portalImage" . }}
imagePullPolicy: {{ .Values.portalImage.pullPolicy | quote }}
{{- if .Values.portal.command }}
image: {{ include "harbor.portal.image" . }}
imagePullPolicy: {{ .Values.portal.image.pullPolicy | quote }}
{{- if .Values.portal.containerSecurityContext.enabled }}
securityContext: {{- omit .Values.portal.containerSecurityContext "enabled" | toYaml | nindent 12 }}
{{- end }}
{{- if .Values.diagnosticMode.enabled }}
command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }}
{{- else if .Values.portal.command }}
command: {{- include "common.tplvalues.render" (dict "value" .Values.portal.command "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.portal.args }}
{{- if .Values.diagnosticMode.enabled }}
args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }}
{{- else if .Values.portal.args }}
args: {{- include "common.tplvalues.render" (dict "value" .Values.portal.args "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.portal.lifecycleHooks }}
lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.portal.lifecycleHooks "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.portal.resources }}
resources: {{- toYaml .Values.portal.resources | nindent 12 }}
{{- end }}
{{- if .Values.containerSecurityContext }}
securityContext: {{- include "common.tplvalues.render" (dict "value" .Values.containerSecurityContext "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.portal.livenessProbe.enabled }}
livenessProbe:
httpGet:
path: /
port: http
scheme: {{ include "harbor.component.scheme" . | upper }}
initialDelaySeconds: {{ .Values.portal.livenessProbe.initialDelaySeconds }}
periodSeconds: {{ .Values.portal.livenessProbe.periodSeconds }}
timeoutSeconds: {{ .Values.portal.livenessProbe.timeoutSeconds }}
successThreshold: {{ .Values.portal.livenessProbe.successThreshold }}
failureThreshold: {{ .Values.portal.livenessProbe.failureThreshold }}
{{- else if .Values.portal.customLivenessProbe }}
livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.portal.customLivenessProbe "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.portal.readinessProbe.enabled }}
readinessProbe:
httpGet:
path: /
port: http
scheme: {{ include "harbor.component.scheme" . | upper }}
initialDelaySeconds: {{ .Values.portal.readinessProbe.initialDelaySeconds }}
periodSeconds: {{ .Values.portal.readinessProbe.periodSeconds }}
timeoutSeconds: {{ .Values.portal.readinessProbe.timeoutSeconds }}
successThreshold: {{ .Values.portal.readinessProbe.successThreshold }}
failureThreshold: {{ .Values.portal.readinessProbe.failureThreshold }}
{{- else if .Values.portal.customReadinessProbe }}
readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.portal.customReadinessProbe "context" $) | nindent 12 }}
{{- end }}
env:
- name: BITNAMI_DEBUG
value: {{ ternary "true" "false" .Values.portalImage.debug | quote }}
value: {{ ternary "true" "false" .Values.portal.image.debug | quote }}
{{- if .Values.portal.extraEnvVars }}
{{- include "common.tplvalues.render" (dict "value" .Values.portal.extraEnvVars "context" $) | nindent 12 }}
{{- end }}
@@ -127,8 +104,41 @@ spec:
name: {{ include "common.tplvalues.render" (dict "value" .Values.portal.extraEnvVarsSecret "context" $) }}
{{- end }}
ports:
- containerPort: {{ include "harbor.portal.containerPort" . }}
name: http
- containerPort: {{ ternary .Values.portal.containerPorts.https .Values.portal.containerPorts.http .Values.internalTLS.enabled }}
name: {{ ternary "https" "http" .Values.internalTLS.enabled }}
{{- if not .Values.diagnosticMode.enabled }}
{{- if .Values.portal.startupProbe.enabled }}
startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.portal.startupProbe "enabled") "context" $) | nindent 12 }}
tcpSocket:
port: {{ ternary "https" "http" .Values.internalTLS.enabled }}
{{- else if .Values.portal.customStartupProbe }}
startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.portal.customStartupProbe "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.portal.livenessProbe.enabled }}
livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.portal.livenessProbe "enabled") "context" $) | nindent 12 }}
httpGet:
path: /
port: {{ ternary "https" "http" .Values.internalTLS.enabled }}
scheme: {{ ternary "https" "http" .Values.internalTLS.enabled | upper }}
{{- else if .Values.portal.customLivenessProbe }}
livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.portal.customLivenessProbe "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.portal.readinessProbe.enabled }}
readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.portal.readinessProbe "enabled") "context" $) | nindent 12 }}
httpGet:
path: /
port: {{ ternary "https" "http" .Values.internalTLS.enabled }}
scheme: {{ ternary "https" "http" .Values.internalTLS.enabled | upper }}
{{- else if .Values.portal.customReadinessProbe }}
readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.portal.customReadinessProbe "context" $) | nindent 12 }}
{{- end }}
{{- end }}
{{- if .Values.portal.lifecycleHooks }}
lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.portal.lifecycleHooks "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.portal.resources }}
resources: {{- toYaml .Values.portal.resources | nindent 12 }}
{{- end }}
volumeMounts:
- name: portal-config
mountPath: /opt/bitnami/nginx/conf/nginx.conf
bitnami/harbor/templates/portal/portal-svc.yaml
+5 -4
View File
@@ -2,6 +2,7 @@ apiVersion: v1
kind: Service
metadata:
name: {{ include "harbor.portal" . }}
namespace: {{ .Release.Namespace | quote }}
labels: {{- include "common.labels.standard" . | nindent 4 }}
