diff --git a/bitnami/harbor/Chart.lock b/bitnami/harbor/Chart.lock index 7b6a72191..695cd7abc 100644 --- a/bitnami/harbor/Chart.lock +++ b/bitnami/harbor/Chart.lock @@ -1,12 +1,12 @@ dependencies: - name: redis repository: https://charts.bitnami.com/bitnami - version: 15.7.6 + version: 16.4.5 - name: postgresql repository: https://charts.bitnami.com/bitnami - version: 10.16.2 + version: 11.1.3 - name: common repository: https://charts.bitnami.com/bitnami version: 1.11.3 -digest: sha256:1f02461905972fa5b358f14eb441ac4558d26a9a3c9c1fb26df3c6da6e807057 -generated: "2022-03-04T15:36:54.029938649Z" +digest: sha256:d769f97794c944c9962ed65f8cceda3b0bee7a740a06310aca12c2455f7afca1 +generated: "2022-03-04T18:35:03.666442+01:00" diff --git a/bitnami/harbor/Chart.yaml b/bitnami/harbor/Chart.yaml index af7b1802a..7c89e157a 100644 --- a/bitnami/harbor/Chart.yaml +++ b/bitnami/harbor/Chart.yaml @@ -6,11 +6,11 @@ dependencies: - condition: redis.enabled name: redis repository: https://charts.bitnami.com/bitnami - version: 15.x.x + version: 16.x.x - condition: postgresql.enabled name: postgresql repository: https://charts.bitnami.com/bitnami - version: 10.x.x + version: 11.x.x - name: common repository: https://charts.bitnami.com/bitnami version: 1.x.x @@ -34,4 +34,4 @@ sources: - https://github.com/bitnami/bitnami-docker-harbor-registry - https://github.com/bitnami/bitnami-docker-harbor-registryctl - https://goharbor.io/ -version: 11.2.6 +version: 12.0.0 diff --git a/bitnami/harbor/README.md b/bitnami/harbor/README.md index 3cd0a381d..835c393ef 100644 --- a/bitnami/harbor/README.md +++ b/bitnami/harbor/README.md @@ -10,9 +10,9 @@ Harbor is an open source trusted cloud-native registry to store, sign, and scan ## TL;DR -``` -$ helm repo add bitnami https://charts.bitnami.com/bitnami -$ helm install my-release bitnami/harbor +```bash +helm repo add bitnami https://charts.bitnami.com/bitnami +helm install my-release bitnami/harbor ``` ## Introduction @@ -43,8 +43,8 @@ For example, the following changes have been introduced: Install the Harbor helm chart with a release name `my-release`: ```bash -$ helm repo add bitnami https://charts.bitnami.com/bitnami -$ helm install my-release bitnami/harbor +helm repo add bitnami https://charts.bitnami.com/bitnami +helm install my-release bitnami/harbor ``` ## Uninstalling the Chart @@ -52,7 +52,7 @@ $ helm install my-release bitnami/harbor To uninstall/delete the `my-release` deployment: ```bash -$ helm delete --purge my-release +helm delete --purge my-release ``` Additionally, if `persistence.resourcePolicy` is set to `keep`, you should manually delete the PVCs. @@ -65,73 +65,85 @@ Additionally, if `persistence.resourcePolicy` is set to `keep`, you should manua | ------------------------- | ----------------------------------------------- | ----- | | `global.imageRegistry` | Global Docker image registry | `""` | | `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` | -| `global.storageClass` | Global storage class for dynamic provisioning | `""` | +| `global.storageClass` | Global StorageClass for Persistent Volume(s) | `""` | ### Common Parameters -| Name | Description | Value | -| ------------------- | -------------------------------------------------------------------------------------------- | ----- | -| `nameOverride` | String to partially override common.names.fullname template (will maintain the release name) | `""` | -| `fullnameOverride` | String to fully override common.names.fullname template with a string | `""` | -| `kubeVersion` | Force target Kubernetes version (using Helm capabilities if not set) | `""` | -| `commonAnnotations` | Annotations to add to all deployed objects | `{}` | -| `commonLabels` | Labels to add to all deployed objects | `{}` | -| `extraDeploy` | Array of extra objects to deploy with the release (evaluated as a template). | `[]` | +| Name | Description | Value | +| ------------------------ | -------------------------------------------------------------------------------------------- | --------------- | +| `nameOverride` | String to partially override common.names.fullname template (will maintain the release name) | `""` | +| `fullnameOverride` | String to fully override common.names.fullname template with a string | `""` | +| `kubeVersion` | Force target Kubernetes version (using Helm capabilities if not set) | `""` | +| `clusterDomain` | Kubernetes Cluster Domain | `cluster.local` | +| `commonAnnotations` | Annotations to add to all deployed objects | `{}` | +| `commonLabels` | Labels to add to all deployed objects | `{}` | +| `extraDeploy` | Array of extra objects to deploy with the release (evaluated as a template). | `[]` | +| `diagnosticMode.enabled` | Enable diagnostic mode (all probes will be disabled and the command will be overridden) | `false` | +| `diagnosticMode.command` | Command to override all containers in the the deployment(s)/statefulset(s) | `["sleep"]` | +| `diagnosticMode.args` | Args to override all containers in the the deployment(s)/statefulset(s) | `["infinity"]` | -### Harbor parameters +### Harbor common parameters -| Name | Description | Value | -| --------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------- | -| `volumePermissions.enabled` | Enable init container that changes volume permissions in the data directory (for cases where the default k8s `runAsUser` and `fsUser` values do not work) | `false` | -| `volumePermissions.image.registry` | Init container volume-permissions image registry | `docker.io` | -| `volumePermissions.image.repository` | Init container volume-permissions image name | `bitnami/bitnami-shell` | -| `volumePermissions.image.tag` | Init container volume-permissions image tag | `10-debian-10-r309` | -| `volumePermissions.image.pullPolicy` | Init container volume-permissions image pull policy | `IfNotPresent` | -| `volumePermissions.image.pullSecrets` | Specify docker-registry secret names as an array | `[]` | -| `volumePermissions.resources.limits` | The resources limits for the container | `{}` | -| `volumePermissions.resources.requests` | The requested resources for the container | `{}` | -| `internalTLS.enabled` | Use TLS in all the supported containers: chartmuseum, clair, core, jobservice, portal, registry and trivy | `false` | -| `ipFamily.ipv6.enabled` | Enable listening on IPv6 ([::]) for nginx-based components (nginx,portal) | `true` | -| `ipFamily.ipv4.enabled` | Enable listening on IPv4 for nginx-based components (nginx,portal) | `true` | -| `caBundleSecretName` | The custom ca bundle secret name, the secret must contain key named "ca.crt" which will be injected into the trust store for chartmuseum, clair, core, jobservice, registry, trivy components. | `""` | -| `externalURL` | The external URL for Harbor core service | `https://core.harbor.domain` | -| `containerSecurityContext.runAsUser` | Set container's Security Context runAsUser | `1001` | -| `containerSecurityContext.runAsNonRoot` | Set container's Security Context runAsNonRoot | `true` | -| `podSecurityContext.fsGroup` | Set pod's Security Context fsGroup | `1001` | -| `logLevel` | The log level used for Harbor services. Allowed values are [ fatal | error | warn | info | debug | trace ] | `debug` | -| `forcePassword` | Option to force users to specify passwords (core.secret, harborAdminPassword, and secretKey). That is required for 'helm upgrade' to work properly. | `false` | -| `harborAdminPassword` | The initial password of Harbor admin. Change it from portal after launching Harbor | `""` | -| `proxy.httpProxy` | The URL of the HTTP proxy server | `""` | -| `proxy.httpsProxy` | The URL of the HTTPS proxy server | `""` | -| `proxy.noProxy` | The URLs that the proxy settings not apply to | `127.0.0.1,localhost,.local,.internal` | -| `proxy.components` | The component list that the proxy settings apply to | `["core","jobservice","clair","trivy"]` | +| Name | Description | Value | +| ---------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------- | +| `adminPassword` | The initial password of Harbor admin. Change it from portal after launching Harbor | `""` | +| `externalURL` | The external URL for Harbor Core service | `https://core.harbor.domain` | +| `proxy.httpProxy` | The URL of the HTTP proxy server | `""` | +| `proxy.httpsProxy` | The URL of the HTTPS proxy server | `""` | +| `proxy.noProxy` | The URLs that the proxy settings not apply to | `127.0.0.1,localhost,.local,.internal` | +| `proxy.components` | The component list that the proxy settings apply to | `["core","jobservice","clair","trivy"]` | +| `logLevel` | The log level used for Harbor services. Allowed values are [ fatal | error | warn | info | debug | trace ] | `debug` | +| `internalTLS.enabled` | Use TLS in all the supported containers: chartmuseum, clair, core, jobservice, portal, registry and trivy | `false` | +| `internalTLS.caBundleSecret` | Name of an existing secret with a custom CA that will be injected into the trust store for chartmuseum, clair, core, jobservice, registry, trivy components | `""` | +| `ipFamily.ipv6.enabled` | Enable listening on IPv6 ([::]) for NGINX-based components (NGINX,portal) | `true` | +| `ipFamily.ipv4.enabled` | Enable listening on IPv4 for NGINX-based components (NGINX,portal) | `true` | ### Traffic Exposure Parameters -| Name | Description | Value | -| ---------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------ | -| `service.type` | The way how to expose the service: `Ingress`, `ClusterIP`, `NodePort` or `LoadBalancer` | `LoadBalancer` | -| `service.tls.enabled` | Enable the tls or not (for external access) | `true` | -| `service.tls.existingSecret` | Existing secret name containing your own TLS certificates. The secret must contain the keys: `tls.crt` - the certificate (required), `tls.key` - the private key (required), `ca.crt` - the certificate of CA (optional). Self-signed TLS certificates will be used otherwise. | `""` | -| `service.tls.notaryExistingSecret` | By default, the Notary service will use the same cert and key as described above. Fill the name of secret if you want to use a separated one. Only needed when the `service.type` is `ingress`. | `""` | -| `service.tls.commonName` | The common name used to generate the certificate, it's necessary when the `service.type` is `ClusterIP` or `NodePort` and `service.tls.existingSecret` is null | `core.harbor.domain` | -| `service.ports.http` | The service port Harbor listens on when serving with HTTP | `80` | -| `service.ports.https` | The service port Harbor listens on when serving with HTTPS | `443` | -| `service.ports.notary` | The service port Notary listens on. Only needed when `notary.enabled` is set to `true` | `4443` | -| `service.nodePorts` | Service parameters when type is "nodePort" | `{}` | -| `service.loadBalancerIP` | Load Balancer IP | `""` | -| `service.annotations` | The annotations attached to the loadBalancer service | `{}` | -| `service.loadBalancerSourceRanges` | List of IP address ranges to assign to loadBalancerSourceRanges | `[]` | -| `service.externalTrafficPolicy` | Enable client source IP preservation | `""` | -| `ingress.enabled` | Deploy ingress rules | `false` | -| `ingress.pathType` | Ingress path type | `ImplementationSpecific` | -| `ingress.apiVersion` | Override ingress api version | `""` | -| `ingress.hosts` | The list of hostnames to be covered with this ingress record | `{}` | -| `ingress.controller` | The ingress controller type. Currently supports `default`, `gce` and `ncp` | `default` | -| `ingress.annotations` | Additional annotations for the Ingress resource. To enable certificate autogeneration, place here your cert-manager annotations. | `{}` | +| Name | Description | Value | +| ---------------------------------- | -------------------------------------------------------------------------------------------------------------------------------- | ------------------------ | +| `exposureType` | The way to expose Harbor. Allowed values are [ ingress | proxy ] | `proxy` | +| `service.type` | NGINX proxy service type | `LoadBalancer` | +| `service.ports.http` | NGINX proxy service HTTP port | `80` | +| `service.ports.https` | NGINX proxy service HTTPS port | `443` | +| `service.ports.notary` | Notary service port | `4443` | +| `service.nodePorts.http` | Node port for HTTP | `""` | +| `service.nodePorts.https` | Node port for HTTPS | `""` | +| `service.nodePorts.notary` | Node port for Notary | `""` | +| `service.sessionAffinity` | Control where client requests go, to the same pod or round-robin | `None` | +| `service.clusterIP` | NGINX proxy service Cluster IP | `""` | +| `service.loadBalancerIP` | NGINX proxy service Load Balancer IP | `""` | +| `service.loadBalancerSourceRanges` | NGINX proxy service Load Balancer sources | `[]` | +| `service.externalTrafficPolicy` | NGINX proxy service external traffic policy | `Cluster` | +| `service.annotations` | Additional custom annotations for NGINX proxy service | `{}` | +| `service.extraPorts` | Extra port to expose on NGINX proxy service | `[]` | +| `ingress.core.ingressClassName` | IngressClass that will be be used to implement the Ingress (Kubernetes 1.18+) | `""` | +| `ingress.core.pathType` | Ingress path type | `ImplementationSpecific` | +| `ingress.core.apiVersion` | Force Ingress API version (automatically detected if not set) | `""` | +| `ingress.core.controller` | The ingress controller type. Currently supports `default`, `gce` and `ncp` | `default` | +| `ingress.core.hostname` | Default host for the ingress record | `core.harbor.domain` | +| `ingress.core.annotations` | Additional annotations for the Ingress resource. To enable certificate autogeneration, place here your cert-manager annotations. | `{}` | +| `ingress.core.tls` | Enable TLS configuration for the host defined at `ingress.core.hostname` parameter | `false` | +| `ingress.core.selfSigned` | Create a TLS secret for this ingress record using self-signed certificates generated by Helm | `false` | +| `ingress.core.extraHosts` | An array with additional hostname(s) to be covered with the ingress record | `[]` | +| `ingress.core.extraPaths` | An array with additional arbitrary paths that may need to be added to the ingress under the main host | `[]` | +| `ingress.core.extraTls` | TLS configuration for additional hostname(s) to be covered with this ingress record | `[]` | +| `ingress.core.secrets` | Custom TLS certificates as secrets | `[]` | +| `ingress.notary.ingressClassName` | IngressClass that will be be used to implement the Ingress (Kubernetes 1.18+) | `""` | +| `ingress.notary.pathType` | Ingress path type | `ImplementationSpecific` | +| `ingress.notary.apiVersion` | Force Ingress API version (automatically detected if not set) | `""` | +| `ingress.notary.controller` | The ingress controller type. Currently supports `default`, `gce` and `ncp` | `default` | +| `ingress.notary.hostname` | Default host for the ingress record | `notary.harbor.domain` | +| `ingress.notary.annotations` | Additional annotations for the Ingress resource. To enable certificate autogeneration, place here your cert-manager annotations. | `{}` | +| `ingress.notary.tls` | Enable TLS configuration for the host defined at `ingress.hostname` parameter | `false` | +| `ingress.notary.selfSigned` | Create a TLS secret for this ingress record using self-signed certificates generated by Helm | `false` | +| `ingress.notary.extraHosts` | An array with additional hostname(s) to be covered with the ingress record | `[]` | +| `ingress.notary.extraPaths` | An array with additional arbitrary paths that may need to be added to the ingress under the main host | `[]` | +| `ingress.notary.extraTls` | TLS configuration for additional hostname(s) to be covered with this ingress record | `[]` | +| `ingress.notary.secrets` | Custom TLS certificates as secrets | `[]` | ### Persistence Parameters @@ -140,25 +152,33 @@ Additionally, if `persistence.resourcePolicy` is set to `keep`, you should manua | ------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------- | | `persistence.enabled` | Enable the data persistence or not | `true` | | `persistence.resourcePolicy` | Setting it to `keep` to avoid removing PVCs during a helm delete operation. Leaving it empty will delete PVCs after the chart deleted | `keep` | -| `persistence.persistentVolumeClaim.registry.existingClaim` | Use the existing PVC which must be created manually before bound, and specify the `subPath` if the PVC is shared with other components | `""` | -| `persistence.persistentVolumeClaim.registry.storageClass` | Specify the `storageClass` used to provision the volume. Or the default StorageClass will be used (the default). Set it to `-` to disable dynamic provisioning | `""` | +| `persistence.persistentVolumeClaim.registry.existingClaim` | Name of an existing PVC to use | `""` | +| `persistence.persistentVolumeClaim.registry.storageClass` | PVC Storage Class for Harbor Registry data volume | `""` | | `persistence.persistentVolumeClaim.registry.subPath` | The sub path used in the volume | `""` | -| `persistence.persistentVolumeClaim.registry.accessMode` | The access mode of the volume | `ReadWriteOnce` | +| `persistence.persistentVolumeClaim.registry.accessModes` | The access mode of the volume | `["ReadWriteOnce"]` | | `persistence.persistentVolumeClaim.registry.size` | The size of the volume | `5Gi` | -| `persistence.persistentVolumeClaim.jobservice.existingClaim` | Use the existing PVC which must be created manually before bound, and specify the `subPath` if the PVC is shared with other components | `""` | -| `persistence.persistentVolumeClaim.jobservice.storageClass` | Specify the `storageClass` used to provision the volume. Or the default StorageClass will be used(the default). Set it to `-` to disable dynamic provisioning | `""` | +| `persistence.persistentVolumeClaim.registry.annotations` | Annotations for the PVC | `{}` | +| `persistence.persistentVolumeClaim.registry.selector` | Selector to match an existing Persistent Volume | `{}` | +| `persistence.persistentVolumeClaim.jobservice.existingClaim` | Name of an existing PVC to use | `""` | +| `persistence.persistentVolumeClaim.jobservice.storageClass` | PVC Storage Class for Harbor Jobservice data volume | `""` | | `persistence.persistentVolumeClaim.jobservice.subPath` | The sub path used in the volume | `""` | -| `persistence.persistentVolumeClaim.jobservice.accessMode` | The access mode of the volume | `ReadWriteOnce` | +| `persistence.persistentVolumeClaim.jobservice.accessModes` | The access mode of the volume | `["ReadWriteOnce"]` | | `persistence.persistentVolumeClaim.jobservice.size` | The size of the volume | `1Gi` | -| `persistence.persistentVolumeClaim.chartmuseum.existingClaim` | Use the existing PVC which must be created manually before bound, and specify the `subPath` if the PVC is shared with other components | `""` | -| `persistence.persistentVolumeClaim.chartmuseum.storageClass` | Specify the `storageClass` used to provision the volume. Or the default StorageClass will be used(the default). Set it to `-` to disable dynamic provisioning | `""` | +| `persistence.persistentVolumeClaim.jobservice.annotations` | Annotations for the PVC | `{}` | +| `persistence.persistentVolumeClaim.jobservice.selector` | Selector to match an existing Persistent Volume | `{}` | +| `persistence.persistentVolumeClaim.chartmuseum.existingClaim` | Name of an existing PVC to use | `""` | +| `persistence.persistentVolumeClaim.chartmuseum.storageClass` | PVC Storage Class for Chartmuseum data volume | `""` | | `persistence.persistentVolumeClaim.chartmuseum.subPath` | The sub path used in the volume | `""` | -| `persistence.persistentVolumeClaim.chartmuseum.accessMode` | The access mode of the volume | `ReadWriteOnce` | +| `persistence.persistentVolumeClaim.chartmuseum.accessModes` | The access mode of the volume | `["ReadWriteOnce"]` | | `persistence.persistentVolumeClaim.chartmuseum.size` | The size of the volume | `5Gi` | -| `persistence.persistentVolumeClaim.trivy.storageClass` | Specify the `storageClass` used to provision the volume. Or the default StorageClass will be used(the default). Set it to `-` to disable dynamic provisioning | `""` | -| `persistence.persistentVolumeClaim.trivy.accessMode` | The access mode of the volume | `ReadWriteOnce` | +| `persistence.persistentVolumeClaim.chartmuseum.annotations` | Annotations for the PVC | `{}` | +| `persistence.persistentVolumeClaim.chartmuseum.selector` | Selector to match an existing Persistent Volume | `{}` | +| `persistence.persistentVolumeClaim.trivy.storageClass` | PVC Storage Class for Trivy data volume | `""` | +| `persistence.persistentVolumeClaim.trivy.accessModes` | The access mode of the volume | `["ReadWriteOnce"]` | | `persistence.persistentVolumeClaim.trivy.size` | The size of the volume | `5Gi` | -| `persistence.imageChartStorage.caBundleSecretName` | Specify the `caBundleSecretName` if the storage service uses a self-signed certificate. The secret must contain keys named `ca.crt` which will be injected into the trust store of registry's and chartmuseum's containers. | `""` | +| `persistence.persistentVolumeClaim.trivy.annotations` | Annotations for the PVC | `{}` | +| `persistence.persistentVolumeClaim.trivy.selector` | Selector to match an existing Persistent Volume | `{}` | +| `persistence.imageChartStorage.caBundleSecret` | Specify the `caBundleSecret` if the storage service uses a self-signed certificate. The secret must contain keys named `ca.crt` which will be injected into the trust store of registry's and chartmuseum's containers. | `""` | | `persistence.imageChartStorage.disableredirect` | The configuration for managing redirects from content backends. For backends which do not supported it (such as using MinIO® for `s3` storage type), please set it to `true` to disable redirects. Refer to the [guide](https://github.com/docker/distribution/blob/master/docs/configuration.md#redirect) for more information about the detail | `false` | | `persistence.imageChartStorage.type` | The type of storage for images and charts: `filesystem`, `azure`, `gcs`, `s3`, `swift` or `oss`. The type must be `filesystem` if you want to use persistent volumes for registry and chartmuseum. Refer to the [guide](https://github.com/docker/distribution/blob/master/docs/configuration.md#storage) for more information about the detail | `filesystem` | | `persistence.imageChartStorage.filesystem.rootdirectory` | Filesystem storage type setting: Storage root directory | `/storage` | @@ -218,715 +238,941 @@ Additionally, if `persistence.resourcePolicy` is set to `keep`, you should manua | `persistence.imageChartStorage.oss.secretkey` | OSS storage type setting: Secret key | `""` | -### Nginx Parameters +### Volume Permissions parameters -| Name | Description | Value | -| ------------------------------------------ | --------------------------------------------------------------------------------------------------------------------- | ---------------------- | -| `nginxImage.registry` | Registry for Nginx image | `docker.io` | -| `nginxImage.repository` | Repository for Nginx image | `bitnami/nginx` | -| `nginxImage.tag` | Tag for Nginx image | `1.21.5-debian-10-r17` | -| `nginxImage.pullPolicy` | Harbor Portal image pull policy | `IfNotPresent` | -| `nginxImage.pullSecrets` | Specify docker-registry secret names as an array | `[]` | -| `nginxImage.debug` | Specify if debug logs should be enabled | `false` | -| `nginx.command` | Override default container command (useful when using custom images) | `[]` | -| `nginx.args` | Override default container args (useful when using custom images) | `[]` | -| `nginx.replicas` | The replica count | `1` | -| `nginx.updateStrategy.type` | Update strategy - only really applicable for deployments with RWO PVs attached | `RollingUpdate` | -| `nginx.customLivenessProbe` | Override default liveness probe | `{}` | -| `nginx.customReadinessProbe` | Override default readiness probe | `{}` | -| `nginx.extraEnvVars` | Array containing extra env vars | `[]` | -| `nginx.extraEnvVarsCM` | ConfigMap containing extra env vars | `""` | -| `nginx.extraEnvVarsSecret` | Secret containing extra env vars (in case of sensitive data) | `""` | -| `nginx.extraVolumes` | Array of extra volumes to be added to the deployment (evaluated as template). Requires setting `extraVolumeMounts` | `[]` | -| `nginx.extraVolumeMounts` | Array of extra volume mounts to be added to the container (evaluated as template). Normally used with `extraVolumes`. | `[]` | -| `nginx.hostAliases` | Specify hostAliases for the Pod to use | `[]` | -| `nginx.initContainers` | Add additional init containers to the pod (evaluated as a template) | `[]` | -| `nginx.sidecars` | Attach additional containers to the pod (evaluated as a template) | `[]` | -| `nginx.resources.limits` | The resources limits for the container | `{}` | -| `nginx.resources.requests` | The requested resources for the container | `{}` | -| `nginx.podAffinityPreset` | NGINX Pod affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `""` | -| `nginx.podAntiAffinityPreset` | NGINX Pod anti-affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `soft` | -| `nginx.nodeAffinityPreset.type` | NGINX Node affinity preset type. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `""` | -| `nginx.nodeAffinityPreset.key` | NGINX Node label key to match Ignored if `affinity` is set. | `""` | -| `nginx.nodeAffinityPreset.values` | NGINX Node label values to match. Ignored if `affinity` is set. | `[]` | -| `nginx.affinity` | NGINX Affinity for pod assignment | `{}` | -| `nginx.priorityClassName` | NGINX pods Priority Class Name | `""` | -| `nginx.nodeSelector` | NGINX Node labels for pod assignment | `{}` | -| `nginx.tolerations` | NGINX Tolerations for pod assignment | `[]` | -| `nginx.podLabels` | Add additional labels to the pod (evaluated as a template) | `{}` | -| `nginx.podAnnotations` | Annotations to add to the nginx pod | `{}` | -| `nginx.behindReverseProxy` | If nginx is behind another reverse proxy, set to true | `false` | -| `nginx.lifecycleHooks` | LifecycleHook to set additional configuration at startup, e.g. LDAP settings via REST API. Evaluated as a template | `{}` | -| `nginx.livenessProbe.enabled` | Enable livenessProbe | `true` | -| `nginx.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `20` | -| `nginx.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `10` | -| `nginx.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `5` | -| `nginx.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `6` | -| `nginx.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` | -| `nginx.readinessProbe.enabled` | Enable readinessProbe | `true` | -| `nginx.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `20` | -| `nginx.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `10` | -| `nginx.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `5` | -| `nginx.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `6` | -| `nginx.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` | +| Name | Description | Value | +| ------------------------------------------------------ | ------------------------------------------------------------------------------- | ----------------------- | +| `volumePermissions.enabled` | Enable init container that changes the owner and group of the persistent volume | `false` | +| `volumePermissions.image.registry` | Init container volume-permissions image registry | `docker.io` | +| `volumePermissions.image.repository` | Init container volume-permissions image repository | `bitnami/bitnami-shell` | +| `volumePermissions.image.tag` | Init container volume-permissions image tag (immutable tags are recommended) | `10-debian-10-r355` | +| `volumePermissions.image.pullPolicy` | Init container volume-permissions image pull policy | `IfNotPresent` | +| `volumePermissions.image.pullSecrets` | Init container volume-permissions image pull secrets | `[]` | +| `volumePermissions.resources.limits` | Init container volume-permissions resource limits | `{}` | +| `volumePermissions.resources.requests` | Init container volume-permissions resource requests | `{}` | +| `volumePermissions.containerSecurityContext.enabled` | Enable init container Security Context | `true` | +| `volumePermissions.containerSecurityContext.runAsUser` | User ID for the init container | `0` | + + +### NGINX Parameters + +| Name | Description | Value | +| --------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------ | ---------------------- | +| `nginx.image.registry` | NGINX image registry | `docker.io` | +| `nginx.image.repository` | NGINX image repository | `bitnami/nginx` | +| `nginx.image.tag` | NGINX image tag (immutable tags are recommended) | `1.21.6-debian-10-r35` | +| `nginx.image.pullPolicy` | NGINX image pull policy | `IfNotPresent` | +| `nginx.image.pullSecrets` | NGINX image pull secrets | `[]` | +| `nginx.image.debug` | Enable NGINX image debug mode | `false` | +| `nginx.tls.enabled` | Enable TLS termination | `true` | +| `nginx.tls.existingSecret` | Existing secret name containing your own TLS certificates. | `""` | +| `nginx.tls.commonName` | The common name used to generate the self-signed TLS certificates | `core.harbor.domain` | +| `nginx.behindReverseProxy` | If NGINX is behind another reverse proxy, set to true | `false` | +| `nginx.command` | Override default container command (useful when using custom images) | `[]` | +| `nginx.args` | Override default container args (useful when using custom images) | `[]` | +| `nginx.extraEnvVars` | Array with extra environment variables to add NGINX pods | `[]` | +| `nginx.extraEnvVarsCM` | ConfigMap containing extra environment variables for NGINX pods | `""` | +| `nginx.extraEnvVarsSecret` | Secret containing extra environment variables (in case of sensitive data) for NGINX pods | `""` | +| `nginx.containerPorts.http` | NGINX HTTP container port | `8080` | +| `nginx.containerPorts.https` | NGINX HTTPS container port | `8443` | +| `nginx.containerPorts.notary` | NGINX container port where Notary svc is exposed | `4443` | +| `nginx.replicaCount` | Number of NGINX replicas | `1` | +| `nginx.livenessProbe.enabled` | Enable livenessProbe on NGINX containers | `true` | +| `nginx.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `20` | +| `nginx.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `10` | +| `nginx.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `5` | +| `nginx.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `6` | +| `nginx.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` | +| `nginx.readinessProbe.enabled` | Enable readinessProbe on NGINX containers | `true` | +| `nginx.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `20` | +| `nginx.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `10` | +| `nginx.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `5` | +| `nginx.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `6` | +| `nginx.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` | +| `nginx.startupProbe.enabled` | Enable startupProbe on NGINX containers | `false` | +| `nginx.startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `10` | +| `nginx.startupProbe.periodSeconds` | Period seconds for startupProbe | `10` | +| `nginx.startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `1` | +| `nginx.startupProbe.failureThreshold` | Failure threshold for startupProbe | `15` | +| `nginx.startupProbe.successThreshold` | Success threshold for startupProbe | `1` | +| `nginx.customLivenessProbe` | Custom livenessProbe that overrides the default one | `{}` | +| `nginx.customReadinessProbe` | Custom readinessProbe that overrides the default one | `{}` | +| `nginx.customStartupProbe` | Custom startupProbe that overrides the default one | `{}` | +| `nginx.resources.limits` | The resources limits for the NGINX containers | `{}` | +| `nginx.resources.requests` | The requested resources for the NGINX containers | `{}` | +| `nginx.podSecurityContext.enabled` | Enabled NGINX pods' Security Context | `true` | +| `nginx.podSecurityContext.fsGroup` | Set NGINX pod's Security Context fsGroup | `1001` | +| `nginx.containerSecurityContext.enabled` | Enabled NGINX containers' Security Context | `true` | +| `nginx.containerSecurityContext.runAsUser` | Set NGINX containers' Security Context runAsUser | `1001` | +| `nginx.containerSecurityContext.runAsNonRoot` | Set NGINX containers' Security Context runAsNonRoot | `true` | +| `nginx.updateStrategy.type` | NGINX deployment strategy type - only really applicable for deployments with RWO PVs attached | `RollingUpdate` | +| `nginx.updateStrategy.rollingUpdate` | NGINX deployment rolling update configuration parameters | `{}` | +| `nginx.lifecycleHooks` | LifecycleHook for the NGINX container(s) to automate configuration before or after startup | `{}` | +| `nginx.hostAliases` | NGINX pods host aliases | `[]` | +| `nginx.podLabels` | Add additional labels to the NGINX pods (evaluated as a template) | `{}` | +| `nginx.podAnnotations` | Annotations to add to the NGINX pods (evaluated as a template) | `{}` | +| `nginx.podAffinityPreset` | NGINX Pod affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `""` | +| `nginx.podAntiAffinityPreset` | NGINX Pod anti-affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `soft` | +| `nginx.nodeAffinityPreset.type` | NGINX Node affinity preset type. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `""` | +| `nginx.nodeAffinityPreset.key` | NGINX Node label key to match Ignored if `affinity` is set. | `""` | +| `nginx.nodeAffinityPreset.values` | NGINX Node label values to match. Ignored if `affinity` is set. | `[]` | +| `nginx.affinity` | NGINX Affinity for pod assignment | `{}` | +| `nginx.nodeSelector` | NGINX Node labels for pod assignment | `{}` | +| `nginx.tolerations` | NGINX Tolerations for pod assignment | `[]` | +| `nginx.topologySpreadConstraints` | Topology Spread Constraints for pod assignment spread across your cluster among failure-domains. Evaluated as a template | `{}` | +| `nginx.priorityClassName` | Priority Class Name | `""` | +| `nginx.schedulerName` | Use an alternate scheduler, e.g. "stork". | `""` | +| `nginx.sidecars` | Add additional sidecar containers to the NGINX pods | `[]` | +| `nginx.initContainers` | Add additional init containers to the NGINX pods | `[]` | +| `nginx.extraVolumeMounts` | Optionally specify extra list of additional volumeMounts for the NGINX pods | `[]` | +| `nginx.extraVolumes` | Optionally specify extra list of additional volumes for the NGINX pods | `[]` | ### Harbor Portal Parameters -| Name | Description | Value | -| ------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------- | -| `portalImage.registry` | Registry for portal image | `docker.io` | -| `portalImage.repository` | Repository for portal image | `bitnami/harbor-portal` | -| `portalImage.tag` | Tag for portal image | `2.4.1-debian-10-r27` | -| `portalImage.pullPolicy` | Harbor Portal image pull policy | `IfNotPresent` | -| `portalImage.pullSecrets` | Specify docker-registry secret names as an array | `[]` | -| `portalImage.debug` | Specify if debug logs should be enabled | `false` | -| `portal.command` | Override default container command (useful when using custom images) | `[]` | -| `portal.args` | Override default container args (useful when using custom images) | `[]` | -| `portal.replicas` | The replica count | `1` | -| `portal.updateStrategy.type` | Update strategy - only really applicable for deployments with RWO PVs attached | `RollingUpdate` | -| `portal.tls.existingSecret` | Name of a secret with the certificates for internal TLS access. Requires internalTLS.enabled to be set to true. If this values is not set it will be automatically generated | `""` | -| `portal.lifecycleHooks` | LifecycleHook to set additional configuration at startup, e.g. LDAP settings via REST API. Evaluated as a template | `{}` | -| `portal.customLivenessProbe` | Override default liveness probe | `{}` | -| `portal.customReadinessProbe` | Override default readiness probe | `{}` | -| `portal.extraEnvVars` | Array containing extra env vars | `[]` | -| `portal.extraEnvVarsCM` | ConfigMap containing extra env vars | `""` | -| `portal.extraEnvVarsSecret` | Secret containing extra env vars (in case of sensitive data) | `""` | -| `portal.extraVolumes` | Array of extra volumes to be added to the deployment (evaluated as template). Requires setting `extraVolumeMounts` | `[]` | -| `portal.extraVolumeMounts` | Array of extra volume mounts to be added to the container (evaluated as template). Normally used with `extraVolumes`. | `[]` | -| `portal.hostAliases` | Specify hostAliases for the Pod to use | `[]` | -| `portal.initContainers` | Add additional init containers to the pod (evaluated as a template) | `[]` | -| `portal.sidecars` | Attach additional containers to the pod (evaluated as a template) | `[]` | -| `portal.resources.limits` | The resources limits for the container | `{}` | -| `portal.resources.requests` | The requested resources for the container | `{}` | -| `portal.podAffinityPreset` | Harbor Portal Pod affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `""` | -| `portal.podAntiAffinityPreset` | Harbor Portal Pod anti-affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `soft` | -| `portal.nodeAffinityPreset.type` | Harbor Portal Node affinity preset type. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `""` | -| `portal.nodeAffinityPreset.key` | Harbor Portal Node label key to match Ignored if `affinity` is set. | `""` | -| `portal.nodeAffinityPreset.values` | Harbor Portal Node label values to match. Ignored if `affinity` is set. | `[]` | -| `portal.affinity` | Harbor Portal Affinity for pod assignment | `{}` | -| `portal.priorityClassName` | Portal pods Priority Class Name | `""` | -| `portal.nodeSelector` | Harbor Portal Node labels for pod assignment | `{}` | -| `portal.tolerations` | Harbor Portal Tolerations for pod assignment | `[]` | -| `portal.podLabels` | Add additional labels to the pod (evaluated as a template) | `{}` | -| `portal.podAnnotations` | Annotations to add to the portal pod | `{}` | -| `portal.automountServiceAccountToken` | Automount service account token | `false` | -| `portal.livenessProbe.enabled` | Enable livenessProbe | `true` | -| `portal.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `20` | -| `portal.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `10` | -| `portal.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `5` | -| `portal.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `6` | -| `portal.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` | -| `portal.readinessProbe.enabled` | Enable readinessProbe | `true` | -| `portal.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `20` | -| `portal.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `10` | -| `portal.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `5` | -| `portal.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `6` | -| `portal.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` | +| Name | Description | Value | +| ---------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------ | ----------------------- | +| `portal.image.registry` | Harbor Portal image registry | `docker.io` | +| `portal.image.repository` | Harbor Portal image repository | `bitnami/harbor-portal` | +| `portal.image.tag` | Harbor Portal image tag (immutable tags are recommended) | `2.4.1-debian-10-r57` | +| `portal.image.pullPolicy` | Harbor Portal image pull policy | `IfNotPresent` | +| `portal.image.pullSecrets` | Harbor Portal image pull secrets | `[]` | +| `portal.image.debug` | Enable Harbor Portal image debug mode | `false` | +| `portal.tls.existingSecret` | Name of an existing secret with the certificates for internal TLS access | `""` | +| `portal.command` | Override default container command (useful when using custom images) | `[]` | +| `portal.args` | Override default container args (useful when using custom images) | `[]` | +| `portal.extraEnvVars` | Array with extra environment variables to add Harbor Portal pods | `[]` | +| `portal.extraEnvVarsCM` | ConfigMap containing extra environment variables for Harbor Portal pods | `""` | +| `portal.extraEnvVarsSecret` | Secret containing extra environment variables (in case of sensitive data) for Harbor Portal pods | `""` | +| `portal.containerPorts.http` | Harbor Portal HTTP container port | `8080` | +| `portal.containerPorts.https` | Harbor Portal HTTPS container port | `8443` | +| `portal.replicaCount` | Number of Harbor Portal replicas | `1` | +| `portal.livenessProbe.enabled` | Enable livenessProbe on Harbor Portal containers | `true` | +| `portal.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `20` | +| `portal.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `10` | +| `portal.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `5` | +| `portal.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `6` | +| `portal.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` | +| `portal.readinessProbe.enabled` | Enable readinessProbe on Harbor Portal containers | `true` | +| `portal.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `20` | +| `portal.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `10` | +| `portal.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `5` | +| `portal.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `6` | +| `portal.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` | +| `portal.startupProbe.enabled` | Enable startupProbe on Harbor Portal containers | `false` | +| `portal.startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `5` | +| `portal.startupProbe.periodSeconds` | Period seconds for startupProbe | `10` | +| `portal.startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `1` | +| `portal.startupProbe.failureThreshold` | Failure threshold for startupProbe | `15` | +| `portal.startupProbe.successThreshold` | Success threshold for startupProbe | `1` | +| `portal.customLivenessProbe` | Custom livenessProbe that overrides the default one | `{}` | +| `portal.customReadinessProbe` | Custom readinessProbe that overrides the default one | `{}` | +| `portal.customStartupProbe` | Custom startupProbe that overrides the default one | `{}` | +| `portal.resources.limits` | The resources limits for the Harbor Portal containers | `{}` | +| `portal.resources.requests` | The requested resources for the Harbor Portal containers | `{}` | +| `portal.podSecurityContext.enabled` | Enabled Harbor Portal pods' Security Context | `true` | +| `portal.podSecurityContext.fsGroup` | Set Harbor Portal pod's Security Context fsGroup | `1001` | +| `portal.containerSecurityContext.enabled` | Enabled Harbor Portal containers' Security Context | `true` | +| `portal.containerSecurityContext.runAsUser` | Set Harbor Portal containers' Security Context runAsUser | `1001` | +| `portal.containerSecurityContext.runAsNonRoot` | Set Harbor Portal containers' Security Context runAsNonRoot | `true` | +| `portal.updateStrategy.type` | Harbor Portal deployment strategy type - only really applicable for deployments with RWO PVs attached | `RollingUpdate` | +| `portal.updateStrategy.rollingUpdate` | Harbor Portal deployment rolling update configuration parameters | `{}` | +| `portal.lifecycleHooks` | LifecycleHook for the Harbor Portal container(s) to automate configuration before or after startup | `{}` | +| `portal.hostAliases` | Harbor Portal pods host aliases | `[]` | +| `portal.podLabels` | Add additional labels to the Harbor Portal pods (evaluated as a template) | `{}` | +| `portal.podAnnotations` | Annotations to add to the Harbor Portal pods (evaluated as a template) | `{}` | +| `portal.podAffinityPreset` | Harbor Portal Pod affinity preset. Ignored if `portal.affinity` is set. Allowed values: `soft` or `hard` | `""` | +| `portal.podAntiAffinityPreset` | Harbor Portal Pod anti-affinity preset. Ignored if `portal.affinity` is set. Allowed values: `soft` or `hard` | `soft` | +| `portal.nodeAffinityPreset.type` | Harbor Portal Node affinity preset type. Ignored if `portal.affinity` is set. Allowed values: `soft` or `hard` | `""` | +| `portal.nodeAffinityPreset.key` | Harbor Portal Node label key to match Ignored if `portal.affinity` is set. | `""` | +| `portal.nodeAffinityPreset.values` | Harbor Portal Node label values to match. Ignored if `portal.affinity` is set. | `[]` | +| `portal.affinity` | Harbor Portal Affinity for pod assignment | `{}` | +| `portal.nodeSelector` | Harbor Portal Node labels for pod assignment | `{}` | +| `portal.tolerations` | Harbor Portal Tolerations for pod assignment | `[]` | +| `portal.topologySpreadConstraints` | Topology Spread Constraints for pod assignment spread across your cluster among failure-domains. Evaluated as a template | `{}` | +| `portal.priorityClassName` | Priority Class Name | `""` | +| `portal.schedulerName` | Use an alternate scheduler, e.g. "stork". | `""` | +| `portal.sidecars` | Add additional sidecar containers to the Harbor Portal pods | `[]` | +| `portal.initContainers` | Add additional init containers to the Harbor Portal pods | `[]` | +| `portal.extraVolumeMounts` | Optionally specify extra list of additional volumeMounts for the Harbor Portal pods | `[]` | +| `portal.extraVolumes` | Optionally specify extra list of additional volumes for the Harbor Portal pods | `[]` | +| `portal.automountServiceAccountToken` | Automount service account token | `false` | +| `portal.service.ports.http` | Harbor Portal HTTP service port | `80` | +| `portal.service.ports.https` | Harbor Portal HTTPS service port | `443` | ### Harbor Core Parameters -| Name | Description | Value | -| ----------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------- | -| `coreImage.registry` | Registry for core image | `docker.io` | -| `coreImage.repository` | Repository for Harbor core image | `bitnami/harbor-core` | -| `coreImage.tag` | Tag for Harbor core image | `2.4.1-debian-10-r24` | -| `coreImage.pullPolicy` | Harbor Core image pull policy | `IfNotPresent` | -| `coreImage.pullSecrets` | Specify docker-registry secret names as an array | `[]` | -| `coreImage.debug` | Specify if debug logs should be enabled | `false` | -| `core.command` | Override default container command (useful when using custom images) | `[]` | -| `core.args` | Override default container args (useful when using custom images) | `[]` | -| `core.uaaSecretName` | If using external UAA auth which has a self signed cert, you can provide a pre-created secret containing it under the key `ca.crt`. | `""` | -| `core.secretKey` | The key used for encryption. Must be a string of 16 chars | `""` | -| `core.updateStrategy.type` | Update strategy - only really applicable for deployments with RWO PVs attached | `RollingUpdate` | -| `core.replicas` | The replica count | `1` | -| `core.tls.existingSecret` | Name of a secret with the certificates for internal TLS access. Requires internalTLS.enabled to be set to true. If this values is not set it will be automatically generated | `""` | -| `core.customLivenessProbe` | Override default liveness probe | `{}` | -| `core.customReadinessProbe` | Override default readiness probe | `{}` | -| `core.customStartupProbe` | Override default Startup Probe probe | `{}` | -| `core.extraEnvVars` | Array containing extra env vars | `[]` | -| `core.extraEnvVarsCM` | ConfigMap containing extra env vars | `""` | -| `core.extraEnvVarsSecret` | Secret containing extra env vars (in case of sensitive data) | `""` | -| `core.extraVolumes` | Array of extra volumes to be added to the deployment (evaluated as template). Requires setting `extraVolumeMounts` | `[]` | -| `core.extraVolumeMounts` | Array of extra volume mounts to be added to the container (evaluated as template). Normally used with `extraVolumes`. | `[]` | -| `core.hostAliases` | Specify hostAliases for the Pod to use | `[]` | -| `core.initContainers` | Add additional init containers to the pod (evaluated as a template) | `[]` | -| `core.sidecars` | Attach additional containers to the pod (evaluated as a template) | `[]` | -| `core.resources.limits` | The resources limits for the container | `{}` | -| `core.resources.requests` | The requested resources for the container | `{}` | -| `core.podAffinityPreset` | Harbor core Pod affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `""` | -| `core.podAntiAffinityPreset` | Harbor core Pod anti-affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `soft` | -| `core.nodeAffinityPreset.type` | Harbor core Node affinity preset type. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `""` | -| `core.nodeAffinityPreset.key` | Harbor core Node label key to match Ignored if `affinity` is set. | `""` | -| `core.nodeAffinityPreset.values` | Harbor core Node label values to match. Ignored if `affinity` is set. | `[]` | -| `core.affinity` | Harbor core Affinity for pod assignment | `{}` | -| `core.priorityClassName` | Core pods Priority Class Name | `""` | -| `core.nodeSelector` | Harbor core Node labels for pod assignment | `{}` | -| `core.tolerations` | Harbor core Tolerations for pod assignment | `[]` | -| `core.podLabels` | Add additional labels to the pod (evaluated as a template) | `{}` | -| `core.podAnnotations` | Annotations to add to the core pod | `{}` | -| `core.secret` | Secret used when the core server communicates with other components. If a secret key is not specified, Helm will generate one. Must be a string of 16 chars. | `""` | -| `core.secretName` | Fill the name of a kubernetes secret if you want to use your own TLS certificate and private key for token encryption/decryption. The secret must contain two keys named: `tls.crt` - the certificate and `tls.key` - the private key. The default key pair will be used if it isn't set | `""` | -| `core.csrfKey` | The CSRF key. Will be generated automatically if it isn't specified | `""` | -| `core.lifecycleHooks` | LifecycleHook to set additional configuration at startup, e.g. LDAP settings via REST API. Evaluated as a template | `{}` | -| `core.automountServiceAccountToken` | Automount service account token | `false` | -| `core.livenessProbe.enabled` | Enable livenessProbe | `true` | -| `core.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `20` | -| `core.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `10` | -| `core.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `5` | -| `core.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `6` | -| `core.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` | -| `core.readinessProbe.enabled` | Enable readinessProbe | `true` | -| `core.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `20` | -| `core.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `10` | -| `core.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `5` | -| `core.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `6` | -| `core.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` | -| `core.startupProbe.enabled` | Enable startupProbe | `true` | -| `core.startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `10` | -| `core.startupProbe.periodSeconds` | Period seconds for startupProbe | `10` | -| `core.startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `5` | -| `core.startupProbe.failureThreshold` | Failure threshold for startupProbe | `30` | -| `core.startupProbe.successThreshold` | Success threshold for startupProbe | `1` | +| Name | Description | Value | +| -------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------- | +| `core.image.registry` | Harbor Core image registry | `docker.io` | +| `core.image.repository` | Harbor Core image repository | `bitnami/harbor-core` | +| `core.image.tag` | Harbor Core image tag (immutable tags are recommended) | `2.4.1-debian-10-r70` | +| `core.image.pullPolicy` | Harbor Core image pull policy | `IfNotPresent` | +| `core.image.pullSecrets` | Harbor Core image pull secrets | `[]` | +| `core.image.debug` | Enable Harbor Core image debug mode | `false` | +| `core.uaaSecret` | If using external UAA auth which has a self signed cert, you can provide a pre-created secret containing it under the key `ca.crt`. | `""` | +| `core.secretKey` | The key used for encryption. Must be a string of 16 chars | `""` | +| `core.secret` | Secret used when the core server communicates with other components. If a secret key is not specified, Helm will generate one. Must be a string of 16 chars. | `""` | +| `core.secretName` | Fill the name of a kubernetes secret if you want to use your own TLS certificate and private key for token encryption/decryption. The secret must contain two keys named: `tls.crt` - the certificate and `tls.key` - the private key. The default key pair will be used if it isn't set | `""` | +| `core.csrfKey` | The CSRF key. Will be generated automatically if it isn't specified | `""` | +| `core.tls.existingSecret` | Name of an existing secret with the certificates for internal TLS access | `""` | +| `core.command` | Override default container command (useful when using custom images) | `[]` | +| `core.args` | Override default container args (useful when using custom images) | `[]` | +| `core.extraEnvVars` | Array with extra environment variables to add Harbor Core pods | `[]` | +| `core.extraEnvVarsCM` | ConfigMap containing extra environment variables for Harbor Core pods | `""` | +| `core.extraEnvVarsSecret` | Secret containing extra environment variables (in case of sensitive data) for Harbor Core pods | `""` | +| `core.containerPorts.http` | Harbor Core HTTP container port | `8080` | +| `core.containerPorts.https` | Harbor Core HTTPS container port | `8443` | +| `core.replicaCount` | Number of Harbor Core replicas | `1` | +| `core.livenessProbe.enabled` | Enable livenessProbe on Harbor Core containers | `true` | +| `core.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `20` | +| `core.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `10` | +| `core.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `5` | +| `core.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `6` | +| `core.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` | +| `core.readinessProbe.enabled` | Enable readinessProbe on Harbor Core containers | `true` | +| `core.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `20` | +| `core.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `10` | +| `core.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `5` | +| `core.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `6` | +| `core.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` | +| `core.startupProbe.enabled` | Enable startupProbe on Harbor Core containers | `false` | +| `core.startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `5` | +| `core.startupProbe.periodSeconds` | Period seconds for startupProbe | `10` | +| `core.startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `1` | +| `core.startupProbe.failureThreshold` | Failure threshold for startupProbe | `15` | +| `core.startupProbe.successThreshold` | Success threshold for startupProbe | `1` | +| `core.customLivenessProbe` | Custom livenessProbe that overrides the default one | `{}` | +| `core.customReadinessProbe` | Custom readinessProbe that overrides the default one | `{}` | +| `core.customStartupProbe` | Custom startupProbe that overrides the default one | `{}` | +| `core.resources.limits` | The resources limits for the Harbor Core containers | `{}` | +| `core.resources.requests` | The requested resources for the Harbor Core containers | `{}` | +| `core.podSecurityContext.enabled` | Enabled Harbor Core pods' Security Context | `true` | +| `core.podSecurityContext.fsGroup` | Set Harbor Core pod's Security Context fsGroup | `1001` | +| `core.containerSecurityContext.enabled` | Enabled Harbor Core containers' Security Context | `true` | +| `core.containerSecurityContext.runAsUser` | Set Harbor Core containers' Security Context runAsUser | `1001` | +| `core.containerSecurityContext.runAsNonRoot` | Set Harbor Core containers' Security Context runAsNonRoot | `true` | +| `core.updateStrategy.type` | Harbor Core deployment strategy type - only really applicable for deployments with RWO PVs attached | `RollingUpdate` | +| `core.updateStrategy.rollingUpdate` | Harbor Core deployment rolling update configuration parameters | `{}` | +| `core.lifecycleHooks` | LifecycleHook for the Harbor Core container(s) to automate configuration before or after startup | `{}` | +| `core.hostAliases` | Harbor Core pods host aliases | `[]` | +| `core.podLabels` | Add additional labels to the Harbor Core pods (evaluated as a template) | `{}` | +| `core.podAnnotations` | Annotations to add to the Harbor Core pods (evaluated as a template) | `{}` | +| `core.podAffinityPreset` | Harbor Core Pod affinity preset. Ignored if `core.affinity` is set. Allowed values: `soft` or `hard` | `""` | +| `core.podAntiAffinityPreset` | Harbor Core Pod anti-affinity preset. Ignored if `core.affinity` is set. Allowed values: `soft` or `hard` | `soft` | +| `core.nodeAffinityPreset.type` | Harbor Core Node affinity preset type. Ignored if `core.affinity` is set. Allowed values: `soft` or `hard` | `""` | +| `core.nodeAffinityPreset.key` | Harbor Core Node label key to match Ignored if `core.affinity` is set. | `""` | +| `core.nodeAffinityPreset.values` | Harbor Core Node label values to match. Ignored if `core.affinity` is set. | `[]` | +| `core.affinity` | Harbor Core Affinity for pod assignment | `{}` | +| `core.nodeSelector` | Harbor Core Node labels for pod assignment | `{}` | +| `core.tolerations` | Harbor Core Tolerations for pod assignment | `[]` | +| `core.topologySpreadConstraints` | Topology Spread Constraints for pod assignment spread across your cluster among failure-domains. Evaluated as a template | `{}` | +| `core.priorityClassName` | Priority Class Name | `""` | +| `core.schedulerName` | Use an alternate scheduler, e.g. "stork". | `""` | +| `core.sidecars` | Add additional sidecar containers to the Harbor Core pods | `[]` | +| `core.initContainers` | Add additional init containers to the Harbor Core pods | `[]` | +| `core.extraVolumeMounts` | Optionally specify extra list of additional volumeMounts for the Harbor Core pods | `[]` | +| `core.extraVolumes` | Optionally specify extra list of additional volumes for the Harbor Core pods | `[]` | +| `core.automountServiceAccountToken` | Automount service account token | `false` | +| `core.service.ports.http` | Harbor Core HTTP service port | `80` | +| `core.service.ports.https` | Harbor Core HTTPS service port | `443` | ### Harbor Jobservice Parameters -| Name | Description | Value | -| ----------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------- | -| `jobserviceImage.registry` | Registry for jobservice image | `docker.io` | -| `jobserviceImage.repository` | Repository for jobservice image | `bitnami/harbor-jobservice` | -| `jobserviceImage.tag` | Tag for jobservice image | `2.4.1-debian-10-r24` | -| `jobserviceImage.pullPolicy` | Harbor Jobservice image pull policy | `IfNotPresent` | -| `jobserviceImage.pullSecrets` | Specify docker-registry secret names as an array | `[]` | -| `jobserviceImage.debug` | Specify if debug logs should be enabled | `false` | -| `jobservice.command` | Override default container command (useful when using custom images) | `[]` | -| `jobservice.args` | Override default container args (useful when using custom images) | `[]` | -| `jobservice.replicas` | The replica count | `1` | -| `jobservice.updateStrategy.type` | The update strategy for deployments with persistent volumes: RollingUpdate or Recreate. Set it as Recreate when RWM for volumes isn't supported | `RollingUpdate` | -| `jobservice.maxJobWorkers` | The max job workers | `10` | -| `jobservice.jobLogger` | The logger for jobs: `file`, `database` or `stdout` | `file` | -| `jobservice.tls.existingSecret` | Name of a secret with the certificates for internal TLS access. Requires internalTLS.enabled to be set to true. If this values is not set it will be automatically generated | `""` | -| `jobservice.lifecycleHooks` | LifecycleHook to set additional configuration at startup, e.g. LDAP settings via REST API. Evaluated as a template | `{}` | -| `jobservice.customLivenessProbe` | Override default liveness probe | `{}` | -| `jobservice.customReadinessProbe` | Override default readiness probe | `{}` | -| `jobservice.extraEnvVars` | Array containing extra env vars | `[]` | -| `jobservice.extraEnvVarsCM` | ConfigMap containing extra env vars | `""` | -| `jobservice.extraEnvVarsSecret` | Secret containing extra env vars (in case of sensitive data) | `""` | -| `jobservice.extraVolumes` | Array of extra volumes to be added to the deployment (evaluated as template). Requires setting `extraVolumeMounts` | `[]` | -| `jobservice.extraVolumeMounts` | Array of extra volume mounts to be added to the container (evaluated as template). Normally used with `extraVolumes`. | `[]` | -| `jobservice.hostAliases` | Specify hostAliases for the Pod to use | `[]` | -| `jobservice.initContainers` | Add additional init containers to the pod (evaluated as a template) | `[]` | -| `jobservice.sidecars` | Attach additional containers to the pod (evaluated as a template) | `[]` | -| `jobservice.resources.limits` | The resources limits for the container | `{}` | -| `jobservice.resources.requests` | The requested resources for the container | `{}` | -| `jobservice.podAffinityPreset` | Harbor Jobservice Pod affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `""` | -| `jobservice.podAntiAffinityPreset` | Harbor Jobservice Pod anti-affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `soft` | -| `jobservice.nodeAffinityPreset.type` | Harbor Jobservice Node affinity preset type. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `""` | -| `jobservice.nodeAffinityPreset.key` | Harbor Jobservice Node label key to match Ignored if `affinity` is set. | `""` | -| `jobservice.nodeAffinityPreset.values` | Harbor Jobservice Node label values to match. Ignored if `affinity` is set. | `[]` | -| `jobservice.affinity` | Harbor Jobservice Affinity for pod assignment | `{}` | -| `jobservice.priorityClassName` | Jobservice pods Priority Class Name | `""` | -| `jobservice.nodeSelector` | Harbor Jobservice Node labels for pod assignment | `{}` | -| `jobservice.tolerations` | Harbor Jobservice Tolerations for pod assignment | `[]` | -| `jobservice.podLabels` | Add additional labels to the pod (evaluated as a template) | `{}` | -| `jobservice.podAnnotations` | Annotations to add to the jobservice pod | `{}` | -| `jobservice.secret` | Secret used when the job service communicates with other components. If a secret key is not specified, Helm will generate one. Must be a string of 16 chars. | `""` | -| `jobservice.automountServiceAccountToken` | Automount service account token | `false` | -| `jobservice.livenessProbe.enabled` | Enable livenessProbe | `true` | -| `jobservice.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `20` | -| `jobservice.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `10` | -| `jobservice.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `5` | -| `jobservice.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `6` | -| `jobservice.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` | -| `jobservice.readinessProbe.enabled` | Enable readinessProbe | `true` | -| `jobservice.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `20` | -| `jobservice.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `10` | -| `jobservice.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `5` | -| `jobservice.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `6` | -| `jobservice.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` | +| Name | Description | Value | +| -------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------ | --------------------------- | +| `jobservice.image.registry` | Harbor Jobservice image registry | `docker.io` | +| `jobservice.image.repository` | Harbor Jobservice image repository | `bitnami/harbor-jobservice` | +| `jobservice.image.tag` | Harbor Jobservice image tag (immutable tags are recommended) | `2.4.1-debian-10-r72` | +| `jobservice.image.pullPolicy` | Harbor Jobservice image pull policy | `IfNotPresent` | +| `jobservice.image.pullSecrets` | Harbor Jobservice image pull secrets | `[]` | +| `jobservice.image.debug` | Enable Harbor Jobservice image debug mode | `false` | +| `jobservice.maxJobWorkers` | The max job workers | `10` | +| `jobservice.jobLogger` | The logger for jobs: `file`, `database` or `stdout` | `file` | +| `jobservice.secret` | Secret used when the job service communicates with other components. If a secret key is not specified, Helm will generate one. Must be a string of 16 chars. | `""` | +| `jobservice.tls.existingSecret` | Name of an existing secret with the certificates for internal TLS access | `""` | +| `jobservice.command` | Override default container command (useful when using custom images) | `[]` | +| `jobservice.args` | Override default container args (useful when using custom images) | `[]` | +| `jobservice.extraEnvVars` | Array with extra environment variables to add Harbor Jobservice pods | `[]` | +| `jobservice.extraEnvVarsCM` | ConfigMap containing extra environment variables for Harbor Jobservice pods | `""` | +| `jobservice.extraEnvVarsSecret` | Secret containing extra environment variables (in case of sensitive data) for Harbor Jobservice pods | `""` | +| `jobservice.containerPorts.http` | Harbor Jobservice HTTP container port | `8080` | +| `jobservice.containerPorts.https` | Harbor Jobservice HTTPS container port | `8443` | +| `jobservice.replicaCount` | Number of Harbor Jobservice replicas | `1` | +| `jobservice.livenessProbe.enabled` | Enable livenessProbe on Harbor Jobservice containers | `true` | +| `jobservice.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `20` | +| `jobservice.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `10` | +| `jobservice.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `5` | +| `jobservice.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `6` | +| `jobservice.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` | +| `jobservice.readinessProbe.enabled` | Enable readinessProbe on Harbor Jobservice containers | `true` | +| `jobservice.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `20` | +| `jobservice.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `10` | +| `jobservice.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `5` | +| `jobservice.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `6` | +| `jobservice.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` | +| `jobservice.startupProbe.enabled` | Enable startupProbe on Harbor Jobservice containers | `false` | +| `jobservice.startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `5` | +| `jobservice.startupProbe.periodSeconds` | Period seconds for startupProbe | `10` | +| `jobservice.startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `1` | +| `jobservice.startupProbe.failureThreshold` | Failure threshold for startupProbe | `15` | +| `jobservice.startupProbe.successThreshold` | Success threshold for startupProbe | `1` | +| `jobservice.customLivenessProbe` | Custom livenessProbe that overrides the default one | `{}` | +| `jobservice.customReadinessProbe` | Custom readinessProbe that overrides the default one | `{}` | +| `jobservice.customStartupProbe` | Custom startupProbe that overrides the default one | `{}` | +| `jobservice.resources.limits` | The resources limits for the Harbor Jobservice containers | `{}` | +| `jobservice.resources.requests` | The requested resources for the Harbor Jobservice containers | `{}` | +| `jobservice.podSecurityContext.enabled` | Enabled Harbor Jobservice pods' Security Context | `true` | +| `jobservice.podSecurityContext.fsGroup` | Set Harbor Jobservice pod's Security Context fsGroup | `1001` | +| `jobservice.containerSecurityContext.enabled` | Enabled Harbor Jobservice containers' Security Context | `true` | +| `jobservice.containerSecurityContext.runAsUser` | Set Harbor Jobservice containers' Security Context runAsUser | `1001` | +| `jobservice.containerSecurityContext.runAsNonRoot` | Set Harbor Jobservice containers' Security Context runAsNonRoot | `true` | +| `jobservice.updateStrategy.type` | Harbor Jobservice deployment strategy type - only really applicable for deployments with RWO PVs attached | `RollingUpdate` | +| `jobservice.updateStrategy.rollingUpdate` | Harbor Jobservice deployment rolling update configuration parameters | `{}` | +| `jobservice.lifecycleHooks` | LifecycleHook for the Harbor Jobservice container(s) to automate configuration before or after startup | `{}` | +| `jobservice.hostAliases` | Harbor Jobservice pods host aliases | `[]` | +| `jobservice.podLabels` | Add additional labels to the Harbor Jobservice pods (evaluated as a template) | `{}` | +| `jobservice.podAnnotations` | Annotations to add to the Harbor Jobservice pods (evaluated as a template) | `{}` | +| `jobservice.podAffinityPreset` | Harbor Jobservice Pod affinity preset. Ignored if `jobservice.affinity` is set. Allowed values: `soft` or `hard` | `""` | +| `jobservice.podAntiAffinityPreset` | Harbor Jobservice Pod anti-affinity preset. Ignored if `jobservice.affinity` is set. Allowed values: `soft` or `hard` | `soft` | +| `jobservice.nodeAffinityPreset.type` | Harbor Jobservice Node affinity preset type. Ignored if `jobservice.affinity` is set. Allowed values: `soft` or `hard` | `""` | +| `jobservice.nodeAffinityPreset.key` | Harbor Jobservice Node label key to match Ignored if `jobservice.affinity` is set. | `""` | +| `jobservice.nodeAffinityPreset.values` | Harbor Jobservice Node label values to match. Ignored if `jobservice.affinity` is set. | `[]` | +| `jobservice.affinity` | Harbor Jobservice Affinity for pod assignment | `{}` | +| `jobservice.nodeSelector` | Harbor Jobservice Node labels for pod assignment | `{}` | +| `jobservice.tolerations` | Harbor Jobservice Tolerations for pod assignment | `[]` | +| `jobservice.topologySpreadConstraints` | Topology Spread Constraints for pod assignment spread across your cluster among failure-domains. Evaluated as a template | `{}` | +| `jobservice.priorityClassName` | Priority Class Name | `""` | +| `jobservice.schedulerName` | Use an alternate scheduler, e.g. "stork". | `""` | +| `jobservice.sidecars` | Add additional sidecar containers to the Harbor Jobservice pods | `[]` | +| `jobservice.initContainers` | Add additional init containers to the Harbor Jobservice pods | `[]` | +| `jobservice.extraVolumeMounts` | Optionally specify extra list of additional volumeMounts for the Harbor Jobservice pods | `[]` | +| `jobservice.extraVolumes` | Optionally specify extra list of additional volumes for the Harbor Jobservice pods | `[]` | +| `jobservice.automountServiceAccountToken` | Automount service account token | `false` | +| `jobservice.service.ports.http` | Harbor Jobservice HTTP service port | `80` | +| `jobservice.service.ports.https` | Harbor Jobservice HTTPS service port | `443` | ### Harbor Registry Parameters -| Name | Description | Value | -| -------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------- | -| `registryImage.registry` | Registry for registry image | `docker.io` | -| `registryImage.repository` | Repository for registry image | `bitnami/harbor-registry` | -| `registryImage.tag` | Tag for registry image | `2.4.1-debian-10-r29` | -| `registryImage.pullPolicy` | Harbor Registry image pull policy | `IfNotPresent` | -| `registryImage.pullSecrets` | Specify docker-registry secret names as an array | `[]` | -| `registryImage.debug` | Specify if debug logs should be enabled | `false` | -| `registryctlImage.registry` | Registry for registryctl image | `docker.io` | -| `registryctlImage.repository` | Repository for registryctl controller image | `bitnami/harbor-registryctl` | -| `registryctlImage.tag` | Tag for registrycrtl controller image | `2.4.1-debian-10-r29` | -| `registryctlImage.pullPolicy` | Harbor Registryctl image pull policy | `IfNotPresent` | -| `registryctlImage.pullSecrets` | Specify docker-registry secret names as an array | `[]` | -| `registryctlImage.debug` | Specify if debug logs should be enabled | `false` | -| `registry.replicas` | The replica count | `1` | -| `registry.updateStrategy.type` | The update strategy for deployments with persistent volumes: RollingUpdate or Recreate. Set it as Recreate when RWM for volumes isn't supported | `RollingUpdate` | -| `registry.tls.existingSecret` | Name of a secret with the certificates for internal TLS access. Requires internalTLS.enabled to be set to true. If this values is not set it will be automatically generated | `""` | -| `registry.server.command` | Override default container command (useful when using custom images) | `[]` | -| `registry.server.args` | Override default container args (useful when using custom images) | `[]` | -| `registry.server.extraEnvVars` | Array containing extra env vars | `[]` | -| `registry.server.extraEnvVarsCM` | ConfigMap containing extra env vars | `""` | -| `registry.server.extraEnvVarsSecret` | Secret containing extra env vars (in case of sensitive data) | `""` | -| `registry.server.extraVolumeMounts` | Array of extra volume mounts to be added to the container (evaluated as template). Normally used with `extraVolumes`. | `[]` | -| `registry.server.lifecycleHooks` | LifecycleHook to set additional configuration at startup, e.g. LDAP settings via REST API. Evaluated as a template | `{}` | -| `registry.server.resources.limits` | The resources limits for the container | `{}` | -| `registry.server.resources.requests` | The requested resources for the container | `{}` | -| `registry.server.livenessProbe.enabled` | Enable livenessProbe | `true` | -| `registry.server.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `10` | -| `registry.server.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `10` | -| `registry.server.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `5` | -| `registry.server.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `6` | -| `registry.server.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` | -| `registry.server.readinessProbe.enabled` | Enable readinessProbe | `true` | -| `registry.server.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `10` | -| `registry.server.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `10` | -| `registry.server.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `5` | -| `registry.server.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `6` | -| `registry.server.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` | -| `registry.server.customLivenessProbe` | Override default liveness probe | `{}` | -| `registry.server.customReadinessProbe` | Override default readiness probe | `{}` | -| `registry.controller.command` | Override default container command (useful when using custom images) | `[]` | -| `registry.controller.args` | Override default container args (useful when using custom images) | `[]` | -| `registry.controller.extraEnvVars` | Array containing extra env vars | `[]` | -| `registry.controller.extraEnvVarsCM` | ConfigMap containing extra env vars | `""` | -| `registry.controller.extraEnvVarsSecret` | Secret containing extra env vars (in case of sensitive data) | `""` | -| `registry.controller.extraVolumeMounts` | Array of extra volume mounts to be added to the container (evaluated as template). Normally used with `extraVolumes`. | `[]` | -| `registry.controller.lifecycleHooks` | LifecycleHook to set additional configuration at startup, e.g. LDAP settings via REST API. Evaluated as a template | `{}` | -| `registry.controller.resources.limits` | The resources limits for the container | `{}` | -| `registry.controller.resources.requests` | The requested resources for the container | `{}` | -| `registry.controller.livenessProbe.enabled` | Enable livenessProbe | `true` | -| `registry.controller.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `10` | -| `registry.controller.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `10` | -| `registry.controller.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `5` | -| `registry.controller.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `6` | -| `registry.controller.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` | -| `registry.controller.readinessProbe.enabled` | Enable readinessProbe | `true` | -| `registry.controller.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `10` | -| `registry.controller.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `10` | -| `registry.controller.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `5` | -| `registry.controller.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `6` | -| `registry.controller.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` | -| `registry.controller.customLivenessProbe` | Override default liveness probe | `{}` | -| `registry.controller.customReadinessProbe` | Override default readiness probe | `{}` | -| `registry.extraVolumes` | Array of extra volumes to be added to the deployment (evaluated as template). Requires setting `extraVolumeMounts` | `[]` | -| `registry.hostAliases` | Specify hostAliases for the Pod to use | `[]` | -| `registry.initContainers` | Add additional init containers to the pod (evaluated as a template) | `[]` | -| `registry.sidecars` | Attach additional containers to the pod (evaluated as a template) | `[]` | -| `registry.podAffinityPreset` | Harbor Registry Pod affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `""` | -| `registry.podAntiAffinityPreset` | Harbor Registry Pod anti-affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `soft` | -| `registry.nodeAffinityPreset.type` | Harbor Registry Node affinity preset type. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `""` | -| `registry.nodeAffinityPreset.key` | Harbor Registry Node label key to match Ignored if `affinity` is set. | `""` | -| `registry.nodeAffinityPreset.values` | Harbor Registry Node label values to match. Ignored if `affinity` is set. | `[]` | -| `registry.affinity` | Harbor Registry Affinity for pod assignment | `{}` | -| `registry.priorityClassName` | Registry pods Priority Class Name | `""` | -| `registry.nodeSelector` | Harbor Registry Node labels for pod assignment | `{}` | -| `registry.tolerations` | Harbor Registry Tolerations for pod assignment | `[]` | -| `registry.podLabels` | Add additional labels to the pod (evaluated as a template) | `{}` | -| `registry.podAnnotations` | Annotations to add to the registry pod | `{}` | -| `registry.automountServiceAccountToken` | Automount service account token | `false` | -| `registry.secret` | Secret is used to secure the upload state from client and registry storage backend. See: https://github.com/docker/distribution/blob/master/docs/configuration.md | `""` | -| `registry.relativeurls` | Make the registry return relative URLs in Location headers. The client is responsible for resolving the correct URL. | `false` | -| `registry.credentials.username` | The username for accessing the registry instance, which is hosted by htpasswd auth mode. More details see [official docs](https://github.com/docker/distribution/blob/master/docs/configuration.md#htpasswd) | `harbor_registry_user` | -| `registry.credentials.password` | The password for accessing the registry instance, which is hosted by htpasswd auth mode. More details see [official docs](https://github.com/docker/distribution/blob/master/docs/configuration.md#htpasswd). It is suggested you update this value before installation. | `harbor_registry_password` | -| `registry.credentials.htpasswd` | The content of htpasswd file based on the value of `registry.credentials.username` `registry.credentials.password`. Currently `helm` does not support bcrypt in the template script, if the credential is updated you need to manually generated by calling | `harbor_registry_user:$2y$10$9L4Tc0DJbFFMB6RdSCunrOpTHdwhid4ktBJmLD00bYgqkkGOvll3m` | -| `registry.middleware.enabled` | Middleware is used to add support for a CDN between backend storage and `docker pull` recipient. See | `false` | -| `registry.middleware.type` | CDN type for the middleware | `cloudFront` | -| `registry.middleware.cloudFront.baseurl` | CloudFront CDN settings: Base URL | `example.cloudfront.net` | -| `registry.middleware.cloudFront.keypairid` | CloudFront CDN settings: Keypair ID | `KEYPAIRID` | -| `registry.middleware.cloudFront.duration` | CloudFront CDN settings: Duration | `3000s` | -| `registry.middleware.cloudFront.ipfilteredby` | CloudFront CDN settings: IP filters | `none` | -| `registry.middleware.cloudFront.privateKeySecret` | CloudFront CDN settings: Secret name with the private key | `my-secret` | +| Name | Description | Value | +| ----------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------- | +| `registry.secret` | Secret is used to secure the upload state from client and registry storage backend. See: https://github.com/docker/distribution/blob/master/docs/configuration.md | `""` | +| `registry.relativeurls` | Make the registry return relative URLs in Location headers. The client is responsible for resolving the correct URL. | `false` | +| `registry.credentials.username` | The username for accessing the registry instance, which is hosted by htpasswd auth mode. More details see [official docs](https://github.com/docker/distribution/blob/master/docs/configuration.md#htpasswd) | `harbor_registry_user` | +| `registry.credentials.password` | The password for accessing the registry instance, which is hosted by htpasswd auth mode. More details see [official docs](https://github.com/docker/distribution/blob/master/docs/configuration.md#htpasswd). It is suggested you update this value before installation. | `harbor_registry_password` | +| `registry.credentials.htpasswd` | The content of htpasswd file based on the value of `registry.credentials.username` `registry.credentials.password`. Currently `helm` does not support bcrypt in the template script, if the credential is updated you need to manually generated by calling | `harbor_registry_user:$2y$10$9L4Tc0DJbFFMB6RdSCunrOpTHdwhid4ktBJmLD00bYgqkkGOvll3m` | +| `registry.middleware.enabled` | Middleware is used to add support for a CDN between backend storage and `docker pull` recipient. See | `false` | +| `registry.middleware.type` | CDN type for the middleware | `cloudFront` | +| `registry.middleware.cloudFront.baseurl` | CloudFront CDN settings: Base URL | `example.cloudfront.net` | +| `registry.middleware.cloudFront.keypairid` | CloudFront CDN settings: Keypair ID | `KEYPAIRID` | +| `registry.middleware.cloudFront.duration` | CloudFront CDN settings: Duration | `3000s` | +| `registry.middleware.cloudFront.ipfilteredby` | CloudFront CDN settings: IP filters | `none` | +| `registry.middleware.cloudFront.privateKeySecret` | CloudFront CDN settings: Secret name with the private key | `my-secret` | +| `registry.tls.existingSecret` | Name of an existing secret with the certificates for internal TLS access | `""` | +| `registry.replicaCount` | Number of Harbor Registry replicas | `1` | +| `registry.podSecurityContext.enabled` | Enabled Harbor Registry pods' Security Context | `true` | +| `registry.podSecurityContext.fsGroup` | Set Harbor Registry pod's Security Context fsGroup | `1001` | +| `registry.updateStrategy.type` | Harbor Registry deployment strategy type - only really applicable for deployments with RWO PVs attached | `RollingUpdate` | +| `registry.updateStrategy.rollingUpdate` | Harbor Registry deployment rolling update configuration parameters | `{}` | +| `registry.hostAliases` | Harbor Registry pods host aliases | `[]` | +| `registry.podLabels` | Add additional labels to the Harbor Registry pods (evaluated as a template) | `{}` | +| `registry.podAnnotations` | Annotations to add to the Harbor Registry pods (evaluated as a template) | `{}` | +| `registry.podAffinityPreset` | Harbor Registry Pod affinity preset. Ignored if `registry.affinity` is set. Allowed values: `soft` or `hard` | `""` | +| `registry.podAntiAffinityPreset` | Harbor Registry Pod anti-affinity preset. Ignored if `registry.affinity` is set. Allowed values: `soft` or `hard` | `soft` | +| `registry.nodeAffinityPreset.type` | Harbor Registry Node affinity preset type. Ignored if `registry.affinity` is set. Allowed values: `soft` or `hard` | `""` | +| `registry.nodeAffinityPreset.key` | Harbor Registry Node label key to match Ignored if `registry.affinity` is set. | `""` | +| `registry.nodeAffinityPreset.values` | Harbor Registry Node label values to match. Ignored if `registry.affinity` is set. | `[]` | +| `registry.affinity` | Harbor Registry Affinity for pod assignment | `{}` | +| `registry.nodeSelector` | Harbor Registry Node labels for pod assignment | `{}` | +| `registry.tolerations` | Harbor Registry Tolerations for pod assignment | `[]` | +| `registry.topologySpreadConstraints` | Topology Spread Constraints for pod assignment spread across your cluster among failure-domains. Evaluated as a template | `{}` | +| `registry.priorityClassName` | Priority Class Name | `""` | +| `registry.schedulerName` | Use an alternate scheduler, e.g. "stork". | `""` | +| `registry.sidecars` | Add additional sidecar containers to the Harbor Registry pods | `[]` | +| `registry.initContainers` | Add additional init containers to the Harbor Registry pods | `[]` | +| `registry.extraVolumes` | Optionally specify extra list of additional volumes for the Harbor Registry pods | `[]` | +| `registry.automountServiceAccountToken` | Automount service account token | `false` | +| `registry.server.image.registry` | Harbor Registry image registry | `docker.io` | +| `registry.server.image.repository` | Harbor Registry image repository | `bitnami/harbor-registry` | +| `registry.server.image.tag` | Harbor Registry image tag (immutable tags are recommended) | `2.4.1-debian-10-r75` | +| `registry.server.image.pullPolicy` | Harbor Registry image pull policy | `IfNotPresent` | +| `registry.server.image.pullSecrets` | Harbor Registry image pull secrets | `[]` | +| `registry.server.image.debug` | Enable Harbor Registry image debug mode | `false` | +| `registry.server.command` | Override default container command (useful when using custom images) | `[]` | +| `registry.server.args` | Override default container args (useful when using custom images) | `[]` | +| `registry.server.extraEnvVars` | Array with extra environment variables to add Harbor Registry main containers | `[]` | +| `registry.server.extraEnvVarsCM` | ConfigMap containing extra environment variables for Harbor Registry main containers | `""` | +| `registry.server.extraEnvVarsSecret` | Secret containing extra environment variables (in case of sensitive data) for Harbor Registry main containers | `""` | +| `registry.server.containerPorts.http` | Harbor Registry HTTP container port | `5000` | +| `registry.server.containerPorts.https` | Harbor Registry HTTPS container port | `5443` | +| `registry.server.containerPorts.debug` | Harbor Registry debug container port | `5001` | +| `registry.server.livenessProbe.enabled` | Enable livenessProbe on Harbor Registry main containers | `true` | +| `registry.server.