{{- if .Values.commonLabels }}
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
@@ -10,12 +11,12 @@ metadata:
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
spec:
{{- if (eq .Values.ingress.controller "gce") }}
{{- if (eq .Values.ingress.core.controller "gce") }}
type: NodePort
{{- end }}
ports:
- name: http
port: {{ include "harbor.portal.servicePort" . }}
targetPort: http
- name: {{ ternary "https" "http" .Values.internalTLS.enabled }}
port: {{ ternary .Values.portal.service.ports.https .Values.portal.service.ports.http .Values.internalTLS.enabled }}
targetPort: {{ ternary "https" "http" .Values.internalTLS.enabled }}
selector: {{- include "common.labels.matchLabels" . | nindent 4 }}
app.kubernetes.io/component: portal
bitnami/harbor/templates/registry/registry-cm.yaml
+7 -6
View File
@@ -2,6 +2,7 @@ apiVersion: v1
kind: ConfigMap
metadata:
name: {{ include "harbor.registry" . }}
namespace: {{ .Release.Namespace | quote }}
labels: {{- include "common.labels.standard" . | nindent 4 }}
{{- if .Values.commonLabels }}
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
@@ -72,8 +73,8 @@ data:
{{- if .Values.persistence.imageChartStorage.s3.rootdirectory }}
rootdirectory: {{ .Values.persistence.imageChartStorage.s3.rootdirectory }}
{{- end }}
{{- if .Values.persistence.imageChartStorage.s3.storageclass }}
storageclass: {{ .Values.persistence.imageChartStorage.s3.storageclass }}
{{- if .Values.persistence.imageChartStorage.s3.storageClass }}
storageclass: {{ .Values.persistence.imageChartStorage.s3.storageClass }}
{{- end }}
{{- else if eq .Values.persistence.imageChartStorage.type "swift" }}
swift:
@@ -157,7 +158,7 @@ data:
db: {{ template "harbor.redis.registryDatabaseIndex" . }}
http:
relativeurls: {{ .Values.registry.relativeurls }}
addr: :{{ include "harbor.registry.containerPort" . }}
addr: :{{ ternary .Values.registry.server.containerPorts.https .Values.registry.server.containerPorts.http .Values.internalTLS.enabled }}
{{- if .Values.internalTLS.enabled }}
tls:
certificate: /etc/harbor/ssl/registry/tls.crt
@@ -167,7 +168,7 @@ data:
# set via environment variable
# secret: placeholder
debug:
addr: localhost:5001
addr: localhost:{{ .Values.registry.server.containerPorts.debug }}
auth:
htpasswd:
realm: harbor-registry-basic-realm
@@ -192,13 +193,13 @@ data:
---
{{- if .Values.internalTLS.enabled }}
protocol: "https"
port: 8443
port: {{ .Values.registry.controller.containerPorts.https }}
https_config:
cert: "/etc/harbor/ssl/registry/tls.crt"
key: "/etc/harbor/ssl/registry/tls.key"
{{- else }}
protocol: "http"
port: 8080
port: {{ .Values.registry.controller.containerPorts.http }}
{{- end }}
log_level: {{ .Values.logLevel }}
registry_config: "/etc/registry/config.yml"
bitnami/harbor/templates/registry/registry-dpl.yaml
+134 -119
View File
@@ -2,6 +2,7 @@ apiVersion: {{ template "common.capabilities.deployment.apiVersion" . }}
kind: Deployment
metadata:
name: {{ include "harbor.registry" . }}
namespace: {{ .Release.Namespace | quote }}
labels: {{- include "common.labels.standard" . | nindent 4 }}
{{- if .Values.commonLabels }}
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
@@ -11,13 +12,13 @@ metadata:
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
spec:
replicas: {{ .Values.registry.replicas }}
{{- if .Values.registry.updateStrategy }}
strategy: {{- toYaml .Values.registry.updateStrategy | nindent 4 }}
{{- end }}
replicas: {{ .Values.registry.replicaCount }}
selector:
matchLabels: {{- include "common.labels.matchLabels" . | nindent 6 }}
app.kubernetes.io/component: registry
{{- if .Values.registry.updateStrategy }}
strategy: {{- toYaml .Values.registry.updateStrategy | nindent 4 }}
{{- end }}
template:
metadata:
labels: {{- include "common.labels.standard" . | nindent 8 }}
@@ -42,8 +43,8 @@ spec:
spec:
{{- include "harbor.imagePullSecrets" . | nindent 6 }}
automountServiceAccountToken: {{ .Values.registry.automountServiceAccountToken }}
{{- if .Values.registry.priorityClassName }}
priorityClassName: {{ .Values.registry.priorityClassName | quote }}
{{- if .Values.registry.hostAliases }}
hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.registry.hostAliases "context" $) | nindent 8 }}
{{- end }}
{{- if .Values.registry.affinity }}
affinity: {{- include "common.tplvalues.render" (dict "value" .Values.registry.affinity "context" $) | nindent 8 }}
@@ -59,22 +60,33 @@ spec:
{{- if .Values.registry.tolerations }}
tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.registry.tolerations "context" $) | nindent 8 }}
{{- end }}
{{- if .Values.podSecurityContext }}
securityContext: {{- include "common.tplvalues.render" (dict "value" .Values.podSecurityContext "context" $) | nindent 8 }}
{{- if .Values.registry.topologySpreadConstraints }}
topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.registry.topologySpreadConstraints "context" .) | nindent 8 }}
{{- end }}
{{- if .Values.registry.priorityClassName }}
priorityClassName: {{ .Values.registry.priorityClassName | quote }}
{{- end }}
{{- if .Values.registry.schedulerName }}
schedulerName: {{ .Values.registry.schedulerName }}
{{- end }}
{{- if .Values.registry.podSecurityContext.enabled }}
securityContext: {{- omit .Values.registry.podSecurityContext "enabled" | toYaml | nindent 8 }}
{{- end }}
initContainers:
{{- if and .Values.volumePermissions.enabled .Values.persistence.enabled }}
{{- if and .Values.volumePermissions.enabled .Values.persistence.enabled }}
- name: volume-permissions
image: {{ include "harbor.volumePermissions.image" . }}
imagePullPolicy: {{ .Values.volumePermissions.image.pullPolicy | quote }}
command:
- sh
- -c
- /bin/bash
args:
- -ec
- |
mkdir -p "{{ .Values.persistence.imageChartStorage.filesystem.rootdirectory }}"
chown -R "{{ .Values.containerSecurityContext.runAsUser }}:{{ .Values.podSecurityContext.fsGroup }}" "{{ .Values.persistence.imageChartStorage.filesystem.rootdirectory }}"
securityContext:
runAsUser: 0
mkdir -p {{ .Values.persistence.imageChartStorage.filesystem.rootdirectory }}
find {{ .Values.persistence.imageChartStorage.filesystem.rootdirectory }} -mindepth 1 -maxdepth 1 -not -name ".snapshot" -not -name "lost+found" | xargs -r chown -R {{ .Values.registry.server.containerSecurityContext.runAsUser }}:{{ .Values.registry.podSecurityContext.fsGroup }}
{{- if .Values.volumePermissions.containerSecurityContext.enabled }}
securityContext: {{- omit .Values.volumePermissions.containerSecurityContext "enabled" | toYaml | nindent 12 }}
{{- end }}
{{- if .Values.volumePermissions.resources }}
resources: {{- toYaml .Values.volumePermissions.resources | nindent 12 }}
{{- end }}
@@ -82,63 +94,30 @@ spec:
- name: registry-data
mountPath: {{ .Values.persistence.imageChartStorage.filesystem.rootdirectory }}
subPath: {{ .Values.persistence.persistentVolumeClaim.registry.subPath }}
{{- end }}
{{- if .Values.registry.initContainers }}
{{- include "common.tplvalues.render" (dict "value" .Values.registry.initContainers "context" $) | nindent 8 }}
{{- end }}
{{- if .Values.registry.hostAliases }}
hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.registry.hostAliases "context" $) | nindent 8 }}
{{- end }}
{{- end }}
{{- if .Values.registry.initContainers }}
{{- include "common.tplvalues.render" (dict "value" .Values.registry.initContainers "context" $) | nindent 8 }}
{{- end }}
containers:
- name: registry
image: {{ include "harbor.registryImage" . }}
imagePullPolicy: {{ .Values.registryImage.pullPolicy | quote }}
{{- if .Values.registry.server.command }}
image: {{ include "harbor.registry.server.image" . }}
imagePullPolicy: {{ .Values.registry.server.image.pullPolicy | quote }}
{{- if .Values.registry.server.containerSecurityContext.enabled }}
securityContext: {{- omit .Values.registry.server.containerSecurityContext "enabled" | toYaml | nindent 12 }}
{{- end }}
{{- if .Values.diagnosticMode.enabled }}
command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }}
{{- else if .Values.registry.server.command }}
command: {{- include "common.tplvalues.render" (dict "value" .Values.registry.server.command "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.registry.server.args }}
{{- if .Values.diagnosticMode.enabled }}
args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }}
{{- else if .Values.registry.server.args }}
args: {{- include "common.tplvalues.render" (dict "value" .Values.registry.server.args "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.containerSecurityContext }}
securityContext: {{- include "common.tplvalues.render" (dict "value" .Values.containerSecurityContext "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.registry.server.livenessProbe.enabled }}
livenessProbe:
httpGet:
path: /
scheme: {{ include "harbor.component.scheme" . | upper }}
port: registry
initialDelaySeconds: {{ .Values.registry.server.livenessProbe.initialDelaySeconds }}
periodSeconds: {{ .Values.registry.server.livenessProbe.periodSeconds }}
timeoutSeconds: {{ .Values.registry.server.livenessProbe.timeoutSeconds }}
successThreshold: {{ .Values.registry.server.livenessProbe.successThreshold }}
failureThreshold: {{ .Values.registry.server.livenessProbe.failureThreshold }}
{{- else if .Values.registry.server.customLivenessProbe }}
livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.registry.server.customLivenessProbe "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.registry.server.readinessProbe.enabled }}
readinessProbe:
httpGet:
path: /
scheme: {{ include "harbor.component.scheme" . | upper }}
port: registry
initialDelaySeconds: {{ .Values.registry.server.readinessProbe.initialDelaySeconds }}
periodSeconds: {{ .Values.registry.server.readinessProbe.periodSeconds }}
timeoutSeconds: {{ .Values.registry.server.readinessProbe.timeoutSeconds }}
successThreshold: {{ .Values.registry.server.readinessProbe.successThreshold }}
failureThreshold: {{ .Values.registry.server.readinessProbe.failureThreshold }}
{{- else if .Values.registry.server.customReadinessProbe }}
readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.registry.server.customReadinessProbe "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.registry.server.lifecycleHooks }}
lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.registry.server.lifecycleHooks "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.registry.server.resources }}
resources: {{- toYaml .Values.registry.server.resources | nindent 12 }}
{{- end }}
env:
- name: BITNAMI_DEBUG
value: {{ ternary "true" "false" .Values.registryImage.debug | quote }}
value: {{ ternary "true" "false" .Values.registry.server.image.debug | quote }}
{{- if .Values.internalTLS.enabled }}
- name: INTERNAL_TLS_ENABLED
value: "true"
@@ -172,10 +151,43 @@ spec:
name: {{ include "common.tplvalues.render" (dict "value" .Values.registry.server.extraEnvVarsSecret "context" $) }}
{{- end }}
ports:
- containerPort: {{ include "harbor.registry.containerPort" . }}
- containerPort: {{ ternary .Values.registry.server.containerPorts.https .Values.registry.server.containerPorts.http .Values.internalTLS.enabled }}
name: registry
- containerPort: 5001