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `20` | +| `registry.server.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `10` | +| `registry.server.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `5` | +| `registry.server.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `6` | +| `registry.server.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` | +| `registry.server.readinessProbe.enabled` | Enable readinessProbe on Harbor Registry main containers | `true` | +| `registry.server.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `20` | +| `registry.server.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `10` | +| `registry.server.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `5` | +| `registry.server.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `6` | +| `registry.server.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` | +| `registry.server.startupProbe.enabled` | Enable startupProbe on Harbor Registry main containers | `false` | +| `registry.server.startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `5` | +| `registry.server.startupProbe.periodSeconds` | Period seconds for startupProbe | `10` | +| `registry.server.startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `1` | +| `registry.server.startupProbe.failureThreshold` | Failure threshold for startupProbe | `15` | +| `registry.server.startupProbe.successThreshold` | Success threshold for startupProbe | `1` | +| `registry.server.customLivenessProbe` | Custom livenessProbe that overrides the default one | `{}` | +| `registry.server.customReadinessProbe` | Custom readinessProbe that overrides the default one | `{}` | +| `registry.server.customStartupProbe` | Custom startupProbe that overrides the default one | `{}` | +| `registry.server.resources.limits` | The resources limits for the Harbor Registry main containers | `{}` | +| `registry.server.resources.requests` | The requested resources for the Harbor Registry main containers | `{}` | +| `registry.server.containerSecurityContext.enabled` | Enabled Harbor Registry main containers' Security Context | `true` | +| `registry.server.containerSecurityContext.runAsUser` | Set Harbor Registry main containers' Security Context runAsUser | `1001` | +| `registry.server.containerSecurityContext.runAsNonRoot` | Set Harbor Registry main containers' Security Context runAsNonRoot | `true` | +| `registry.server.lifecycleHooks` | LifecycleHook for the Harbor Registry main container(s) to automate configuration before or after startup | `{}` | +| `registry.server.extraVolumeMounts` | Optionally specify extra list of additional volumeMounts for the Harbor Registry main pods | `[]` | +| `registry.server.service.ports.http` | Harbor Registry HTTP service port | `5000` | +| `registry.server.service.ports.https` | Harbor Registry HTTPS service port | `5443` | +| `registry.controller.image.registry` | Harbor Registryctl image registry | `docker.io` | +| `registry.controller.image.repository` | Harbor Registryctl image repository | `bitnami/harbor-registryctl` | +| `registry.controller.image.tag` | Harbor Registryctl image tag (immutable tags are recommended) | `2.4.1-debian-10-r75` | +| `registry.controller.image.pullPolicy` | Harbor Registryctl image pull policy | `IfNotPresent` | +| `registry.controller.image.pullSecrets` | Harbor Registryctl image pull secrets | `[]` | +| `registry.controller.image.debug` | Enable Harbor Registryctl image debug mode | `false` | +| `registry.controller.command` | Override default container command (useful when using custom images) | `[]` | +| `registry.controller.args` | Override default container args (useful when using custom images) | `[]` | +| `registry.controller.extraEnvVars` | Array with extra environment variables to add Harbor Registryctl containers | `[]` | +| `registry.controller.extraEnvVarsCM` | ConfigMap containing extra environment variables for Harbor Registryctl containers | `""` | +| `registry.controller.extraEnvVarsSecret` | Secret containing extra environment variables (in case of sensitive data) for Harbor Registryctl containers | `""` | +| `registry.controller.containerPorts.http` | Harbor Registryctl HTTP container port | `8080` | +| `registry.controller.containerPorts.https` | Harbor Registryctl HTTPS container port | `8443` | +| `registry.controller.livenessProbe.enabled` | Enable livenessProbe on Harbor Registryctl containers | `true` | +| `registry.controller.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `20` | +| `registry.controller.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `10` | +| `registry.controller.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `5` | +| `registry.controller.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `6` | +| `registry.controller.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` | +| `registry.controller.readinessProbe.enabled` | Enable readinessProbe on Harbor Registryctl containers | `true` | +| `registry.controller.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `20` | +| `registry.controller.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `10` | +| `registry.controller.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `5` | +| `registry.controller.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `6` | +| `registry.controller.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` | +| `registry.controller.startupProbe.enabled` | Enable startupProbe on Harbor Registryctl containers | `false` | +| `registry.controller.startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `5` | +| `registry.controller.startupProbe.periodSeconds` | Period seconds for startupProbe | `10` | +| `registry.controller.startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `1` | +| `registry.controller.startupProbe.failureThreshold` | Failure threshold for startupProbe | `15` | +| `registry.controller.startupProbe.successThreshold` | Success threshold for startupProbe | `1` | +| `registry.controller.customLivenessProbe` | Custom livenessProbe that overrides the default one | `{}` | +| `registry.controller.customReadinessProbe` | Custom readinessProbe that overrides the default one | `{}` | +| `registry.controller.customStartupProbe` | Custom startupProbe that overrides the default one | `{}` | +| `registry.controller.resources.limits` | The resources limits for the Harbor Registryctl containers | `{}` | +| `registry.controller.resources.requests` | The requested resources for the Harbor Registryctl containers | `{}` | +| `registry.controller.containerSecurityContext.enabled` | Enabled Harbor Registryctl containers' Security Context | `true` | +| `registry.controller.containerSecurityContext.runAsUser` | Set Harbor Registryctl containers' Security Context runAsUser | `1001` | +| `registry.controller.containerSecurityContext.runAsNonRoot` | Set Harbor Registryctl containers' Security Context runAsNonRoot | `true` | +| `registry.controller.lifecycleHooks` | LifecycleHook for the Harbor Registryctl container(s) to automate configuration before or after startup | `{}` | +| `registry.controller.extraVolumeMounts` | Optionally specify extra list of additional volumeMounts for the Harbor Registryctl pods | `[]` | +| `registry.controller.service.ports.http` | Harbor Registryctl HTTP service port | `8080` | +| `registry.controller.service.ports.https` | Harbor Registryctl HTTPS service port | `8443` | ### ChartMuseum Parameters -| Name | Description | Value | -| ------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------- | -| `chartMuseumImage.registry` | Registry for ChartMuseum image | `docker.io` | -| `chartMuseumImage.repository` | Repository for clair image | `bitnami/chartmuseum` | -| `chartMuseumImage.tag` | Tag for ChartMuseum image | `0.13.1-debian-10-r285` | -| `chartMuseumImage.pullPolicy` | ChartMuseum image pull policy | `IfNotPresent` | -| `chartMuseumImage.pullSecrets` | Specify docker-registry secret names as an array | `[]` | -| `chartMuseumImage.debug` | Specify if debug logs should be enabled | `false` | -| `chartmuseum.enabled` | Enable ChartMuseum | `true` | -| `chartmuseum.command` | Override default container command (useful when using custom images) | `[]` | -| `chartmuseum.args` | Override default container args (useful when using custom images) | `[]` | -| `chartmuseum.replicas` | Number of ChartMuseum replicas | `1` | -| `chartmuseum.updateStrategy.type` | Update strategy - only really applicable for deployments with RWO PVs attached | `RollingUpdate` | -| `chartmuseum.useRedisCache` | Specify if ChartMuseum will use redis cache | `true` | -| `chartmuseum.absoluteUrl` | Specify an absolute URL for ChartMuseum registry | `false` | -| `chartmuseum.chartRepoName` | Specify the endpoint for the chartmuseum registry. Only applicable if `chartmuseum.absoluteUrl` is `true` | `chartsRepo` | -| `chartmuseum.depth` | Support for multitenancy. More info [here](https://chartmuseum.com/docs/#multitenancy) | `1` | -| `chartmuseum.logJson` | Print logs on JSON format | `false` | -| `chartmuseum.disableMetrics` | Disable prometheus metrics exposure | `false` | -| `chartmuseum.disableApi` | Disable all the routes prefixed with `/api` | `false` | -| `chartmuseum.disableStatefiles` | Disable use of index-cache.yaml | `false` | -| `chartmuseum.allowOverwrite` | Allow chart versions to be re-uploaded without force querystring | `true` | -| `chartmuseum.anonymousGet` | Allow anonymous GET operations | `false` | -| `chartmuseum.tls.existingSecret` | Name of a secret with the certificates for internal TLS access. Requires internalTLS.enabled to be set to true. If this values is not set it will be automatically generated | `""` | -| `chartmuseum.contextPath` | Set the base context path for ChartMuseum | `""` | -| `chartmuseum.indexLimit` | Limit the number of parallels indexes for ChartMuseum | `""` | -| `chartmuseum.chartPostFormFieldName` | Form field which will be queried for the chart file content | `""` | -| `chartmuseum.provPostFormFieldName` | Form field which will be queried for the provenance file content | `""` | -| `chartmuseum.maxStorageObjects` | Maximum storage objects | `""` | -| `chartmuseum.maxUploadSize` | Maximum upload size | `""` | -| `chartmuseum.storageTimestampTolerance` | Timestamp tolerance size | `1s` | -| `chartmuseum.lifecycleHooks` | LifecycleHook to set additional configuration at startup, e.g. LDAP settings via REST API. Evaluated as a template | `{}` | -| `chartmuseum.customLivenessProbe` | Override default liveness probe | `{}` | -| `chartmuseum.customReadinessProbe` | Override default readiness probe | `{}` | -| `chartmuseum.extraEnvVars` | Array containing extra env vars | `[]` | -| `chartmuseum.extraEnvVarsCM` | ConfigMap containing extra env vars | `""` | -| `chartmuseum.extraEnvVarsSecret` | Secret containing extra env vars (in case of sensitive data) | `""` | -| `chartmuseum.extraVolumes` | Array of extra volumes to be added to the deployment (evaluated as template). Requires setting `extraVolumeMounts` | `[]` | -| `chartmuseum.extraVolumeMounts` | Array of extra volume mounts to be added to the container (evaluated as template). Normally used with `extraVolumes`. | `[]` | -| `chartmuseum.hostAliases` | Specify hostAliases for the Pod to use | `[]` | -| `chartmuseum.initContainers` | Add additional init containers to the pod (evaluated as a template) | `[]` | -| `chartmuseum.sidecars` | Attach additional containers to the pod (evaluated as a template) | `[]` | -| `chartmuseum.resources.limits` | The resources limits for the container | `{}` | -| `chartmuseum.resources.requests` | The requested resources for the container | `{}` | -| `chartmuseum.podAffinityPreset` | ChartMuseum Pod affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `""` | -| `chartmuseum.podAntiAffinityPreset` | ChartMuseum Pod anti-affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `soft` | -| `chartmuseum.nodeAffinityPreset.type` | ChartMuseum Node affinity preset type. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `""` | -| `chartmuseum.nodeAffinityPreset.key` | ChartMuseum Node label key to match Ignored if `affinity` is set. | `""` | -| `chartmuseum.nodeAffinityPreset.values` | ChartMuseum Node label values to match. Ignored if `affinity` is set. | `[]` | -| `chartmuseum.affinity` | ChartMuseum Affinity for pod assignment | `{}` | -| `chartmuseum.priorityClassName` | Chartmuseum pods Priority Class Name | `""` | -| `chartmuseum.nodeSelector` | ChartMuseum Node labels for pod assignment | `{}` | -| `chartmuseum.tolerations` | ChartMuseum Tolerations for pod assignment | `[]` | -| `chartmuseum.podLabels` | Add additional labels to the pod (evaluated as a template) | `{}` | -| `chartmuseum.podAnnotations` | Annotations to add to the chartmuseum pod | `{}` | -| `chartmuseum.automountServiceAccountToken` | Automount service account token | `false` | -| `chartmuseum.livenessProbe.enabled` | Enable livenessProbe | `true` | -| `chartmuseum.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `30` | -| `chartmuseum.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `10` | -| `chartmuseum.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `20` | -| `chartmuseum.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `10` | -| `chartmuseum.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` | -| `chartmuseum.readinessProbe.enabled` | Enable readinessProbe | `true` | -| `chartmuseum.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `30` | -| `chartmuseum.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `10` | -| `chartmuseum.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `20` | -| `chartmuseum.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `10` | -| `chartmuseum.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` | +| Name | Description | Value | +| --------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------ | ---------------------- | +| `chartmuseum.image.registry` | ChartMuseum image registry | `docker.io` | +| `chartmuseum.image.repository` | ChartMuseum image repository | `bitnami/chartmuseum` | +| `chartmuseum.image.tag` | ChartMuseum image tag (immutable tags are recommended) | `0.14.0-debian-10-r30` | +| `chartmuseum.image.pullPolicy` | ChartMuseum image pull policy | `IfNotPresent` | +| `chartmuseum.image.pullSecrets` | ChartMuseum image pull secrets | `[]` | +| `chartmuseum.image.debug` | Enable ChartMuseum image debug mode | `false` | +| `chartmuseum.enabled` | Enable ChartMuseum | `true` | +| `chartmuseum.useRedisCache` | Specify if ChartMuseum will use redis cache | `true` | +| `chartmuseum.absoluteUrl` | Specify an absolute URL for ChartMuseum registry | `false` | +| `chartmuseum.chartRepoName` | Specify the endpoint for the chartmuseum registry. Only applicable if `chartmuseum.absoluteUrl` is `true` | `chartsRepo` | +| `chartmuseum.depth` | Support for multitenancy. More info [here](https://chartmuseum.com/docs/#multitenancy) | `1` | +| `chartmuseum.logJson` | Print logs on JSON format | `false` | +| `chartmuseum.disableMetrics` | Disable prometheus metrics exposure | `false` | +| `chartmuseum.disableApi` | Disable all the routes prefixed with `/api` | `false` | +| `chartmuseum.disableStatefiles` | Disable use of index-cache.yaml | `false` | +| `chartmuseum.allowOverwrite` | Allow chart versions to be re-uploaded without force querystring | `true` | +| `chartmuseum.anonymousGet` | Allow anonymous GET operations | `false` | +| `chartmuseum.contextPath` | Set the base context path for ChartMuseum | `""` | +| `chartmuseum.indexLimit` | Limit the number of parallels indexes for ChartMuseum | `""` | +| `chartmuseum.chartPostFormFieldName` | Form field which will be queried for the chart file content | `""` | +| `chartmuseum.provPostFormFieldName` | Form field which will be queried for the provenance file content | `""` | +| `chartmuseum.maxStorageObjects` | Maximum storage objects | `""` | +| `chartmuseum.maxUploadSize` | Maximum upload size | `""` | +| `chartmuseum.storageTimestampTolerance` | Timestamp tolerance size | `1s` | +| `chartmuseum.tls.existingSecret` | Name of an existing secret with the certificates for internal TLS access | `""` | +| `chartmuseum.command` | Override default container command (useful when using custom images) | `[]` | +| `chartmuseum.args` | Override default container args (useful when using custom images) | `[]` | +| `chartmuseum.extraEnvVars` | Array with extra environment variables to add Chartmuseum pods | `[]` | +| `chartmuseum.extraEnvVarsCM` | ConfigMap containing extra environment variables for Chartmuseum pods | `""` | +| `chartmuseum.extraEnvVarsSecret` | Secret containing extra environment variables (in case of sensitive data) for Chartmuseum pods | `""` | +| `chartmuseum.containerPorts.http` | Chartmuseum HTTP container port | `9999` | +| `chartmuseum.containerPorts.https` | Chartmuseum HTTPS container port | `9443` | +| `chartmuseum.replicaCount` | Number of Chartmuseum replicas | `1` | +| `chartmuseum.livenessProbe.enabled` | Enable livenessProbe on Chartmuseum containers | `true` | +| `chartmuseum.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `20` | +| `chartmuseum.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `10` | +| `chartmuseum.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `5` | +| `chartmuseum.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `6` | +| `chartmuseum.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` | +| `chartmuseum.readinessProbe.enabled` | Enable readinessProbe on Chartmuseum containers | `true` | +| `chartmuseum.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `20` | +| `chartmuseum.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `10` | +| `chartmuseum.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `5` | +| `chartmuseum.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `6` | +| `chartmuseum.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` | +| `chartmuseum.startupProbe.enabled` | Enable startupProbe on Chartmuseum containers | `false` | +| `chartmuseum.startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `5` | +| `chartmuseum.startupProbe.periodSeconds` | Period seconds for startupProbe | `10` | +| `chartmuseum.startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `1` | +| `chartmuseum.startupProbe.failureThreshold` | Failure threshold for startupProbe | `15` | +| `chartmuseum.startupProbe.successThreshold` | Success threshold for startupProbe | `1` | +| `chartmuseum.customLivenessProbe` | Custom livenessProbe that overrides the default one | `{}` | +| `chartmuseum.customReadinessProbe` | Custom readinessProbe that overrides the default one | `{}` | +| `chartmuseum.customStartupProbe` | Custom startupProbe that overrides the default one | `{}` | +| `chartmuseum.resources.limits` | The resources limits for the Chartmuseum containers | `{}` | +| `chartmuseum.resources.requests` | The requested resources for the Chartmuseum containers | `{}` | +| `chartmuseum.podSecurityContext.enabled` | Enabled Chartmuseum pods' Security Context | `true` | +| `chartmuseum.podSecurityContext.fsGroup` | Set Chartmuseum pod's Security Context fsGroup | `1001` | +| `chartmuseum.containerSecurityContext.enabled` | Enabled Chartmuseum containers' Security Context | `true` | +| `chartmuseum.containerSecurityContext.runAsUser` | Set Chartmuseum containers' Security Context runAsUser | `1001` | +| `chartmuseum.containerSecurityContext.runAsNonRoot` | Set Chartmuseum containers' Security Context runAsNonRoot | `true` | +| `chartmuseum.updateStrategy.type` | Chartmuseum deployment strategy type - only really applicable for deployments with RWO PVs attached | `RollingUpdate` | +| `chartmuseum.updateStrategy.rollingUpdate` | Chartmuseum deployment rolling update configuration parameters | `{}` | +| `chartmuseum.lifecycleHooks` | LifecycleHook for the Chartmuseum container(s) to automate configuration before or after startup | `{}` | +| `chartmuseum.hostAliases` | Chartmuseum pods host aliases | `[]` | +| `chartmuseum.podLabels` | Add additional labels to the Chartmuseum pods (evaluated as a template) | `{}` | +| `chartmuseum.podAnnotations` | Annotations to add to the Chartmuseum pods (evaluated as a template) | `{}` | +| `chartmuseum.podAffinityPreset` | Chartmuseum Pod affinity preset. Ignored if `chartmuseum.affinity` is set. Allowed values: `soft` or `hard` | `""` | +| `chartmuseum.podAntiAffinityPreset` | Chartmuseum Pod anti-affinity preset. Ignored if `chartmuseum.affinity` is set. Allowed values: `soft` or `hard` | `soft` | +| `chartmuseum.nodeAffinityPreset.type` | Chartmuseum Node affinity preset type. Ignored if `chartmuseum.affinity` is set. Allowed values: `soft` or `hard` | `""` | +| `chartmuseum.nodeAffinityPreset.key` | Chartmuseum Node label key to match Ignored if `chartmuseum.affinity` is set. | `""` | +| `chartmuseum.nodeAffinityPreset.values` | Chartmuseum Node label values to match. Ignored if `chartmuseum.affinity` is set. | `[]` | +| `chartmuseum.affinity` | Chartmuseum Affinity for pod assignment | `{}` | +| `chartmuseum.nodeSelector` | Chartmuseum Node labels for pod assignment | `{}` | +| `chartmuseum.tolerations` | Chartmuseum Tolerations for pod assignment | `[]` | +| `chartmuseum.topologySpreadConstraints` | Topology Spread Constraints for pod assignment spread across your cluster among failure-domains. Evaluated as a template | `{}` | +| `chartmuseum.priorityClassName` | Priority Class Name | `""` | +| `chartmuseum.schedulerName` | Use an alternate scheduler, e.g. "stork". | `""` | +| `chartmuseum.sidecars` | Add additional sidecar containers to the Chartmuseum pods | `[]` | +| `chartmuseum.initContainers` | Add additional init containers to the Chartmuseum pods | `[]` | +| `chartmuseum.extraVolumeMounts` | Optionally specify extra list of additional volumeMounts for the Chartmuseum pods | `[]` | +| `chartmuseum.extraVolumes` | Optionally specify extra list of additional volumes for the Chartmuseum pods | `[]` | +| `chartmuseum.automountServiceAccountToken` | Automount service account token | `false` | +| `chartmuseum.service.ports.http` | Chartmuseum HTTP service port | `80` | +| `chartmuseum.service.ports.https` | Chartmuseum HTTPS service port | `443` | ### Clair Parameters -| Name | Description | Value | -| -------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------ | -| `clairImage.registry` | Registry for clair image | `docker.io` | -| `clairImage.repository` | Repository for clair image | `bitnami/harbor-clair` | -| `clairImage.tag` | Tag for clair image | `2.4.1-debian-10-r29` | -| `clairImage.pullPolicy` | Harbor clair image pull policy | `IfNotPresent` | -| `clairImage.pullSecrets` | Specify docker-registry secret names as an array | `[]` | -| `clairImage.debug` | Specify if debug logs should be enabled | `false` | -| `clairAdapterImage.registry` | Registry for clair adapter image | `docker.io` | -| `clairAdapterImage.repository` | Repository for clair adapter image | `bitnami/harbor-adapter-clair` | -| `clairAdapterImage.tag` | Tag for clair adapter image | `2.4.1-debian-10-r29` | -| `clairAdapterImage.pullPolicy` | Harbor clair adapter image pull policy | `IfNotPresent` | -| `clairAdapterImage.pullSecrets` | Specify docker-registry secret names as an array | `[]` | -| `clairAdapterImage.debug` | Specify if debug logs should be enabled | `false` | -| `clair.enabled` | Enable Clair scanner. Add it as an additional interrogation service by following https://goharbor.io/docs/latest/administration/vulnerability-scanning/pluggable-scanners | `false` | -| `clair.replicas` | The replica count | `1` | -| `clair.tls.existingSecret` | Name of a secret with the certificates for internal TLS access. Requires internalTLS.enabled to be set to true. If this values is not set it will be automatically generated | `""` | -| `clair.updateStrategy.type` | Update strategy - only really applicable for deployments with RWO PVs attached | `RollingUpdate` | -| `clair.httpProxy` | The http proxy used to update vulnerabilities database from internet | `""` | -| `clair.httpsProxy` | The https proxy used to update vulnerabilities database from internet | `""` | -| `clair.updatersInterval` | The interval of clair updaters (hours), set to 0 to disable | `12` | -| `clair.adapter.command` | Override default container command (useful when using custom images) | `[]` | -| `clair.adapter.args` | Override default container args (useful when using custom images) | `[]` | -| `clair.adapter.extraEnvVars` | Array containing extra env vars | `[]` | -| `clair.adapter.extraEnvVarsCM` | ConfigMap containing extra env vars | `""` | -| `clair.adapter.extraEnvVarsSecret` | Secret containing extra env vars (in case of sensitive data) | `""` | -| `clair.adapter.extraVolumeMounts` | Array of extra volume mounts to be added to the container (evaluated as template). Normally used with `extraVolumes`. | `[]` | -| `clair.adapter.livenessProbe.enabled` | Enable livenessProbe | `true` | -| `clair.adapter.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `20` | -| `clair.adapter.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `10` | -| `clair.adapter.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `5` | -| `clair.adapter.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `6` | -| `clair.adapter.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` | -| `clair.adapter.readinessProbe.enabled` | Enable readinessProbe | `true` | -| `clair.adapter.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `20` | -| `clair.adapter.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `10` | -| `clair.adapter.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `5` | -| `clair.adapter.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `6` | -| `clair.adapter.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` | -| `clair.adapter.lifecycleHooks` | LifecycleHook to set additional configuration at startup, e.g. LDAP settings via REST API. Evaluated as a template | `{}` | -| `clair.adapter.customLivenessProbe` | Override default liveness probe | `{}` | -| `clair.adapter.customReadinessProbe` | Override default readiness probe | `{}` | -| `clair.adapter.resources.limits` | The resources limits for the container | `{}` | -| `clair.adapter.resources.requests` | The requested resources for the container | `{}` | -| `clair.server.command` | Override default container command (useful when using custom images) | `[]` | -| `clair.server.args` | Override default container args (useful when using custom images) | `[]` | -| `clair.server.livenessProbe.enabled` | Enable livenessProbe | `true` | -| `clair.server.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `20` | -| `clair.server.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `10` | -| `clair.server.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `5` | -| `clair.server.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `6` | -| `clair.server.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` | -| `clair.server.readinessProbe.enabled` | Enable readinessProbe | `true` | -| `clair.server.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `20` | -| `clair.server.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `10` | -| `clair.server.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `5` | -| `clair.server.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `6` | -| `clair.server.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` | -| `clair.server.lifecycleHooks` | LifecycleHook to set additional configuration at startup, e.g. LDAP settings via REST API. Evaluated as a template | `{}` | -| `clair.server.customLivenessProbe` | Override default liveness probe | `{}` | -| `clair.server.customReadinessProbe` | Override default readiness probe | `{}` | -| `clair.server.extraEnvVars` | Array containing extra env vars | `[]` | -| `clair.server.extraEnvVarsCM` | ConfigMap containing extra env vars | `""` | -| `clair.server.extraEnvVarsSecret` | Secret containing extra env vars (in case of sensitive data) | `""` | -| `clair.server.extraVolumeMounts` | Array of extra volume mounts to be added to the container (evaluated as template). Normally used with `extraVolumes`. | `[]` | -| `clair.server.resources.limits` | The resources limits for the container | `{}` | -| `clair.server.resources.requests` | The requested resources for the container | `{}` | -| `clair.extraVolumes` | Array of extra volumes to be added to the deployment (evaluated as template). Requires setting `extraVolumeMounts` | `[]` | -| `clair.hostAliases` | Specify hostAliases for the Pod to use | `[]` | -| `clair.initContainers` | Add additional init containers to the pod (evaluated as a template) | `[]` | -| `clair.sidecars` | Attach additional containers to the pod (evaluated as a template) | `[]` | -| `clair.podAffinityPreset` | Harbor Clair Pod affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `""` | -| `clair.podAntiAffinityPreset` | Harbor Clair Pod anti-affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `soft` | -| `clair.nodeAffinityPreset.type` | Harbor Clair Node affinity preset type. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `""` | -| `clair.nodeAffinityPreset.key` | Harbor Clair Node label key to match Ignored if `affinity` is set. | `""` | -| `clair.nodeAffinityPreset.values` | Harbor Clair Node label values to match. Ignored if `affinity` is set. | `[]` | -| `clair.affinity` | Harbor Clair Affinity for pod assignment | `{}` | -| `clair.priorityClassName` | Clair pods Priority Class Name | `""` | -| `clair.nodeSelector` | Harbor Clair Node labels for pod assignment | `{}` | -| `clair.tolerations` | Harbor Clair Tolerations for pod assignment | `[]` | -| `clair.podLabels` | Add additional labels to the pod (evaluated as a template) | `{}` | -| `clair.podAnnotations` | Annotations to add to the clair pod | `{}` | -| `clair.automountServiceAccountToken` | Automount service account token | `false` | +| Name | Description | Value | +| ----------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------ | +| `clair.enabled` | Enable Clair scanner. Add it as an additional interrogation service by following https://goharbor.io/docs/latest/administration/vulnerability-scanning/pluggable-scanners | `false` | +| `clair.httpProxy` | The http proxy used to update vulnerabilities database from internet | `""` | +| `clair.httpsProxy` | The https proxy used to update vulnerabilities database from internet | `""` | +| `clair.updatersInterval` | The interval of clair updaters (hours), set to 0 to disable | `12` | +| `clair.tls.existingSecret` | Name of an existing secret with the certificates for internal TLS access | `""` | +| `clair.replicaCount` | Number of Clair replicas | `1` | +| `clair.podSecurityContext.enabled` | Enabled Clair pods' Security Context | `true` | +| `clair.podSecurityContext.fsGroup` | Set Clair pod's Security Context fsGroup | `1001` | +| `clair.updateStrategy.type` | Clair deployment strategy type - only really applicable for deployments with RWO PVs attached | `RollingUpdate` | +| `clair.updateStrategy.rollingUpdate` | Clair deployment rolling update configuration parameters | `{}` | +| `clair.hostAliases` | Clair pods host aliases | `[]` | +| `clair.podLabels` | Add additional labels to the Clair pods (evaluated as a template) | `{}` | +| `clair.podAnnotations` | Annotations to add to the Clair pods (evaluated as a template) | `{}` | +| `clair.podAffinityPreset` | Clair Pod affinity preset. Ignored if `clair.affinity` is set. Allowed values: `soft` or `hard` | `""` | +| `clair.podAntiAffinityPreset` | Clair Pod anti-affinity preset. Ignored if `clair.affinity` is set. Allowed values: `soft` or `hard` | `soft` | +| `clair.nodeAffinityPreset.type` | Clair Node affinity preset type. Ignored if `clair.affinity` is set. Allowed values: `soft` or `hard` | `""` | +| `clair.nodeAffinityPreset.key` | Clair Node label key to match Ignored if `clair.affinity` is set. | `""` | +| `clair.nodeAffinityPreset.values` | Clair Node label values to match. Ignored if `clair.affinity` is set. | `[]` | +| `clair.affinity` | Clair Affinity for pod assignment | `{}` | +| `clair.nodeSelector` | Clair Node labels for pod assignment | `{}` | +| `clair.tolerations` | Clair Tolerations for pod assignment | `[]` | +| `clair.topologySpreadConstraints` | Topology Spread Constraints for pod assignment spread across your cluster among failure-domains. Evaluated as a template | `{}` | +| `clair.priorityClassName` | Priority Class Name | `""` | +| `clair.schedulerName` | Use an alternate scheduler, e.g. "stork". | `""` | +| `clair.sidecars` | Add additional sidecar containers to the Clair pods | `[]` | +| `clair.initContainers` | Add additional init containers to the Clair pods | `[]` | +| `clair.extraVolumes` | Optionally specify extra list of additional volumes for the Clair pods | `[]` | +| `clair.automountServiceAccountToken` | Automount service account token | `false` | +| `clair.adapter.image.registry` | Harbor Adapter for Clair image registry | `docker.io` | +| `clair.adapter.image.repository` | Harbor Adapter for Clair image repository | `bitnami/harbor-adapter-clair` | +| `clair.adapter.image.tag` | Harbor Adapter for Clair image tag (immutable tags are recommended) | `2.4.1-debian-10-r76` | +| `clair.adapter.image.pullPolicy` | Harbor Adapter for Clair image pull policy | `IfNotPresent` | +| `clair.adapter.image.pullSecrets` | Harbor Adapter for Clair image pull secrets | `[]` | +| `clair.adapter.image.debug` | Enable Harbor Adapter for Clair image debug mode | `false` | +| `clair.adapter.command` | Override default container command (useful when using custom images) | `[]` | +| `clair.adapter.args` | Override default container args (useful when using custom images) | `[]` | +| `clair.adapter.extraEnvVars` | Array with extra environment variables to add Harbor Adapter for Clair containers | `[]` | +| `clair.adapter.extraEnvVarsCM` | ConfigMap containing extra environment variables for Harbor Adapter for Clair containers | `""` | +| `clair.adapter.extraEnvVarsSecret` | Secret containing extra environment variables (in case of sensitive data) for Harbor Adapter for Clair containers | `""` | +| `clair.adapter.containerPorts.http` | Harbor Adapter for Clair HTTP container port | `8080` | +| `clair.adapter.containerPorts.https` | Harbor Adapter for Clair HTTPS container port | `8443` | +| `clair.adapter.livenessProbe.enabled` | Enable livenessProbe on Harbor Adapter for Clair containers | `true` | +| `clair.adapter.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `20` | +| `clair.adapter.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `10` | +| `clair.adapter.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `5` | +| `clair.adapter.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `6` | +| `clair.adapter.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` | +| `clair.adapter.readinessProbe.enabled` | Enable readinessProbe on Harbor Adapter for Clair containers | `true` | +| `clair.adapter.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `20` | +| `clair.adapter.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `10` | +| `clair.adapter.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `5` | +| `clair.adapter.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `6` | +| `clair.adapter.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` | +| `clair.adapter.startupProbe.enabled` | Enable startupProbe on Harbor Adapter for Clair containers | `false` | +| `clair.adapter.startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `5` | +| `clair.adapter.startupProbe.periodSeconds` | Period seconds for startupProbe | `10` | +| `clair.adapter.startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `1` | +| `clair.adapter.startupProbe.failureThreshold` | Failure threshold for startupProbe | `15` | +| `clair.adapter.startupProbe.successThreshold` | Success threshold for startupProbe | `1` | +| `clair.adapter.customLivenessProbe` | Custom livenessProbe that overrides the default one | `{}` | +| `clair.adapter.customReadinessProbe` | Custom readinessProbe that overrides the default one | `{}` | +| `clair.adapter.customStartupProbe` | Custom startupProbe that overrides the default one | `{}` | +| `clair.adapter.resources.limits` | The resources limits for the Harbor Adapter for Clair containers | `{}` | +| `clair.adapter.resources.requests` | The requested resources for the Harbor Adapter for Clair containers | `{}` | +| `clair.adapter.containerSecurityContext.enabled` | Enabled Harbor Adapter for Clair containers' Security Context | `true` | +| `clair.adapter.containerSecurityContext.runAsUser` | Set Harbor Adapter for Clair containers' Security Context runAsUser | `1001` | +| `clair.adapter.containerSecurityContext.runAsNonRoot` | Set Harbor Adapter for Clair containers' Security Context runAsNonRoot | `true` | +| `clair.adapter.lifecycleHooks` | LifecycleHook for the Harbor Adapter for Clair container(s) to automate configuration before or after startup | `{}` | +| `clair.adapter.extraVolumeMounts` | Optionally specify extra list of additional volumeMounts for the Harbor Adapter for Clair pods | `[]` | +| `clair.adapter.service.ports.http` | Harbor Adapter for Clair HTTP service port | `8080` | +| `clair.adapter.service.ports.https` | Harbor Adapter for Clair HTTPS service port | `8443` | +| `clair.server.image.registry` | Harbor Clair image registry | `docker.io` | +| `clair.server.image.repository` | Harbor Clair image repository | `bitnami/harbor-clair` | +| `clair.server.image.tag` | Harbor Clair image tag (immutable tags are recommended) | `2.4.1-debian-10-r78` | +| `clair.server.image.pullPolicy` | Harbor Clair image pull policy | `IfNotPresent` | +| `clair.server.image.pullSecrets` | Harbor Clair image pull secrets | `[]` | +| `clair.server.image.debug` | Enable Harbor Clair image debug mode | `false` | +| `clair.server.command` | Override default container command (useful when using custom images) | `[]` | +| `clair.server.args` | Override default container args (useful when using custom images) | `[]` | +| `clair.server.extraEnvVars` | Array with extra environment variables to add Harbor Clair containers | `[]` | +| `clair.server.extraEnvVarsCM` | ConfigMap containing extra environment variables for Harbor Clair containers | `""` | +| `clair.server.extraEnvVarsSecret` | Secret containing extra environment variables (in case of sensitive data) for Harbor Clair containers | `""` | +| `clair.server.containerPorts.api` | Harbor Clair API container port | `6060` | +| `clair.server.containerPorts.health` | Harbor Clair health container port | `6061` | +| `clair.server.livenessProbe.enabled` | Enable livenessProbe on Harbor Clair containers | `true` | +| `clair.server.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `20` | +| `clair.server.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `10` | +| `clair.server.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `5` | +| `clair.server.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `6` | +| `clair.server.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` | +| `clair.server.readinessProbe.enabled` | Enable readinessProbe on Harbor Clair containers | `true` | +| `clair.server.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `20` | +| `clair.server.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `10` | +| `clair.server.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `5` | +| `clair.server.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `6` | +| `clair.server.