- containerPort: {{ .Values.registry.server.containerPorts.debug }}
name: debug
{{- if not .Values.diagnosticMode.enabled }}
{{- if .Values.registry.server.startupProbe.enabled }}
startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.registry.server.startupProbe "enabled") "context" $) | nindent 12 }}
tcpSocket:
port: {{ ternary "https" "http" .Values.internalTLS.enabled }}
{{- else if .Values.registry.server.customStartupProbe }}
startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.registry.server.customStartupProbe "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.registry.server.livenessProbe.enabled }}
livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.registry.server.livenessProbe "enabled") "context" $) | nindent 12 }}
httpGet:
path: /
scheme: {{ ternary "https" "http" .Values.internalTLS.enabled | upper }}
port: registry
{{- else if .Values.registry.server.customLivenessProbe }}
livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.registry.server.customLivenessProbe "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.registry.server.readinessProbe.enabled }}
readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.registry.server.readinessProbe "enabled") "context" $) | nindent 12 }}
httpGet:
path: /
scheme: {{ ternary "https" "http" .Values.internalTLS.enabled | upper }}
port: registry
{{- else if .Values.registry.server.customReadinessProbe }}
readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.registry.server.customReadinessProbe "context" $) | nindent 12 }}
{{- end }}
{{- end }}
{{- if .Values.registry.server.lifecycleHooks }}
lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.registry.server.lifecycleHooks "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.registry.server.resources }}
resources: {{- toYaml .Values.registry.server.resources | nindent 12 }}
{{- end }}
volumeMounts:
- name: registry-data
mountPath: {{ .Values.persistence.imageChartStorage.filesystem.rootdirectory }}
@@ -193,15 +205,15 @@ spec:
- name: internal-tls-certs
mountPath: /etc/harbor/ssl/registry
{{- end }}
{{- if .Values.caBundleSecretName }}
{{ include "harbor.caBundleVolumeMount" . | indent 12 }}
{{- if .Values.internalTLS.caBundleSecret }}
{{- include "harbor.caBundleVolumeMount" . | nindent 12 }}
{{- end }}
{{- if and .Values.persistence.enabled (eq .Values.persistence.imageChartStorage.type "gcs") }}
- name: gcs-key
mountPath: /etc/registry/gcs-key.json
subPath: gcs-key.json
{{- end }}
{{- if .Values.persistence.imageChartStorage.caBundleSecretName }}
{{- if .Values.persistence.imageChartStorage.caBundleSecret }}
- name: storage-service-ca
mountPath: /harbor_cust_cert/custom-ca-bundle.crt
subPath: ca.crt
@@ -217,51 +229,21 @@ spec:
{{- include "common.tplvalues.render" (dict "value" .Values.registry.server.extraVolumeMounts "context" $) | nindent 12 }}
{{- end }}
- name: registryctl
image: {{ include "harbor.registryctlImage" . }}
imagePullPolicy: {{ .Values.registryctlImage.pullPolicy | quote }}
{{- if .Values.registry.controller.command }}
image: {{ include "harbor.registry.controller.image" . }}
imagePullPolicy: {{ .Values.registry.controller.image.pullPolicy | quote }}
{{- if .Values.registry.controller.containerSecurityContext.enabled }}
securityContext: {{- omit .Values.registry.controller.containerSecurityContext "enabled" | toYaml | nindent 12 }}
{{- end }}
{{- if .Values.diagnosticMode.enabled }}
command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }}
{{- else if .Values.registry.controller.command }}
command: {{- include "common.tplvalues.render" (dict "value" .Values.registry.controller.command "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.registry.controller.args }}
{{- if .Values.diagnosticMode.enabled }}
args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }}
{{- else if .Values.registry.controller.args }}
args: {{- include "common.tplvalues.render" (dict "value" .Values.registry.controller.args "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.registry.controller.lifecycleHooks }}
lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.registry.controller.lifecycleHooks "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.containerSecurityContext }}
securityContext: {{- include "common.tplvalues.render" (dict "value" .Values.containerSecurityContext "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.registry.controller.livenessProbe.enabled }}
livenessProbe:
httpGet:
path: /api/health
scheme: {{ include "harbor.component.scheme" . | upper }}
port: registryctl
initialDelaySeconds: {{ .Values.registry.controller.livenessProbe.initialDelaySeconds }}
periodSeconds: {{ .Values.registry.controller.livenessProbe.periodSeconds }}
timeoutSeconds: {{ .Values.registry.controller.livenessProbe.timeoutSeconds }}
successThreshold: {{ .Values.registry.controller.livenessProbe.successThreshold }}
failureThreshold: {{ .Values.registry.controller.livenessProbe.failureThreshold }}
{{- else if .Values.registry.controller.customLivenessProbe }}
livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.registry.controller.customLivenessProbe "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.registry.controller.readinessProbe.enabled }}
readinessProbe:
httpGet:
path: /api/health
scheme: {{ include "harbor.component.scheme" . | upper }}
port: registryctl
initialDelaySeconds: {{ .Values.registry.controller.readinessProbe.initialDelaySeconds }}
periodSeconds: {{ .Values.registry.controller.readinessProbe.periodSeconds }}
timeoutSeconds: {{ .Values.registry.controller.readinessProbe.timeoutSeconds }}