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` | +| `clair.server.startupProbe.enabled` | Enable startupProbe on Harbor Clair containers | `false` | +| `clair.server.startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `5` | +| `clair.server.startupProbe.periodSeconds` | Period seconds for startupProbe | `10` | +| `clair.server.startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `1` | +| `clair.server.startupProbe.failureThreshold` | Failure threshold for startupProbe | `15` | +| `clair.server.startupProbe.successThreshold` | Success threshold for startupProbe | `1` | +| `clair.server.customLivenessProbe` | Custom livenessProbe that overrides the default one | `{}` | +| `clair.server.customReadinessProbe` | Custom readinessProbe that overrides the default one | `{}` | +| `clair.server.customStartupProbe` | Custom startupProbe that overrides the default one | `{}` | +| `clair.server.resources.limits` | The resources limits for the Harbor Clair containers | `{}` | +| `clair.server.resources.requests` | The requested resources for the Harbor Clair containers | `{}` | +| `clair.server.containerSecurityContext.enabled` | Enabled Harbor Clair containers' Security Context | `true` | +| `clair.server.containerSecurityContext.runAsUser` | Set Harbor Clair containers' Security Context runAsUser | `1001` | +| `clair.server.containerSecurityContext.runAsNonRoot` | Set Harbor Clair containers' Security Context runAsNonRoot | `true` | +| `clair.server.lifecycleHooks` | LifecycleHook for the Harbor Clair container(s) to automate configuration before or after startup | `{}` | +| `clair.server.extraVolumeMounts` | Optionally specify extra list of additional volumeMounts for the Harbor Clair pods | `[]` | +| `clair.server.service.ports.api` | Harbor Clair API service port | `6060` | +| `clair.server.service.ports.health` | Harbor Clair health service port | `6061` | ### Notary Parameters -| Name | Description | Value | -| -------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------ | -| `notaryServerImage.registry` | Registry for notary server image | `docker.io` | -| `notaryServerImage.repository` | Repository for notary server image | `bitnami/harbor-notary-server` | -| `notaryServerImage.tag` | Tag for notary server image | `2.4.1-debian-10-r29` | -| `notaryServerImage.pullPolicy` | Harbor notary server image pull policy | `IfNotPresent` | -| `notaryServerImage.pullSecrets` | Specify docker-registry secret names as an array | `[]` | -| `notaryServerImage.debug` | Specify if debug logs should be enabled | `false` | -| `notarySignerImage.registry` | Registry for notary signer images | `docker.io` | -| `notarySignerImage.repository` | Repository for notary signer image | `bitnami/harbor-notary-signer` | -| `notarySignerImage.tag` | Tag for notary signer image | `2.4.1-debian-10-r29` | -| `notarySignerImage.pullPolicy` | Harbor notary signer image pull policy | `IfNotPresent` | -| `notarySignerImage.pullSecrets` | Specify docker-registry secret names as an array | `[]` | -| `notarySignerImage.debug` | Specify if debug logs should be enabled | `false` | -| `notary.enabled` | Enable Notary | `true` | -| `notary.server.command` | Override default container command (useful when using custom images) | `[]` | -| `notary.server.args` | Override default container args (useful when using custom images) | `[]` | -| `notary.server.replicas` | The replica count | `1` | -| `notary.server.updateStrategy.type` | Update strategy - only really applicable for deployments with RWO PVs attached | `RollingUpdate` | -| `notary.server.extraEnvVars` | Array containing extra env vars | `[]` | -| `notary.server.extraEnvVarsCM` | ConfigMap containing extra env vars | `""` | -| `notary.server.extraEnvVarsSecret` | Secret containing extra env vars (in case of sensitive data) | `""` | -| `notary.server.extraVolumeMounts` | Array of extra volume mounts to be added to the container (evaluated as template). Normally used with `extraVolumes`. | `[]` | -| `notary.server.hostAliases` | HostAliases to add to the deployment | `[]` | -| `notary.server.lifecycleHooks` | LifecycleHook to set additional configuration at startup, e.g. LDAP settings via REST API. Evaluated as a template | `{}` | -| `notary.server.resources.limits` | The resources limits for the container | `{}` | -| `notary.server.resources.requests` | The requested resources for the container | `{}` | -| `notary.server.livenessProbe.enabled` | Enable livenessProbe | `true` | -| `notary.server.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `10` | -| `notary.server.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `10` | -| `notary.server.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `5` | -| `notary.server.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `6` | -| `notary.server.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` | -| `notary.server.readinessProbe.enabled` | Enable readinessProbe | `true` | -| `notary.server.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `10` | -| `notary.server.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `10` | -| `notary.server.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `5` | -| `notary.server.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `6` | -| `notary.server.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` | -| `notary.server.customLivenessProbe` | Override default liveness probe | `{}` | -| `notary.server.customReadinessProbe` | Override default readiness probe | `{}` | -| `notary.server.extraVolumes` | Array of extra volumes to be added to the deployment (evaluated as template). Requires setting `extraVolumeMounts` | `[]` | -| `notary.server.initContainers` | Add additional init containers to the pod (evaluated as a template) | `[]` | -| `notary.server.sidecars` | Attach additional containers to the pod (evaluated as a template) | `[]` | -| `notary.server.podAffinityPreset` | Notary server Pod affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `""` | -| `notary.server.podAntiAffinityPreset` | Notary server Pod anti-affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `soft` | -| `notary.server.nodeAffinityPreset.type` | Notary server Node affinity preset type. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `""` | -| `notary.server.nodeAffinityPreset.key` | Notary server Node label key to match Ignored if `affinity` is set. | `""` | -| `notary.server.nodeAffinityPreset.values` | Notary server Node label values to match. Ignored if `affinity` is set. | `[]` | -| `notary.server.affinity` | Notary server Affinity for pod assignment | `{}` | -| `notary.server.priorityClassName` | Notary server pods Priority Class Name | `""` | -| `notary.server.nodeSelector` | Notary server Node labels for pod assignment | `{}` | -| `notary.server.tolerations` | Notary server Tolerations for pod assignment | `[]` | -| `notary.server.podLabels` | Add additional labels to the pod (evaluated as a template) | `{}` | -| `notary.server.podAnnotations` | Annotations to add to the notary pod | `{}` | -| `notary.server.automountServiceAccountToken` | Automount service account token | `false` | -| `notary.signer.command` | Override default container command (useful when using custom images) | `[]` | -| `notary.signer.args` | Override default container args (useful when using custom images) | `[]` | -| `notary.signer.replicas` | The replica count | `1` | -| `notary.signer.updateStrategy.type` | Update strategy - only really applicable for deployments with RWO PVs attached | `RollingUpdate` | -| `notary.signer.extraEnvVars` | Array containing extra env vars | `[]` | -| `notary.signer.extraEnvVarsCM` | ConfigMap containing extra env vars | `""` | -| `notary.signer.extraEnvVarsSecret` | Secret containing extra env vars (in case of sensitive data) | `""` | -| `notary.signer.extraVolumeMounts` | Array of extra volume mounts to be added to the container (evaluated as template). Normally used with `extraVolumes`. | `[]` | -| `notary.signer.resources.limits` | The resources limits for the container | `{}` | -| `notary.signer.resources.requests` | The requested resources for the container | `{}` | -| `notary.signer.extraVolumes` | Array of extra volumes to be added to the deployment (evaluated as template). Requires setting `extraVolumeMounts` | `[]` | -| `notary.signer.hostAliases` | HostAliases to add to the deployment | `[]` | -| `notary.signer.initContainers` | Add additional init containers to the pod (evaluated as a template) | `[]` | -| `notary.signer.sidecars` | Attach additional containers to the pod (evaluated as a template) | `[]` | -| `notary.signer.podAffinityPreset` | Notary signer Pod affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `""` | -| `notary.signer.podAntiAffinityPreset` | Notary signer Pod anti-affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `soft` | -| `notary.signer.nodeAffinityPreset.type` | Notary signer Node affinity preset type. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `""` | -| `notary.signer.nodeAffinityPreset.key` | Notary signer Node label key to match Ignored if `affinity` is set. | `""` | -| `notary.signer.nodeAffinityPreset.values` | Notary signer Node label values to match. Ignored if `affinity` is set. | `[]` | -| `notary.signer.affinity` | Notary signer Affinity for pod assignment | `{}` | -| `notary.signer.priorityClassName` | Notary signer pods Priority Class Name | `""` | -| `notary.signer.nodeSelector` | Notary signer Node labels for pod assignment | `{}` | -| `notary.signer.tolerations` | Notary signer Tolerations for pod assignment | `[]` | -| `notary.signer.podLabels` | Add additional labels to the pod (evaluated as a template) | `{}` | -| `notary.signer.podAnnotations` | Annotations to add to the notary.signer pod | `{}` | -| `notary.signer.livenessProbe.enabled` | Enable livenessProbe | `true` | -| `notary.signer.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `10` | -| `notary.signer.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `10` | -| `notary.signer.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `5` | -| `notary.signer.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `6` | -| `notary.signer.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` | -| `notary.signer.readinessProbe.enabled` | Enable readinessProbe | `true` | -| `notary.signer.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `10` | -| `notary.signer.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `10` | -| `notary.signer.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `5` | -| `notary.signer.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `6` | -| `notary.signer.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` | -| `notary.signer.lifecycleHooks` | LifecycleHook to set additional configuration at startup, e.g. LDAP settings via REST API. Evaluated as a template | `{}` | -| `notary.signer.customLivenessProbe` | Override default liveness probe | `{}` | -| `notary.signer.customReadinessProbe` | Override default readiness probe | `{}` | -| `notary.signer.automountServiceAccountToken` | Automount service account token | `false` | -| `notary.secretName` | Fill the name of a kubernetes secret if you want to use your own TLS certificate authority, certificate and private key for notary communications. The secret must contain keys named `notary-signer-ca.crt`, `notary-signer.key` and `notary-signer.crt` that contain the CA, certificate and private key. They will be generated if not set. | `""` | +| Name | Description | Value | +| ----------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------ | +| `notary.enabled` | Enable Notary | `true` | +| `notary.secretName` | Fill the name of a kubernetes secret if you want to use your own TLS certificate authority, certificate and private key for notary communications. The secret must contain keys named `notary-signer-ca.crt`, `notary-signer.key` and `notary-signer.crt` that contain the CA, certificate and private key. They will be generated if not set. | `""` | +| `notary.server.image.registry` | Harbor Notary Server image registry | `docker.io` | +| `notary.server.image.repository` | Harbor Notary Server image repository | `bitnami/harbor-notary-server` | +| `notary.server.image.tag` | Harbor Notary Server image tag (immutable tags are recommended) | `2.4.1-debian-10-r80` | +| `notary.server.image.pullPolicy` | Harbor Notary Server image pull policy | `IfNotPresent` | +| `notary.server.image.pullSecrets` | Harbor Notary Server image pull secrets | `[]` | +| `notary.server.image.debug` | Enable Harbor Notary Server image debug mode | `false` | +| `notary.server.command` | Override default container command (useful when using custom images) | `[]` | +| `notary.server.args` | Override default container args (useful when using custom images) | `[]` | +| `notary.server.extraEnvVars` | Array with extra environment variables to add Harbor Notary Server pods | `[]` | +| `notary.server.extraEnvVarsCM` | ConfigMap containing extra environment variables for Harbor Notary Server pods | `""` | +| `notary.server.extraEnvVarsSecret` | Secret containing extra environment variables (in case of sensitive data) for Harbor Notary Server pods | `""` | +| `notary.server.containerPorts.server` | Harbor Notary Server container port | `4443` | +| `notary.server.replicaCount` | Number of Harbor Notary Server replicas | `1` | +| `notary.server.livenessProbe.enabled` | Enable livenessProbe on Harbor Notary Server containers | `true` | +| `notary.server.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `20` | +| `notary.server.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `10` | +| `notary.server.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `5` | +| `notary.server.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `6` | +| `notary.server.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` | +| `notary.server.readinessProbe.enabled` | Enable readinessProbe on Harbor Notary Server containers | `true` | +| `notary.server.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `20` | +| `notary.server.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `10` | +| `notary.server.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `5` | +| `notary.server.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `6` | +| `notary.server.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` | +| `notary.server.startupProbe.enabled` | Enable startupProbe on Harbor Notary Server containers | `false` | +| `notary.server.startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `5` | +| `notary.server.startupProbe.periodSeconds` | Period seconds for startupProbe | `10` | +| `notary.server.startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `1` | +| `notary.server.startupProbe.failureThreshold` | Failure threshold for startupProbe | `15` | +| `notary.server.startupProbe.successThreshold` | Success threshold for startupProbe | `1` | +| `notary.server.customLivenessProbe` | Custom livenessProbe that overrides the default one | `{}` | +| `notary.server.customReadinessProbe` | Custom readinessProbe that overrides the default one | `{}` | +| `notary.server.customStartupProbe` | Custom startupProbe that overrides the default one | `{}` | +| `notary.server.resources.limits` | The resources limits for the Harbor Notary Server containers | `{}` | +| `notary.server.resources.requests` | The requested resources for the Harbor Notary Server containers | `{}` | +| `notary.server.podSecurityContext.enabled` | Enabled Harbor Notary Server pods' Security Context | `true` | +| `notary.server.podSecurityContext.fsGroup` | Set Harbor Notary Server pod's Security Context fsGroup | `1001` | +| `notary.server.containerSecurityContext.enabled` | Enabled Harbor Notary Server containers' Security Context | `true` | +| `notary.server.containerSecurityContext.runAsUser` | Set Harbor Notary Server containers' Security Context runAsUser | `1001` | +| `notary.server.containerSecurityContext.runAsNonRoot` | Set Harbor Notary Server containers' Security Context runAsNonRoot | `true` | +| `notary.server.updateStrategy.type` | Harbor Notary Server deployment strategy type - only really applicable for deployments with RWO PVs attached | `RollingUpdate` | +| `notary.server.updateStrategy.rollingUpdate` | Harbor Notary Server deployment rolling update configuration parameters | `{}` | +| `notary.server.lifecycleHooks` | LifecycleHook for the Harbor Notary Server container(s) to automate configuration before or after startup | `{}` | +| `notary.server.hostAliases` | Harbor Notary Server pods host aliases | `[]` | +| `notary.server.podLabels` | Add additional labels to the Harbor Notary Server pods (evaluated as a template) | `{}` | +| `notary.server.podAnnotations` | Annotations to add to the Harbor Notary Server pods (evaluated as a template) | `{}` | +| `notary.server.podAffinityPreset` | Harbor Notary Server Pod affinity preset. Ignored if `notary.server.affinity` is set. Allowed values: `soft` or `hard` | `""` | +| `notary.server.podAntiAffinityPreset` | Harbor Notary Server Pod anti-affinity preset. Ignored if `notary.server.affinity` is set. Allowed values: `soft` or `hard` | `soft` | +| `notary.server.nodeAffinityPreset.type` | Harbor Notary Server Node affinity preset type. Ignored if `notary.server.affinity` is set. Allowed values: `soft` or `hard` | `""` | +| `notary.server.nodeAffinityPreset.key` | Harbor Notary Server Node label key to match Ignored if `notary.server.affinity` is set. | `""` | +| `notary.server.nodeAffinityPreset.values` | Harbor Notary Server Node label values to match. Ignored if `notary.server.affinity` is set. | `[]` | +| `notary.server.affinity` | Harbor Notary Server Affinity for pod assignment | `{}` | +| `notary.server.nodeSelector` | Harbor Notary Server Node labels for pod assignment | `{}` | +| `notary.server.tolerations` | Harbor Notary Server Tolerations for pod assignment | `[]` | +| `notary.server.topologySpreadConstraints` | Topology Spread Constraints for pod assignment spread across your cluster among failure-domains. Evaluated as a template | `{}` | +| `notary.server.priorityClassName` | Priority Class Name | `""` | +| `notary.server.schedulerName` | Use an alternate scheduler, e.g. "stork". | `""` | +| `notary.server.sidecars` | Add additional sidecar containers to the Harbor Notary Server pods | `[]` | +| `notary.server.initContainers` | Add additional init containers to the Harbor Notary Server pods | `[]` | +| `notary.server.extraVolumeMounts` | Optionally specify extra list of additional volumeMounts for the Harbor Notary Server pods | `[]` | +| `notary.server.extraVolumes` | Optionally specify extra list of additional volumes for the Harbor Notary Server pods | `[]` | +| `notary.server.automountServiceAccountToken` | Automount service account token | `false` | +| `notary.signer.image.registry` | Harbor Notary Signer image registry | `docker.io` | +| `notary.signer.image.repository` | Harbor Notary Signer image repository | `bitnami/harbor-notary-signer` | +| `notary.signer.image.tag` | Harbor Notary Signer image tag (immutable tags are recommended) | `2.4.1-debian-10-r77` | +| `notary.signer.image.pullPolicy` | Harbor Notary Signer image pull policy | `IfNotPresent` | +| `notary.signer.image.pullSecrets` | Harbor Notary Signer image pull secrets | `[]` | +| `notary.signer.image.debug` | Enable Harbor Notary Signer image debug mode | `false` | +| `notary.signer.command` | Override default container command (useful when using custom images) | `[]` | +| `notary.signer.args` | Override default container args (useful when using custom images) | `[]` | +| `notary.signer.extraEnvVars` | Array with extra environment variables to add Harbor Notary Signer pods | `[]` | +| `notary.signer.extraEnvVarsCM` | ConfigMap containing extra environment variables for Harbor Notary Signer pods | `""` | +| `notary.signer.extraEnvVarsSecret` | Secret containing extra environment variables (in case of sensitive data) for Harbor Notary Signer pods | `""` | +| `notary.signer.containerPorts.signer` | Harbor Notary Signer container port | `7899` | +| `notary.signer.replicaCount` | Number of Harbor Notary Signer replicas | `1` | +| `notary.signer.livenessProbe.enabled` | Enable livenessProbe on Harbor Notary Signer containers | `true` | +| `notary.signer.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `20` | +| `notary.signer.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `10` | +| `notary.signer.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `5` | +| `notary.signer.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `6` | +| `notary.signer.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` | +| `notary.signer.readinessProbe.enabled` | Enable readinessProbe on Harbor Notary Signer containers | `true` | +| `notary.signer.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `20` | +| `notary.signer.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `10` | +| `notary.signer.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `5` | +| `notary.signer.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `6` | +| `notary.signer.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` | +| `notary.signer.startupProbe.enabled` | Enable startupProbe on Harbor Notary Signer containers | `false` | +| `notary.signer.startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `5` | +| `notary.signer.startupProbe.periodSeconds` | Period seconds for startupProbe | `10` | +| `notary.signer.startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `1` | +| `notary.signer.startupProbe.failureThreshold` | Failure threshold for startupProbe | `15` | +| `notary.signer.startupProbe.successThreshold` | Success threshold for startupProbe | `1` | +| `notary.signer.customLivenessProbe` | Custom livenessProbe that overrides the default one | `{}` | +| `notary.signer.customReadinessProbe` | Custom readinessProbe that overrides the default one | `{}` | +| `notary.signer.customStartupProbe` | Custom startupProbe that overrides the default one | `{}` | +| `notary.signer.resources.limits` | The resources limits for the Harbor Notary Signer containers | `{}` | +| `notary.signer.resources.requests` | The requested resources for the Harbor Notary Signer containers | `{}` | +| `notary.signer.podSecurityContext.enabled` | Enabled Harbor Notary Signer pods' Security Context | `true` | +| `notary.signer.podSecurityContext.fsGroup` | Set Harbor Notary Signer pod's Security Context fsGroup | `1001` | +| `notary.signer.containerSecurityContext.enabled` | Enabled Harbor Notary Signer containers' Security Context | `true` | +| `notary.signer.containerSecurityContext.runAsUser` | Set Harbor Notary Signer containers' Security Context runAsUser | `1001` | +| `notary.signer.containerSecurityContext.runAsNonRoot` | Set Harbor Notary Signer containers' Security Context runAsNonRoot | `true` | +| `notary.signer.updateStrategy.type` | Harbor Notary Signer deployment strategy type - only really applicable for deployments with RWO PVs attached | `RollingUpdate` | +| `notary.signer.updateStrategy.rollingUpdate` | Harbor Notary Signer deployment rolling update configuration parameters | `{}` | +| `notary.signer.lifecycleHooks` | LifecycleHook for the Harbor Notary Signer container(s) to automate configuration before or after startup | `{}` | +| `notary.signer.hostAliases` | Harbor Notary Signer pods host aliases | `[]` | +| `notary.signer.podLabels` | Add additional labels to the Harbor Notary Signer pods (evaluated as a template) | `{}` | +| `notary.signer.podAnnotations` | Annotations to add to the Harbor Notary Signer pods (evaluated as a template) | `{}` | +| `notary.signer.podAffinityPreset` | Harbor Notary Signer Pod affinity preset. Ignored if `notary.signer.affinity` is set. Allowed values: `soft` or `hard` | `""` | +| `notary.signer.podAntiAffinityPreset` | Harbor Notary Signer Pod anti-affinity preset. Ignored if `notary.signer.affinity` is set. Allowed values: `soft` or `hard` | `soft` | +| `notary.signer.nodeAffinityPreset.type` | Harbor Notary Signer Node affinity preset type. Ignored if `notary.signer.affinity` is set. Allowed values: `soft` or `hard` | `""` | +| `notary.signer.nodeAffinityPreset.key` | Harbor Notary Signer Node label key to match Ignored if `notary.signer.affinity` is set. | `""` | +| `notary.signer.nodeAffinityPreset.values` | Harbor Notary Signer Node label values to match. Ignored if `notary.signer.affinity` is set. | `[]` | +| `notary.signer.affinity` | Harbor Notary Signer Affinity for pod assignment | `{}` | +| `notary.signer.nodeSelector` | Harbor Notary Signer Node labels for pod assignment | `{}` | +| `notary.signer.tolerations` | Harbor Notary Signer Tolerations for pod assignment | `[]` | +| `notary.signer.topologySpreadConstraints` | Topology Spread Constraints for pod assignment spread across your cluster among failure-domains. Evaluated as a template | `{}` | +| `notary.signer.priorityClassName` | Priority Class Name | `""` | +| `notary.signer.schedulerName` | Use an alternate scheduler, e.g. "stork". | `""` | +| `notary.signer.sidecars` | Add additional sidecar containers to the Harbor Notary Signer pods | `[]` | +| `notary.signer.initContainers` | Add additional init containers to the Harbor Notary Signer pods | `[]` | +| `notary.signer.extraVolumeMounts` | Optionally specify extra list of additional volumeMounts for the Harbor Notary Signer pods | `[]` | +| `notary.signer.extraVolumes` | Optionally specify extra list of additional volumes for the Harbor Notary Signer pods | `[]` | +| `notary.signer.automountServiceAccountToken` | Automount service account token | `false` | +| `notary.service.ports.server` | Harbor Notary server service port | `4443` | +| `notary.service.ports.signer` | Harbor Notary signer service port | `7899` | -### Harbor Trivy Parameters +### Harbor Adapter Trivy Parameters -| Name | Description | Value | -| ------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------- | -| `trivyImage.registry` | Registry for trivy image | `docker.io` | -| `trivyImage.repository` | Repository for trivy image | `bitnami/harbor-adapter-trivy` | -| `trivyImage.tag` | Tag for trivy image | `2.4.1-debian-10-r28` | -| `trivyImage.pullPolicy` | Harbor trivy image pull policy | `IfNotPresent` | -| `trivyImage.pullSecrets` | Specify docker-registry secret names as an array | `[]` | -| `trivyImage.debug` | Specify if debug logs should be enabled | `false` | -| `trivy.enabled` | Enable Trivy | `true` | -| `trivy.replicas` | The replica count | `1` | -| `trivy.command` | Override default container command (useful when using custom images) | `[]` | -| `trivy.args` | Override default container args (useful when using custom images) | `[]` | -| `trivy.tls.existingSecret` | Name of a secret with the certificates for internal TLS access. Requires internalTLS.enabled to be set to true. If this values is not set it will be automatically generated | `""` | -| `trivy.updateStrategy.type` | Update strategy | `RollingUpdate` | -| `trivy.debugMode` | The flag to enable Trivy debug mode | `false` | -| `trivy.vulnType` | Comma-separated list of vulnerability types. Possible values `os` and `library`. | `os,library` | -| `trivy.automountServiceAccountToken` | Automount service account token in the Trivy containers | `false` | -| `trivy.severity` | Comma-separated list of severities to be checked | `UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL` | -| `trivy.ignoreUnfixed` | The flag to display only fixed vulnerabilities | `false` | -| `trivy.insecure` | The flag to skip verifying registry certificate | `false` | -| `trivy.gitHubToken` | The GitHub access token to download Trivy DB | `""` | -| `trivy.skipUpdate` | The flag to disable Trivy DB downloads from GitHub | `false` | -| `trivy.cacheDir` | Directory to store the cache | `/bitnami/harbor-adapter-trivy/.cache` | -| `trivy.resources` | The resources to allocate for container | `{}` | -| `trivy.extraEnvVars` | Array containing extra env vars | `[]` | -| `trivy.extraEnvVarsCM` | ConfigMap containing extra env vars | `""` | -| `trivy.extraEnvVarsSecret` | Secret containing extra env vars (in case of sensitive data) | `""` | -| `trivy.extraVolumes` | Array of extra volumes to be added to the deployment (evaluated as template). Requires setting `extraVolumeMounts` | `[]` | -| `trivy.extraVolumeMounts` | Array of extra volume mounts to be added to the container (evaluated as template). Normally used with `extraVolumes`. | `[]` | -| `trivy.hostAliases` | Specify hostAliases for the Pod to use | `[]` | -| `trivy.initContainers` | Add additional init containers to the pod (evaluated as a template) | `[]` | -| `trivy.sidecars` | Attach additional containers to the pod (evaluated as a template) | `[]` | -| `trivy.livenessProbe.enabled` | Enable livenessProbe | `true` | -| `trivy.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `20` | -| `trivy.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `10` | -| `trivy.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `5` | -| `trivy.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `6` | -| `trivy.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` | -| `trivy.readinessProbe.enabled` | Enable readinessProbe | `true` | -| `trivy.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `20` | -| `trivy.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `10` | -| `trivy.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `5` | -| `trivy.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `6` | -| `trivy.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` | -| `trivy.lifecycleHooks` | LifecycleHook to set additional configuration at startup, e.g. LDAP settings via REST API. Evaluated as a template | `{}` | -| `trivy.customLivenessProbe` | Override default liveness probe | `{}` | -| `trivy.customReadinessProbe` | Override default readiness probe | `{}` | -| `trivy.podAffinityPreset` | Trivy Pod affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `""` | -| `trivy.podAntiAffinityPreset` | Trivy Pod anti-affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `soft` | -| `trivy.nodeAffinityPreset.type` | Trivy Node affinity preset type. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `""` | -| `trivy.nodeAffinityPreset.key` | Trivy Node label key to match Ignored if `affinity` is set. | `""` | -| `trivy.nodeAffinityPreset.values` | Trivy Node label values to match. Ignored if `affinity` is set. | `[]` | -| `trivy.affinity` | Trivy Affinity for pod assignment | `{}` | -| `trivy.priorityClassName` | Trivy pods Priority Class Name | `""` | -| `trivy.nodeSelector` | Trivy Node labels for pod assignment | `{}` | -| `trivy.tolerations` | Trivy Tolerations for pod assignment | `[]` | -| `trivy.podLabels` | Add additional labels to the pod (evaluated as a template) | `{}` | -| `trivy.podAnnotations` | Annotations to add to the trivy pod | `{}` | +| Name | Description | Value | +| --------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------ | -------------------------------------- | +| `trivy.image.registry` | Harbor Adapter Trivy image registry | `docker.io` | +| `trivy.image.repository` | Harbor Adapter Trivy image repository | `bitnami/harbor-adapter-trivy` | +| `trivy.image.tag` | Harbor Adapter Trivy image tag (immutable tags are recommended) | `2.4.1-debian-10-r75` | +| `trivy.image.pullPolicy` | Harbor Adapter Trivy image pull policy | `IfNotPresent` | +| `trivy.image.pullSecrets` | Harbor Adapter Trivy image pull secrets | `[]` | +| `trivy.image.debug` | Enable Harbor Adapter Trivy image debug mode | `false` | +| `trivy.enabled` | Enable Trivy | `true` | +| `trivy.debugMode` | The flag to enable Trivy debug mode | `false` | +| `trivy.vulnType` | Comma-separated list of vulnerability types. Possible values `os` and `library`. | `os,library` | +| `trivy.severity` | Comma-separated list of severities to be checked | `UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL` | +| `trivy.ignoreUnfixed` | The flag to display only fixed vulnerabilities | `false` | +| `trivy.insecure` | The flag to skip verifying registry certificate | `false` | +| `trivy.gitHubToken` | The GitHub access token to download Trivy DB | `""` | +| `trivy.skipUpdate` | The flag to disable Trivy DB downloads from GitHub | `false` | +| `trivy.cacheDir` | Directory to store the cache | `/bitnami/harbor-adapter-trivy/.cache` | +| `trivy.tls.existingSecret` | Name of an existing secret with the certificates for internal TLS access | `""` | +| `trivy.command` | Override default container command (useful when using custom images) | `[]` | +| `trivy.args` | Override default container args (useful when using custom images) | `[]` | +| `trivy.extraEnvVars` | Array with extra environment variables to add Trivy pods | `[]` | +| `trivy.extraEnvVarsCM` | ConfigMap containing extra environment variables for Trivy pods | `""` | +| `trivy.extraEnvVarsSecret` | Secret containing extra environment variables (in case of sensitive data) for Trivy pods | `""` | +| `trivy.containerPorts.http` | Trivy HTTP container port | `8080` | +| `trivy.containerPorts.https` | Trivy HTTPS container port | `8443` | +| `trivy.replicaCount` | Number of Trivy replicas | `1` | +| `trivy.livenessProbe.enabled` | Enable livenessProbe on Trivy containers | `true` | +| `trivy.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `20` | +| `trivy.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `10` | +| `trivy.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `5` | +| `trivy.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `6` | +| `trivy.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` | +| `trivy.readinessProbe.enabled` | Enable readinessProbe on Trivy containers | `true` | +| `trivy.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `20` | +| `trivy.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `10` | +| `trivy.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `5` | +| `trivy.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `6` | +| `trivy.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` | +| `trivy.startupProbe.enabled` | Enable startupProbe on Trivy containers | `false` | +| `trivy.startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `5` | +| `trivy.startupProbe.periodSeconds` | Period seconds for startupProbe | `10` | +| `trivy.startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `1` | +| `trivy.startupProbe.failureThreshold` | Failure threshold for startupProbe | `15` | +| `trivy.startupProbe.successThreshold` | Success threshold for startupProbe | `1` | +| `trivy.customLivenessProbe` | Custom livenessProbe that overrides the default one | `{}` | +| `trivy.customReadinessProbe` | Custom readinessProbe that overrides the default one | `{}` | +| `trivy.customStartupProbe` | Custom startupProbe that overrides the default one | `{}` | +| `trivy.resources.limits` | The resources limits for the Trivy containers | `{}` | +| `trivy.resources.requests` | The requested resources for the Trivy containers | `{}` | +| `trivy.podSecurityContext.enabled` | Enabled Trivy pods' Security Context | `true` | +| `trivy.podSecurityContext.fsGroup` | Set Trivy pod's Security Context fsGroup | `1001` | +| `trivy.containerSecurityContext.enabled` | Enabled Trivy containers' Security Context | `true` | +| `trivy.containerSecurityContext.runAsUser` | Set Trivy containers' Security Context runAsUser | `1001` | +| `trivy.containerSecurityContext.runAsNonRoot` | Set Trivy containers' Security Context runAsNonRoot | `true` | +| `trivy.updateStrategy.type` | Trivy deployment strategy type - only really applicable for deployments with RWO PVs attached | `RollingUpdate` | +| `trivy.updateStrategy.rollingUpdate` | Trivy deployment rolling update configuration parameters | `{}` | +| `trivy.lifecycleHooks` | LifecycleHook for the Trivy container(s) to automate configuration before or after startup | `{}` | +| `trivy.hostAliases` | Trivy pods host aliases | `[]` | +| `trivy.podLabels` | Add additional labels to the Trivy pods (evaluated as a template) | `{}` | +| `trivy.podAnnotations` | Annotations to add to the Trivy pods (evaluated as a template) | `{}` | +| `trivy.podAffinityPreset` | Trivy Pod affinity preset. Ignored if `trivy.affinity` is set. Allowed values: `soft` or `hard` | `""` | +| `trivy.podAntiAffinityPreset` | Trivy Pod anti-affinity preset. Ignored if `trivy.affinity` is set. Allowed values: `soft` or `hard` | `soft` | +| `trivy.nodeAffinityPreset.type` | Trivy Node affinity preset type. Ignored if `trivy.affinity` is set. Allowed values: `soft` or `hard` | `""` | +| `trivy.nodeAffinityPreset.key` | Trivy Node label key to match Ignored if `trivy.affinity` is set. | `""` | +| `trivy.nodeAffinityPreset.values` | Trivy Node label values to match. Ignored if `trivy.affinity` is set. | `[]` | +| `trivy.affinity` | Trivy Affinity for pod assignment | `{}` | +| `trivy.nodeSelector` | Trivy Node labels for pod assignment | `{}` | +| `trivy.tolerations` | Trivy Tolerations for pod assignment | `[]` | +| `trivy.topologySpreadConstraints` | Topology Spread Constraints for pod assignment spread across your cluster among failure-domains. Evaluated as a template | `{}` | +| `trivy.priorityClassName` | Priority Class Name | `""` | +| `trivy.schedulerName` | Use an alternate scheduler, e.g. "stork". | `""` | +| `trivy.sidecars` | Add additional sidecar containers to the Trivy pods | `[]` | +| `trivy.initContainers` | Add additional init containers to the Trivy pods | `[]` | +| `trivy.extraVolumeMounts` | Optionally specify extra list of additional volumeMounts for the Trivy pods | `[]` | +| `trivy.extraVolumes` | Optionally specify extra list of additional volumes for the Trivy pods | `[]` | +| `trivy.automountServiceAccountToken` | Automount service account token | `false` | +| `trivy.service.ports.http` | Trivy HTTP service port | `8080` | +| `trivy.service.ports.https` | Trivy HTTPS service port | `8443` | ### PostgreSQL Parameters -| Name | Description | Value | -| --------------------------------------- | --------------------------------------------------------------------------------------------------------- | ------------------------------ | -| `postgresql.enabled` | If external database is used, set it to `false` | `true` | -| `postgresql.nameOverride` | String to partially override common.names.fullname template with a string (will prepend the release name) | `""` | -| `postgresql.postgresqlUsername` | Postgresql username | `postgres` | -| `postgresql.postgresqlPassword` | Postgresql password | `not-secure-database-password` | -| `postgresql.existingSecret` | Set Postgresql password via an existing secret | `""` | -| `postgresql.postgresqlExtendedConf` | Extended runtime config parameters (appended to main or default configuration) | `{}` | -| `postgresql.replication.enabled` | Enable replicated postgresql | `false` | -| `postgresql.persistence.enabled` | Enable persistence for PostgreSQL | `true` | -| `postgresql.initdbScripts` | Initdb scripts to create Harbor databases | `{}` | -| `externalDatabase.host` | Host of the external database | `localhost` | -| `externalDatabase.user` | Existing username in the external db | `bn_harbor` | -| `externalDatabase.password` | Password for the above username | `""` | -| `externalDatabase.port` | Port of the external database | `5432` | -| `externalDatabase.sslmode` | External database ssl mode | `disable` | -| `externalDatabase.coreDatabase` | External database name for core | `""` | -| `externalDatabase.clairDatabase` | External database name for clair | `""` | -| `externalDatabase.clairUsername` | External database username for clair | `""` | -| `externalDatabase.clairPassword` | External database password for clair | `""` | -| `externalDatabase.notaryServerDatabase` | External database name for notary server | `""` | -| `externalDatabase.notaryServerUsername` | External database username for notary server | `""` | -| `externalDatabase.notaryServerPassword` | External database password for notary server | `""` | -| `externalDatabase.notarySignerDatabase` | External database name for notary signer | `""` | -| `externalDatabase.notarySignerUsername` | External database username for notary signer | `""` | -| `externalDatabase.notarySignerPassword` | External database password for notary signer | `""` | +| Name | Description | Value | +| ------------------------------------------ | ------------------------------------------------------------------------------------------------------ | ------------------------------ | +| `postgresql.enabled` | Switch to enable or disable the PostgreSQL helm chart | `true` | +| `postgresql.auth.enablePostgresUser` | Assign a password to the "postgres" admin user. Otherwise, remote access will be blocked for this user | `true` | +| `postgresql.auth.postgresPassword` | Password for the "postgres" admin user | `not-secure-database-password` | +| `postgresql.auth.existingSecret` | Name of existing secret to use for PostgreSQL credentials | `""` | +| `postgresql.architecture` | PostgreSQL architecture (`standalone` or `replication`) | `standalone` | +| `postgresql.primary.extendedConfiguration` | Extended PostgreSQL Primary configuration (appended to main or default configuration) | `max_connections = 1024 +` | +| `postgresql.primary.initdb.scripts` | Initdb scripts to create Harbor databases | `{}` | +| `postgresql.image.registry` | PostgreSQL image registry | `docker.io` | +| `postgresql.image.repository` | PostgreSQL image repository | `bitnami/postgresql` | +| `postgresql.image.tag` | PostgreSQL image tag (immutable tags are recommended) | `13.6.0-debian-10-r18` | +| `externalDatabase.host` | Database host | `localhost` | +| `externalDatabase.port` | Database port number | `5432` | +| `externalDatabase.user` | Non-root username for Harbor | `bn_harbor` | +| `externalDatabase.password` | Password for the non-root username for Harbor | `""` | +| `externalDatabase.sslmode` | External database ssl mode | `disable` | +| `externalDatabase.coreDatabase` | External database name for core | `""` | +| `externalDatabase.clairDatabase` | External database name for clair | `""` | +| `externalDatabase.clairUsername` | External database username for clair | `""` | +| `externalDatabase.clairPassword` | External database password for clair | `""` | +| `externalDatabase.notaryServerDatabase` | External database name for notary server | `""` | +| `externalDatabase.notaryServerUsername` | External database username for notary server | `""` | +| `externalDatabase.notaryServerPassword` | External database password for notary server | `""` | +| `externalDatabase.notarySignerDatabase` | External database name for notary signer | `""` | +| `externalDatabase.notarySignerUsername` | External database username for notary signer | `""` | +| `externalDatabase.notarySignerPassword` | External database password for notary signer | `""` | -### Redis™ Parameters +### Redis™ parameters -| Name | Description | Value | -| ----------------------------------------- | --------------------------------------------------------------------------------------------------------- | ------------ | -| `redis.enabled` | If external redis is used, set it to `false` | `true` | -| `redis.nameOverride` | String to partially override common.names.fullname template with a string (will prepend the release name) | `""` | -| `redis.auth.enabled` | Use redis password | `false` | -| `redis.auth.password` | Redis password | `""` | -| `redis.architecture` | Cluster settings | `standalone` | -| `redis.master.persistence.enabled` | Enable persistence for master Redis | `true` | -| `redis.master.priorityClassName` | Redis pods Priority Class Name | `""` | -| `redis.replica.persistence.enabled` | Enable persistence for replica Redis | `true` | -| `externalRedis.host` | Host of the external redis | `localhost` | -| `externalRedis.port` | Port of the external redis | `6379` | -| `externalRedis.sentinel.enabled` | If external redis with sentinal is used, set it to `true` | `false` | -| `externalRedis.sentinel.masterSet` | Name of sentinel masterSet if sentinel is used | `mymaster` | -| `externalRedis.sentinel.hosts` | Sentinel hosts and ports in the format | `""` | -| `externalRedis.password` | Password for the external redis | `""` | -| `externalRedis.coreDatabaseIndex` | Index for core database | `0` | -| `externalRedis.jobserviceDatabaseIndex` | Index for jobservice database | `1` | -| `externalRedis.registryDatabaseIndex` | Index for registry database | `2` | -| `externalRedis.chartmuseumDatabaseIndex` | Index for chartmuseum database | `3` | -| `externalRedis.clairAdapterDatabaseIndex` | Index for chartmuseum database | `4` | -| `externalRedis.trivyAdapterDatabaseIndex` | Index for chartmuseum database | `5` | +| Name | Description | Value | +| ----------------------------------------- | ------------------------------------------------------------------------ | ------------ | +| `redis.enabled` | Switch to enable or disable the Redis™ helm | `true` | +| `redis.auth.enabled` | Enable password authentication | `false` | +| `redis.auth.password` | Redis™ password | `""` | +| `redis.auth.existingSecret` | The name of an existing secret with Redis™ credentials | `""` | +| `redis.architecture` | Redis™ architecture. Allowed values: `standalone` or `replication` | `standalone` | +| `externalRedis.host` | Redis™ host | `localhost` | +| `externalRedis.port` | Redis™ port number | `6379` | +| `externalRedis.password` | Redis™ password | `""` | +| `externalRedis.coreDatabaseIndex` | Index for core database | `0` | +| `externalRedis.jobserviceDatabaseIndex` | Index for jobservice database | `1` | +| `externalRedis.registryDatabaseIndex` | Index for registry database | `2` | +| `externalRedis.chartmuseumDatabaseIndex` | Index for chartmuseum database | `3` | +| `externalRedis.clairAdapterDatabaseIndex` | Index for chartmuseum database | `4` | +| `externalRedis.trivyAdapterDatabaseIndex` | Index for chartmuseum database | `5` | +| `externalRedis.sentinel.enabled` | If external redis with sentinal is used, set it to `true` | `false` | +| `externalRedis.sentinel.masterSet` | Name of sentinel masterSet if sentinel is used | `mymaster` | +| `externalRedis.sentinel.hosts` | Sentinel hosts and ports in the format | `""` | Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example, ```console $ helm install my-release \ - --set harborAdminPassword=password \ + --set adminPassword=password \ bitnami/harbor ``` @@ -948,13 +1194,33 @@ It is strongly recommended to use immutable tags in a production environment. Th Bitnami will release a new chart updating its containers if a new version of the main container, significant changes, or critical vulnerabilities exist. -### Configure the way how to expose Harbor service: +### Configure the way how to expose Harbor core -- **Ingress**: The ingress controller must be installed in the Kubernetes cluster. - **Notes:** if the TLS is disabled, the port must be included in the command when pulling/pushing images. Refer to issue [#5291](https://github.com/goharbor/harbor/issues/5291) for the detail. -- **ClusterIP**: Exposes the service on a cluster-internal IP. Choosing this value makes the service only reachable from within the cluster. -- **NodePort**: Exposes the service on each Node's IP at a static port (the NodePort). You'll be able to contact the NodePort service, from outside the cluster, by requesting `NodeIP:NodePort`. -- **LoadBalancer**: Exposes the service externally using a cloud provider's load balancer. +You can expose Harbor core using two methods: + +- An Ingress Controller, `exposureType` should be set to `ingress`. + - An ingress controller must be installed in the Kubernetes cluster. + - If the TLS is disabled, the port must be included in the command when pulling/pushing images. Refer to issue [#5291](https://github.com/goharbor/harbor/issues/5291) for the detail. +- An NGINX Proxy, `exposureType` should be set to `proxy`. There are three ways to do so depending on the NGINX Proxy service type: + - **ClusterIP**: Exposes the service on a cluster-internal IP. Choosing this value makes the service only reachable from within the cluster: + - **NodePort**: Exposes the service on each Node's IP at a static port (the NodePort). You'll be able to contact the NodePort service, from outside the cluster, by requesting `NodeIP:NodePort`. + - **LoadBalancer**: Exposes the service externally using a cloud provider's load balancer. + +### Configure the external URL + +The external URL for Harbor core service is used to: + +1. populate the docker/helm commands showed on portal +2. populate the token service URL returned to docker/notary client + +Format: `protocol://domain[:port]`. Usually: + +- if expose Harbor core service via Ingress, the `domain` should be the value of `ingress.core.hostname`. +- if expose Harbor core via NGINX proxy using a `ClusterIP` service type, the `domain` should be the value of `service.clusterIP`. +- if expose Harbor core via NGINX proxy using a `NodePort` service type, the `domain` should be the IP address of one Kubernetes node. +- if expose Harbor core via NGINX proxy using a `LoadBalancer` service type, set the `domain` as your own domain name and add a CNAME record to map the domain name to the one you got from the cloud provider. + +If Harbor is deployed behind the proxy, set it as the URL of proxy. ### Sidecars and Init Containers @@ -997,29 +1263,13 @@ core: Alternatively, you can use a ConfigMap or a Secret with the environment variables. To do so, use the `extraEnvVarsCM` or the `extraEnvVarsSecret` values inside each component subsection. -### Configure the external URL: - -The external URL for Harbor core service is used to: - -1. populate the docker/helm commands showed on portal -2. populate the token service URL returned to docker/notary client - -Format: `protocol://domain[:port]`. Usually: - -- if expose the service via `Ingress`, the `domain` should be the value of `ingress.hosts.core` -- if expose the service via `ClusterIP`, the `domain` should be the value of `service.clusterIP.name` -- if expose the service via `NodePort`, the `domain` should be the IP address of one Kubernetes node -- if expose the service via `LoadBalancer`, set the `domain` as your own domain name and add a CNAME record to map the domain name to the one you got from the cloud provider - -If Harbor is deployed behind the proxy, set it as the URL of proxy. - -### Configure data persistence: +### Configure data persistence - **Disable**: The data does not survive the termination of a pod. - **Persistent Volume Claim(default)**: A default `StorageClass` is needed in the Kubernetes cluster to dynamically provision the volumes. Specify another StorageClass in the `storageClass` or set `existingClaim` if you have already existing persistent volumes to use. - **External Storage(only for images and charts)**: For images and charts, the external storages are supported: `azure`, `gcs`, `s3` `swift` and `oss`. -### Configure the secrets: +### Configure the secrets - **Secret keys**: Secret keys are used for secure communication between components. Fill `core.secret`, `jobservice.secret` and `registry.secret` to configure. - **Certificates**: Used for token encryption/decryption. Fill `core.secretName` to configure. @@ -1047,170 +1297,7 @@ Find more information about how to deal with common errors related to Bitnami's ## Upgrading -> NOTE: In you are upgrading an installation that contains a high amount of data, it is recommended to disable the liveness/readiness probes as the migration can take a substantial amount of time. - -### To 11.0.0 - -This major update the Redis™ subchart to its newest major, 15.0.0. [Here](https://github.com/bitnami/charts/tree/master/bitnami/redis#to-1500) you can find more info about the specific changes. - -### To 10.0.0 - -This major updates the Redis™ subchart to it newest major, 14.0.0, which contains breaking changes. For more information on this subchart's major and the steps needed to migrate your data from your previous release, please refer to [Redis™ upgrade notes.](https://github.com/bitnami/charts/tree/master/bitnami/redis#to-1400). - -### To 9.7.0 - -This new version of the chart bumps the version of Harbor to [`2.2.0`](https://github.com/goharbor/harbor/releases/tag/v2.2.0) which deprecates built-in Clair. If you still want to use Clair, you will need to set `clair.enabled` to `true` and Clair scanner and the Harbor adapter will be deployed. Follow [these steps](https://goharbor.io/docs/latest/administration/vulnerability-scanning/pluggable-scanners) to add it as an additional interrogation service for Harbor. - -Please note that Clair might be fully deprecated from this chart in following updates. - -### To 9.0.0 - -[On November 13, 2020, Helm v2 support was formally finished](https://github.com/helm/charts#status-of-the-project), this major version is the result of the required changes applied to the Helm Chart to be able to incorporate the different features added in Helm v3 and to be consistent with the Helm project itself regarding the Helm v2 EOL. - -**What changes were introduced in this major version?** - -- Previous versions of this Helm Chart use `apiVersion: v1` (installable by both Helm 2 and 3), this Helm Chart was updated to `apiVersion: v2` (installable by Helm 3 only). [Here](https://helm.sh/docs/topics/charts/#the-apiversion-field) you can find more information about the `apiVersion` field. -- Move dependency information from the *requirements.yaml* to the *Chart.yaml* -- After running `helm dependency update`, a *Chart.lock* file is generated containing the same structure used in the previous *requirements.lock* -- The different fields present in the *Chart.yaml* file has been ordered alphabetically in a homogeneous way for all the Bitnami Helm Charts -- This chart depends on the **PostgreSQL 10** instead of **PostgreSQL 9**. Apart from the same changes that are described in this section, there are also other major changes due to the master/slave nomenclature was replaced by primary/readReplica. [Here](https://github.com/bitnami/charts/pull/4385) you can find more information about the changes introduced. - -**Considerations when upgrading to this version** - -- If you want to upgrade to this version using Helm v2, this scenario is not supported as this version doesn't support Helm v2 anymore -- If you installed the previous version with Helm v2 and wants to upgrade to this version with Helm v3, please refer to the [official Helm documentation](https://helm.sh/docs/topics/v2_v3_migration/#migration-use-cases) about migrating from Helm v2 to v3 -- If you want to upgrade to this version from a previous one installed with Helm v3, it should be done reusing the PVC used to hold the PostgreSQL data on your previous release. To do so, follow the instructions below (the following example assumes that the release name is `harbor`): - -> NOTE: Please, create a backup of your database before running any of those actions. - -##### Export secrets and required values to update - -```console -$ export HARBOR_ADMIN_PASSWORD=$(kubectl get secret --namespace default harbor-core-envvars -o jsonpath="{.data.HARBOR_ADMIN_PASSWORD}" | base64 --decode) -$ export POSTGRESQL_PASSWORD=$(kubectl get secret --namespace default harbor-postgresql -o jsonpath="{.data.postgresql-password}" | base64 --decode) -$ export POSTGRESQL_PVC=$(kubectl get pvc -l app.kubernetes.io/instance=harbor,app.kubernetes.io/name=postgresql,role=master -o jsonpath="{.items[0].metadata.name}") -``` - -##### Delete statefulsets - -Delete PostgreSQL statefulset. Notice the option `--cascade=false`: - -``` -$ kubectl delete statefulsets.apps harbor-postgresql --cascade=false -``` - -##### Upgrade the chart release - -```console -$ helm upgrade harbor bitnami/harbor \ - --set harborAdminPassword=$HARBOR_ADMIN_PASSWORD \ - --set postgresql.postgresqlPassword=$POSTGRESQL_PASSWORD \ - --set postgresql.persistence.existingClaim=$POSTGRESQL_PVC -``` - -##### Force new statefulset to create a new pod for postgresql - -```console -$ kubectl delete pod harbor-postgresql-0 -``` -Finally, you should see the lines below in MariaDB container logs: - -```console -$ kubectl logs $(kubectl get pods -l app.kubernetes.io/instance=postgresql,app.kubernetes.io/name=postgresql,role=primary -o jsonpath="{.items[0].metadata.name}") -... -postgresql 08:05:12.59 INFO ==> Deploying PostgreSQL with persisted data... -... -``` - -**Useful links** - -- https://docs.bitnami.com/tutorials/resolve-helm2-helm3-post-migration-issues/ -- https://helm.sh/docs/topics/v2_v3_migration/ -- https://helm.sh/blog/migrate-from-helm-v2-to-helm-v3/ - -### To 8.0.0 - -Redis™ dependency version was bumped to the new major version `11.x.x`, which introduced breaking changes regarding sentinel. By default, this Chart does not use of this feature and hence no issues are expected between upgrades. You may refer to [Redis™ Upgrading Notes](https://github.com/bitnami/charts/tree/master/bitnami/redis#to-1100) for further information. - -### To 7.0.0 - -This major version include a major change in the PostgreSQL subchart labeling. Backwards compatibility from previous versions to this one is not guarantee during the upgrade. - -You can find more information about the changes in the PostgreSQL subchart and a way to workaround the `helm upgrade` issue in the ["Upgrade to 9.0.0"](https://github.com/bitnami/charts/tree/master/bitnami/postgresql#900) section of the PostgreSQL README. - -### From 6.0.0 to 6.0.2 - -Due to an issue with Trivy volumeClaimTemplates, the upgrade needs to be done in two steps: - -- Upgrade the chart to 6.0.2 with `trivy.enabled=false` - -```console -$ helm upgrade bitnami/chart --version 6.0.2 --set trivy.enabled=false -``` - -- Execute a new upgrade setting `trivy.enabled=true` - -```console -$ helm upgrade bitnami/chart --set trivy.enabled=true -``` - -### To 6.0.0 - -The chart was changed to adapt to the common Bitnami chart standards. Now it includes common elements such as sidecar and init container support, custom commands, custom liveness/readiness probes, extra environment variables support, extra pod annotations and labels, among others. In addition, it adds a new Trivy deployment for image scanning. - -No issues are expected between upgrades but please double check the updated parameter list as some of them could have been renamed. Please pay special attention to the following changes: - -- `service.type=ingress` is not allowed anymore. Instead, set the value `ingress.enabled=true`. -- `secretKey` has been moved to `core.secretKey`. - -### To 4.0.0 - -PostgreSQL and Redis™ dependencies were updated to the use the latest major versions, `8.x.x` and `10.x.x`, respectively. These major versions do not include changes that should break backwards compatibilities, check the links below for more information: - -- [PostgreSQL Upgrade notes](https://github.com/bitnami/charts/blob/master/bitnami/postgresql/README.md#upgrade) -- [Redis™ Upgrade notes](https://github.com/bitnami/charts/blob/master/bitnami/redis/README.md#upgrading-an-existing-release-to-a-new-major-version) - -### To 3.0.0 - -Helm performs a lookup for the object based on its group (apps), version (v1), and kind (Deployment). Also known as its GroupVersionKind, or GVK. Changing the GVK is considered a compatibility breaker from Kubernetes' point of view, so you cannot "upgrade" those objects to the new GVK in-place. Earlier versions of Helm 3 did not perform the lookup correctly which has since been fixed to match the spec. - -In c085d396a0515be7217d65e92f4fbd474840908b the `apiVersion` of the deployment resources was updated to `apps/v1` in tune with the api's deprecated, resulting in compatibility breakage. - -This major version signifies this change. - -### To 2.0.0 - -In this version, two major changes were performed: - -- This **chart depends on the Redis™ 5 chart instead of Redis™ 4**. There is a breaking change that will affect releases with `metrics.enabled: true`, since the default tag for the exporter image is now `v1.x.x`. This introduces many changes including metrics names. You'll want to use [this dashboard](https://github.com/oliver006/redis_exporter/blob/master/contrib/grafana_prometheus_redis_dashboard.json) now. Please see the [redis_exporter github page](https://github.com/oliver006/redis_exporter#upgrading-from-0x-to-1x) for more details. -- This **chart depends on the PostgreSQL 11 chart instead of PostgreSQL 10**. You can find the main difference and notable changes in the following links: [https://www.postgresql.org/about/news/1894/](https://www.postgresql.org/about/news/1894/) and [https://www.postgresql.org/about/featurematrix/](https://www.postgresql.org/about/featurematrix/). - -For major releases of PostgreSQL, the internal data storage format is subject to change, thus complicating upgrades, you can see some errors like the following one in the logs: - -```bash -Welcome to the Bitnami postgresql container -Subscribe to project updates by watching https://github.com/bitnami/bitnami-docker-postgresql -Submit issues and feature requests at https://github.com/bitnami/bitnami-docker-postgresql/issues -Send us your feedback at containers@bitnami.com - -INFO ==> ** Starting PostgreSQL setup ** -NFO ==> Validating settings in POSTGRESQL_* env vars.. -INFO ==> Initializing PostgreSQL database... -INFO ==> postgresql.conf file not detected. Generating it... -INFO ==> pg_hba.conf file not detected. Generating it... -INFO ==> Deploying PostgreSQL with persisted data... -INFO ==> Configuring replication parameters -INFO ==> Loading custom scripts... -INFO ==> Enabling remote connections -INFO ==> Stopping PostgreSQL... -INFO ==> ** PostgreSQL setup finished! ** - -INFO ==> ** Starting PostgreSQL ** - [1] FATAL: database files are incompatible with server - [1] DETAIL: The data directory was initialized by PostgreSQL version 10, which is not compatible with this version 11.3. -``` - -In this case, you should migrate the data from the old PostgreSQL chart to the new one following an approach similar to that described in [this section](https://www.postgresql.org/docs/current/upgrading.html#UPGRADING-VIA-PGDUMPALL) from the official documentation. Basically, create a database dump in the old chart, move and restore it in the new one. +Refer to the [chart documentation for more information about how to upgrade from previous releases](https://docs.bitnami.com/kubernetes/infrastructure/harbor/administration/upgrade/). ## License diff --git a/bitnami/harbor/ci/values-production.yaml b/bitnami/harbor/ci/values-production.yaml index 6fdeab880..ceb06a0d8 100644 --- a/bitnami/harbor/ci/values-production.yaml +++ b/bitnami/harbor/ci/values-production.yaml @@ -1,15 +1,32 @@ # Test values file for generating all of the yaml and check that # the rendering is correct -ingress: - enabled: true - -volumePermissions: - enabled: true +exposureType: ingress internalTLS: enabled: true -redis: +ingress: + core: + hostname: core.harbor.domain + annotations: + kubernetes.io/ingress.class: nginx + ingress.kubernetes.io/ssl-redirect: 'true' + ingress.kubernetes.io/proxy-body-size: '0' + nginx.ingress.kubernetes.io/ssl-redirect: 'true' + nginx.ingress.kubernetes.io/proxy-body-size: '0' + tls: true + selfSigned: true + notary: + hostname: notary.harbor.domain + annotations: + ingress.kubernetes.io/ssl-redirect: 'true' + ingress.kubernetes.io/proxy-body-size: '0' + nginx.ingress.kubernetes.io/ssl-redirect: 'true' + nginx.ingress.kubernetes.io/proxy-body-size: '0' + kubernetes.io/ingress.class: nginx + tls: true + selfSigned: true + +volumePermissions: enabled: true - architecture: standalone diff --git a/bitnami/harbor/conf/clair.yaml b/bitnami/harbor/conf/clair.yaml index 1cdac9086..11c104b8e 100644 --- a/bitnami/harbor/conf/clair.yaml +++ b/bitnami/harbor/conf/clair.yaml @@ -8,9 +8,9 @@ clair: cachesize: 16384 api: # API server port - port: 6060 - healthport: 6061 + port: {{ .Values.clair.server.containerPorts.api }} + healthport: {{ .Values.clair.server.containerPorts.health }} # Deadline before an API request will respond with a 503 timeout: 300s updater: - interval: {{ .Values.clair.updatersInterval }}h + interval: {{ .Values.clair.updatersInterval }} diff --git a/bitnami/harbor/templates/NOTES.txt b/bitnami/harbor/templates/NOTES.txt index 1a41455ca..aaa1a0bfa 100644 --- a/bitnami/harbor/templates/NOTES.txt +++ b/bitnami/harbor/templates/NOTES.txt @@ -6,45 +6,45 @@ APP VERSION: {{ .Chart.AppVersion }} 1. Get the Harbor URL: -{{- if .Values.ingress.enabled }} +{{- if eq .Values.exposureType "ingress" }} You should be able to access your new Harbor installation through {{ include "harbor.externalUrl" . }} -{{- else if contains "LoadBalancer" .Values.service.type }} +{{- else if and (eq .Values.exposureType "proxy") (eq .Values.service.type "LoadBalancer") }} NOTE: It may take a few minutes for the LoadBalancer IP to be available. Watch the status with: 'kubectl get svc --namespace {{ .Release.Namespace }} -w {{ include "common.names.fullname" . }}' -{{- $port:=.Values.service.ports.http | toString }} - export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "common.names.fullname" . }} --template "{{ "{{ range (index .status.loadBalancer.ingress 0) }}{{ . }}{{ end }}" }}") - echo "Harbor URL: http://$SERVICE_IP{{- if ne $port "80" }}:{{ .Values.service.ports.http }}{{ end }}/" + {{- $port:=.Values.service.ports.http | toString }} + export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "common.names.fullname" . }} --template "{{ "{{ range (index .status.loadBalancer.ingress 0) }}{{ . }}{{ end }}" }}") + echo "Harbor URL: http://$SERVICE_IP{{- if ne $port "80" }}:{{ .Values.service.ports.http }}{{ end }}/" -{{- else if contains "ClusterIP" .Values.service.type }} +{{- else if and (eq .Values.exposureType "proxy") (eq .Values.service.type "ClusterIP") }} - {{- if .Values.service.tls.enabled }} + {{- if .Values.nginx.tls.enabled }} - echo "Harbor URL: https://127.0.0.1:8443/" - kubectl port-forward --namespace {{ .Release.Namespace }} svc/{{ include "common.names.fullname" . }} 8443:{{ .Values.service.ports.https }} + echo "Harbor URL: https://127.0.0.1:8443/" + kubectl port-forward --namespace {{ .Release.Namespace }} svc/{{ include "common.names.fullname" . }} 8443:{{ .Values.service.ports.https }} {{- else }} - echo "Harbor URL: http://127.0.0.1:8080/" - kubectl port-forward --namespace {{ .Release.Namespace }} svc/{{ include "common.names.fullname" . }} 8080:{{ .Values.service.ports.http }} + echo "Harbor URL: http://127.0.0.1:8080/" + kubectl port-forward --namespace {{ .Release.Namespace }} svc/{{ include "common.names.fullname" . }} 8080:{{ .Values.service.ports.http }} {{- end }} -{{- else if contains "NodePort" .Values.service.type }} +{{- else if and (eq .Values.exposureType "proxy") (eq .Values.service.type "NodePort") }} - export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "common.names.fullname" . }}) - export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}") - echo "Harbor URL: http://$NODE_IP:$NODE_PORT/" + export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "common.names.fullname" . }}) + export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}") + echo "Harbor URL: http://$NODE_IP:$NODE_PORT/" {{- end }} 2. Login with the following credentials to see your Harbor application echo Username: "admin" - echo Password: $(kubectl get secret --namespace {{ .Release.Namespace }} {{ template "harbor.core" . }}-envvars -o jsonpath="{.data.HARBOR_ADMIN_PASSWORD}" | base64 --decode) + echo Password: $(kubectl get secret --namespace {{ .Release.Namespace }} {{ printf "%s-envvars" (include "harbor.core" .) }} -o jsonpath="{.data.HARBOR_ADMIN_PASSWORD}" | base64 --decode) {{- if .Values.clair.enabled }} @@ -59,23 +59,3 @@ https://goharbor.io/docs/latest/administration/vulnerability-scanning/pluggable- {{ include "harbor.validateValues" . }} {{ include "harbor.checkRollingTags" . }} - -{{- $passwordValidationErrors := list -}} - -{{- $harborSecretName := printf "%s-envvars" (include "harbor.core" .) -}} -{{- $requiredAdminPassword := dict "valueKey" "harborAdminPassword" "secret" $harborSecretName "field" "HARBOR_ADMIN_PASSWORD" -}} -{{- $requiredHarborErrors := include "common.validations.values.multiple.empty" (dict "required" (list $requiredAdminPassword) "context" $) -}} -{{- $passwordValidationErrors = append $passwordValidationErrors $requiredHarborErrors -}} - -{{- $postgresqlSecretName := include "harbor.postgresql.fullname" . -}} -{{- $postgresqlPasswordValidationErrors := include "common.validations.values.postgresql.passwords" (dict "secret" $postgresqlSecretName "subchart" true "context" $) -}} -{{- $passwordValidationErrors = append $passwordValidationErrors $postgresqlPasswordValidationErrors -}} - -{{- if .Values.redis.auth.enabled -}} -{{- $redisSecretName := printf "%s-%s" .Release.Name "redis" -}} -{{- $requiredRedisPassword := dict "valueKey" "redis.auth.password" "secret" $redisSecretName "field" "redis-password" -}} -{{- $redisPasswordValidationErrors := include "common.validations.values.multiple.empty" (dict "required" (list $requiredRedisPassword) "context" $) -}} -{{- $passwordValidationErrors = append $passwordValidationErrors $redisPasswordValidationErrors -}} -{{- end -}} - -{{- include "common.errors.upgrade.passwords.empty" (dict "validationErrors" $passwordValidationErrors "context" $) -}} diff --git a/bitnami/harbor/templates/_helpers.tpl b/bitnami/harbor/templates/_helpers.tpl index 1ffea6924..6529b8db1 100644 --- a/bitnami/harbor/templates/_helpers.tpl +++ b/bitnami/harbor/templates/_helpers.tpl @@ -4,34 +4,31 @@ Expand the name of the chart. We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). */}} -{{- define "harbor.autoGenCert" -}} - {{- if and .Values.service.tls.enabled (not .Values.service.tls.existingSecret) -}} - {{- printf "true" -}} - {{- else -}} - {{- printf "false" -}} - {{- end -}} +{{/* +Set the http prefix if the externalURl doesn't have it +*/}} +{{- define "harbor.externalUrl" -}} +{{- if hasPrefix "http" .Values.externalURL -}} + {{- print .Values.externalURL -}} +{{- else if and (eq .Values.exposureType "proxy") .Values.nginx.tls.enabled -}} + {{- printf "https://%s" .Values.externalURL -}} +{{- else if and (eq .Values.exposureType "ingress") .Values.ingress.core.tls -}} + {{- printf "https://%s" .Values.externalURL -}} +{{- else -}} + {{- printf "http://%s" .Values.externalURL -}} {{- end -}} - -{{- define "harbor.autoGenCertForIngress" -}} - {{- if and (eq (include "harbor.autoGenCert" .) "true") .Values.ingress.enabled -}} - {{- printf "true" -}} - {{- else -}} - {{- printf "false" -}} - {{- end -}} {{- end -}} {{- define "harbor.autoGenCertForNginx" -}} - {{- if and (eq (include "harbor.autoGenCert" .) "true") (not .Values.ingress.enabled) -}} - {{- printf "true" -}} - {{- else -}} - {{- printf "false" -}} - {{- end -}} +{{- if and (eq .Values.exposureType "proxy") .Values.nginx.tls.enabled (not .Values.nginx.tls.existingSecret) -}} + {{- true -}} +{{- end -}} {{- end -}} {{- define "harbor.caBundleVolume" -}} - name: ca-bundle-certs secret: - secretName: {{ .Values.caBundleSecretName }} + secretName: {{ .Values.internalTLS.caBundleSecret }} {{- end -}} {{- define "harbor.caBundleVolumeMount" -}} @@ -40,187 +37,34 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this subPath: ca.crt {{- end -}} -{{/* Scheme for all components except notary because it only support http mode */}} -{{- define "harbor.component.scheme" -}} - {{- if .Values.internalTLS.enabled -}} - {{- printf "https" -}} - {{- else -}} - {{- printf "http" -}} - {{- end -}} -{{- end -}} - -{{/* Chartmuseum component container port */}} -{{- define "harbor.chartmuseum.containerPort" -}} - {{- if .Values.internalTLS.enabled -}} - {{- printf "9443" -}} - {{- else -}} - {{- printf "9999" -}} - {{- end -}} -{{- end -}} - -{{/* Chartmuseum component service port */}} -{{- define "harbor.chartmuseum.servicePort" -}} - {{- if .Values.internalTLS.enabled -}} - {{- printf "443" -}} - {{- else -}} - {{- printf "80" -}} - {{- end -}} -{{- end -}} - -{{/* Clair Adapter component container port */}} -{{- define "harbor.clairAdapter.containerPort" -}} - {{- if .Values.internalTLS.enabled -}} - {{- printf "8443" -}} - {{- else -}} - {{- printf "8080" -}} - {{- end -}} -{{- end -}} - -{{/* Clair Adapter component service port */}} -{{- define "harbor.clairAdapter.servicePort" -}} - {{- if .Values.internalTLS.enabled -}} - {{- printf "8443" -}} - {{- else -}} - {{- printf "8080" -}} - {{- end -}} -{{- end -}} - -{{/* Core component container port */}} -{{- define "harbor.core.containerPort" -}} - {{- if .Values.internalTLS.enabled -}} - {{- printf "8443" -}} - {{- else -}} - {{- printf "8080" -}} - {{- end -}} -{{- end -}} - -{{/* Core component service port */}} -{{- define "harbor.core.servicePort" -}} - {{- if .Values.internalTLS.enabled -}} - {{- printf "443" -}} - {{- else -}} - {{- printf "80" -}} - {{- end -}} -{{- end -}} - -{{/* Jobservice component container port */}} -{{- define "harbor.jobservice.containerPort" -}} - {{- if .Values.internalTLS.enabled -}} - {{- printf "8443" -}} - {{- else -}} - {{- printf "8080" -}} - {{- end -}} -{{- end -}} - -{{/* Jobservice component service port */}} -{{- define "harbor.jobservice.servicePort" -}} - {{- if .Values.internalTLS.enabled -}} - {{- printf "443" -}} - {{- else -}} - {{- printf "80" -}} - {{- end -}} -{{- end -}} - -{{/* Portal component container port */}} -{{- define "harbor.portal.containerPort" -}} - {{- if .Values.internalTLS.enabled -}} - {{- printf "8443" -}} - {{- else -}} - {{- printf "8080" -}} - {{- end -}} -{{- end -}} - -{{/* Portal component service port */}} -{{- define "harbor.portal.servicePort" -}} - {{- if .Values.internalTLS.enabled -}} - {{- printf "443" -}} - {{- else -}} - {{- printf "80" -}} - {{- end -}} -{{- end -}} - -{{/* Registry server component container port */}} -{{- define "harbor.registry.containerPort" -}} - {{- if .Values.internalTLS.enabled -}} - {{- printf "5443" -}} - {{- else -}} - {{- printf "5000" -}} - {{- end -}} -{{- end -}} - -{{/* Registry server component service port */}} -{{- define "harbor.registry.servicePort" -}} - {{- if .Values.internalTLS.enabled -}} - {{- printf "5443" -}} - {{- else -}} - {{- printf "5000" -}} - {{- end -}} -{{- end -}} - -{{/* RegistryCtl component container port */}} -{{- define "harbor.registryCtl.containerPort" -}} - {{- if .Values.internalTLS.enabled -}} - {{- printf "8443" -}} - {{- else -}} - {{- printf "8080" -}} - {{- end -}} -{{- end -}} - -{{/* RegistryCtl component service port */}} -{{- define "harbor.registryctl.servicePort" -}} - {{- if .Values.internalTLS.enabled -}} - {{- printf "8443" -}} - {{- else -}} - {{- printf "8080" -}} - {{- end -}} -{{- end -}} - -{{/* Trivy component container port */}} -{{- define "harbor.trivy.containerPort" -}} - {{- if .Values.internalTLS.enabled -}} - {{- printf "8443" -}} - {{- else -}} - {{- printf "8080" -}} - {{- end -}} -{{- end -}} - -{{/* Trivy component service port */}} -{{- define "harbor.trivy.servicePort" -}} - {{- if .Values.internalTLS.enabled -}} - {{- printf "8443" -}} - {{- else -}} - {{- printf "8080" -}} - {{- end -}} -{{- end -}} - -{{/* Clair Adadpter URL */}} +{{/* Harbor Adapter for Clair URL */}} {{- define "harbor.clairAdapter.url" -}} - {{- printf "%s://%s:%s" (include "harbor.component.scheme" .) (include "harbor.clair" .) (include "harbor.clairAdapter.servicePort" .) -}} + {{- printf "%s://%s:%d" (ternary "https" "http" .Values.internalTLS.enabled) (include "harbor.clair" .) (ternary .Values.clair.adapter.service.ports.https .Values.clair.adapter.service.ports.http .Values.internalTLS.enabled | int ) -}} {{- end -}} {{/* port is included in this url as a workaround for issue https://github.com/aquasecurity/harbor-scanner-trivy/issues/108 */}} {{- define "harbor.core.url" -}} - {{- printf "%s://%s:%s" (include "harbor.component.scheme" .) (include "harbor.core" .) (include "harbor.core.servicePort" .) -}} + {{- printf "%s://%s:%d" (ternary "https" "http" .Values.internalTLS.enabled) (include "harbor.core" .) (ternary .Values.core.service.ports.https .Values.core.service.ports.http .Values.internalTLS.enabled | int) -}} {{- end -}} {{- define "harbor.jobservice.url" -}} - {{- printf "%s://%s-jobservice" (include "harbor.component.scheme" .) (include "common.names.fullname" .) -}} + {{- printf "%s://%s-jobservice:%d" (ternary "https" "http" .Values.internalTLS.enabled) (include "common.names.fullname" .) (ternary .Values.jobservice.service.ports.https .Values.jobservice.service.ports.http .Values.internalTLS.enabled | int) -}} {{- end -}} {{- define "harbor.portal.url" -}} - {{- printf "%s://%s" (include "harbor.component.scheme" .) (include "harbor.portal" .) -}} + {{- printf "%s://%s:%d" (ternary "https" "http" .Values.internalTLS.enabled) (include "harbor.portal" .) (ternary .Values.portal.service.ports.https .Values.portal.service.ports.http .Values.internalTLS.enabled | int) -}} {{- end -}} {{- define "harbor.chartmuseum.url" -}} - {{- printf "%s://%s" (include "harbor.component.scheme" .) (include "harbor.chartmuseum" .) -}} + {{- printf "%s://%s:%d" (ternary "https" "http" .Values.internalTLS.enabled) (include "harbor.chartmuseum" .) (ternary .Values.chartmuseum.service.ports.https .Values.chartmuseum.service.ports.http .Values.internalTLS.enabled | int) -}} {{- end -}} {{- define "harbor.registry.url" -}} - {{- printf "%s://%s:%s" (include "harbor.component.scheme" .) (include "harbor.registry" .) (include "harbor.registry.servicePort" .) -}} + {{- printf "%s://%s:%d" (ternary "https" "http" .Values.internalTLS.enabled) (include "harbor.registry" .) (ternary .Values.registry.server.service.ports.https .Values.registry.server.service.ports.http .Values.internalTLS.enabled | int ) -}} {{- end -}} {{- define "harbor.registryCtl.url" -}} - {{- printf "%s://%s:%s" (include "harbor.component.scheme" .) (include "harbor.registry" .) (include "harbor.registryctl.servicePort" .) -}} + {{- printf "%s://%s:%d" (ternary "https" "http" .Values.internalTLS.enabled) (include "harbor.registry" .) (ternary .Values.registry.controller.service.ports.https .Values.registry.controller.service.ports.http .Values.internalTLS.enabled | int ) -}} {{- end -}} {{- define "harbor.tokenService.url" -}} @@ -228,7 +72,7 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this {{- end -}} {{- define "harbor.trivy.url" -}} - {{- printf "%s://%s:%s" (include "harbor.component.scheme" .) (include "harbor.trivy" .) (include "harbor.trivy.servicePort" .) -}} + {{- printf "%s://%s:%d" (ternary "https" "http" .Values.internalTLS.enabled) (include "harbor.trivy" .) (ternary .Values.trivy.service.ports.https .Values.trivy.service.ports.http .Values.internalTLS.enabled | int) -}} {{- end -}} {{- define "harbor.core.tls.secretName" -}} @@ -270,112 +114,63 @@ Create a default fully qualified postgresql name. We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). */}} {{- define "harbor.postgresql.fullname" -}} -{{- $name := default "postgresql" .Values.postgresql.nameOverride -}} -{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} +{{- include "common.names.dependency.fullname" (dict "chartName" "postgresql" "chartValues" .Values.postgresql "context" $) -}} {{- end -}} {{- define "harbor.database.host" -}} - {{- if eq .Values.postgresql.enabled true -}} - {{- template "harbor.postgresql.fullname" . }} - {{- else -}} - {{- .Values.externalDatabase.host -}} - {{- end -}} +{{- if eq .Values.postgresql.architecture "replication" }} + {{- ternary (printf "%s-primary" (include "harbor.postgresql.fullname" .)) .Values.externalDatabase.host .Values.postgresql.enabled -}} +{{- else }} + {{- ternary (include "harbor.postgresql.fullname" .) .Values.externalDatabase.host .Values.postgresql.enabled -}} +{{- end -}} {{- end -}} {{- define "harbor.database.port" -}} - {{- if eq .Values.postgresql.enabled true -}} - {{- printf "%s" "5432" -}} - {{- else -}} - {{- .Values.externalDatabase.port -}} - {{- end -}} +{{- ternary "5432" .Values.externalDatabase.port .Values.postgresql.enabled -}} {{- end -}} {{- define "harbor.database.username" -}} - {{- if eq .Values.postgresql.enabled true -}} - {{- .Values.postgresql.postgresqlUsername -}} - {{- else -}} - {{- .Values.externalDatabase.user -}} - {{- end -}} +{{- ternary "postgres" .Values.externalDatabase.user .Values.postgresql.enabled -}} {{- end -}} {{- define "harbor.database.clairUsername" -}} - {{- if eq .Values.postgresql.enabled true -}} - {{- .Values.postgresql.postgresqlUsername -}} - {{- else -}} - {{- if .Values.externalDatabase.clairUsername -}} - {{- .Values.externalDatabase.clairUsername -}} - {{- else -}} - {{- .Values.externalDatabase.user -}} - {{- end -}} - {{- end -}} +{{- ternary "postgres" (default .Values.externalDatabase.user .Values.externalDatabase.clairUsername) .Values.postgresql.enabled -}} {{- end -}} {{- define "harbor.database.notaryServerUsername" -}} - {{- if eq .Values.postgresql.enabled true -}} - {{- .Values.postgresql.postgresqlUsername -}} - {{- else -}} - {{- if .Values.externalDatabase.notaryServerUsername -}} - {{- .Values.externalDatabase.notaryServerUsername -}} - {{- else -}} - {{- .Values.externalDatabase.user -}} - {{- end -}} - {{- end -}} +{{- ternary "postgres" (default .Values.externalDatabase.user .Values.externalDatabase.notaryServerUsername) .Values.postgresql.enabled -}} {{- end -}} {{- define "harbor.database.notarySignerUsername" -}} - {{- if eq .Values.postgresql.enabled true -}} - {{- .Values.postgresql.postgresqlUsername -}} - {{- else -}} - {{- if .Values.externalDatabase.notarySignerUsername -}} - {{- .Values.externalDatabase.notarySignerUsername -}} - {{- else -}} - {{- .Values.externalDatabase.user -}} - {{- end -}} - {{- end -}} +{{- ternary "postgres" (default .Values.externalDatabase.user .Values.externalDatabase.notarySignerUsername) .Values.postgresql.enabled -}} {{- end -}} {{- define "harbor.database.rawPassword" -}} - {{- if eq .Values.postgresql.enabled true -}} - {{- .Values.postgresql.postgresqlPassword -}} - {{- else -}} - {{- .Values.externalDatabase.password -}} - {{- end -}} +{{- if .Values.postgresql.enabled }} + {{- if .Values.global.postgresql }} + {{- if .Values.global.postgresql.auth }} + {{- coalesce .Values.global.postgresql.auth.postgresPassword .Values.postgresql.auth.postgresPassword -}} + {{- else -}} + {{- .Values.postgresql.auth.postgresPassword -}} + {{- end -}} + {{- else -}} + {{- .Values.postgresql.auth.postgresPassword -}} + {{- end -}} +{{- else -}} + {{- .Values.externalDatabase.password -}} +{{- end -}} {{- end -}} {{- define "harbor.database.clairRawPassword" -}} - {{- if eq .Values.postgresql.enabled true -}} - {{- .Values.postgresql.postgresqlPassword -}} - {{- else -}} - {{- if .Values.externalDatabase.clairPassword -}} - {{- .Values.externalDatabase.clairPassword -}} - {{- else -}} - {{- .Values.externalDatabase.password -}} - {{- end -}} - {{- end -}} +{{- ternary (include "harbor.database.rawPassword" .) (default .Values.externalDatabase.password .Values.externalDatabase.clairPassword) .Values.postgresql.enabled -}} {{- end -}} {{- define "harbor.database.notaryServerRawPassword" -}} - {{- if eq .Values.postgresql.enabled true -}} - {{- .Values.postgresql.postgresqlPassword -}} - {{- else -}} - {{- if .Values.externalDatabase.notaryServerPassword -}} - {{- .Values.externalDatabase.notaryServerPassword -}} - {{- else -}} - {{- .Values.externalDatabase.password -}} - {{- end -}} - {{- end -}} +{{- ternary (include "harbor.database.rawPassword" .) (default .Values.externalDatabase.password .Values.externalDatabase.notaryServerPassword) .Values.postgresql.enabled -}} {{- end -}} {{- define "harbor.database.notarySignerRawPassword" -}} - {{- if eq .Values.postgresql.enabled true -}} - {{- .Values.postgresql.postgresqlPassword -}} - {{- else -}} - {{- if .Values.externalDatabase.notarySignerPassword -}} - {{- .Values.externalDatabase.notarySignerPassword -}} - {{- else -}} - {{- .Values.externalDatabase.password -}} - {{- end -}} - {{- end -}} +{{- ternary (include "harbor.database.rawPassword" .) (default .Values.externalDatabase.password .Values.externalDatabase.notarySignerPassword) .Values.postgresql.enabled -}} {{- end -}} {{- define "harbor.database.escapedClairRawPassword" -}} @@ -399,43 +194,23 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this {{- end -}} {{- define "harbor.database.coreDatabase" -}} - {{- if eq .Values.postgresql.enabled true -}} - {{- printf "%s" "registry" -}} - {{- else -}} - {{- .Values.externalDatabase.coreDatabase -}} - {{- end -}} +{{- ternary "registry" .Values.externalDatabase.coreDatabase .Values.postgresql.enabled -}} {{- end -}} {{- define "harbor.database.clairDatabase" -}} - {{- if eq .Values.postgresql.enabled true -}} - {{- printf "%s" "postgres" -}} - {{- else -}} - {{- .Values.externalDatabase.clairDatabase -}} - {{- end -}} +{{- ternary "postgres" .Values.externalDatabase.clairDatabase .Values.postgresql.enabled -}} {{- end -}} {{- define "harbor.database.notaryServerDatabase" -}} - {{- if eq .Values.postgresql.enabled true -}} - {{- printf "%s" "notaryserver" -}} - {{- else -}} - {{- .Values.externalDatabase.notaryServerDatabase -}} - {{- end -}} +{{- ternary "notaryserver" .Values.externalDatabase.notaryServerDatabase .Values.postgresql.enabled -}} {{- end -}} {{- define "harbor.database.notarySignerDatabase" -}} - {{- if eq .Values.postgresql.enabled true -}} - {{- printf "%s" "notarysigner" -}} - {{- else -}} - {{- .Values.externalDatabase.notarySignerDatabase -}} - {{- end -}} +{{- ternary "notarysigner" .Values.externalDatabase.notarySignerDatabase .Values.postgresql.enabled -}} {{- end -}} {{- define "harbor.database.sslmode" -}} - {{- if eq .Values.postgresql.enabled true -}} - {{- printf "%s" "disable" -}} - {{- else -}} - {{- .Values.externalDatabase.sslmode -}} - {{- end -}} +{{- ternary "disable" .Values.externalDatabase.sslmode .Values.postgresql.enabled -}} {{- end -}} {{- define "harbor.database.clair" -}} @@ -450,79 +225,51 @@ postgres://{{ template "harbor.database.notaryServerUsername" . }}:{{ template " postgres://{{ template "harbor.database.notarySignerUsername" . }}:{{ template "harbor.database.escapedNotarySignerRawPassword" . }}@{{ template "harbor.database.host" . }}:{{ template "harbor.database.port" . }}/{{ template "harbor.database.notarySignerDatabase" . }}?sslmode={{ template "harbor.database.sslmode" . }} {{- end -}} -Create