successThreshold: {{ .Values.registry.controller.readinessProbe.successThreshold }}
failureThreshold: {{ .Values.registry.controller.readinessProbe.failureThreshold }}
{{- else if .Values.registry.controller.customReadinessProbe }}
readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.registry.controller.customReadinessProbe "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.registry.controller.resources }}
resources: {{- toYaml .Values.registry.controller.resources | nindent 12 }}
{{- end }}
envFrom:
- secretRef:
name: {{ include "harbor.registry" . }}
@@ -275,7 +257,7 @@ spec:
{{- end }}
env:
- name: BITNAMI_DEBUG
value: {{ ternary "true" "false" .Values.registryctlImage.debug | quote }}
value: {{ ternary "true" "false" .Values.registry.controller.image.debug | quote }}
- name: CORE_SECRET
valueFrom:
secretKeyRef:
@@ -300,8 +282,41 @@ spec:
{{- include "common.tplvalues.render" (dict "value" .Values.registry.controller.extraEnvVars "context" $) | nindent 12 }}
{{- end }}
ports:
- containerPort: {{ include "harbor.registryCtl.containerPort" . }}
- containerPort: {{ ternary .Values.registry.controller.containerPorts.https .Values.registry.controller.containerPorts.http .Values.internalTLS.enabled }}
name: registryctl
{{- if not .Values.diagnosticMode.enabled }}
{{- if .Values.registry.controller.startupProbe.enabled }}
startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.registry.controller.startupProbe "enabled") "context" $) | nindent 12 }}
tcpSocket:
port: {{ ternary "https" "http" .Values.internalTLS.enabled }}
{{- else if .Values.registry.controller.customStartupProbe }}
startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.registry.controller.customStartupProbe "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.registry.controller.livenessProbe.enabled }}
livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.registry.controller.livenessProbe "enabled") "context" $) | nindent 12 }}
httpGet:
path: /api/health
scheme: {{ ternary "https" "http" .Values.internalTLS.enabled | upper }}
port: registryctl
{{- else if .Values.registry.controller.customLivenessProbe }}
livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.registry.controller.customLivenessProbe "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.registry.controller.readinessProbe.enabled }}
readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.registry.controller.readinessProbe "enabled") "context" $) | nindent 12 }}
httpGet:
path: /api/health
scheme: {{ ternary "https" "http" .Values.internalTLS.enabled | upper }}
port: registryctl
{{- else if .Values.registry.controller.customReadinessProbe }}
readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.registry.controller.customReadinessProbe "context" $) | nindent 12 }}
{{- end }}
{{- end }}
{{- if .Values.registry.controller.lifecycleHooks }}
lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.registry.controller.lifecycleHooks "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.registry.controller.resources }}
resources: {{- toYaml .Values.registry.controller.resources | nindent 12 }}
{{- end }}
volumeMounts:
- name: registry-data
mountPath: {{ .Values.persistence.imageChartStorage.filesystem.rootdirectory }}
@@ -316,13 +331,13 @@ spec:
- name: registry-config
mountPath: /etc/registryctl/config.yml
subPath: ctl-config.yml
{{- if .Values.persistence.imageChartStorage.caBundleSecretName }}
{{- if .Values.persistence.imageChartStorage.caBundleSecret }}
- name: storage-service-ca
mountPath: /harbor_cust_cert/custom-ca-bundle.crt
subPath: ca.crt
{{- end }}
{{- if .Values.caBundleSecretName }}
{{ include "harbor.caBundleVolumeMount" . | indent 12 }}
{{- if .Values.internalTLS.caBundleSecret }}
{{- include "harbor.caBundleVolumeMount" . | nindent 12 }}
{{- end }}
{{- if and .Values.persistence.enabled (eq .Values.persistence.imageChartStorage.type "gcs") }}
- name: gcs-key
@@ -364,8 +379,8 @@ spec:
{{- else }}
emptyDir: {}
{{- end }}
{{- if .Values.caBundleSecretName }}
{{ include "harbor.caBundleVolume" . | indent 8 }}
{{- if .Values.internalTLS.caBundleSecret }}
{{- include "harbor.caBundleVolume" . | nindent 8 }}
{{- end }}
{{- if and .Values.persistence.enabled (eq .Values.persistence.imageChartStorage.type "gcs") }}
- name: gcs-key
@@ -375,10 +390,10 @@ spec:
- key: GCS_KEY_DATA
path: gcs-key.json
{{- end }}
{{- if .Values.persistence.imageChartStorage.caBundleSecretName }}
{{- if .Values.persistence.imageChartStorage.caBundleSecret }}
- name: storage-service-ca
secret:
secretName: {{ .Values.persistence.imageChartStorage.caBundleSecretName }}
secretName: {{ .Values.persistence.imageChartStorage.caBundleSecret }}
{{- end }}
{{- if .Values.registry.middleware.enabled }}
{{- if eq .Values.registry.middleware.type "cloudFront" }}
bitnami/harbor/templates/registry/registry-pvc.yaml
+18 -9
View File
@@ -4,24 +4,33 @@ kind: PersistentVolumeClaim
apiVersion: v1
metadata:
name: {{ include "harbor.registry" . }}
{{- if eq .Values.persistence.resourcePolicy "keep" }}
annotations:
helm.sh/resource-policy: keep
{{- end }}
namespace: {{ .Release.Namespace | quote }}
labels: {{- include "common.labels.standard" . | nindent 4 }}
{{- if .Values.commonLabels }}
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- end }}
app.kubernetes.io/component: registry
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
annotations:
{{- if eq .Values.persistence.resourcePolicy "keep" }}
helm.sh/resource-policy: keep
{{- end }}
{{- if .Values.commonAnnotations }}
{{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
{{- if .Values.persistence.persistentVolumeClaim.registry.annotations }}
{{- toYaml .Values.persistence.persistentVolumeClaim.registry.annotations | nindent 4 }}
{{- end }}
spec:
accessModes:
- {{ .Values.persistence.persistentVolumeClaim.registry.accessMode }}
{{- range .Values.persistence.persistentVolumeClaim.registry.accessModes }}
- {{ . | quote }}
{{- end }}
resources:
requests:
storage: {{ .Values.persistence.persistentVolumeClaim.registry.size }}
{{- include "harbor.registry.storageClass" . | nindent 2 }}
{{- if .Values.persistence.persistentVolumeClaim.registry.selector }}
selector: {{- include "common.tplvalues.render" (dict "value" .Values.persistence.persistentVolumeClaim.registry.selector "context" $) | nindent 2 }}
{{- end }}
{{- include "common.storage.class" ( dict "persistence" .Values.persistence.persistentVolumeClaim.registry "global" .Values.global ) | nindent 2 }}
{{- end }}
{{- end }}
bitnami/harbor/templates/registry/registry-secret.yaml
+2 -1
View File
@@ -2,6 +2,7 @@ apiVersion: v1
kind: Secret
metadata:
name: {{ include "harbor.registry" . }}
namespace: {{ .Release.Namespace | quote }}
labels: {{- include "common.labels.standard" . | nindent 4 }}
{{- if .Values.commonLabels }}
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
@@ -12,7 +13,7 @@ metadata:
type: Opaque
data:
REGISTRY_HTPASSWD: {{ .Values.registry.credentials.htpasswd | b64enc | quote }}
REGISTRY_HTTP_SECRET: {{ .Values.registry.secret | default (randAlphaNum 16) | b64enc | quote }}
REGISTRY_HTTP_SECRET: {{ include "common.secrets.passwords.manage" (dict "secret" (include "harbor.registry" .) "key" "REGISTRY_HTTP_SECRET" "length" 16 "providedValues" (list "registry.secret") "context" $) }}
REGISTRY_REDIS_PASSWORD: {{ (include "harbor.redis.rawPassword" .) | b64enc | quote }}
{{- if eq .Values.persistence.imageChartStorage.type "azure" }}
REGISTRY_STORAGE_AZURE_ACCOUNTKEY: {{ .Values.persistence.imageChartStorage.azure.accountkey | b64enc | quote }}
bitnami/harbor/templates/registry/registry-svc.yaml
+3 -2
View File
@@ -2,6 +2,7 @@ apiVersion: v1
kind: Service
metadata:
name: {{ include "harbor.registry" . }}
namespace: {{ .Release.Namespace | quote }}
labels: {{- include "common.labels.standard" . | nindent 4 }}
{{- if .Values.commonLabels }}
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
@@ -12,8 +13,8 @@ metadata:
spec:
ports:
- name: registry
port: {{ include "harbor.registry.servicePort" . }}
port: {{ ternary .Values.registry.server.service.ports.https .Values.registry.server.service.ports.http .Values.internalTLS.enabled }}
- name: controller
port: {{ include "harbor.registryctl.servicePort" . }}
port: {{ ternary .Values.registry.controller.service.ports.https .Values.registry.controller.service.ports.http .Values.internalTLS.enabled }}
selector: {{- include "common.labels.matchLabels" . | nindent 4 }}
app.kubernetes.io/component: registry
bitnami/harbor/templates/trivy/trivy-cm-envvars.yaml
+3 -2
View File
@@ -1,7 +1,8 @@
apiVersion: v1
kind: ConfigMap
metadata:
name: {{ template "harbor.trivy" . }}-envvars
name: {{ printf "%s-envvars" (include "harbor.trivy" .) }}
namespace: {{ .Release.Namespace | quote }}
labels: {{- include "common.labels.standard" . | nindent 4 }}
{{- if .Values.commonLabels }}
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
@@ -20,7 +21,7 @@ data:
SCANNER_TRIVY_IGNORE_UNFIXED: {{ .Values.trivy.ignoreUnfixed | quote }}
SCANNER_TRIVY_SKIP_UPDATE: {{ .Values.trivy.skipUpdate | quote }}
SCANNER_TRIVY_INSECURE: {{ .Values.trivy.insecure | quote }}
SCANNER_API_SERVER_ADDR: {{ printf ":%s" (include "harbor.trivy.containerPort" .) | quote }}
SCANNER_API_SERVER_ADDR: {{ printf ":%d" (ternary .Values.trivy.containerPorts.https .Values.trivy.containerPorts.http .Values.internalTLS.enabled | int) | quote }}
{{- if .Values.internalTLS.enabled }}
INTERNAL_TLS_ENABLED: "true"
SCANNER_API_SERVER_TLS_KEY: /etc/harbor/ssl/trivy/tls.key
bitnami/harbor/templates/trivy/trivy-secret-envvars.yaml
+2 -1
View File
@@ -2,7 +2,8 @@
apiVersion: v1
kind: Secret
metadata:
name: {{ include "harbor.trivy" . }}-envvars
name: {{ printf "%s-envvars" (include "harbor.trivy" .) }}
namespace: {{ .Release.Namespace | quote }}
labels: {{- include "common.labels.standard" . | nindent 4 }}
{{- if .Values.commonLabels }}
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
bitnami/harbor/templates/trivy/trivy-sts.yaml
+89 -70
View File
@@ -1,9 +1,9 @@
{{- if .Values.trivy.enabled }}
apiVersion: apps/v1
kind: StatefulSet
metadata:
name: {{ include "harbor.trivy" . }}
namespace: {{ .Release.Namespace | quote }}
labels: {{- include "common.labels.standard" . | nindent 4 }}
{{- if .Values.commonLabels }}
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
@@ -13,7 +13,7 @@ metadata:
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
spec:
replicas: {{ .Values.trivy.replicas }}
replicas: {{ .Values.trivy.replicaCount }}
serviceName: {{ template "harbor.trivy" . }}
updateStrategy: {{- toYaml .Values.trivy.updateStrategy | nindent 4 }}
selector:
@@ -40,8 +40,8 @@ spec:
{{- end }}
spec:
{{- include "harbor.imagePullSecrets" . | nindent 6 }}
{{- if .Values.trivy.priorityClassName }}
priorityClassName: {{ .Values.trivy.priorityClassName | quote }}
{{- if .Values.trivy.hostAliases }}
hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.trivy.hostAliases "context" $) | nindent 8 }}
{{- end }}
{{- if .Values.trivy.affinity }}
affinity: {{- include "common.tplvalues.render" (dict "value" .Values.trivy.affinity "context" $) | nindent 8 }}