a default fully qualified redis name. +{{/* +Create a default fully qualified app name We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). */}} {{- define "harbor.redis.fullname" -}} -{{- $name := default "redis" .Values.redis.nameOverride -}} -{{- printf "%s-%s-master" .Release.Name $name | trunc 63 | trimSuffix "-" -}} +{{- include "common.names.dependency.fullname" (dict "chartName" "redis" "chartValues" .Values.redis "context" $) -}} {{- end -}} {{- define "harbor.redis.host" -}} - {{- if eq .Values.redis.enabled true -}} - {{- template "harbor.redis.fullname" . -}} - {{- else -}} - {{- if eq .Values.externalRedis.sentinel.enabled true -}} - {{- .Values.externalRedis.sentinel.hosts -}}/{{- .Values.externalRedis.sentinel.masterSet -}} - {{- else -}} - {{- .Values.externalRedis.host -}} - {{- end -}} - {{- end -}} +{{- ternary (printf "%s-master" (include "harbor.redis.fullname" .)) (ternary (printf "%s/%s" .Values.externalRedis.sentinel.hosts .Values.externalRedis.sentinel.masterSet) .Values.externalRedis.host .Values.externalRedis.sentinel.enabled) .Values.redis.enabled -}} {{- end -}} {{- define "harbor.redis.port" -}} - {{- if eq .Values.redis.enabled true -}} - {{- printf "%s" "6379" -}} - {{- else -}} - {{- .Values.externalRedis.port -}} - {{- end -}} +{{- ternary "6379" .Values.externalRedis.port .Values.redis.enabled -}} {{- end -}} {{- define "harbor.redis.coreDatabaseIndex" -}} - {{- if eq .Values.redis.enabled true -}} - {{- printf "%s" "0" }} - {{- else -}} - {{- .Values.externalRedis.coreDatabaseIndex -}} - {{- end -}} +{{- ternary "0" .Values.externalRedis.coreDatabaseIndex .Values.redis.enabled -}} {{- end -}} {{- define "harbor.redis.jobserviceDatabaseIndex" -}} - {{- if eq .Values.redis.enabled true -}} - {{- printf "%s" "1" }} - {{- else -}} - {{- .Values.externalRedis.jobserviceDatabaseIndex -}} - {{- end -}} +{{- ternary "1" .Values.externalRedis.jobserviceDatabaseIndex .Values.redis.enabled -}} {{- end -}} {{- define "harbor.redis.registryDatabaseIndex" -}} - {{- if eq .Values.redis.enabled true -}} - {{- printf "%s" "2" }} - {{- else -}} - {{- .Values.externalRedis.registryDatabaseIndex -}} - {{- end -}} +{{- ternary "2" .Values.externalRedis.registryDatabaseIndex .Values.redis.enabled -}} {{- end -}} {{- define "harbor.redis.chartmuseumDatabaseIndex" -}} - {{- if eq .Values.redis.enabled true -}} - {{- printf "%s" "3" }} - {{- else -}} - {{- .Values.externalRedis.chartmuseumDatabaseIndex -}} - {{- end -}} +{{- ternary "3" .Values.externalRedis.chartmuseumDatabaseIndex .Values.redis.enabled -}} {{- end -}} {{- define "harbor.redis.clairAdapterDatabaseIndex" -}} - {{- if eq .Values.redis.enabled true -}} - {{- printf "%s" "4" -}} - {{- else -}} - {{- .Values.externalRedis.clairAdapterDatabaseIndex -}} - {{- end -}} +{{- ternary "4" .Values.externalRedis.clairAdapterDatabaseIndex .Values.redis.enabled -}} +{{- end -}} + +{{- define "harbor.redis.trivyAdapterDatabaseIndex" -}} +{{- ternary "5" .Values.externalRedis.trivyAdapterDatabaseIndex .Values.redis.enabled -}} {{- end -}} {{/* Return whether Redis™ uses password authentication or not */}} {{- define "harbor.redis.auth.enabled" -}} -{{- if or (and .Values.redis.enabled .Values.redis.auth.enabled) (and (not .Values.redis.enabled) (or .Values.externalRedis.password .Values.externalRedis.existingSecret)) }} +{{- if or .Values.redis.auth.enabled (and (not .Values.redis.enabled) .Values.externalRedis.password) }} {{- true -}} {{- end -}} {{- end -}} @@ -536,14 +283,6 @@ Return whether Redis™ uses password authentication or not {{- end -}} {{- end -}} -{{- define "harbor.redis.trivyAdapterDatabaseIndex" -}} - {{- if .Values.redis.enabled -}} - {{- printf "%s" "5" -}} - {{- else -}} - {{- .Values.externalRedis.trivyAdapterDatabaseIndex -}} - {{- end -}} -{{- end -}} - {{- define "harbor.redis.escapedRawPassword" -}} {{- if (include "harbor.redis.rawPassword" . ) -}} {{- include "harbor.redis.rawPassword" . | urlquery | replace "+" "%20" -}} @@ -696,136 +435,85 @@ Return whether Redis™ uses password authentication or not {{/* Return the proper Harbor Core image name */}} -{{- define "harbor.coreImage" -}} -{{- include "common.images.image" ( dict "imageRoot" .Values.coreImage "global" .Values.global ) -}} +{{- define "harbor.core.image" -}} +{{- include "common.images.image" ( dict "imageRoot" .Values.core.image "global" .Values.global ) -}} {{- end -}} {{/* Return the proper Harbor Portal image name */}} -{{- define "harbor.portalImage" -}} -{{- include "common.images.image" ( dict "imageRoot" .Values.portalImage "global" .Values.global ) -}} +{{- define "harbor.portal.image" -}} +{{- include "common.images.image" ( dict "imageRoot" .Values.portal.image "global" .Values.global ) -}} {{- end -}} {{/* Return the proper Harbor Trivy Adapter image name */}} -{{- define "harbor.trivyImage" -}} -{{- include "common.images.image" ( dict "imageRoot" .Values.trivyImage "global" .Values.global ) -}} +{{- define "harbor.trivy.image" -}} +{{- include "common.images.image" ( dict "imageRoot" .Values.trivy.image "global" .Values.global ) -}} {{- end -}} {{/* Return the proper Harbor Job Service image name */}} -{{- define "harbor.jobserviceImage" -}} -{{- include "common.images.image" ( dict "imageRoot" .Values.jobserviceImage "global" .Values.global ) -}} +{{- define "harbor.jobservice.image" -}} +{{- include "common.images.image" ( dict "imageRoot" .Values.jobservice.image "global" .Values.global ) -}} {{- end -}} {{/* Return the proper ChartMuseum image name */}} -{{- define "harbor.chartMuseumImage" -}} -{{- include "common.images.image" ( dict "imageRoot" .Values.chartMuseumImage "global" .Values.global ) -}} +{{- define "harbor.chartmuseum.image" -}} +{{- include "common.images.image" ( dict "imageRoot" .Values.chartmuseum.image "global" .Values.global ) -}} {{- end -}} {{/* Return the proper Harbor Notary Server image name */}} -{{- define "harbor.notaryServerImage" -}} -{{- include "common.images.image" ( dict "imageRoot" .Values.notaryServerImage "global" .Values.global ) -}} +{{- define "harbor.notary.server.image" -}} +{{- include "common.images.image" ( dict "imageRoot" .Values.notary.server.image "global" .Values.global ) -}} {{- end -}} {{/* Return the proper Harbor Notary Signer image name */}} -{{- define "harbor.notarySignerImage" -}} -{{- include "common.images.image" ( dict "imageRoot" .Values.notarySignerImage "global" .Values.global ) -}} +{{- define "harbor.notary.signer.image" -}} +{{- include "common.images.image" ( dict "imageRoot" .Values.notary.signer.image "global" .Values.global ) -}} {{- end -}} {{/* Return the proper Harbor Registry image name */}} -{{- define "harbor.registryImage" -}} -{{- include "common.images.image" ( dict "imageRoot" .Values.registryImage "global" .Values.global ) -}} +{{- define "harbor.registry.server.image" -}} +{{- include "common.images.image" ( dict "imageRoot" .Values.registry.server.image "global" .Values.global ) -}} {{- end -}} {{/* Return the proper Harbor Registryctl image name */}} -{{- define "harbor.registryctlImage" -}} -{{- include "common.images.image" ( dict "imageRoot" .Values.registryctlImage "global" .Values.global ) -}} +{{- define "harbor.registry.controller.image" -}} +{{- include "common.images.image" ( dict "imageRoot" .Values.registry.controller.image "global" .Values.global ) -}} {{- end -}} {{/* Return the proper Harbor Clair image name */}} -{{- define "harbor.clairImage" -}} -{{- include "common.images.image" ( dict "imageRoot" .Values.clairImage "global" .Values.global ) -}} +{{- define "harbor.clair.server.image" -}} +{{- include "common.images.image" ( dict "imageRoot" .Values.clair.server.image "global" .Values.global ) -}} {{- end -}} {{/* Return the proper Harbor Clair image name */}} -{{- define "harbor.clairAdapterImage" -}} -{{- include "common.images.image" ( dict "imageRoot" .Values.clairAdapterImage "global" .Values.global ) -}} +{{- define "harbor.clair.adapter.image" -}} +{{- include "common.images.image" ( dict "imageRoot" .Values.clair.adapter.image "global" .Values.global ) -}} {{- end -}} {{/* Return the proper Nginx image name */}} -{{- define "harbor.nginxImage" -}} -{{- include "common.images.image" ( dict "imageRoot" .Values.nginxImage "global" .Values.global ) -}} -{{- end -}} - -{{/* -Return the proper Docker Image Registry Secret Names -*/}} -{{- define "harbor.imagePullSecrets" -}} -{{- include "common.images.pullSecrets" (dict "images" (list .Values.coreImage .Values.portalImage .Values.jobserviceImage .Values.clairImage .Values.clairAdapterImage .Values.trivyImage .Values.notaryServerImage .Values.notarySignerImage .Values.registryImage .Values.registryctlImage .Values.nginxImage .Values.volumePermissions.image) "global" .Values.global) -}} -{{- end -}} - -{{/* Check if there are rolling tags in the images */}} -{{- define "harbor.checkRollingTags" -}} -{{- include "common.warnings.rollingTag" .Values.coreImage -}} -{{- include "common.warnings.rollingTag" .Values.portalImage -}} -{{- include "common.warnings.rollingTag" .Values.jobserviceImage -}} -{{- include "common.warnings.rollingTag" .Values.registryImage -}} -{{- include "common.warnings.rollingTag" .Values.registryctlImage -}} -{{- include "common.warnings.rollingTag" .Values.clairImage -}} -{{- include "common.warnings.rollingTag" .Values.clairAdapterImage -}} -{{- include "common.warnings.rollingTag" .Values.trivyImage -}} -{{- include "common.warnings.rollingTag" .Values.volumePermissions.image -}} -{{- end -}} - -{{/* -Compile all warnings into a single message, and call fail. -*/}} -{{- define "harbor.validateValues" -}} -{{- $messages := list -}} -{{- $messages := append $messages (include "harbor.validateValues.postgresqlPassword" .) -}} -{{- $messages := without $messages "" -}} -{{- $message := join "\n" $messages -}} - -{{- if $message -}} -{{- printf "\nVALUES VALIDATION:\n%s" $message | fail -}} -{{- end -}} -{{- end -}} - -{{/* Validate .Values of Harbor - must provide a password for PostgreSQL */}} -{{- define "harbor.validateValues.postgresqlPassword" -}} -{{- if eq .Values.postgresql.enabled true -}} - {{- if not .Values.postgresql.postgresqlPassword -}} -harbor: PostgreSQL password - A database password is required!. - Please set a passsord (--set postgresql.postgresqlPassword="xxxx") - {{- end -}} -{{- else -}} - {{- if not .Values.externalDatabase.password -}} -harbor: External PostgreSQL password - An external database password is required!. - Please set a passsord (--set externalDatabase.password="xxxx") - {{- end -}} -{{- end -}} +{{- define "harbor.nginx.image" -}} +{{- include "common.images.image" ( dict "imageRoot" .Values.nginx.image "global" .Values.global ) -}} {{- end -}} {{/* @@ -836,42 +524,63 @@ Return the proper image name (for the init container volume-permissions image) {{- end -}} {{/* -Return the proper Storage Class for chartmuseum +Return the proper Docker Image Registry Secret Names */}} -{{- define "harbor.chartmuseum.storageClass" -}} -{{- include "common.storage.class" ( dict "persistence" .Values.persistence.persistentVolumeClaim.chartmuseum "global" .Values.global ) -}} +{{- define "harbor.imagePullSecrets" -}} +{{- include "common.images.pullSecrets" (dict "images" (list .Values.core.image .Values.portal.image .Values.jobservice.image .Values.clair.server.image .Values.clair.adapter.image .Values.chartmuseum.image .Values.trivy.image .Values.notary.server.image .Values.notary.signer.image .Values.registry.server.image .Values.registry.controller.image .Values.nginx.image .Values.volumePermissions.image) "global" .Values.global) -}} +{{- end -}} + +{{/* Check if there are rolling tags in the images */}} +{{- define "harbor.checkRollingTags" -}} +{{- include "common.warnings.rollingTag" .Values.core.image -}} +{{- include "common.warnings.rollingTag" .Values.portal.image -}} +{{- include "common.warnings.rollingTag" .Values.jobservice.image -}} +{{- include "common.warnings.rollingTag" .Values.registry.server.image -}} +{{- include "common.warnings.rollingTag" .Values.registry.controller.image -}} +{{- include "common.warnings.rollingTag" .Values.clair.server.image -}} +{{- include "common.warnings.rollingTag" .Values.clair.adapter.image -}} +{{- include "common.warnings.rollingTag" .Values.chartmuseum.image -}} +{{- include "common.warnings.rollingTag" .Values.trivy.image -}} +{{- include "common.warnings.rollingTag" .Values.volumePermissions.image -}} {{- end -}} {{/* -Return the proper Storage Class for jobservice +Compile all warnings into a single message, and call fail. */}} -{{- define "harbor.jobservice.storageClass" -}} -{{- include "common.storage.class" ( dict "persistence" .Values.persistence.persistentVolumeClaim.jobservice "global" .Values.global ) -}} +{{- define "harbor.validateValues" -}} +{{- $messages := list -}} +{{- $messages := append $messages (include "harbor.validateValues.postgresqlPassword" .) -}} +{{- $messages := append $messages (include "harbor.validateValues.exposureType" .) -}} +{{- $messages := without $messages "" -}} +{{- $message := join "\n" $messages -}} + +{{- if $message -}} +{{- printf "\nVALUES VALIDATION:\n%s" $message | fail -}} +{{- end -}} {{- end -}} -{{/* -Return the proper Storage Class for registry -*/}} -{{- define "harbor.registry.storageClass" -}} -{{- include "common.storage.class" ( dict "persistence" .Values.persistence.persistentVolumeClaim.registry "global" .Values.global ) -}} -{{- end -}} - -{{/* -Return the proper Storage Class for trivy -*/}} -{{- define "harbor.trivy.storageClass" -}} -{{- include "common.storage.class" ( dict "persistence" .Values.persistence.persistentVolumeClaim.trivy "global" .Values.global ) -}} -{{- end -}} - -{{/* -Set the http prefix if the externalURl dont have it -*/}} -{{- define "harbor.externalUrl" -}} -{{- if hasPrefix "http" .Values.externalURL -}} - {{- print .Values.externalURL -}} -{{- else if .Values.service.tls.enabled -}} - {{- printf "https://%s" .Values.externalURL -}} +{{/* Validate values of Harbor - must provide a password for PostgreSQL */}} +{{- define "harbor.validateValues.postgresqlPassword" -}} +{{- if .Values.postgresql.enabled -}} + {{- if empty (include "harbor.database.rawPassword" .) -}} +harbor: PostgreSQL password + A database password is required!. + Please set a password (--set postgresql.auth.postgresPassword="xxxx") + {{- end -}} {{- else -}} - {{- printf "http://%s" .Values.externalURL -}} + {{- if not .Values.externalDatabase.password -}} +harbor: External PostgreSQL password + An external database password is required!. + Please set a password (--set externalDatabase.password="xxxx") + {{- end -}} +{{- end -}} +{{- end -}} + +{{/* Validate values of Harbor - must provide a valid exposureType */}} +{{- define "harbor.validateValues.exposureType" -}} +{{- if and (ne .Values.exposureType "ingress") (ne .Values.exposureType "proxy") -}} +harbor: exposureType + Invalid exposureType selected. Valid values are "ingress" and + "proxy". Please set a valid exposureType (--set exposureType="xxxx") {{- end -}} {{- end -}} diff --git a/bitnami/harbor/templates/chartmuseum/chartmuseum-cm-envvars.yaml b/bitnami/harbor/templates/chartmuseum/chartmuseum-cm-envvars.yaml index a98b46ff1..de9569b38 100644 --- a/bitnami/harbor/templates/chartmuseum/chartmuseum-cm-envvars.yaml +++ b/bitnami/harbor/templates/chartmuseum/chartmuseum-cm-envvars.yaml @@ -2,7 +2,8 @@ apiVersion: v1 kind: ConfigMap metadata: - name: {{ include "harbor.chartmuseum" . }}-envvars + name: {{ printf "%s-envvars" (include "harbor.chartmuseum" .) }} + namespace: {{ .Release.Namespace | quote }} labels: {{- include "common.labels.standard" . | nindent 4 }} {{- if .Values.commonLabels }} {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} @@ -12,7 +13,7 @@ metadata: annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} {{- end }} data: - PORT: {{ include "harbor.chartmuseum.containerPort" . | quote }} + PORT: {{ ternary .Values.chartmuseum.containerPorts.https .Values.chartmuseum.containerPorts.http .Values.internalTLS.enabled | quote }} {{- if .Values.internalTLS.enabled }} TLS_CERT: "/etc/harbor/ssl/chartmuseum/tls.crt" TLS_KEY: "/etc/harbor/ssl/chartmuseum/tls.key" @@ -28,7 +29,7 @@ data: CHART_URL: {{ printf "%s/%s" ( include "harbor.externalUrl" . ) .Values.chartmuseum.chartRepoName | quote }} {{- end }} DEPTH: {{ .Values.chartmuseum.depth | quote }} - {{- if or (eq .Values.logLevel "debug") .Values.chartMuseumImage.debug }} + {{- if or (eq .Values.logLevel "debug") .Values.chartmuseum.image.debug }} DEBUG: "true" {{- else }} DEBUG: "false" diff --git a/bitnami/harbor/templates/chartmuseum/chartmuseum-dpl.yaml b/bitnami/harbor/templates/chartmuseum/chartmuseum-dpl.yaml index 85b3e28b8..1512c014b 100644 --- a/bitnami/harbor/templates/chartmuseum/chartmuseum-dpl.yaml +++ b/bitnami/harbor/templates/chartmuseum/chartmuseum-dpl.yaml @@ -3,6 +3,7 @@ apiVersion: {{ template "common.capabilities.deployment.apiVersion" . }} kind: Deployment metadata: name: {{ include "harbor.chartmuseum" . }} + namespace: {{ .Release.Namespace | quote }} labels: {{- include "common.labels.standard" . | nindent 4 }} {{- if .Values.commonLabels }} {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} @@ -12,13 +13,13 @@ metadata: annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} {{- end }} spec: - replicas: {{ .Values.chartmuseum.replicas }} - {{- if .Values.chartmuseum.updateStrategy }} - strategy: {{- toYaml .Values.chartmuseum.updateStrategy | nindent 4 }} - {{- end }} + replicas: {{ .Values.chartmuseum.replicaCount }} selector: matchLabels: {{- include "common.labels.matchLabels" . | nindent 6 }} app.kubernetes.io/component: chartmuseum + {{- if .Values.chartmuseum.updateStrategy }} + strategy: {{- toYaml .Values.chartmuseum.updateStrategy | nindent 4 }} + {{- end }} template: metadata: labels: {{- include "common.labels.matchLabels" . | nindent 8 }} @@ -41,10 +42,10 @@ spec: {{- end }} spec: {{- include "harbor.imagePullSecrets" . | nindent 6 }} - automountServiceAccountToken: {{ .Values.chartmuseum.automountServiceAccountToken }} - {{- if .Values.chartmuseum.priorityClassName }} - priorityClassName: {{ .Values.chartmuseum.priorityClassName | quote }} + {{- if .Values.chartmuseum.hostAliases }} + hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.chartmuseum.hostAliases "context" $) | nindent 8 }} {{- end }} + automountServiceAccountToken: {{ .Values.chartmuseum.automountServiceAccountToken }} {{- if .Values.chartmuseum.affinity }} affinity: {{- include "common.tplvalues.render" (dict "value" .Values.chartmuseum.affinity "context" $) | nindent 8 }} {{- else }} @@ -59,78 +60,41 @@ spec: {{- if .Values.chartmuseum.tolerations }} tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.chartmuseum.tolerations "context" $) | nindent 8 }} {{- end }} - {{- if .Values.podSecurityContext }} - securityContext: {{- include "common.tplvalues.render" (dict "value" .Values.podSecurityContext "context" $) | nindent 8 }} + {{- if .Values.chartmuseum.topologySpreadConstraints }} + topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.chartmuseum.topologySpreadConstraints "context" .) | nindent 8 }} + {{- end }} + {{- if .Values.chartmuseum.priorityClassName }} + priorityClassName: {{ .Values.chartmuseum.priorityClassName | quote }} + {{- end }} + {{- if .Values.chartmuseum.schedulerName }} + schedulerName: {{ .Values.chartmuseum.schedulerName }} + {{- end }} + {{- if .Values.chartmuseum.podSecurityContext.enabled }} + securityContext: {{- omit .Values.chartmuseum.podSecurityContext "enabled" | toYaml | nindent 8 }} {{- end }} {{- if .Values.chartmuseum.initContainers }} initContainers: {{- include "common.tplvalues.render" (dict "value" .Values.chartmuseum.initContainers "context" $) | nindent 8 }} {{- end }} - {{- if .Values.chartmuseum.hostAliases }} - hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.chartmuseum.hostAliases "context" $) | nindent 8 }} - {{- end }} containers: - name: chartmuseum - image: {{ include "harbor.chartMuseumImage" . }} - imagePullPolicy: {{ .Values.chartMuseumImage.pullPolicy | quote }} - {{- if .Values.containerSecurityContext }} - securityContext: {{- include "common.tplvalues.render" (dict "value" .Values.containerSecurityContext "context" $) | nindent 12 }} + image: {{ include "harbor.chartmuseum.image" . }} + imagePullPolicy: {{ .Values.chartmuseum.image.pullPolicy | quote }} + {{- if .Values.chartmuseum.containerSecurityContext.enabled }} + securityContext: {{- omit .Values.chartmuseum.containerSecurityContext "enabled" | toYaml | nindent 12 }} {{- end }} - {{- if .Values.chartmuseum.command }} + {{- if .Values.diagnosticMode.enabled }} + command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }} + {{- else if .Values.chartmuseum.command }} command: {{- include "common.tplvalues.render" (dict "value" .Values.chartmuseum.command "context" $) | nindent 12 }} {{- end }} - {{- if .Values.chartmuseum.args }} + {{- if .Values.diagnosticMode.enabled }} + args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }} + {{- else if .Values.chartmuseum.args }} args: {{- include "common.tplvalues.render" (dict "value" .Values.chartmuseum.args "context" $) | nindent 12 }} {{- end }} - {{- if .Values.chartmuseum.lifecycleHooks }} - lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.chartmuseum.lifecycleHooks "context" $) | nindent 12 }} - {{- end }} - {{- if .Values.chartmuseum.resources }} - resources: {{- toYaml .Values.chartmuseum.resources | nindent 12 }} - {{- end }} - {{- if .Values.chartmuseum.livenessProbe.enabled }} - livenessProbe: - httpGet: - path: /health - port: http - scheme: {{ include "harbor.component.scheme" . | upper }} - initialDelaySeconds: {{ .Values.chartmuseum.livenessProbe.initialDelaySeconds }} - periodSeconds: {{ .Values.chartmuseum.livenessProbe.periodSeconds }} - timeoutSeconds: {{ .Values.chartmuseum.livenessProbe.timeoutSeconds }} - successThreshold: {{ .Values.chartmuseum.livenessProbe.successThreshold }} - failureThreshold: {{ .Values.chartmuseum.livenessProbe.failureThreshold }} - {{- else if .Values.chartmuseum.customLivenessProbe }} - livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.chartmuseum.customLivenessProbe "context" $) | nindent 12 }} - {{- end }} - {{- if .Values.chartmuseum.readinessProbe.enabled }} - readinessProbe: - httpGet: - path: /health - port: http - scheme: {{ include "harbor.component.scheme" . | upper }} - initialDelaySeconds: {{ .Values.chartmuseum.readinessProbe.initialDelaySeconds }} - periodSeconds: {{ .Values.chartmuseum.readinessProbe.periodSeconds }} - timeoutSeconds: {{ .Values.chartmuseum.readinessProbe.timeoutSeconds }} - successThreshold: {{ .Values.chartmuseum.readinessProbe.successThreshold }} - failureThreshold: {{ .Values.chartmuseum.readinessProbe.failureThreshold }} - {{- else if .Values.chartmuseum.customReadinessProbe }} - readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.chartmuseum.customReadinessProbe "context" $) | nindent 12 }} - {{- end }} - envFrom: - - configMapRef: - name: {{ include "harbor.chartmuseum" . }}-envvars - - secretRef: - name: {{ include "harbor.chartmuseum" . }}-secret - {{- if .Values.chartmuseum.extraEnvVarsCM }} - - configMapRef: - name: {{ include "common.tplvalues.render" (dict "value" .Values.chartmuseum.extraEnvVarsCM "context" $) }} - {{- end }} - {{- if .Values.chartmuseum.extraEnvVarsSecret }} - - secretRef: - name: {{ include "common.tplvalues.render" (dict "value" .Values.chartmuseum.extraEnvVarsSecret "context" $) }} - {{- end }} env: - name: DEBUG - value: {{ ternary "1" "0" .Values.chartMuseumImage.debug | quote }} + value: {{ ternary "1" "0" .Values.chartmuseum.image.debug | quote }} {{- if has "chartmuseum" .Values.proxy.components }} - name: HTTP_PROXY value: {{ .Values.proxy.httpProxy | quote }} @@ -149,18 +113,64 @@ spec: - name: INTERNAL_TLS_TRUST_CA_PATH value: /etc/harbor/ssl/chartmuseum/ca.crt {{- end }} - {{- if .Values.chartmuseum.extraEnvVars }} - {{- include "common.tplvalues.render" (dict "value" .Values.chartmuseum.extraEnvVars "context" $) | nindent 12 }} - {{- end }} - name: BASIC_AUTH_PASS valueFrom: secretKeyRef: # Take the password from the core component secret name: {{ include "harbor.core" . }} key: secret + {{- if .Values.chartmuseum.extraEnvVars }} + {{- include "common.tplvalues.render" (dict "value" .Values.chartmuseum.extraEnvVars "context" $) | nindent 12 }} + {{- end }} + envFrom: + - configMapRef: + name: {{ printf "%s-envvars" (include "harbor.chartmuseum" .) }} + - secretRef: + name: {{ printf "%s-secret" (include "harbor.chartmuseum" .) }} + {{- if .Values.chartmuseum.extraEnvVarsCM }} + - configMapRef: + name: {{ include "common.tplvalues.render" (dict "value" .Values.chartmuseum.extraEnvVarsCM "context" $) }} + {{- end }} + {{- if .Values.chartmuseum.extraEnvVarsSecret }} + - secretRef: + name: {{ include "common.tplvalues.render" (dict "value" .Values.chartmuseum.extraEnvVarsSecret "context" $) }} + {{- end }} ports: - - containerPort: {{ include "harbor.chartmuseum.containerPort" . }} - name: http + - containerPort: {{ ternary .Values.chartmuseum.containerPorts.https .Values.chartmuseum.containerPorts.http .Values.internalTLS.enabled }} + name: {{ ternary "https" "http" .Values.internalTLS.enabled }} + {{- if not .Values.diagnosticMode.enabled }} + {{- if .Values.chartmuseum.startupProbe.enabled }} + startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.chartmuseum.startupProbe "enabled") "context" $) | nindent 12 }} + tcpSocket: + port: {{ ternary "https" "http" .Values.internalTLS.enabled }} + {{- else if .Values.chartmuseum.customStartupProbe }} + startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.chartmuseum.customStartupProbe "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.chartmuseum.livenessProbe.enabled }} + livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.chartmuseum.livenessProbe "enabled") "context" $) | nindent 12 }} + httpGet: + path: /health + port: {{ ternary "https" "http" .Values.internalTLS.enabled }} + scheme: {{ ternary "https" "http" .Values.internalTLS.enabled | upper }} + {{- else if .Values.chartmuseum.customLivenessProbe }} + livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.chartmuseum.customLivenessProbe "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.chartmuseum.readinessProbe.enabled }} + readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.chartmuseum.readinessProbe "enabled") "context" $) | nindent 12 }} + httpGet: + path: /health + port: {{ ternary "https" "http" .Values.internalTLS.enabled }} + scheme: {{ ternary "https" "http" .Values.internalTLS.enabled | upper }} + {{- else if .Values.chartmuseum.customReadinessProbe }} + readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.chartmuseum.customReadinessProbe "context" $) | nindent 12 }} + {{- end }} + {{- end }} + {{- if .Values.chartmuseum.lifecycleHooks }} + lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.chartmuseum.lifecycleHooks "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.chartmuseum.resources }} + resources: {{- toYaml .Values.chartmuseum.resources | nindent 12 }} + {{- end }} volumeMounts: - name: chartmuseum-data mountPath: /bitnami/data @@ -174,12 +184,12 @@ spec: - name: internal-tls-certs mountPath: /etc/harbor/ssl/chartmuseum {{- end }} - {{- if .Values.persistence.imageChartStorage.caBundleSecretName }} + {{- if .Values.persistence.imageChartStorage.caBundleSecret }} - name: storage-service-ca mountPath: /harbor_cust_cert/ca-bundle.crt subPath: ca.crt - {{- if .Values.caBundleSecretName }} -{{ include "harbor.caBundleVolumeMount" . | indent 12 }} + {{- if .Values.internalTLS.caBundleSecret }} + {{- include "harbor.caBundleVolumeMount" . | nindent 12 }} {{- end }} {{- end }} {{- if .Values.chartmuseum.extraVolumeMounts }} @@ -204,13 +214,13 @@ spec: - key: GCS_KEY_DATA path: gcs-key.json {{- end }} - {{- if .Values.persistence.imageChartStorage.caBundleSecretName }} + {{- if .Values.persistence.imageChartStorage.caBundleSecret }} - name: storage-service-ca secret: - secretName: {{ .Values.persistence.imageChartStorage.caBundleSecretName }} + secretName: {{ .Values.persistence.imageChartStorage.caBundleSecret }} {{- end }} - {{- if .Values.caBundleSecretName }} -{{ include "harbor.caBundleVolume" . | indent 8 }} + {{- if .Values.internalTLS.caBundleSecret }} + {{- include "harbor.caBundleVolume" . | nindent 8 }} {{- end }} {{- if .Values.internalTLS.enabled }} - name: internal-tls-certs diff --git a/bitnami/harbor/templates/chartmuseum/chartmuseum-pvc.yaml b/bitnami/harbor/templates/chartmuseum/chartmuseum-pvc.yaml index 78b0cee41..a52cfff16 100644 --- a/bitnami/harbor/templates/chartmuseum/chartmuseum-pvc.yaml +++ b/bitnami/harbor/templates/chartmuseum/chartmuseum-pvc.yaml @@ -5,25 +5,34 @@ kind: PersistentVolumeClaim apiVersion: v1 metadata: name: {{ include "harbor.chartmuseum" . }} + namespace: {{ .Release.Namespace | quote }} labels: {{- include "common.labels.standard" . | nindent 4 }} {{- if .Values.commonLabels }} {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} {{- end }} app.kubernetes.io/component: chartmuseum - {{- if eq .Values.persistence.resourcePolicy "keep" }} annotations: + {{- if eq .Values.persistence.resourcePolicy "keep" }} helm.sh/resource-policy: keep - {{- end }} - {{- if .Values.commonAnnotations }} + {{- end }} + {{- if .Values.commonAnnotations }} {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} + {{- end }} + {{- if .Values.persistence.persistentVolumeClaim.chartmuseum.annotations }} + {{- toYaml .Values.persistence.persistentVolumeClaim.chartmuseum.annotations | nindent 4 }} + {{- end }} spec: accessModes: - - {{ .Values.persistence.persistentVolumeClaim.chartmuseum.accessMode }} + {{- range .Values.persistence.persistentVolumeClaim.chartmuseum.accessModes }} + - {{ . | quote }} + {{- end }} resources: requests: storage: {{ .Values.persistence.persistentVolumeClaim.chartmuseum.size }} - {{ include "harbor.chartmuseum.storageClass" . }} + {{- if .Values.persistence.persistentVolumeClaim.chartmuseum.selector }} + selector: {{- include "common.tplvalues.render" (dict "value" .Values.persistence.persistentVolumeClaim.chartmuseum.selector "context" $) | nindent 2 }} + {{- end }} + {{- include "common.storage.class" ( dict "persistence" .Values.persistence.persistentVolumeClaim.chartmuseum "global" .Values.global ) | nindent 2 }} {{- end }} {{- end }} {{- end }} diff --git a/bitnami/harbor/templates/chartmuseum/chartmuseum-secret.yaml b/bitnami/harbor/templates/chartmuseum/chartmuseum-secret.yaml index 28a56d995..9fe458cb8 100644 --- a/bitnami/harbor/templates/chartmuseum/chartmuseum-secret.yaml +++ b/bitnami/harbor/templates/chartmuseum/chartmuseum-secret.yaml @@ -2,7 +2,8 @@ apiVersion: v1 kind: Secret metadata: - name: {{ include "harbor.chartmuseum" . }}-secret + name: {{ printf "%s-secret" (include "harbor.chartmuseum" .) }} + namespace: {{ .Release.Namespace | quote }} labels: {{- include "common.labels.standard" . | nindent 4 }} {{- if .Values.commonLabels }} {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} diff --git a/bitnami/harbor/templates/chartmuseum/chartmuseum-svc.yaml b/bitnami/harbor/templates/chartmuseum/chartmuseum-svc.yaml index 8fce572e7..417db9f27 100644 --- a/bitnami/harbor/templates/chartmuseum/chartmuseum-svc.yaml +++ b/bitnami/harbor/templates/chartmuseum/chartmuseum-svc.yaml @@ -3,6 +3,7 @@ apiVersion: v1 kind: Service metadata: name: {{ include "harbor.chartmuseum" . }} + namespace: {{ .Release.Namespace | quote }} labels: {{- include "common.labels.standard" . | nindent 4 }} {{- if .Values.commonLabels }} {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} @@ -13,9 +14,9 @@ metadata: {{- end }} spec: ports: - - port: {{ include "harbor.chartmuseum.servicePort" . }} - name: http - targetPort: http + - name: {{ ternary "https" "http" .Values.internalTLS.enabled }} + port: {{ ternary .Values.chartmuseum.service.ports.https .Values.chartmuseum.service.ports.http .Values.internalTLS.enabled }} + targetPort: {{ ternary "https" "http" .Values.internalTLS.enabled }} selector: {{- include "common.labels.matchLabels" . | nindent 4 }} app.kubernetes.io/component: chartmuseum {{- end }} diff --git a/bitnami/harbor/templates/clair/clair-dpl.yaml b/bitnami/harbor/templates/clair/clair-dpl.yaml index 8c5d5356b..3a31d0816 100644 --- a/bitnami/harbor/templates/clair/clair-dpl.yaml +++ b/bitnami/harbor/templates/clair/clair-dpl.yaml @@ -3,6 +3,7 @@ apiVersion: {{ template "common.capabilities.deployment.apiVersion" . }} kind: Deployment metadata: name: {{ include "harbor.clair" . }} + namespace: {{ .Release.Namespace | quote }} labels: {{- include "common.labels.standard" . | nindent 4 }} {{- if .Values.commonLabels }} {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} @@ -12,13 +13,13 @@ metadata: annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} {{- end }} spec: - replicas: {{ .Values.clair.replicas }} - {{- if .Values.clair.updateStrategy }} - strategy: {{- toYaml .Values.clair.updateStrategy | nindent 4 }} - {{- end }} + replicas: {{ .Values.clair.replicaCount }} selector: matchLabels: {{- include "common.labels.matchLabels" . | nindent 6 }} app.kubernetes.io/component: clair + {{- if .Values.clair.updateStrategy }} + strategy: {{- toYaml .Values.clair.updateStrategy | nindent 4 }} + {{- end }} template: metadata: labels: {{- include "common.labels.standard" . | nindent 8 }} @@ -39,10 +40,10 @@ spec: {{- end }} spec: {{- include "harbor.imagePullSecrets" . | nindent 6 }} - automountServiceAccountToken: {{ .Values.clair.automountServiceAccountToken }} - {{- if .Values.clair.priorityClassName }} - priorityClassName: {{ .Values.clair.priorityClassName | quote }} + {{- if .Values.clair.hostAliases }} + hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.clair.hostAliases "context" $) | nindent 8 }} {{- end }} + automountServiceAccountToken: {{ .Values.clair.automountServiceAccountToken }} {{- if .Values.clair.affinity }} affinity: {{- include "common.tplvalues.render" (dict "value" .Values.clair.affinity "context" $) | nindent 8 }} {{- else }} @@ -60,57 +61,41 @@ spec: {{- if .Values.clair.tolerations }} tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.clair.tolerations "context" $) | nindent 8 }} {{- end }} + {{- if .Values.clair.topologySpreadConstraints }} + topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.clair.topologySpreadConstraints "context" .) | nindent 8 }} + {{- end }} + {{- if .Values.clair.priorityClassName }} + priorityClassName: {{ .Values.clair.priorityClassName | quote }} + {{- end }} + {{- if .Values.clair.schedulerName }} + schedulerName: {{ .Values.clair.schedulerName }} + {{- end }} + {{- if .Values.clair.podSecurityContext.enabled }} + securityContext: {{- omit .Values.clair.podSecurityContext "enabled" | toYaml | nindent 8 }} + {{- end }} {{- if .Values.clair.initContainers }} initContainers: {{- include "common.tplvalues.render" (dict "value" .Values.clair.initContainers "context" $) | nindent 8 }} {{- end }} - {{- if .Values.clair.hostAliases }} - hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.clair.hostAliases "context" $) | nindent 8 }} - {{- end }} containers: - name: clair - image: {{ include "harbor.clairImage" . }} - imagePullPolicy: {{ .Values.clairImage.pullPolicy | quote }} - {{- if .Values.containerSecurityContext }} - securityContext: {{- include "common.tplvalues.render" (dict "value" .Values.containerSecurityContext "context" $) | nindent 12 }} + image: {{ include "harbor.clair.server.image" . }} + imagePullPolicy: {{ .Values.clair.server.image.pullPolicy | quote }} + {{- if .Values.clair.server.containerSecurityContext.enabled }} + securityContext: {{- omit .Values.clair.server.containerSecurityContext "enabled" | toYaml | nindent 12 }} {{- end }} - {{- if .Values.clair.server.command }} + {{- if .Values.diagnosticMode.enabled }} + command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }} + {{- else if .Values.clair.server.command }} command: {{- include "common.tplvalues.render" (dict "value" .Values.clair.server.command "context" $) | nindent 12 }} {{- end }} - {{- if .Values.clair.server.args }} + {{- if .Values.diagnosticMode.enabled }} + args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }} + {{- else if .Values.clair.server.args }} args: {{- include "common.tplvalues.render" (dict "value" .Values.clair.server.args "context" $) | nindent 12 }} {{- end }} - {{- if .Values.clair.server.lifecycleHooks }} - lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.clair.server.lifecycleHooks "context" $) | nindent 12 }} - {{- end }} - {{- if .Values.clair.server.livenessProbe.enabled }} - livenessProbe: - httpGet: - path: /health - port: 6061 - initialDelaySeconds: {{ .Values.clair.server.livenessProbe.initialDelaySeconds }} - periodSeconds: {{ .Values.clair.server.livenessProbe.periodSeconds }} - timeoutSeconds: {{ .Values.clair.server.livenessProbe.timeoutSeconds }} - successThreshold: {{ .Values.clair.server.livenessProbe.successThreshold }} - failureThreshold: {{ .Values.clair.server.livenessProbe.failureThreshold }} - {{- else if .Values.clair.server.customLivenessProbe }} - livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.clair.server.customLivenessProbe "context" $) | nindent 12 }} - {{- end }} - {{- if .Values.clair.server.readinessProbe.enabled }} - readinessProbe: - httpGet: - path: /health - port: 6061 - initialDelaySeconds: {{ .Values.clair.server.readinessProbe.initialDelaySeconds }} - periodSeconds: {{ .Values.clair.server.readinessProbe.periodSeconds }} - timeoutSeconds: {{ .Values.clair.server.readinessProbe.timeoutSeconds }} - successThreshold: {{ .Values.clair.server.readinessProbe.successThreshold }} - failureThreshold: {{ .Values.clair.server.readinessProbe.failureThreshold }} - {{- else if .Values.clair.server.customReadinessProbe }} - readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.clair.server.customReadinessProbe "context" $) | nindent 12 }} - {{- end }} env: - name: BITNAMI_DEBUG - value: {{ ternary "true" "false" .Values.clairImage.debug | quote }} + value: {{ ternary "true" "false" .Values.clair.server.image.debug | quote }} {{- if has "clair" .Values.proxy.components }} {{- if .Values.clair.httpProxy }} - name: HTTP_PROXY @@ -135,17 +120,48 @@ spec: - secretRef: name: {{ include "common.tplvalues.render" (dict "value" .Values.clair.server.extraEnvVarsSecret "context" $) }} {{- end }} + ports: + - containerPort: {{ .Values.clair.server.containerPorts.api }} + name: api + - containerPort: {{ .Values.clair.server.containerPorts.health }} + name: health + {{- if not .Values.diagnosticMode.enabled }} + {{- if .Values.clair.server.startupProbe.enabled }} + startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.clair.server.startupProbe "enabled") "context" $) | nindent 12 }} + tcpSocket: + port: health + {{- else if .Values.clair.server.customStartupProbe }} + startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.clair.server.customStartupProbe "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.clair.server.livenessProbe.enabled }} + livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.clair.server.livenessProbe "enabled") "context" $) | nindent 12 }} + httpGet: + path: /health + port: health + {{- else if .Values.clair.server.customLivenessProbe }} + livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.clair.server.customLivenessProbe "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.clair.server.readinessProbe.enabled }} + readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.clair.server.readinessProbe "enabled") "context" $) | nindent 12 }} + httpGet: + path: /health + port: health + {{- else if .Values.clair.server.customReadinessProbe }} + readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.clair.server.customReadinessProbe "context" $) | nindent 12 }} + {{- end }} + {{- end }} + {{- if .Values.clair.server.lifecycleHooks }} + lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.clair.server.lifecycleHooks "context" $) | nindent 12 }} + {{- end }} {{- if .Values.clair.server.resources }} resources: {{- toYaml .Values.clair.server.resources | nindent 12 }} {{- end }} - ports: - - containerPort: 6060 volumeMounts: - name: config mountPath: /etc/clair/config.yaml subPath: config.yaml - {{- if .Values.caBundleSecretName }} -{{ include "harbor.caBundleVolumeMount" . | indent 12 }} + {{- if .Values.internalTLS.caBundleSecret }} + {{- include "harbor.caBundleVolumeMount" . | nindent 12 }} {{- end }} {{- if .Values.internalTLS.enabled }} - name: internal-tls-certs @@ -155,54 +171,27 @@ spec: {{- include "common.tplvalues.render" (dict "value" .Values.clair.server.extraVolumeMounts "context" $) | nindent 12 }} {{- end }} - name: adapter - image: {{ include "harbor.clairAdapterImage" . }} - imagePullPolicy: {{ .Values.clairAdapterImage.pullPolicy }} - {{- if .Values.clair.adapter.command }} + image: {{ include "harbor.clair.adapter.image" . }} + imagePullPolicy: {{ .Values.clair.adapter.image.pullPolicy }} + {{- if .Values.clair.adapter.containerSecurityContext.enabled }} + securityContext: {{- omit .Values.clair.adapter.containerSecurityContext "enabled" | toYaml | nindent 12 }} + {{- end }} + {{- if .Values.diagnosticMode.enabled }} + command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }} + {{- else if .Values.clair.adapter.command }} command: {{- include "common.tplvalues.render" (dict "value" .Values.clair.adapter.command "context" $) | nindent 12 }} {{- end }} - {{- if .Values.clair.adapter.args }} + {{- if .Values.diagnosticMode.enabled }} + args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }} + {{- else if .Values.clair.adapter.args }} args: {{- include "common.tplvalues.render" (dict "value" .Values.clair.adapter.args "context" $) | nindent 12 }} {{- end }} - {{- if .Values.clair.adapter.lifecycleHooks }} - lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.clair.adapter.lifecycleHooks "context" $) | nindent 12 }} - {{- end }} - {{- if .Values.containerSecurityContext }} - securityContext: {{- include "common.tplvalues.render" (dict "value" .Values.containerSecurityContext "context" $) | nindent 12 }} - {{- end }} - {{- if .Values.clair.adapter.livenessProbe.enabled }} - livenessProbe: - httpGet: - path: /probe/healthy - port: {{ include "harbor.clairAdapter.containerPort" . }} - scheme: {{ include "harbor.component.scheme" . | upper }} - initialDelaySeconds: {{ .Values.clair.adapter.livenessProbe.initialDelaySeconds }} - periodSeconds: {{ .Values.clair.adapter.livenessProbe.periodSeconds }} - timeoutSeconds: {{ .Values.clair.adapter.livenessProbe.timeoutSeconds }} - successThreshold: {{ .Values.clair.adapter.livenessProbe.successThreshold }} - failureThreshold: {{ .Values.clair.adapter.livenessProbe.failureThreshold }} - {{- else if .Values.clair.adapter.customLivenessProbe }} - livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.clair.adapter.customLivenessProbe "context" $) | nindent 12 }} - {{- end }} - {{- if .Values.clair.adapter.readinessProbe.enabled }} - readinessProbe: - httpGet: - path: /probe/ready - port: {{ include "harbor.clairAdapter.containerPort" . }} - scheme: {{ include "harbor.component.scheme" . | upper }} - initialDelaySeconds: {{ .Values.clair.adapter.readinessProbe.initialDelaySeconds }} - periodSeconds: {{ .Values.clair.adapter.readinessProbe.periodSeconds }} - timeoutSeconds: {{ .Values.clair.adapter.readinessProbe.timeoutSeconds }} - successThreshold: {{ .Values.clair.adapter.readinessProbe.successThreshold }} - failureThreshold: {{ .Values.clair.adapter.readinessProbe.failureThreshold }} - {{- else if .Values.clair.adapter.customReadinessProbe }} - readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.clair.adapter.customReadinessProbe "context" $) | nindent 12 }} - {{- end }} env: - name: BITNAMI_DEBUG - value: {{ ternary "true" "false" .Values.clairAdapterImage.debug | quote }} + value: {{ ternary "true" "false" .Values.clair.adapter.image.debug | quote }} - name: SCANNER_CLAIR_URL # To avoid a pod cannot reach itself via service IP when the clusters disable hairpin - value: "http://127.0.0.1:6060" + value: {{ printf "http://127.0.0.1:%d" (int .Values.clair.server.containerPorts.api) | quote }} - name: SCANNER_STORE_REDIS_URL value: {{ include "harbor.redisForClairAdapter" . }} - name: SCANNER_CLAIR_DATABASE_URL @@ -214,7 +203,7 @@ spec: - name: INTERNAL_TLS_ENABLED value: "true" - name: SCANNER_API_SERVER_ADDR - value: {{ printf ":%s" ( include "harbor.clairAdapter.containerPort" . ) | quote }} + value: {{ printf ":%d" (ternary .Values.clair.adapter.containerPorts.https .Values.clair.adapter.containerPorts.http .Values.internalTLS.enabled | int) | quote }} - name: SCANNER_API_SERVER_TLS_KEY value: /etc/harbor/ssl/clair/tls.key - name: SCANNER_API_SERVER_TLS_CERTIFICATE @@ -232,23 +221,53 @@ spec: - secretRef: name: {{ include "common.tplvalues.render" (dict "value" .Values.clair.adapter.extraEnvVarsSecret "context" $) }} {{- end }} + ports: + - containerPort: {{ ternary .Values.clair.adapter.containerPorts.https .Values.clair.adapter.containerPorts.http .Values.internalTLS.enabled }} + name: {{ ternary "https" "http" .Values.internalTLS.enabled }} + {{- if not .Values.diagnosticMode.enabled }} + {{- if .Values.clair.adapter.startupProbe.enabled }} + startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.clair.adapter.startupProbe "enabled") "context" $) | nindent 12 }} + tcpSocket: + port: {{ ternary "https" "http" .Values.internalTLS.enabled }} + {{- else if .Values.clair.adapter.customStartupProbe }} + startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.clair.adapter.customStartupProbe "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.clair.adapter.livenessProbe.enabled }} + livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.clair.adapter.livenessProbe "enabled") "context" $) | nindent 12 }} + httpGet: + path: /probe/healthy + port: {{ ternary "https" "http" .Values.internalTLS.enabled }} + scheme: {{ ternary "https" "http" .Values.internalTLS.enabled | upper }} + {{- else if .Values.clair.adapter.customLivenessProbe }} + livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.clair.adapter.customLivenessProbe "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.clair.adapter.readinessProbe.enabled }} + readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.clair.adapter.readinessProbe "enabled") "context" $) | nindent 12 }} + httpGet: + path: /probe/ready + port: {{ ternary "https" "http" .Values.internalTLS.enabled }} + scheme: {{ ternary "https" "http" .Values.internalTLS.enabled | upper }} + {{- else if .Values.clair.adapter.customReadinessProbe }} + readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.clair.adapter.customReadinessProbe "context" $) | nindent 12 }} + {{- end }} + {{- end }} + {{- if .Values.clair.adapter.lifecycleHooks }} + lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.clair.adapter.lifecycleHooks "context" $) | nindent 12 }} + {{- end }} {{- if .Values.clair.adapter.resources }} resources: {{- toYaml .Values.clair.adapter.resources | nindent 12 }} {{- end }} - ports: - - containerPort: 8080 volumeMounts: {{- if .Values.internalTLS.enabled }} - name: internal-tls-certs mountPath: /etc/harbor/ssl/clair {{- end }} - {{- if .Values.caBundleSecretName }} -{{ include "harbor.caBundleVolumeMount" . | indent 12 }} + {{- if .Values.internalTLS.caBundleSecret }} + {{- include "harbor.caBundleVolumeMount" . | nindent 12 }} {{- end }} {{- if .Values.clair.adapter.extraVolumeMounts }} {{- include "common.tplvalues.render" (dict "value" .Values.clair.adapter.extraVolumeMounts "context" $) | nindent 12 }} {{- end }} - {{- if .Values.clair.sidecars }} {{- include "common.tplvalues.render" (dict "value" .Values.clair.sidecars "context" $) | nindent 8 }} {{- end }} @@ -261,8 +280,8 @@ spec: secret: secretName: {{ template "harbor.clair.tls.secretName" . }} {{- end }} - {{- if .Values.caBundleSecretName }} -{{ include "harbor.caBundleVolume" . | indent 8 }} + {{- if .Values.internalTLS.caBundleSecret }} + {{- include "harbor.caBundleVolume" . | nindent 8 }} {{- end }} {{- if .Values.clair.extraVolumes }} {{- include "common.tplvalues.render" (dict "value" .Values.clair.extraVolumes "context" $) | nindent 8 }} diff --git a/bitnami/harbor/templates/clair/clair-secret.yaml b/bitnami/harbor/templates/clair/clair-secret.yaml index a80a12582..18255ece8 100644 --- a/bitnami/harbor/templates/clair/clair-secret.yaml +++ b/bitnami/harbor/templates/clair/clair-secret.yaml @@ -3,6 +3,7 @@ apiVersion: v1 kind: Secret metadata: name: {{ template "harbor.clair" . }} + namespace: {{ .Release.Namespace | quote }} labels: {{- include "common.labels.standard" . | nindent 4 }} {{- if .Values.commonLabels }} {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} diff --git a/bitnami/harbor/templates/clair/clair-svc.yaml b/bitnami/harbor/templates/clair/clair-svc.yaml index af21da051..48d8a164a 100644 --- a/bitnami/harbor/templates/clair/clair-svc.yaml +++ b/bitnami/harbor/templates/clair/clair-svc.yaml @@ -3,6 +3,7 @@ apiVersion: v1 kind: Service metadata: name: {{ include "harbor.clair" . }} + namespace: {{ .Release.Namespace | quote }} labels: {{- include "common.labels.standard" . | nindent 4 }} {{- if .Values.commonLabels }} {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} @@ -13,12 +14,12 @@ metadata: {{- end }} spec: ports: - - name: clair - port: 6060 + - name: api + port: {{ .Values.clair.server.service.ports.api }} - name: health - port: 6061 + port: {{ .Values.clair.server.service.ports.health }} - name: adapter - port: {{ include "harbor.clairAdapter.servicePort" . }} + port: {{ ternary .Values.clair.adapter.service.ports.https .Values.clair.adapter.service.ports.http .Values.internalTLS.enabled }} selector: {{- include "common.labels.matchLabels" . | nindent 4 }} app.kubernetes.io/component: clair {{- end }} diff --git a/bitnami/harbor/templates/core/core-cm-envvars.yaml b/bitnami/harbor/templates/core/core-cm-envvars.yaml index 9c7b89808..0be0770e6 100644 --- a/bitnami/harbor/templates/core/core-cm-envvars.yaml +++ b/bitnami/harbor/templates/core/core-cm-envvars.yaml @@ -1,7 +1,10 @@ +{{- $scheme := ternary "https" "http" .Values.internalTLS.enabled -}} +{{- $port := ternary .Values.core.containerPorts.https .Values.core.containerPorts.http .Values.internalTLS.enabled | int -}} apiVersion: v1 kind: ConfigMap metadata: - name: {{ include "harbor.core" . }}-envvars + name: {{ printf "%s-envvars" (include "harbor.core" .) }} + namespace: {{ .Release.Namespace | quote }} labels: {{- include "common.labels.standard" . | nindent 4 }} {{- if .Values.commonLabels }} {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} @@ -11,7 +14,7 @@ metadata: annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} {{- end }} data: - PORT: {{ include "harbor.core.containerPort" . | quote }} + PORT: {{ $port | quote }} DATABASE_TYPE: "postgresql" POSTGRESQL_HOST: {{ include "harbor.database.host" . | quote }} POSTGRESQL_PORT: {{ include "harbor.database.port" . | quote }} @@ -25,7 +28,7 @@ data: TOKEN_SERVICE_URL: {{ include "harbor.tokenService.url" . | quote }} WITH_NOTARY: {{ .Values.notary.enabled | quote }} NOTARY_URL: {{ printf "http://%s:4443" (include "harbor.notary-server" .) | quote }} - CORE_LOCAL_URL: "{{ ternary "https://127.0.0.1:8443" "http://127.0.0.1:8080" .Values.internalTLS.enabled }}" + CORE_LOCAL_URL: {{ printf "%s://127.0.0.1:%d" $scheme $port | quote }} CFG_EXPIRATION: "5" ADMIRAL_URL: "NA" WITH_TRIVY: {{ .Values.trivy.enabled | quote }} @@ -41,7 +44,7 @@ data: REGISTRY_CONTROLLER_URL: {{ include "harbor.registryCtl.url" . | quote }} REGISTRY_CREDENTIAL_USERNAME: {{ .Values.registry.credentials.username | quote }} PERMITTED_REGISTRY_TYPES_FOR_PROXY_CACHE: "docker-hub,harbor,azure-acr,aws-ecr,google-gcr,quay,docker-registry" - {{- if .Values.core.uaaSecretName }} + {{- if .Values.core.uaaSecret }} UAA_CA_ROOT: "/etc/core/auth-ca/auth-ca.crt" {{- end }} {{- if has "core" .Values.proxy.components }} diff --git a/bitnami/harbor/templates/core/core-cm.yaml b/bitnami/harbor/templates/core/core-cm.yaml index 1534a9a5f..0a6466e49 100644 --- a/bitnami/harbor/templates/core/core-cm.yaml +++ b/bitnami/harbor/templates/core/core-cm.yaml @@ -2,6 +2,7 @@ apiVersion: v1 kind: ConfigMap metadata: name: {{ include "harbor.core" . }} + namespace: {{ .Release.Namespace | quote }} labels: {{- include "common.labels.standard" . | nindent 4 }} {{- if .Values.commonLabels }} {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} @@ -17,4 +18,4 @@ data: enablegzip = true [prod] - httpport = {{ include "harbor.core.containerPort" . | quote }} + httpport = {{ ternary .Values.core.containerPorts.https .Values.core.containerPorts.http .Values.internalTLS.enabled | quote }} diff --git a/bitnami/harbor/templates/core/core-dpl.yaml b/bitnami/harbor/templates/core/core-dpl.yaml index e912a277e..9df34a2e1 100644 --- a/bitnami/harbor/templates/core/core-dpl.yaml +++ b/bitnami/harbor/templates/core/core-dpl.yaml @@ -2,6 +2,7 @@ apiVersion: {{ template "common.capabilities.deployment.apiVersion" . }} kind: Deployment metadata: name: {{ include "harbor.core" . }} + namespace: {{ .Release.Namespace | quote }} labels: {{- include "common.labels.standard" . | nindent 4 }} {{- if .Values.commonLabels }} {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} @@ -11,13 +12,13 @@ metadata: annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} {{- end }} spec: - replicas: {{ .Values.core.replicas }} - {{- if .Values.core.updateStrategy }} - strategy: {{- toYaml .Values.core.updateStrategy | nindent 4 }} - {{- end }} + replicas: {{ .Values.core.replicaCount }} selector: matchLabels: {{- include "common.labels.matchLabels" . | nindent 6 }} app.kubernetes.io/component: core + {{- if .Values.core.updateStrategy }} + strategy: {{- toYaml .Values.core.updateStrategy | nindent 4 }} + {{- end }} template: metadata: labels: {{- include "common.labels.matchLabels" . | nindent 8 }} @@ -43,8 +44,8 @@ spec: spec: {{- include "harbor.imagePullSecrets" . | nindent 6 }} automountServiceAccountToken: {{ .Values.core.automountServiceAccountToken }} - {{- if .Values.core.priorityClassName }} - priorityClassName: {{ .Values.core.priorityClassName | quote }} + {{- if .Values.core.hostAliases }} + hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.core.hostAliases "context" $) | nindent 8 }} {{- end }} {{- if .Values.core.affinity }} affinity: {{- include "common.tplvalues.render" (dict "value" .Values.core.affinity "context" $) | nindent 8 }} @@ -60,89 +61,41 @@ spec: {{- if .Values.core.tolerations }} tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.core.tolerations "context" $) | nindent 8 }} {{- end }} - {{- if .Values.podSecurityContext }} - securityContext: {{- include "common.tplvalues.render" (dict "value" .Values.podSecurityContext "context" $) | nindent 8 }} + {{- if .Values.core.topologySpreadConstraints }} + topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.core.topologySpreadConstraints "context" .) | nindent 8 }} + {{- end }} + {{- if .Values.core.priorityClassName }} + priorityClassName: {{ .Values.core.priorityClassName | quote }} + {{- end }} + {{- if .Values.core.schedulerName }} + schedulerName: {{ .Values.core.schedulerName }} + {{- end }} + {{- if .Values.core.podSecurityContext.enabled }} + securityContext: {{- omit .Values.core.podSecurityContext "enabled" | toYaml | nindent 8 }} {{- end }} {{- if .Values.core.initContainers }} initContainers: {{- include "common.tplvalues.render" (dict "value" .Values.core.initContainers "context" $) | nindent 8 }} {{- end }} - {{- if .Values.core.hostAliases }} - hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.core.hostAliases "context" $) | nindent 8 }} - {{- end }} containers: - name: core - image: {{ include "harbor.coreImage" . }} - imagePullPolicy: {{ .Values.coreImage.pullPolicy | quote }} - {{- if .Values.core.command }} + image: {{ include "harbor.core.image" . }} + imagePullPolicy: {{ .Values.core.image.pullPolicy | quote }} + {{- if .Values.core.containerSecurityContext.enabled }} + securityContext: {{- omit .Values.core.containerSecurityContext "enabled" | toYaml | nindent 12 }} + {{- end }} + {{- if .Values.diagnosticMode.enabled }} + command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }} + {{- else if .Values.core.command }} command: {{- include "common.tplvalues.render" (dict "value" .Values.core.command "context" $) | nindent 12 }} {{- end }} - {{- if .Values.core.args }} + {{- if .Values.diagnosticMode.enabled }} + args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }} + {{- else if .Values.core.args }} args: {{- include "common.tplvalues.render" (dict "value" .Values.core.args "context" $) | nindent 12 }} {{- end }} - {{- if .Values.containerSecurityContext }} - securityContext: {{- include "common.tplvalues.render" (dict "value" .Values.containerSecurityContext "context" $) | nindent 12 }} - {{- end }} - {{- if .Values.core.lifecycleHooks }} - lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.core.lifecycleHooks "context" $) | nindent 12 }} - {{- end }} - {{- if .Values.core.livenessProbe.enabled }} - livenessProbe: - httpGet: - path: /api/v2.0/ping - scheme: {{ include "harbor.component.scheme" . | upper }} - port: http - initialDelaySeconds: {{ .Values.core.livenessProbe.initialDelaySeconds }} - periodSeconds: {{ .Values.core.livenessProbe.periodSeconds }} - timeoutSeconds: {{ .Values.core.livenessProbe.timeoutSeconds }} - successThreshold: {{ .Values.core.livenessProbe.successThreshold }} - failureThreshold: {{ .Values.core.livenessProbe.failureThreshold }} - {{- else if .Values.core.customLivenessProbe }} - livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.core.customLivenessProbe "context" $) | nindent 12 }} - {{- end }} - {{- if .Values.core.readinessProbe.enabled }} - readinessProbe: - httpGet: - path: /api/v2.0/ping - scheme: {{ include "harbor.component.scheme" . | upper }} - port: http - initialDelaySeconds: {{ .Values.core.readinessProbe.initialDelaySeconds }} - periodSeconds: {{ .Values.core.readinessProbe.periodSeconds }} - timeoutSeconds: {{ .Values.core.readinessProbe.timeoutSeconds }} - successThreshold: {{ .Values.core.readinessProbe.successThreshold }} - failureThreshold: {{ .Values.core.readinessProbe.failureThreshold }} - {{- else if .Values.core.customReadinessProbe }} - readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.core.customReadinessProbe "context" $) | nindent 12 }} - {{- end }} - {{- if .Values.core.startupProbe.enabled }} - startupProbe: - httpGet: - path: /api/v2.0/ping - scheme: {{ include "harbor.component.scheme" . | upper }} - port: http - initialDelaySeconds: {{ .Values.core.startupProbe.initialDelaySeconds }} - periodSeconds: {{ .Values.core.startupProbe.periodSeconds }} - timeoutSeconds: {{ .Values.core.startupProbe.timeoutSeconds }} - successThreshold: {{ .Values.core.startupProbe.successThreshold }} - failureThreshold: {{ .Values.core.startupProbe.failureThreshold }} - {{- else if .Values.core.customStartupProbe }} - startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.core.customStartupProbe "context" $) | nindent 12 }} - {{- end }} - envFrom: - - configMapRef: - name: {{ include "harbor.core" . }}-envvars - - secretRef: - name: {{ include "harbor.core" . }}-envvars - {{- if .Values.core.extraEnvVarsCM }} - - configMapRef: - name: {{ include "common.tplvalues.render" (dict "value" .Values.core.extraEnvVarsCM "context" $) }} - {{- end }} - {{- if .Values.core.extraEnvVarsSecret }} - - secretRef: - name: {{ include "common.tplvalues.render" (dict "value" .Values.core.extraEnvVarsSecret "context" $) }} - {{- end }} env: - name: BITNAMI_DEBUG - value: {{ ternary "true" "false" .Values.coreImage.debug | quote }} + value: {{ ternary "true" "false" .Values.core.image.debug | quote }} - name: CORE_SECRET valueFrom: secretKeyRef: @@ -166,9 +119,57 @@ spec: {{- if .Values.core.extraEnvVars }} {{- include "common.tplvalues.render" (dict "value" .Values.core.extraEnvVars "context" $) | nindent 12 }} {{- end }} + envFrom: + - configMapRef: + name: {{ printf "%s-envvars" (include "harbor.core" .) }} + - secretRef: + name: {{ printf "%s-envvars" (include "harbor.core" .) }} + {{- if .Values.core.extraEnvVarsCM }} + - configMapRef: + name: {{ include "common.tplvalues.render" (dict "value" .Values.core.extraEnvVarsCM "context" $) }} + {{- end }} + {{- if .Values.core.extraEnvVarsSecret }} + - secretRef: + name: {{ include "common.tplvalues.render" (dict "value" .Values.core.extraEnvVarsSecret "context" $) }} + {{- end }} ports: - - containerPort: {{ include "harbor.core.containerPort" . }} - name: http + - containerPort: {{ ternary .Values.core.containerPorts.https .Values.core.containerPorts.http .Values.internalTLS.enabled }} + name: {{ ternary "https" "http" .Values.internalTLS.enabled }} + {{- if not .Values.diagnosticMode.enabled }} + {{- if .Values.core.startupProbe.enabled }} + startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.core.startupProbe "enabled") "context" $) | nindent 12 }} + httpGet: + path: /api/v2.0/ping + scheme: {{ ternary "https" "http" .Values.internalTLS.enabled | upper }} + port: {{ ternary "https" "http" .Values.internalTLS.enabled }} + {{- else if .Values.core.customStartupProbe }} + startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.core.customStartupProbe "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.core.livenessProbe.enabled }} + livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.core.livenessProbe "enabled") "context" $) | nindent 12 }} + httpGet: + path: /api/v2.0/ping + scheme: {{ ternary "https" "http" .Values.internalTLS.enabled | upper }} + port: {{ ternary "https" "http" .Values.internalTLS.enabled }} + {{- else if .Values.core.customLivenessProbe }} + livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.core.customLivenessProbe "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.core.readinessProbe.enabled }} + readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.core.readinessProbe "enabled") "context" $) | nindent 12 }} + httpGet: + path: /api/v2.0/ping + scheme: {{ ternary "https" "http" .Values.internalTLS.enabled | upper }} + port: {{ ternary "https" "http" .Values.internalTLS.enabled }} + {{- else if .Values.core.customReadinessProbe }} + readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.core.customReadinessProbe "context" $) | nindent 12 }} + {{- end }} + {{- end }} + {{- if .Values.core.lifecycleHooks }} + lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.core.lifecycleHooks "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.core.resources }} + resources: {{- toYaml .Values.core.resources | nindent 12 }} + {{- end }} volumeMounts: - name: config mountPath: /etc/core/app.conf @@ -183,26 +184,23 @@ spec: - name: internal-tls-certs mountPath: /etc/harbor/ssl/core {{- end }} - {{- if .Values.service.tls.enabled }} + {{- if or (and (eq .Values.exposureType "proxy") .Values.nginx.tls.enabled) (and (eq .Values.exposureType "ingress") .Values.ingress.core.tls) }} - name: ca-download mountPath: /etc/core/ca {{- end }} - {{- if .Values.core.uaaSecretName }} + {{- if .Values.core.uaaSecret }} - name: auth-ca-cert mountPath: /etc/core/auth-ca/auth-ca.crt subPath: auth-ca.crt {{- end }} - name: psc mountPath: /etc/core/token - {{- if .Values.caBundleSecretName }} -{{ include "harbor.caBundleVolumeMount" . | indent 12 }} + {{- if .Values.internalTLS.caBundleSecret }} + {{- include "harbor.caBundleVolumeMount" . | nindent 12 }} {{- end }} {{- if .Values.core.extraVolumeMounts }} {{- include "common.tplvalues.render" (dict "value" .Values.core.extraVolumeMounts "context" $) | nindent 12 }} {{- end }} - {{- if .Values.core.resources }} - resources: {{- toYaml .Values.core.resources | nindent 12 }} - {{- end }} {{- if .Values.core.sidecars }} {{- include "common.tplvalues.render" (dict "value" .Values.core.sidecars "context" $) | nindent 8 }} {{- end }} @@ -219,8 +217,8 @@ spec: items: - key: secretKey path: key - {{- if .Values.caBundleSecretName }} -{{ include "harbor.caBundleVolume" . | indent 8 }} + {{- if .Values.internalTLS.caBundleSecret }} + {{- include "harbor.caBundleVolume" . | nindent 8 }} {{- end }} - name: token-service-private-key secret: @@ -234,21 +232,23 @@ spec: secret: secretName: {{ include "harbor.core.tls.secretName" . }} {{- end }} - {{- if .Values.service.tls.enabled }} + {{- if or (and (eq .Values.exposureType "proxy") .Values.nginx.tls.enabled) (and (eq .Values.exposureType "ingress") .Values.ingress.core.tls) }} - name: ca-download secret: - {{- if eq (include "harbor.autoGenCertForIngress" .) "true" }} - secretName: {{ include "harbor.ingress" . }} - {{- else if eq (include "harbor.autoGenCertForNginx" .) "true" }} + {{- if and (eq .Values.exposureType "proxy") .Values.nginx.tls.enabled }} + {{- if (include "harbor.autoGenCertForNginx" .) }} secretName: {{ include "harbor.nginx" . }} - {{- else }} - secretName: {{ .Values.service.tls.existingSecret }} + {{- else }} + secretName: {{ .Values.nginx.tls.existingSecret }} + {{- end }} + {{- else if and (eq .Values.exposureType "ingress") .Values.ingress.core.tls }} + secretName: {{ printf "%s-tls" .Values.ingress.core.hostname }} {{- end }} {{- end }} - {{- if .Values.core.uaaSecretName }} + {{- if .Values.core.uaaSecret }} - name: auth-ca-cert secret: - secretName: {{ .Values.core.uaaSecretName }} + secretName: {{ .Values.core.uaaSecret }} items: - key: ca.crt path: auth-ca.crt diff --git a/bitnami/harbor/templates/core/core-secret-envvars.yaml b/bitnami/harbor/templates/core/core-secret-envvars.yaml index 3898f97eb..379dc32ab 100644 --- a/bitnami/harbor/templates/core/core-secret-envvars.yaml +++ b/bitnami/harbor/templates/core/core-secret-envvars.yaml @@ -1,7 +1,8 @@ apiVersion: v1 kind: Secret metadata: - name: {{ include "harbor.core" . }}-envvars + name: {{ printf "%s-envvars" (include "harbor.core" .) }} + namespace: {{ .Release.Namespace | quote }} labels: {{- include "common.labels.standard" . | nindent 4 }} {{- if .Values.commonLabels }} {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} @@ -16,16 +17,6 @@ data: _REDIS_URL_REG: {{ include "harbor.redisForGC" . | b64enc | quote }} REGISTRY_CREDENTIAL_USERNAME: {{ .Values.registry.credentials.username | b64enc | quote }} REGISTRY_CREDENTIAL_PASSWORD: {{ .Values.registry.credentials.password | b64enc | quote }} - {{- if .Values.core.csrfKey }} - CSRF_KEY: {{ .Values.core.csrfKey | b64enc | quote }} - {{- else }} - CSRF_KEY: {{ randAlphaNum 32 | b64enc | quote }} - {{- end }} - {{- if .Values.harborAdminPassword }} - HARBOR_ADMIN_PASSWORD: {{ .Values.harborAdminPassword | b64enc | quote }} - {{- else if (not .Values.forcePassword) }} - HARBOR_ADMIN_PASSWORD: {{ randAlphaNum 10 | b64enc | quote }} - {{ else }} - HARBOR_ADMIN_PASSWORD: {{ required "A Harbor Admin Password is required!" .Values.harborAdminPassword }} - {{- end }} + CSRF_KEY: {{ include "common.secrets.passwords.manage" (dict "secret" (printf "%s-envvars" (include "harbor.core" .)) "key" "CSRF_KEY" "length" 32 "providedValues" (list "core.csrfKey") "context" $) }} + HARBOR_ADMIN_PASSWORD: {{ include "common.secrets.passwords.manage" (dict "secret" (printf "%s-envvars" (include "harbor.core" .)) "key" "HARBOR_ADMIN_PASSWORD" "length" 10 "providedValues" (list "adminPassword") "context" $) }} POSTGRESQL_PASSWORD: {{ template "harbor.database.encryptedPassword" . }} diff --git a/bitnami/harbor/templates/core/core-secret.yaml b/bitnami/harbor/templates/core/core-secret.yaml index c450af251..c47336dc3 100644 --- a/bitnami/harbor/templates/core/core-secret.yaml +++ b/bitnami/harbor/templates/core/core-secret.yaml @@ -2,6 +2,7 @@ apiVersion: v1 kind: Secret metadata: name: {{ include "harbor.core" . }} + namespace: {{ .Release.Namespace | quote }} labels: {{- include "common.labels.standard" . | nindent 4 }} {{- if .Values.commonLabels }} {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} @@ -12,22 +13,8 @@ metadata: {{- end }} type: Opaque data: - {{- if .Values.core.secretKey }} - secretKey: {{ .Values.core.secretKey | b64enc | quote }} - {{- else if (not .Values.forcePassword) }} - secretKey: {{ randAlphaNum 16 | b64enc | quote }} - {{- else }} - secretKey: {{ required "A secret key is required!" .Values.core.secretKey }} - {{- end }} - - {{- if .Values.core.secret }} - secret: {{ .Values.core.secret | b64enc | quote }} - {{- else if (not .Values.forcePassword) }} - secret: {{ randAlphaNum 16 | b64enc | quote }} - {{- else }} - secret: {{ required "A secret is required!" .Values.core.secret }} - {{- end }} - + secretKey: {{ include "common.secrets.passwords.manage" (dict "secret" (include "harbor.core" .) "key" "secretKey" "length" 16 "providedValues" (list "core.secretKey") "context" $) }} + secret: {{ include "common.secrets.passwords.manage" (dict "secret" (include "harbor.core" .) "key" "secret" "length" 16 "providedValues" (list "core.secret") "context" $) }} {{- if not .Values.core.secretName }} tls.crt: {{ .Files.Get "cert/tls.crt" | b64enc }} tls.key: {{ .Files.Get "cert/tls.key" | b64enc }} diff --git a/bitnami/harbor/templates/core/core-svc.yaml b/bitnami/harbor/templates/core/core-svc.yaml index 4cc981df1..9a386b196 100644 --- a/bitnami/harbor/templates/core/core-svc.yaml +++ b/bitnami/harbor/templates/core/core-svc.yaml @@ -2,6 +2,7 @@ apiVersion: v1 kind: Service metadata: name: {{ include "harbor.core" . }} + namespace: {{ .Release.Namespace | quote }} labels: {{- include "common.labels.standard" . | nindent 4 }} {{- if .Values.commonLabels }} {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} @@ -11,12 +12,12 @@ metadata: annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} {{- end }} spec: - {{- if (eq .Values.ingress.controller "gce") }} + {{- if (eq .Values.ingress.core.controller "gce") }} type: NodePort {{- end }} ports: - - name: http - port: {{ include "harbor.core.servicePort" . }} - targetPort: http + - name: {{ ternary "https" "http" .Values.internalTLS.enabled }} + port: {{ ternary .Values.core.service.ports.https .Values.core.service.ports.http .Values.internalTLS.enabled }} + targetPort: {{ ternary "https" "http" .Values.internalTLS.enabled }} selector: {{- include "common.labels.matchLabels" . | nindent 4 }} app.kubernetes.io/component: core diff --git a/bitnami/harbor/templates/ingress/core-ingress.yaml b/bitnami/harbor/templates/ingress/core-ingress.yaml new file mode 100644 index 000000000..35e90594e --- /dev/null +++ b/bitnami/harbor/templates/ingress/core-ingress.yaml @@ -0,0 +1,116 @@ +{{- if eq .Values.exposureType "ingress" }} +{{- if eq .Values.ingress.core.controller "gce" }} + {{- $_ := set . "portal_path" "/*" -}} + {{- $_ := set . "api_path" "/api/*" -}} + {{- $_ := set . "service_path" "/service/*" -}} + {{- $_ := set . "v2_path" "/v2/*" -}} + {{- $_ := set . "chartrepo_path" "/chartrepo/*" -}} + {{- $_ := set . "controller_path" "/c/*" -}} +{{- else if eq .Values.ingress.core.controller "ncp" }} + {{- $_ := set . "portal_path" "/.*" -}} + {{- $_ := set . "api_path" "/api/.*" -}} + {{- $_ := set . "service_path" "/service/.*" -}} + {{- $_ := set . "v2_path" "/v2/.*" -}} + {{- $_ := set . "chartrepo_path" "/chartrepo/.*" -}} + {{- $_ := set . "controller_path" "/c/.*" -}} +{{- else }} + {{- $_ := set . "portal_path" "/" -}} + {{- $_ := set . "api_path" "/api/" -}} + {{- $_ := set . "service_path" "/service/" -}} + {{- $_ := set . "v2_path" "/v2" -}} + {{- $_ := set . "chartrepo_path" "/chartrepo/" -}} + {{- $_ := set . "controller_path" "/c/" -}} +{{- end }} +apiVersion: {{ template "common.capabilities.ingress.apiVersion" . }} +kind: Ingress +metadata: + name: {{ include "harbor.ingress" . }} + namespace: {{ .Release.Namespace | quote }} + labels: {{- include "common.labels.standard" . | nindent 4 }} + {{- if .Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + annotations: + {{- if .Values.internalTLS.enabled }} + nginx.ingress.kubernetes.io/backend-protocol: "HTTPS" + {{- end }} + {{- if eq .Values.ingress.core.controller "ncp" }} + ncp/use-regex: "true" + {{- if .Values.internalTLS.enabled }} + ncp/http-redirect: "true" + {{- end }} + {{- end }} + {{- if .Values.ingress.core.annotations }} + {{- include "common.tplvalues.render" (dict "value" .Values.ingress.core.annotations "context" .) | nindent 4 }} + {{- end }} + {{- if .Values.commonAnnotations }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" .) | nindent 4 }} + {{- end }} +spec: + {{- if eq .Values.ingress.core.controller "ncp" }} + backend: {{- include "common.ingress.backend" (dict "serviceName" (include "harbor.portal" .) "servicePort" (ternary "https" "http" .Values.internalTLS.enabled) "context" $) | nindent 4 }} + {{- end }} + {{- if and .Values.ingress.core.ingressClassName (eq "true" (include "common.ingress.supportsIngressClassname" .)) }} + ingressClassName: {{ .Values.ingress.core.ingressClassName | quote }} + {{- end }} + rules: + {{- if .Values.ingress.core.hostname }} + - host: {{ include "common.tplvalues.render" ( dict "value" .Values.ingress.core.hostname "context" $ ) }} + http: + paths: + {{- if .Values.ingress.core.extraPaths }} + {{- toYaml .Values.ingress.core.extraPaths | nindent 10 }} + {{- end }} + - path: {{ .portal_path }} + {{- if eq "true" (include "common.ingress.supportsPathType" .) }} + pathType: {{ .Values.ingress.core.pathType }} + {{- end }} + backend: {{- include "common.ingress.backend" (dict "serviceName" (include "harbor.portal" .) "servicePort" (ternary "https" "http" .Values.internalTLS.enabled) "context" $) | nindent 14 }} + - path: {{ .api_path }} + {{- if eq "true" (include "common.ingress.supportsPathType" .) }} + pathType: {{ .Values.ingress.core.pathType }} + {{- end }} + backend: {{- include "common.ingress.backend" (dict "serviceName" (include "harbor.core" .) "servicePort" (ternary "https" "http" .Values.internalTLS.enabled) "context" $) | nindent 14 }} + - path: {{ .service_path }} + {{- if eq "true" (include "common.ingress.supportsPathType" .) }} + pathType: {{ .Values.ingress.core.pathType }} + {{- end }} + backend: {{- include "common.ingress.backend" (dict "serviceName" (include "harbor.core" .) "servicePort" (ternary "https" "http" .Values.internalTLS.enabled) "context" $) | nindent 14 }} + - path: {{ .v2_path }} + {{- if eq "true" (include "common.ingress.supportsPathType" .) }} + pathType: {{ .Values.ingress.core.pathType }} + {{- end }} + backend: {{- include "common.ingress.backend" (dict "serviceName" (include "harbor.core" .) "servicePort" (ternary "https" "http" .Values.internalTLS.enabled) "context" $) | nindent 14 }} + - path: {{ .chartrepo_path }} + {{- if eq "true" (include "common.ingress.supportsPathType" .) }} + pathType: {{ .Values.ingress.core.pathType }} + {{- end }} + backend: {{- include "common.ingress.backend" (dict "serviceName" (include "harbor.core" .) "servicePort" (ternary "https" "http" .Values.internalTLS.enabled) "context" $) | nindent 14 }} + - path: {{ .controller_path }} + {{- if eq "true" (include "common.ingress.supportsPathType" .) }} + pathType: {{ .Values.ingress.core.pathType }} + {{- end }} + backend: {{- include "common.ingress.backend" (dict "serviceName" (include "harbor.core" .) "servicePort" (ternary "https" "http" .Values.internalTLS.enabled) "context" $) | nindent 14 }} + {{- end }} + {{- range .Values.ingress.core.extraHosts }} + - host: {{ include "common.tplvalues.render" ( dict "value" .name "context" $ ) }} + http: + paths: + - path: {{ default "/" .path }} + {{- if eq "true" (include "common.ingress.supportsPathType" $) }} + pathType: {{ default "ImplementationSpecific" .pathType }} + {{- end }} + backend: {{- include "common.ingress.backend" (dict "serviceName" (include "harbor.core" .) "servicePort" (ternary "https" "http" .Values.internalTLS.enabled) "context" $) | nindent 14 }} + {{- end }} + {{- if or (and .Values.ingress.core.tls (or (include "common.ingress.certManagerRequest" ( dict "annotations" .Values.ingress.core.annotations )) .Values.ingress.core.selfSigned)) .Values.ingress.core.extraTls }} + tls: + {{- if and .Values.ingress.core.tls (or (include "common.ingress.certManagerRequest" ( dict "annotations" .Values.ingress.core.annotations )) .Values.ingress.core.selfSigned) }} + - hosts: + - {{ .Values.ingress.core.hostname | quote }} + secretName: {{ printf "%s-tls" .Values.ingress.core.hostname }} + {{- end }} + {{- if .Values.ingress.core.extraTls }} + {{- include "common.tplvalues.render" (dict "value" .Values.ingress.core.extraTls "context" $) | nindent 4 }} + {{- end }} + {{- end }} +{{- end }} diff --git a/bitnami/harbor/templates/ingress/ingress.yaml b/bitnami/harbor/templates/ingress/ingress.yaml deleted file mode 100644 index 6cd18bd17..000000000 --- a/bitnami/harbor/templates/ingress/ingress.yaml +++ /dev/null @@ -1,162 +0,0 @@ -{{- if .Values.ingress.enabled }} -{{- if eq .Values.ingress.controller "gce" }} - {{- $_ := set . "portal_path" "/*" -}} - {{- $_ := set . "api_path" "/api/*" -}} - {{- $_ := set . "service_path" "/service/*" -}} - {{- $_ := set . "v2_path" "/v2/*" -}} - {{- $_ := set . "chartrepo_path" "/chartrepo/*" -}} - {{- $_ := set . "controller_path" "/c/*" -}} - {{- $_ := set . "notary_path" "/" -}} -{{- else if eq .Values.ingress.controller "ncp" }} - {{- $_ := set . "portal_path" "/.*" -}} - {{- $_ := set . "api_path" "/api/.*" -}} - {{- $_ := set . "service_path" "/service/.*" -}} - {{- $_ := set . "v2_path" "/v2/.*" -}} - {{- $_ := set . "chartrepo_path" "/chartrepo/.*" -}} - {{- $_ := set . "controller_path" "/c/.*" -}} - {{- $_ := set . "notary_path" "/.*" -}} -{{- else }} - {{- $_ := set . "portal_path" "/" -}} - {{- $_ := set . "api_path" "/api/" -}} - {{- $_ := set . "service_path" "/service/" -}} - {{- $_ := set . "v2_path" "/v2" -}} - {{- $_ := set . "chartrepo_path" "/chartrepo/" -}} - {{- $_ := set . "controller_path" "/c/" -}} - {{- $_ := set . "notary_path" "/" -}} -{{- end }} - ---- -apiVersion: {{ template "common.capabilities.ingress.apiVersion" . }} -kind: Ingress -metadata: - name: {{ include "harbor.ingress" . }} - labels: {{- include "common.labels.standard" . | nindent 4 }} - {{- if .Values.commonLabels }} - {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} - {{- end }} - annotations: - {{- if .Values.internalTLS.enabled }} - nginx.ingress.kubernetes.io/backend-protocol: "HTTPS" - {{- end }} - {{- if .Values.ingress.certManager }} - kubernetes.io/tls-acme: "true" - {{- end }} - {{- if eq .Values.ingress.controller "ncp" }} - ncp/use-regex: "true" - {{- if .Values.internalTLS.enabled }} - ncp/http-redirect: "true" - {{- end }} - {{- end }} - {{- if .Values.ingress.annotations }} - {{- toYaml .Values.ingress.annotations | nindent 4 }} - {{- end }} - {{- if .Values.commonAnnotations }} - {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} -spec: - {{- if .Values.service.tls.enabled }} - tls: - {{- if .Values.service.tls.existingSecret }} - - secretName: {{ .Values.service.tls.existingSecret }} - {{- else }} - - secretName: {{ include "harbor.ingress" . }} - {{- end }} - {{- if .Values.ingress.hosts.core }} - hosts: - - {{ .Values.ingress.hosts.core }} - {{- end }} - {{- end }} - {{- if eq .Values.ingress.controller "ncp" }} - backend: {{- include "common.ingress.backend" (dict "serviceName" (include "harbor.portal" .) "servicePort" "http" "context" $) | nindent 4 }} - {{- end }} - rules: - - http: - paths: - - path: {{ .portal_path }} - {{- if eq "true" (include "common.ingress.supportsPathType" .) }} - pathType: {{ .Values.ingress.pathType }} - {{- end }} - backend: {{- include "common.ingress.backend" (dict "serviceName" (include "harbor.portal" .) "servicePort" "http" "context" $) | nindent 14 }} - - path: {{ .api_path }} - {{- if eq "true" (include "common.ingress.supportsPathType" .) }} - pathType: {{ .Values.ingress.pathType }} - {{- end }} - backend: {{- include "common.ingress.backend" (dict "serviceName" (include "harbor.core" .) "servicePort" "http" "context" $) | nindent 14 }} - - path: {{ .service_path }} - {{- if eq "true" (include "common.ingress.supportsPathType" .) }} - pathType: {{ .Values.ingress.pathType }} - {{- end }} - backend: {{- include "common.ingress.backend" (dict "serviceName" (include "harbor.core" .) "servicePort" "http" "context" $) | nindent 14 }} - - path: {{ .v2_path }} - {{- if eq "true" (include "common.ingress.supportsPathType" .) }} - pathType: {{ .Values.ingress.pathType }} - {{- end }} - backend: {{- include "common.ingress.backend" (dict "serviceName" (include "harbor.core" .) "servicePort" "http" "context" $) | nindent 14 }} - - path: {{ .chartrepo_path }} - {{- if eq "true" (include "common.ingress.supportsPathType" .) }} - pathType: {{ .Values.ingress.pathType }} - {{- end }} - backend: {{- include "common.ingress.backend" (dict "serviceName" (include "harbor.core" .) "servicePort" "http" "context" $) | nindent 14 }} - - path: {{ .controller_path }} - {{- if eq "true" (include "common.ingress.supportsPathType" .) }} - pathType: {{ .Values.ingress.pathType }} - {{- end }} - backend: {{- include "common.ingress.backend" (dict "serviceName" (include "harbor.core" .) "servicePort" "http" "context" $) | nindent 14 }} - {{- if .Values.ingress.hosts.core }} - host: {{ .Values.ingress.hosts.core }} - {{- end }} - -{{- if .Values.notary.enabled }} ---- -apiVersion: {{ template "common.capabilities.ingress.apiVersion" . }} -kind: Ingress -metadata: - name: {{ include "harbor.ingress-notary" . }} - labels: {{- include "common.labels.standard" . | nindent 4 }} - {{- if .Values.commonLabels }} - {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} - {{- end }} - annotations: - {{- if eq .Values.ingress.controller "ncp" }} - ncp/use-regex: "true" - {{- if .Values.internalTLS.enabled }} - ncp/http-redirect: "true" - {{- end }} - {{- end }} - {{- if .Values.ingress.annotations }} - {{- toYaml .Values.ingress.annotations | nindent 4 }} - {{- end }} - {{- if .Values.commonAnnotations }} - {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} -spec: - {{- if .Values.service.tls.enabled }} - tls: - {{- if .Values.service.tls.notaryExistingSecret }} - - secretName: {{ .Values.service.tls.notaryExistingSecret }} - {{- else if .Values.service.tls.existingSecret }} - - secretName: {{ .Values.service.tls.existingSecret }} - {{- else }} - - secretName: {{ include "harbor.ingress-notary" . }} - {{- end }} - {{- if .Values.ingress.hosts.notary }} - hosts: - - {{ .Values.ingress.hosts.notary }} - {{- end }} - {{- end }} - {{- if eq .Values.ingress.controller "ncp" }} - backend: {{- include "common.ingress.backend" (dict "serviceName" (include "harbor.notary-server" .) "servicePort" 4443 "context" $) | nindent 4 }} - {{- end }} - rules: - - http: - paths: - - path: {{ .notary_path }} - {{- if eq "true" (include "common.ingress.supportsPathType" .) }} - pathType: {{ .Values.ingress.pathType }} - {{- end }} - backend: {{- include "common.ingress.backend" (dict "serviceName" (include "harbor.notary-server" .) "servicePort" 4443 "context" $) | nindent 14 }} - {{- if .Values.ingress.hosts.notary }} - host: {{ .Values.ingress.hosts.notary }} - {{- end }} -{{- end }} -{{- end }} diff --git a/bitnami/harbor/templates/ingress/notary-ingress.yaml b/bitnami/harbor/templates/ingress/notary-ingress.yaml new file mode 100644 index 000000000..044cb0553 --- /dev/null +++ b/bitnami/harbor/templates/ingress/notary-ingress.yaml @@ -0,0 +1,64 @@ +{{- if and .Values.notary.enabled (eq .Values.exposureType "ingress") }} +apiVersion: {{ template "common.capabilities.ingress.apiVersion" . }} +kind: Ingress +metadata: + name: {{ include "harbor.ingress-notary" . }} + namespace: {{ .Release.Namespace | quote }} + labels: {{- include "common.labels.standard" . | nindent 4 }} + {{- if .Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + annotations: + {{- if .Values.ingress.notary.annotations }} + {{- include "common.tplvalues.render" (dict "value" .Values.ingress.notary.annotations "context" .) | nindent 4 }} + {{- end }} + {{- if .Values.commonAnnotations }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" .) | nindent 4 }} + {{- end }} +spec: + {{- if eq .Values.ingress.notary.controller "ncp" }} + backend: {{- include "common.ingress.backend" (dict "serviceName" (include "harbor.notary-server" .) "servicePort" "notary-server" "context" $) | nindent 4 }} + {{- end }} + {{- if and .Values.ingress.notary.ingressClassName (eq "true" (include "common.ingress.supportsIngressClassname" .)) }} + ingressClassName: {{ .Values.ingress.notary.ingressClassName | quote }} + {{- end }} + rules: + {{- if .Values.ingress.notary.hostname }} + - host: {{ include "common.tplvalues.render" ( dict "value" .Values.ingress.notary.hostname "context" $ ) }} + http: + paths: + {{- if .Values.ingress.notary.extraPaths }} + {{- toYaml .Values.ingress.notary.extraPaths | nindent 10 }} + {{- end }} + {{- if eq .Values.ingress.notary.controller "ncp" }} + - path: /.