@@ -57,62 +57,72 @@ spec:
{{- if .Values.trivy.tolerations }}
tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.trivy.tolerations "context" $) | nindent 8 }}
{{- end }}
{{- if .Values.podSecurityContext }}
securityContext: {{- include "common.tplvalues.render" (dict "value" .Values.podSecurityContext "context" $) | nindent 8 }}
{{- if .Values.trivy.topologySpreadConstraints }}
topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.trivy.topologySpreadConstraints "context" .) | nindent 8 }}
{{- end }}
{{- if .Values.trivy.priorityClassName }}
priorityClassName: {{ .Values.trivy.priorityClassName | quote }}
{{- end }}
{{- if .Values.trivy.schedulerName }}
schedulerName: {{ .Values.trivy.schedulerName }}
{{- end }}
{{- if .Values.trivy.podSecurityContext.enabled }}
securityContext: {{- omit .Values.trivy.podSecurityContext "enabled" | toYaml | nindent 8 }}
{{- end }}
automountServiceAccountToken: {{ .Values.trivy.automountServiceAccountToken }}
initContainers:
{{- if and .Values.volumePermissions.enabled .Values.persistence.enabled }}
{{- if and .Values.volumePermissions.enabled .Values.persistence.enabled }}
- name: volume-permissions
image: {{ include "harbor.volumePermissions.image" . }}
imagePullPolicy: {{ .Values.volumePermissions.image.pullPolicy | quote }}
command:
- sh
- -c
- /bin/bash
args:
- -ec
- |
mkdir -p "{{ .Values.trivy.cacheDir }}"
mkdir -p "{{ .Values.trivy.cacheDir }}/trivy"
mkdir -p "{{ .Values.trivy.cacheDir }}/reports"
chown -R "{{ .Values.containerSecurityContext.runAsUser }}:{{ .Values.podSecurityContext.fsGroup }}" "{{ .Values.trivy.cacheDir }}"
securityContext:
runAsUser: 0
mkdir -p {{ .Values.trivy.cacheDir }} {{ .Values.trivy.cacheDir }}/trivy {{ .Values.trivy.cacheDir }}/reports
find {{ .Values.trivy.cacheDir }} -mindepth 1 -maxdepth 1 -not -name ".snapshot" -not -name "lost+found" | xargs -r chown -R {{ .Values.trivy.containerSecurityContext.runAsUser }}:{{ .Values.trivy.podSecurityContext.fsGroup }}
{{- if .Values.volumePermissions.containerSecurityContext.enabled }}
securityContext: {{- omit .Values.volumePermissions.containerSecurityContext "enabled" | toYaml | nindent 12 }}
{{- end }}
{{- if .Values.volumePermissions.resources }}
resources: {{- toYaml .Values.volumePermissions.resources | nindent 12 }}
{{- end }}
volumeMounts:
- name: data
mountPath: {{ .Values.trivy.cacheDir }}
{{- end }}
{{- if .Values.trivy.initContainers }}
{{- include "common.tplvalues.render" (dict "value" .Values.trivy.initContainers "context" $) | nindent 8 }}
{{- end }}
{{- if .Values.trivy.hostAliases }}
hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.trivy.hostAliases "context" $) | nindent 8 }}
{{- end }}
{{- end }}
{{- if .Values.trivy.initContainers }}
{{- include "common.tplvalues.render" (dict "value" .Values.trivy.initContainers "context" $) | nindent 8 }}
{{- end }}
containers:
- name: trivy
image: {{ include "harbor.trivyImage" . }}
imagePullPolicy: {{ .Values.trivyImage.pullPolicy | quote }}
{{- if .Values.containerSecurityContext }}
securityContext: {{- include "common.tplvalues.render" (dict "value" .Values.containerSecurityContext "context" $) | nindent 12 }}
image: {{ include "harbor.trivy.image" . }}
imagePullPolicy: {{ .Values.trivy.image.pullPolicy | quote }}
{{- if .Values.trivy.containerSecurityContext.enabled }}
securityContext: {{- omit .Values.trivy.containerSecurityContext "enabled" | toYaml | nindent 12 }}
{{- end }}
{{- if .Values.trivy.command }}
{{- if .Values.diagnosticMode.enabled }}
command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }}
{{- else if .Values.trivy.command }}
command: {{- include "common.tplvalues.render" (dict "value" .Values.trivy.command "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.trivy.args }}
{{- if .Values.diagnosticMode.enabled }}
args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }}
{{- else if .Values.trivy.args }}
args: {{- include "common.tplvalues.render" (dict "value" .Values.trivy.args "context" $) | nindent 12 }}
{{- end }}
env:
- name: BITNAMI_DEBUG
value: {{ ternary "true" "false" .Values.trivyImage.debug | quote }}
value: {{ ternary "true" "false" .Values.trivy.image.debug | quote }}
{{- if .Values.trivy.extraEnvVars }}
{{- include "common.tplvalues.render" (dict "value" .Values.trivy.extraEnvVars "context" $) | nindent 12 }}
{{- end }}
envFrom:
- configMapRef:
name: {{ template "harbor.trivy" . }}-envvars
name: {{ printf "%s-envvars" (include "harbor.trivy" .) }}
- secretRef:
name: {{ template "harbor.trivy" . }}-envvars
name: {{ printf "%s-envvars" (include "harbor.trivy" .) }}
{{- if .Values.trivy.extraEnvVarsCM }}
- configMapRef:
name: {{ include "common.tplvalues.render" (dict "value" .Values.trivy.extraEnvVarsCM "context" $) }}
@@ -123,7 +133,40 @@ spec:
{{- end }}
ports:
- name: api-server
containerPort: {{ template "harbor.trivy.containerPort" . }}
containerPort: {{ ternary .Values.trivy.containerPorts.https .Values.trivy.containerPorts.http .Values.internalTLS.enabled }}
{{- if not .Values.diagnosticMode.enabled }}
{{- if .Values.trivy.startupProbe.enabled }}
startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.trivy.startupProbe "enabled") "context" $) | nindent 12 }}
tcpSocket:
port: api-server
{{- else if .Values.trivy.customStartupProbe }}
startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.trivy.customStartupProbe "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.trivy.livenessProbe.enabled }}
livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.trivy.livenessProbe "enabled") "context" $) | nindent 12 }}
httpGet:
scheme: {{ ternary "https" "http" .Values.internalTLS.enabled | upper }}
path: /probe/healthy
port: api-server
{{- else if .Values.trivy.customLivenessProbe }}
livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.trivy.customLivenessProbe "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.trivy.readinessProbe.enabled }}
readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.trivy.readinessProbe "enabled") "context" $) | nindent 12 }}
httpGet:
scheme: {{ ternary "https" "http" .Values.internalTLS.enabled | upper }}
path: /probe/ready
port: api-server
{{- else if .Values.trivy.customReadinessProbe }}
readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.trivy.customReadinessProbe "context" $) | nindent 12 }}
{{- end }}
{{- end }}
{{- if .Values.trivy.lifecycleHooks }}
lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.trivy.lifecycleHooks "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.trivy.resources }}
resources: {{- toYaml .Values.trivy.resources | nindent 12 }}
{{- end }}
volumeMounts:
- name: data
mountPath: {{ .Values.trivy.cacheDir }}
@@ -132,44 +175,12 @@ spec:
- name: internal-tls-certs
mountPath: /etc/harbor/ssl/trivy
{{- end }}
{{- if .Values.caBundleSecretName }}
{{ include "harbor.caBundleVolumeMount" . | indent 12 }}
{{- if .Values.internalTLS.caBundleSecret }}
{{- include "harbor.caBundleVolumeMount" . | nindent 12 }}
{{- end }}
{{- if .Values.trivy.extraVolumeMounts }}
{{- include "common.tplvalues.render" (dict "value" .Values.trivy.extraVolumeMounts "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.trivy.lifecycleHooks }}
lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.trivy.lifecycleHooks "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.trivy.livenessProbe.enabled }}
livenessProbe:
httpGet:
scheme: {{ include "harbor.component.scheme" . | upper }}
path: /probe/healthy
port: api-server
initialDelaySeconds: {{ .Values.trivy.livenessProbe.initialDelaySeconds }}
periodSeconds: {{ .Values.trivy.livenessProbe.periodSeconds }}
timeoutSeconds: {{ .Values.trivy.livenessProbe.timeoutSeconds }}
successThreshold: {{ .Values.trivy.livenessProbe.successThreshold }}
failureThreshold: {{ .Values.trivy.livenessProbe.failureThreshold }}
{{- else if .Values.trivy.customLivenessProbe }}
livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.trivy.customLivenessProbe "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.trivy.readinessProbe.enabled }}
readinessProbe:
httpGet:
scheme: {{ include "harbor.component.scheme" . | upper }}
path: /probe/ready
port: api-server
initialDelaySeconds: {{ .Values.trivy.readinessProbe.initialDelaySeconds }}
periodSeconds: {{ .Values.trivy.readinessProbe.periodSeconds }}
timeoutSeconds: {{ .Values.trivy.readinessProbe.timeoutSeconds }}
successThreshold: {{ .Values.trivy.readinessProbe.successThreshold }}
failureThreshold: {{ .Values.trivy.readinessProbe.failureThreshold }}
{{- else if .Values.trivy.customReadinessProbe }}
readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.trivy.customReadinessProbe "context" $) | nindent 12 }}
{{- end }}
resources: {{- toYaml .Values.trivy.resources | nindent 12 }}
{{- if .Values.trivy.sidecars }}
{{- include "common.tplvalues.render" (dict "value" .Values.trivy.sidecars "context" $) | nindent 8 }}
{{- end }}
@@ -179,8 +190,8 @@ spec:
secret:
secretName: {{ include "harbor.trivy.tls.secretName" . }}
{{- end }}
{{- if .Values.caBundleSecretName }}
{{ include "harbor.caBundleVolume" . | indent 8 }}
{{- if .Values.internalTLS.caBundleSecret }}
{{- include "harbor.caBundleVolume" . | nindent 8 }}
{{- end }}
{{- if not .Values.persistence.enabled }}
- name: data
@@ -194,12 +205,20 @@ spec:
- metadata:
name: data
labels: {{- include "common.labels.matchLabels" . | nindent 10 }}
{{- if .Values.persistence.persistentVolumeClaim.trivy.annotations }}
annotations: {{- toYaml .Values.persistence.persistentVolumeClaim.trivy.annotations | nindent 10 }}
{{- end }}
spec:
accessModes:
- {{ .Values.persistence.persistentVolumeClaim.trivy.accessMode | quote }}
{{- include "harbor.trivy.storageClass" . | nindent 8 }}
{{- range .Values.persistence.persistentVolumeClaim.trivy.accessModes }}
- {{ . | quote }}
{{- end }}
resources:
requests:
storage: {{ .Values.persistence.persistentVolumeClaim.trivy.size | quote }}
{{- if .Values.persistence.persistentVolumeClaim.trivy.selector }}
selector: {{- include "common.tplvalues.render" (dict "value" .Values.persistence.persistentVolumeClaim.trivy.selector "context" $) | nindent 10 }}
{{- end }}
{{- include "common.storage.class" ( dict "persistence" .Values.persistence.persistentVolumeClaim.trivy "global" .Values.global ) | nindent 8 }}
{{- end }}
{{- end }}
bitnami/harbor/templates/trivy/trivy-svc.yaml
+2 -1
View File
@@ -3,6 +3,7 @@ apiVersion: v1
kind: Service
metadata:
name: {{ include "harbor.trivy" . }}
namespace: {{ .Release.Namespace | quote }}
labels: {{- include "common.labels.standard" . | nindent 4 }}
{{- if .Values.commonLabels }}
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
@@ -15,7 +16,7 @@ spec:
ports:
- name: api-server
protocol: TCP
port: {{ include "harbor.trivy.servicePort" . }}
port: {{ ternary .Values.trivy.service.ports.https .Values.trivy.service.ports.http .Values.internalTLS.enabled }}
targetPort: api-server
selector: {{- include "common.labels.matchLabels" . | nindent 4 }}
app.kubernetes.io/component: trivy
bitnami/harbor/values.yaml
+2756 -2003
View File
File diff suppressed because it is too large Load Diff