* + {{- else }} + - path: / + {{- end }} + {{- if eq "true" (include "common.ingress.supportsPathType" .) }} + pathType: {{ .Values.ingress.notary.pathType }} + {{- end }} + backend: {{- include "common.ingress.backend" (dict "serviceName" (include "harbor.notary-server" .) "servicePort" "notary-server" "context" $) | nindent 14 }} + {{- end }} + {{- range .Values.ingress.notary.extraHosts }} + - host: {{ include "common.tplvalues.render" ( dict "value" .name "context" $ ) }} + http: + paths: + - path: {{ default "/" .path }} + {{- if eq "true" (include "common.ingress.supportsPathType" $) }} + pathType: {{ default "ImplementationSpecific" .pathType }} + {{- end }} + backend: {{- include "common.ingress.backend" (dict "serviceName" (include "harbor.notary-server" .) "servicePort" "notary-server" "context" $) | nindent 14 }} + {{- end }} + {{- if or (and .Values.ingress.notary.tls (or (include "common.ingress.certManagerRequest" ( dict "annotations" .Values.ingress.notary.annotations )) .Values.ingress.notary.selfSigned)) .Values.ingress.notary.extraTls }} + tls: + {{- if and .Values.ingress.notary.tls (or (include "common.ingress.certManagerRequest" ( dict "annotations" .Values.ingress.notary.annotations )) .Values.ingress.notary.selfSigned) }} + - hosts: + - {{ .Values.ingress.notary.hostname | quote }} + secretName: {{ printf "%s-tls" .Values.ingress.notary.hostname }} + {{- end }} + {{- if .Values.ingress.notary.extraTls }} + {{- include "common.tplvalues.render" (dict "value" .Values.ingress.notary.extraTls "context" $) | nindent 4 }} + {{- end }} + {{- end }} +{{- end }} diff --git a/bitnami/harbor/templates/ingress/secret.yaml b/bitnami/harbor/templates/ingress/secret.yaml deleted file mode 100644 index c959fcc70..000000000 --- a/bitnami/harbor/templates/ingress/secret.yaml +++ /dev/null @@ -1,38 +0,0 @@ -{{- if eq (include "harbor.autoGenCertForIngress" .) "true" }} -{{- $ca := genCA "harbor-ca" 365 }} -{{- $cert := genSignedCert .Values.ingress.hosts.core nil (list .Values.ingress.hosts.core ) 365 $ca }} -apiVersion: v1 -kind: Secret -metadata: - name: {{ include "harbor.ingress" . }} - labels: {{- include "common.labels.standard" . | nindent 4 }} - {{- if .Values.commonLabels }} - {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} - {{- end }} - {{- if .Values.commonAnnotations }} - annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} -type: kubernetes.io/tls -data: - tls.crt: {{ $cert.Cert | b64enc | quote }} - tls.key: {{ $cert.Key | b64enc | quote }} - ca.crt: {{ $ca.Cert | b64enc | quote }} ---- -{{- $cert := genSignedCert .Values.ingress.hosts.notary nil (list .Values.ingress.hosts.notary) 365 $ca }} -apiVersion: v1 -kind: Secret -metadata: - name: {{ include "harbor.ingress-notary" . }} - labels: {{- include "common.labels.standard" . | nindent 4 }} - {{- if .Values.commonLabels }} - {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} - {{- end }} - {{- if .Values.commonAnnotations }} - annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} -type: kubernetes.io/tls -data: - tls.crt: {{ $cert.Cert | b64enc | quote }} - tls.key: {{ $cert.Key | b64enc | quote }} - ca.crt: {{ $ca.Cert | b64enc | quote }} -{{- end }} diff --git a/bitnami/harbor/templates/ingress/tls-secret.yaml b/bitnami/harbor/templates/ingress/tls-secret.yaml new file mode 100644 index 000000000..acca9da45 --- /dev/null +++ b/bitnami/harbor/templates/ingress/tls-secret.yaml @@ -0,0 +1,85 @@ +{{- if eq .Values.exposureType "ingress" }} +{{- $ca := genCA "harbor-ca" 365 }} +{{- range .Values.ingress.core.secrets }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ .name }} + namespace: {{ $.Release.Namespace | quote | quote }} + labels: {{- include "common.labels.standard" $ | nindent 4 }} + {{- if $.Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" $.Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + {{- if $.Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" $.Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +type: kubernetes.io/tls +data: + tls.crt: {{ .certificate | b64enc }} + tls.key: {{ .key | b64enc }} +--- +{{- end }} +{{- if and .Values.ingress.core.tls .Values.ingress.core.selfSigned }} +{{- $cert := genSignedCert .Values.ingress.core.hostname nil (list .Values.ingress.core.hostname) 365 $ca }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ printf "%s-tls" .Values.ingress.core.hostname }} + namespace: {{ .Release.Namespace | quote | quote }} + labels: {{- include "common.labels.standard" . | nindent 4 }} + {{- if .Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +type: kubernetes.io/tls +data: + tls.crt: {{ $cert.Cert | b64enc | quote }} + tls.key: {{ $cert.Key | b64enc | quote }} + ca.crt: {{ $ca.Cert | b64enc | quote }} +--- +{{- end }} +{{- if .Values.notary.enabled }} +{{- range .Values.ingress.notary.secrets }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ .name }} + namespace: {{ $.Release.Namespace | quote | quote }} + labels: {{- include "common.labels.standard" $ | nindent 4 }} + {{- if $.Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" $.Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + {{- if $.Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" $.Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +type: kubernetes.io/tls +data: + tls.crt: {{ .certificate | b64enc }} + tls.key: {{ .key | b64enc }} +--- +{{- end }} +{{- if and .Values.ingress.notary.tls .Values.ingress.notary.selfSigned }} +{{- $cert := genSignedCert .Values.ingress.notary.hostname nil (list .Values.ingress.notary.hostname) 365 $ca }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ printf "%s-tls" .Values.ingress.notary.hostname }} + namespace: {{ .Release.Namespace | quote | quote }} + labels: {{- include "common.labels.standard" . | nindent 4 }} + {{- if .Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +type: kubernetes.io/tls +data: + tls.crt: {{ $cert.Cert | b64enc | quote }} + tls.key: {{ $cert.Key | b64enc | quote }} + ca.crt: {{ $ca.Cert | b64enc | quote }} +--- +{{- end }} +{{- end }} +{{- end }} diff --git a/bitnami/harbor/templates/internal/internal-crt-secret.yaml b/bitnami/harbor/templates/internal/internal-crt-secret.yaml index b8bf8778a..73bce4bd9 100644 --- a/bitnami/harbor/templates/internal/internal-crt-secret.yaml +++ b/bitnami/harbor/templates/internal/internal-crt-secret.yaml @@ -9,6 +9,7 @@ apiVersion: v1 kind: Secret metadata: name: {{ include "harbor.core" . }}-crt + namespace: {{ .Release.Namespace | quote }} labels: {{- include "common.labels.standard" . | nindent 4 }} {{- if .Values.commonLabels }} {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} @@ -28,6 +29,7 @@ apiVersion: v1 kind: Secret metadata: name: {{ include "harbor.jobservice" . }}-crt + namespace: {{ .Release.Namespace | quote }} labels: {{- include "common.labels.standard" . | nindent 4 }} {{- if .Values.commonLabels }} {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} @@ -47,6 +49,7 @@ apiVersion: v1 kind: Secret metadata: name: {{ include "harbor.registry" . }}-crt + namespace: {{ .Release.Namespace | quote }} labels: {{- include "common.labels.standard" . | nindent 4 }} {{- if .Values.commonLabels }} {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} @@ -66,6 +69,7 @@ apiVersion: v1 kind: Secret metadata: name: {{ include "harbor.portal" . }}-crt + namespace: {{ .Release.Namespace | quote }} labels: {{- include "common.labels.standard" . | nindent 4 }} {{- if .Values.commonLabels }} {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} @@ -85,6 +89,7 @@ apiVersion: v1 kind: Secret metadata: name: {{ include "harbor.chartmuseum" . }}-crt + namespace: {{ .Release.Namespace | quote }} labels: {{- include "common.labels.standard" . | nindent 4 }} {{- if .Values.commonLabels }} {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} @@ -105,6 +110,7 @@ apiVersion: v1 kind: Secret metadata: name: {{ include "harbor.clair" . }}-crt + namespace: {{ .Release.Namespace | quote }} labels: {{- include "common.labels.standard" . | nindent 4 }} {{- if .Values.commonLabels }} {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} @@ -125,6 +131,7 @@ apiVersion: v1 kind: Secret metadata: name: {{ include "harbor.trivy" . }}-crt + namespace: {{ .Release.Namespace | quote }} labels: {{- include "common.labels.standard" . | nindent 4 }} {{- if .Values.commonLabels }} {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} diff --git a/bitnami/harbor/templates/jobservice/jobservice-cm-envvars.yaml b/bitnami/harbor/templates/jobservice/jobservice-cm-envvars.yaml index 3773dbebf..647bf4945 100644 --- a/bitnami/harbor/templates/jobservice/jobservice-cm-envvars.yaml +++ b/bitnami/harbor/templates/jobservice/jobservice-cm-envvars.yaml @@ -1,7 +1,8 @@ apiVersion: v1 kind: ConfigMap metadata: - name: {{ template "harbor.jobservice" . }}-envvars + name: {{ printf "%s-envvars" (include "harbor.jobservice" .) }} + namespace: {{ .Release.Namespace | quote }} labels: {{- include "common.labels.standard" . | nindent 4 }} {{- if .Values.commonLabels }} {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} diff --git a/bitnami/harbor/templates/jobservice/jobservice-cm.yaml b/bitnami/harbor/templates/jobservice/jobservice-cm.yaml index 9b8cd8293..6f842031c 100644 --- a/bitnami/harbor/templates/jobservice/jobservice-cm.yaml +++ b/bitnami/harbor/templates/jobservice/jobservice-cm.yaml @@ -2,6 +2,7 @@ apiVersion: v1 kind: ConfigMap metadata: name: {{ include "harbor.jobservice" . }} + namespace: {{ .Release.Namespace | quote }} labels: {{- include "common.labels.standard" . | nindent 4 }} {{- if .Values.commonLabels }} {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} @@ -13,8 +14,8 @@ metadata: data: config.yml: |+ #Server listening port - protocol: {{ include "harbor.component.scheme" . | quote }} - port: {{ include "harbor.jobservice.containerPort" . }} + protocol: {{ ternary "https" "http" .Values.internalTLS.enabled | quote }} + port: {{ ternary .Values.jobservice.containerPorts.https .Values.jobservice.containerPorts.http .Values.internalTLS.enabled }} {{- if .Values.internalTLS.enabled }} https_config: cert: "/etc/harbor/ssl/jobservice/tls.crt" diff --git a/bitnami/harbor/templates/jobservice/jobservice-dpl.yaml b/bitnami/harbor/templates/jobservice/jobservice-dpl.yaml index 91bac6b71..2c8d0fec0 100644 --- a/bitnami/harbor/templates/jobservice/jobservice-dpl.yaml +++ b/bitnami/harbor/templates/jobservice/jobservice-dpl.yaml @@ -2,6 +2,7 @@ apiVersion: {{ template "common.capabilities.deployment.apiVersion" . }} kind: Deployment metadata: name: {{ include "harbor.jobservice" . }} + namespace: {{ .Release.Namespace | quote }} labels: {{- include "common.labels.standard" . | nindent 4 }} {{- if .Values.commonLabels }} {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} @@ -12,12 +13,12 @@ metadata: {{- end }} spec: replicas: {{ .Values.jobservice.replicas }} - {{- if .Values.jobservice.updateStrategy }} - strategy: {{- toYaml .Values.jobservice.updateStrategy | nindent 4 }} - {{- end }} selector: matchLabels: {{- include "common.labels.matchLabels" . | nindent 6 }} app.kubernetes.io/component: jobservice + {{- if .Values.jobservice.updateStrategy }} + strategy: {{- toYaml .Values.jobservice.updateStrategy | nindent 4 }} + {{- end }} template: metadata: labels: {{- include "common.labels.standard" . | nindent 8 }} @@ -43,10 +44,12 @@ spec: spec: {{- include "harbor.imagePullSecrets" . | nindent 6 }} automountServiceAccountToken: {{ .Values.jobservice.automountServiceAccountToken }} + {{- if .Values.jobservice.hostAliases }} + hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.jobservice.hostAliases "context" $) | nindent 8 }} + {{- end }} {{- if .Values.jobservice.affinity }} affinity: {{- include "common.tplvalues.render" (dict "value" .Values.jobservice.affinity "context" $) | nindent 8 }} {{- else }} - priorityClassName: {{ .Values.jobservice.priorityClassName | quote }} affinity: podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.jobservice.podAffinityPreset "component" "jobservice" "context" $) | nindent 10 }} podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.jobservice.podAntiAffinityPreset "component" "jobservice" "context" $) | nindent 10 }} @@ -58,22 +61,33 @@ spec: {{- if .Values.jobservice.tolerations }} tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.jobservice.tolerations "context" $) | nindent 8 }} {{- end }} - {{- if .Values.podSecurityContext }} - securityContext: {{- include "common.tplvalues.render" (dict "value" .Values.podSecurityContext "context" $) | nindent 8 }} + {{- if .Values.jobservice.topologySpreadConstraints }} + topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.jobservice.topologySpreadConstraints "context" .) | nindent 8 }} + {{- end }} + {{- if .Values.jobservice.priorityClassName }} + priorityClassName: {{ .Values.jobservice.priorityClassName | quote }} + {{- end }} + {{- if .Values.jobservice.schedulerName }} + schedulerName: {{ .Values.jobservice.schedulerName }} + {{- end }} + {{- if .Values.jobservice.podSecurityContext.enabled }} + securityContext: {{- omit .Values.jobservice.podSecurityContext "enabled" | toYaml | nindent 8 }} {{- end }} initContainers: - {{- if and .Values.volumePermissions.enabled .Values.persistence.enabled }} + {{- if and .Values.volumePermissions.enabled .Values.persistence.enabled }} - name: volume-permissions image: {{ include "harbor.volumePermissions.image" . }} imagePullPolicy: {{ .Values.volumePermissions.image.pullPolicy | quote }} command: - - sh - - -c + - /bin/bash + args: + - -ec - | - mkdir -p "/var/log/jobs" - chown -R "{{ .Values.containerSecurityContext.runAsUser }}:{{ .Values.podSecurityContext.fsGroup }}" "/var/log/jobs" - securityContext: - runAsUser: 0 + mkdir -p /var/log/jobs + find /var/log/jobs -mindepth 1 -maxdepth 1 -not -name ".snapshot" -not -name "lost+found" | xargs -r chown -R {{ .Values.jobservice.containerSecurityContext.runAsUser }}:{{ .Values.jobservice.podSecurityContext.fsGroup }} + {{- if .Values.volumePermissions.containerSecurityContext.enabled }} + securityContext: {{- omit .Values.volumePermissions.containerSecurityContext "enabled" | toYaml | nindent 12 }} + {{- end }} {{- if .Values.volumePermissions.resources }} resources: {{- toYaml .Values.volumePermissions.resources | nindent 12 }} {{- end }} @@ -81,63 +95,30 @@ spec: - name: job-logs mountPath: /var/log/jobs subPath: {{ .Values.persistence.persistentVolumeClaim.jobservice.subPath }} - {{- end }} - {{- if .Values.jobservice.initContainers }} - {{- include "common.tplvalues.render" (dict "value" .Values.jobservice.initContainers "context" $) | nindent 8 }} - {{- end }} - {{- if .Values.jobservice.hostAliases }} - hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.jobservice.hostAliases "context" $) | nindent 8 }} - {{- end }} + {{- end }} + {{- if .Values.jobservice.initContainers }} + {{- include "common.tplvalues.render" (dict "value" .Values.jobservice.initContainers "context" $) | nindent 8 }} + {{- end }} containers: - name: jobservice - image: {{ include "harbor.jobserviceImage" . }} - imagePullPolicy: {{ .Values.jobserviceImage.pullPolicy | quote }} - {{- if .Values.jobservice.command }} + image: {{ include "harbor.jobservice.image" . }} + imagePullPolicy: {{ .Values.jobservice.image.pullPolicy | quote }} + {{- if .Values.jobservice.containerSecurityContext.enabled }} + securityContext: {{- omit .Values.jobservice.containerSecurityContext "enabled" | toYaml | nindent 12 }} + {{- end }} + {{- if .Values.diagnosticMode.enabled }} + command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }} + {{- else if .Values.jobservice.command }} command: {{- include "common.tplvalues.render" (dict "value" .Values.jobservice.command "context" $) | nindent 12 }} {{- end }} - {{- if .Values.containerSecurityContext }} - securityContext: {{- include "common.tplvalues.render" (dict "value" .Values.containerSecurityContext "context" $) | nindent 12 }} - {{- end }} - {{- if .Values.jobservice.args }} + {{- if .Values.diagnosticMode.enabled }} + args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }} + {{- else if .Values.jobservice.args }} args: {{- include "common.tplvalues.render" (dict "value" .Values.jobservice.args "context" $) | nindent 12 }} {{- end }} - {{- if .Values.jobservice.livenessProbe.enabled }} - livenessProbe: - httpGet: - path: /api/v1/stats - port: http - scheme: {{ include "harbor.component.scheme" . | upper }} - initialDelaySeconds: {{ .Values.jobservice.livenessProbe.initialDelaySeconds }} - periodSeconds: {{ .Values.jobservice.livenessProbe.periodSeconds }} - timeoutSeconds: {{ .Values.jobservice.livenessProbe.timeoutSeconds }} - successThreshold: {{ .Values.jobservice.livenessProbe.successThreshold }} - failureThreshold: {{ .Values.jobservice.livenessProbe.failureThreshold }} - {{- else if .Values.jobservice.customLivenessProbe }} - livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.jobservice.customLivenessProbe "context" $) | nindent 12 }} - {{- end }} - {{- if .Values.jobservice.readinessProbe.enabled }} - readinessProbe: - httpGet: - path: /api/v1/stats - port: http - scheme: {{ include "harbor.component.scheme" . | upper }} - initialDelaySeconds: {{ .Values.jobservice.readinessProbe.initialDelaySeconds }} - periodSeconds: {{ .Values.jobservice.readinessProbe.periodSeconds }} - timeoutSeconds: {{ .Values.jobservice.readinessProbe.timeoutSeconds }} - successThreshold: {{ .Values.jobservice.readinessProbe.successThreshold }} - failureThreshold: {{ .Values.jobservice.readinessProbe.failureThreshold }} - {{- else if .Values.jobservice.customReadinessProbe }} - readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.jobservice.customReadinessProbe "context" $) | nindent 12 }} - {{- end }} - {{- if .Values.jobservice.lifecycleHooks }} - lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.jobservice.lifecycleHooks "context" $) | nindent 12 }} - {{- end }} - {{- if .Values.jobservice.resources }} - resources: {{- toYaml .Values.jobservice.resources | nindent 12 }} - {{- end }} env: - name: BITNAMI_DEBUG - value: {{ ternary "true" "false" .Values.jobserviceImage.debug | quote }} + value: {{ ternary "true" "false" .Values.jobservice.image.debug | quote }} - name: CORE_SECRET valueFrom: secretKeyRef: @@ -163,9 +144,9 @@ spec: {{- end }} envFrom: - configMapRef: - name: {{ template "harbor.jobservice" . }}-envvars + name: {{ printf "%s-envvars" (include "harbor.jobservice" .) }} - secretRef: - name: {{ template "harbor.jobservice" . }}-envvars + name: {{ printf "%s-envvars" (include "harbor.jobservice" .) }} {{- if .Values.jobservice.extraEnvVarsCM }} - configMapRef: name: {{ include "common.tplvalues.render" (dict "value" .Values.jobservice.extraEnvVarsCM "context" $) }} @@ -175,8 +156,41 @@ spec: name: {{ include "common.tplvalues.render" (dict "value" .Values.jobservice.extraEnvVarsSecret "context" $) }} {{- end }} ports: - - containerPort: {{ include "harbor.jobservice.containerPort" . }} - name: http + - containerPort: {{ ternary .Values.jobservice.containerPorts.https .Values.jobservice.containerPorts.http .Values.internalTLS.enabled }} + name: {{ ternary "https" "http" .Values.internalTLS.enabled }} + {{- if not .Values.diagnosticMode.enabled }} + {{- if .Values.jobservice.startupProbe.enabled }} + startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.jobservice.startupProbe "enabled") "context" $) | nindent 12 }} + tcpSocket: + port: {{ ternary "https" "http" .Values.internalTLS.enabled }} + {{- else if .Values.jobservice.customStartupProbe }} + startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.jobservice.customStartupProbe "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.jobservice.livenessProbe.enabled }} + livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.jobservice.livenessProbe "enabled") "context" $) | nindent 12 }} + httpGet: + path: /api/v1/stats + port: {{ ternary "https" "http" .Values.internalTLS.enabled }} + scheme: {{ ternary "https" "http" .Values.internalTLS.enabled | upper }} + {{- else if .Values.jobservice.customLivenessProbe }} + livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.jobservice.customLivenessProbe "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.jobservice.readinessProbe.enabled }} + readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.jobservice.readinessProbe "enabled") "context" $) | nindent 12 }} + httpGet: + path: /api/v1/stats + port: {{ ternary "https" "http" .Values.internalTLS.enabled }} + scheme: {{ ternary "https" "http" .Values.internalTLS.enabled | upper }} + {{- else if .Values.jobservice.customReadinessProbe }} + readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.jobservice.customReadinessProbe "context" $) | nindent 12 }} + {{- end }} + {{- end }} + {{- if .Values.jobservice.lifecycleHooks }} + lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.jobservice.lifecycleHooks "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.jobservice.resources }} + resources: {{- toYaml .Values.jobservice.resources | nindent 12 }} + {{- end }} volumeMounts: - name: jobservice-config mountPath: /etc/jobservice/config.yml @@ -188,8 +202,8 @@ spec: - name: internal-tls-certs mountPath: /etc/harbor/ssl/jobservice {{- end }} - {{- if .Values.caBundleSecretName }} -{{ include "harbor.caBundleVolumeMount" . | indent 12 }} + {{- if .Values.internalTLS.caBundleSecret }} + {{- include "harbor.caBundleVolumeMount" . | nindent 12 }} {{- end }} {{- if .Values.jobservice.extraVolumeMounts }} {{- include "common.tplvalues.render" (dict "value" .Values.jobservice.extraVolumeMounts "context" $) | nindent 12 }} @@ -208,8 +222,8 @@ spec: {{- else }} emptyDir: {} {{- end }} - {{- if .Values.caBundleSecretName }} -{{ include "harbor.caBundleVolume" . | indent 8 }} + {{- if .Values.internalTLS.caBundleSecret }} + {{- include "harbor.caBundleVolume" . | nindent 8 }} {{- end }} {{- if .Values.internalTLS.enabled }} - name: internal-tls-certs diff --git a/bitnami/harbor/templates/jobservice/jobservice-pvc.yaml b/bitnami/harbor/templates/jobservice/jobservice-pvc.yaml index 0f2909914..83c975a32 100644 --- a/bitnami/harbor/templates/jobservice/jobservice-pvc.yaml +++ b/bitnami/harbor/templates/jobservice/jobservice-pvc.yaml @@ -4,24 +4,33 @@ kind: PersistentVolumeClaim apiVersion: v1 metadata: name: {{ include "harbor.jobservice" . }} + namespace: {{ .Release.Namespace | quote }} labels: {{- include "common.labels.standard" . | nindent 4 }} {{- if .Values.commonLabels }} {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} {{- end }} app.kubernetes.io/component: jobservice annotations: - {{- if eq .Values.persistence.resourcePolicy "keep" }} + {{- if eq .Values.persistence.resourcePolicy "keep" }} helm.sh/resource-policy: keep - {{- end }} - {{- if .Values.commonAnnotations }} + {{- end }} + {{- if .Values.commonAnnotations }} {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} + {{- end }} + {{- if .Values.persistence.persistentVolumeClaim.jobservice.annotations }} + {{- toYaml .Values.persistence.persistentVolumeClaim.jobservice.annotations | nindent 4 }} + {{- end }} spec: accessModes: - - {{ .Values.persistence.persistentVolumeClaim.jobservice.accessMode }} + {{- range .Values.persistence.persistentVolumeClaim.jobservice.accessModes }} + - {{ . | quote }} + {{- end }} resources: requests: storage: {{ .Values.persistence.persistentVolumeClaim.jobservice.size }} - {{- include "harbor.jobservice.storageClass" . | nindent 2 }} + {{- if .Values.persistence.persistentVolumeClaim.jobservice.selector }} + selector: {{- include "common.tplvalues.render" (dict "value" .Values.persistence.persistentVolumeClaim.jobservice.selector "context" $) | nindent 2 }} + {{- end }} + {{- include "common.storage.class" ( dict "persistence" .Values.persistence.persistentVolumeClaim.jobservice "global" .Values.global ) | nindent 2 }} {{- end }} {{- end }} diff --git a/bitnami/harbor/templates/jobservice/jobservice-secret-envvars.yaml b/bitnami/harbor/templates/jobservice/jobservice-secret-envvars.yaml index 33db50f66..a3af30712 100644 --- a/bitnami/harbor/templates/jobservice/jobservice-secret-envvars.yaml +++ b/bitnami/harbor/templates/jobservice/jobservice-secret-envvars.yaml @@ -1,7 +1,8 @@ apiVersion: v1 kind: Secret metadata: - name: {{ include "harbor.jobservice" . }}-envvars + name: {{ printf "%s-envvars" (include "harbor.jobservice" .) }} + namespace: {{ .Release.Namespace | quote }} labels: {{- include "common.labels.standard" . | nindent 4 }} {{- if .Values.commonLabels }} {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} diff --git a/bitnami/harbor/templates/jobservice/jobservice-secrets.yaml b/bitnami/harbor/templates/jobservice/jobservice-secrets.yaml index bb7bebf01..ea41a19eb 100644 --- a/bitnami/harbor/templates/jobservice/jobservice-secrets.yaml +++ b/bitnami/harbor/templates/jobservice/jobservice-secrets.yaml @@ -1,7 +1,8 @@ apiVersion: v1 kind: Secret metadata: - name: {{ template "harbor.jobservice" . }} + name: {{ include "harbor.jobservice" . }} + namespace: {{ .Release.Namespace | quote }} labels: {{- include "common.labels.standard" . | nindent 4 }} {{- if .Values.commonLabels }} {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} @@ -12,4 +13,4 @@ metadata: {{- end }} type: Opaque data: - secret: {{ .Values.jobservice.secret | default (randAlphaNum 16) | b64enc | quote }} + secret: {{ include "common.secrets.passwords.manage" (dict "secret" (include "harbor.jobservice" .) "key" "secret" "length" 16 "providedValues" (list "jobservice.secret") "context" $) }} diff --git a/bitnami/harbor/templates/jobservice/jobservice-svc.yaml b/bitnami/harbor/templates/jobservice/jobservice-svc.yaml index b0604fbdb..0893327b4 100644 --- a/bitnami/harbor/templates/jobservice/jobservice-svc.yaml +++ b/bitnami/harbor/templates/jobservice/jobservice-svc.yaml @@ -2,6 +2,7 @@ apiVersion: v1 kind: Service metadata: name: {{ include "harbor.jobservice" . }} + namespace: {{ .Release.Namespace | quote }} labels: {{- include "common.labels.standard" . | nindent 4 }} {{- if .Values.commonLabels }} {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} @@ -12,8 +13,8 @@ metadata: {{- end }} spec: ports: - - name: http - port: {{ include "harbor.jobservice.servicePort" . }} - targetPort: http + - name: {{ ternary "https" "http" .Values.internalTLS.enabled }} + port: {{ ternary .Values.jobservice.service.ports.https .Values.jobservice.service.ports.http .Values.internalTLS.enabled }} + targetPort: {{ ternary "https" "http" .Values.internalTLS.enabled }} selector: {{- include "common.labels.matchLabels" . | nindent 4 }} app.kubernetes.io/component: jobservice diff --git a/bitnami/harbor/templates/nginx/configmap-http.yaml b/bitnami/harbor/templates/nginx/configmap-http.yaml index b61d40ac1..0626c6792 100644 --- a/bitnami/harbor/templates/nginx/configmap-http.yaml +++ b/bitnami/harbor/templates/nginx/configmap-http.yaml @@ -1,9 +1,10 @@ -{{- if and (not .Values.ingress.enabled) (not .Values.service.tls.enabled) }} -{{- $scheme := include "harbor.component.scheme" . -}} +{{- if and (eq .Values.exposureType "proxy") (not .Values.nginx.tls.enabled) }} +{{- $scheme := ternary "https" "http" .Values.internalTLS.enabled -}} apiVersion: v1 kind: ConfigMap metadata: name: {{ include "harbor.nginx" . }} + namespace: {{ .Release.Namespace | quote }} labels: {{- include "common.labels.standard" . | nindent 4 }} {{- if .Values.commonLabels }} {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} @@ -35,11 +36,11 @@ data: proxy_http_version 1.1; upstream core { - server {{ template "harbor.core" . }}:{{ template "harbor.core.servicePort" . }}; + server {{ printf "%s:%d" (include "harbor.core" .) (ternary .Values.core.service.ports.https .Values.core.service.ports.http .Values.internalTLS.enabled | int) }}; } upstream portal { - server {{ template "harbor.portal" . }}:{{ template "harbor.portal.servicePort" . }}; + server {{ printf "%s:%d" (include "harbor.portal" .) (ternary .Values.portal.service.ports.https .Values.portal.service.ports.http .Values.internalTLS.enabled | int) }}; } log_format timed_combined '[$time_local]:$remote_addr - ' @@ -51,10 +52,10 @@ data: server { {{- if .Values.ipFamily.ipv4.enabled }} - listen 8080; + listen {{ .Values.nginx.containerPorts.http }}; {{- end }} {{- if .Values.ipFamily.ipv6.enabled }} - listen [::]:8080; + listen [::]:{{ .Values.nginx.containerPorts.http }}; {{- end }} server_tokens off; # disable any limits to avoid HTTP 413 for large image uploads diff --git a/bitnami/harbor/templates/nginx/configmap-https.yaml b/bitnami/harbor/templates/nginx/configmap-https.yaml index 962e81a4d..cdfc9e97d 100644 --- a/bitnami/harbor/templates/nginx/configmap-https.yaml +++ b/bitnami/harbor/templates/nginx/configmap-https.yaml @@ -1,9 +1,10 @@ -{{- if and (not .Values.ingress.enabled) .Values.service.tls.enabled }} -{{- $scheme := (include "harbor.component.scheme" .) -}} +{{- if and (eq .Values.exposureType "proxy") .Values.nginx.tls.enabled }} +{{- $scheme := ternary "https" "http" .Values.internalTLS.enabled -}} apiVersion: v1 kind: ConfigMap metadata: name: {{ include "harbor.nginx" . }} + namespace: {{ .Release.Namespace | quote }} labels: {{- include "common.labels.standard" . | nindent 4 }} {{- if .Values.commonLabels }} {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} @@ -36,16 +37,16 @@ data: proxy_http_version 1.1; upstream core { - server "{{ template "harbor.core" . }}:{{ template "harbor.core.servicePort" . }}"; + server {{ printf "%s:%d" (include "harbor.core" .) (ternary .Values.core.service.ports.https .Values.core.service.ports.http .Values.internalTLS.enabled | int) }}; } upstream portal { - server "{{ template "harbor.portal" . }}:{{ template "harbor.portal.servicePort" . }}"; + server {{ printf "%s:%d" (include "harbor.portal" .) (ternary .Values.portal.service.ports.https .Values.portal.service.ports.http .Values.internalTLS.enabled | int) }}; } {{- if .Values.notary.enabled }} upstream notary-server { - server {{ template "harbor.notary-server" . }}:4443; + server {{ printf "%s:%d" (include "harbor.notary-server" .) (.Values.notary.service.ports.server | int) }}; } {{- end }} @@ -59,10 +60,10 @@ data: {{- if .Values.notary.enabled }} server { {{- if .Values.ipFamily.ipv4.enabled }} - listen 4443 ssl; + listen {{ .Values.nginx.containerPorts.notary }} ssl; {{- end }} {{- if .Values.ipFamily.ipv6.enabled }} - listen [::]:4443 ssl; + listen [::]:{{ .Values.nginx.containerPorts.notary }} ssl; {{- end }} server_tokens off; # ssl @@ -99,10 +100,10 @@ data: server { {{- if .Values.ipFamily.ipv4.enabled }} - listen 8443 ssl; + listen {{ .Values.nginx.containerPorts.https }} ssl; {{- end }} {{- if .Values.ipFamily.ipv6.enabled }} - listen [::]:8443 ssl; + listen [::]:{{ .Values.nginx.containerPorts.https }} ssl; {{- end }} server_tokens off; # SSL diff --git a/bitnami/harbor/templates/nginx/deployment.yaml b/bitnami/harbor/templates/nginx/deployment.yaml index c1ddccd31..2500a2ae2 100644 --- a/bitnami/harbor/templates/nginx/deployment.yaml +++ b/bitnami/harbor/templates/nginx/deployment.yaml @@ -1,8 +1,9 @@ -{{- if not .Values.ingress.enabled }} +{{- if eq .Values.exposureType "proxy" }} apiVersion: {{ template "common.capabilities.deployment.apiVersion" . }} kind: Deployment metadata: name: {{ include "harbor.nginx" . }} + namespace: {{ .Release.Namespace | quote }} labels: {{- include "common.labels.standard" . | nindent 4 }} {{- if .Values.commonLabels }} {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} @@ -12,13 +13,13 @@ metadata: annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} {{- end }} spec: - replicas: {{ .Values.nginx.replicas }} - {{- if .Values.nginx.updateStrategy }} - strategy: {{- toYaml .Values.nginx.updateStrategy | nindent 4 }} - {{- end }} + replicas: {{ .Values.nginx.replicaCount }} selector: matchLabels: {{- include "common.labels.matchLabels" . | nindent 6 }} app.kubernetes.io/component: nginx + {{- if .Values.nginx.updateStrategy }} + strategy: {{- toYaml .Values.nginx.updateStrategy | nindent 4 }} + {{- end }} template: metadata: labels: {{- include "common.labels.standard" . | nindent 8 }} @@ -30,21 +31,21 @@ spec: {{- end }} app.kubernetes.io/component: nginx annotations: - {{- if not .Values.service.tls.enabled }} + {{- if not .Values.nginx.tls.enabled }} checksum/configmap: {{ include (print $.Template.BasePath "/nginx/configmap-http.yaml") . | sha256sum }} {{- else }} checksum/configmap: {{ include (print $.Template.BasePath "/nginx/configmap-https.yaml") . | sha256sum }} {{- end }} - {{- if eq (include "harbor.autoGenCertForNginx" .) "true" }} - checksum/secret: {{ include (print $.Template.BasePath "/nginx/secret.yaml") . | sha256sum }} + {{- if (include "harbor.autoGenCertForNginx" .) }} + checksum/tls-secret: {{ include (print $.Template.BasePath "/nginx/tls-secret.yaml") . | sha256sum }} {{- end }} {{- if .Values.nginx.podAnnotations }} annotations: {{- include "common.tplvalues.render" (dict "value" .Values.nginx.podAnnotations "context" $) | nindent 8 }} {{- end }} spec: {{- include "harbor.imagePullSecrets" . | nindent 6 }} - {{- if .Values.nginx.priorityClassName }} - priorityClassName: {{ .Values.nginx.priorityClassName | quote }} + {{- if .Values.nginx.hostAliases }} + hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.nginx.hostAliases "context" $) | nindent 8 }} {{- end }} {{- if .Values.nginx.affinity }} affinity: {{- include "common.tplvalues.render" (dict "value" .Values.nginx.affinity "context" $) | nindent 8 }} @@ -60,63 +61,41 @@ spec: {{- if .Values.nginx.tolerations }} tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.nginx.tolerations "context" $) | nindent 8 }} {{- end }} - {{- if .Values.podSecurityContext }} - securityContext: {{- include "common.tplvalues.render" (dict "value" .Values.podSecurityContext "context" $) | nindent 8 }} + {{- if .Values.nginx.topologySpreadConstraints }} + topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.nginx.topologySpreadConstraints "context" .) | nindent 8 }} + {{- end }} + {{- if .Values.nginx.priorityClassName }} + priorityClassName: {{ .Values.nginx.priorityClassName | quote }} + {{- end }} + {{- if .Values.nginx.schedulerName }} + schedulerName: {{ .Values.nginx.schedulerName }} + {{- end }} + {{- if .Values.nginx.podSecurityContext.enabled }} + securityContext: {{- omit .Values.nginx.podSecurityContext "enabled" | toYaml | nindent 8 }} {{- end }} {{- if .Values.nginx.initContainers }} initContainers: {{- include "common.tplvalues.render" (dict "value" .Values.nginx.initContainers "context" $) | nindent 8 }} {{- end }} - {{- if .Values.nginx.hostAliases }} - hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.nginx.hostAliases "context" $) | nindent 8 }} - {{- end }} containers: - name: nginx - image: {{ include "harbor.nginxImage" . }} - imagePullPolicy: {{ .Values.nginxImage.pullPolicy | quote }} - {{- if .Values.nginx.command }} + image: {{ include "harbor.nginx.image" . }} + imagePullPolicy: {{ .Values.nginx.image.pullPolicy | quote }} + {{- if .Values.nginx.containerSecurityContext.enabled }} + securityContext: {{- omit .Values.nginx.containerSecurityContext "enabled" | toYaml | nindent 12 }} + {{- end }} + {{- if .Values.diagnosticMode.enabled }} + command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }} + {{- else if .Values.nginx.command }} command: {{- include "common.tplvalues.render" (dict "value" .Values.nginx.command "context" $) | nindent 12 }} {{- end }} - {{- if .Values.nginx.args }} + {{- if .Values.diagnosticMode.enabled }} + args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }} + {{- else if .Values.nginx.args }} args: {{- include "common.tplvalues.render" (dict "value" .Values.nginx.args "context" $) | nindent 12 }} {{- end }} - {{- if .Values.containerSecurityContext }} - securityContext: {{- include "common.tplvalues.render" (dict "value" .Values.containerSecurityContext "context" $) | nindent 12 }} - {{- end }} - {{- if .Values.nginx.livenessProbe.enabled }} - livenessProbe: - httpGet: - path: / - port: {{ ternary "https" "http" .Values.service.tls.enabled }} - {{- if .Values.service.tls.enabled }} - scheme: HTTPS - {{- end }} - initialDelaySeconds: {{ .Values.nginx.livenessProbe.initialDelaySeconds }} - periodSeconds: {{ .Values.nginx.livenessProbe.periodSeconds }} - timeoutSeconds: {{ .Values.nginx.livenessProbe.timeoutSeconds }} - successThreshold: {{ .Values.nginx.livenessProbe.successThreshold }} - failureThreshold: {{ .Values.nginx.livenessProbe.failureThreshold }} - {{- else if .Values.nginx.customLivenessProbe }} - livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.nginx.customLivenessProbe "context" $) | nindent 12 }} - {{- end }} - {{- if .Values.nginx.readinessProbe.enabled }} - readinessProbe: - httpGet: - path: / - port: {{ ternary "https" "http" .Values.service.tls.enabled }} - {{- if .Values.service.tls.enabled }} - scheme: HTTPS - {{- end }} - initialDelaySeconds: {{ .Values.nginx.readinessProbe.initialDelaySeconds }} - periodSeconds: {{ .Values.nginx.readinessProbe.periodSeconds }} - timeoutSeconds: {{ .Values.nginx.readinessProbe.timeoutSeconds }} - successThreshold: {{ .Values.nginx.readinessProbe.successThreshold }} - failureThreshold: {{ .Values.nginx.readinessProbe.failureThreshold }} - {{- else if .Values.nginx.customReadinessProbe }} - readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.nginx.customReadinessProbe "context" $) | nindent 12 }} - {{- end }} env: - name: BITNAMI_DEBUG - value: {{ ternary "true" "false" .Values.nginxImage.debug | quote }} + value: {{ ternary "true" "false" .Values.nginx.image.debug | quote }} {{- if .Values.nginx.extraEnvVars }} {{- include "common.tplvalues.render" (dict "value" .Values.nginx.extraEnvVars "context" $) | nindent 12 }} {{- end }} @@ -132,21 +111,48 @@ spec: {{- if .Values.nginx.lifecycleHooks }} lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.nginx.lifecycleHooks "context" $) | nindent 12 }} {{- end }} + ports: + - containerPort: {{ .Values.nginx.containerPorts.http }} + name: http + - containerPort: {{ .Values.nginx.containerPorts.https }} + name: https + - containerPort: {{ .Values.nginx.containerPorts.notary }} + name: notary + {{- if not .Values.diagnosticMode.enabled }} + {{- if .Values.nginx.startupProbe.enabled }} + startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.nginx.startupProbe "enabled") "context" $) | nindent 12 }} + tcpSocket: + port: {{ ternary "https" "http" .Values.nginx.tls.enabled }} + {{- else if .Values.nginx.customStartupProbe }} + startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.nginx.customStartupProbe "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.nginx.livenessProbe.enabled }} + livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.nginx.livenessProbe "enabled") "context" $) | nindent 12 }} + httpGet: + path: / + port: {{ ternary "https" "http" .Values.nginx.tls.enabled }} + scheme: {{ ternary "https" "http" .Values.nginx.tls.enabled | upper }} + {{- else if .Values.nginx.customLivenessProbe }} + livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.nginx.customLivenessProbe "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.nginx.readinessProbe.enabled }} + readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.nginx.readinessProbe "enabled") "context" $) | nindent 12 }} + httpGet: + path: / + port: {{ ternary "https" "http" .Values.nginx.tls.enabled }} + scheme: {{ ternary "https" "http" .Values.nginx.tls.enabled | upper }} + {{- else if .Values.nginx.customReadinessProbe }} + readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.nginx.customReadinessProbe "context" $) | nindent 12 }} + {{- end }} + {{- end }} {{- if .Values.nginx.resources }} resources: {{- toYaml .Values.nginx.resources | nindent 12 }} {{- end }} - ports: - - containerPort: 8080 - name: http - - containerPort: 8443 - name: https - - containerPort: 4443 - name: notary volumeMounts: - name: config mountPath: /opt/bitnami/nginx/conf/nginx.conf subPath: nginx.conf - {{- if .Values.service.tls.enabled }} + {{- if .Values.nginx.tls.enabled }} - name: certificate mountPath: /etc/nginx/cert {{- end }} @@ -160,11 +166,11 @@ spec: - name: config configMap: name: {{ include "harbor.nginx" . }} - {{- if .Values.service.tls.enabled }} + {{- if .Values.nginx.tls.enabled }} - name: certificate secret: - {{- if .Values.service.tls.existingSecret }} - secretName: {{ .Values.service.tls.existingSecret }} + {{- if .Values.nginx.tls.existingSecret }} + secretName: {{ .Values.nginx.tls.existingSecret }} {{- else }} secretName: {{ include "harbor.nginx" . }} {{- end }} diff --git a/bitnami/harbor/templates/nginx/service.yaml b/bitnami/harbor/templates/nginx/service.yaml index 6df24dd14..7f4dcd388 100644 --- a/bitnami/harbor/templates/nginx/service.yaml +++ b/bitnami/harbor/templates/nginx/service.yaml @@ -1,8 +1,9 @@ -{{- if not .Values.ingress.enabled }} +{{- if eq .Values.exposureType "proxy" }} apiVersion: v1 kind: Service metadata: name: {{ include "common.names.fullname" . }} + namespace: {{ .Release.Namespace | quote }} labels: {{- include "common.labels.standard" . | nindent 4 }} {{- if .Values.commonLabels }} {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} @@ -17,29 +18,35 @@ metadata: {{- end }} spec: type: {{ .Values.service.type }} + sessionAffinity: {{ .Values.service.sessionAffinity }} + {{- if and .Values.service.clusterIP (eq .Values.service.type "ClusterIP") }} + clusterIP: {{ .Values.service.clusterIP }} + {{- end }} {{- if (or (eq .Values.service.type "LoadBalancer") (eq .Values.service.type "NodePort")) }} externalTrafficPolicy: {{ .Values.service.externalTrafficPolicy | quote }} {{- end }} {{- if (and (eq .Values.service.type "LoadBalancer") .Values.service.loadBalancerSourceRanges) }} - loadBalancerSourceRanges: {{- toYaml .Values.service.loadBalancerSourceRanges | nindent 4 }} + {{- with .Values.service.loadBalancerSourceRanges }} + loadBalancerSourceRanges: {{- toYaml . | nindent 4 }} {{- end }} - {{- if (and (eq .Values.service.type "LoadBalancer") .Values.service.loadBalancerIP) }} + {{- end }} + {{- if (and (eq .Values.service.type "LoadBalancer") (not (empty .Values.service.loadBalancerIP))) }} loadBalancerIP: {{ .Values.service.loadBalancerIP }} {{- end }} ports: - name: http port: {{ .Values.service.ports.http }} targetPort: http - {{- if and .Values.service.nodePorts.http }} + {{- if and (or (eq .Values.service.type "NodePort") (eq .Values.service.type "LoadBalancer")) (not (empty .Values.service.nodePorts.http)) }} nodePort: {{ .Values.service.nodePorts.http }} {{- else if eq .Values.service.type "ClusterIP" }} nodePort: null {{- end }} - {{- if .Values.service.tls.enabled }} + {{- if .Values.nginx.tls.enabled }} - name: https port: {{ .Values.service.ports.https }} targetPort: https - {{- if and .Values.service.nodePorts.https }} + {{- if and (or (eq .Values.service.type "NodePort") (eq .Values.service.type "LoadBalancer")) (not (empty .Values.service.nodePorts.https)) }} nodePort: {{ .Values.service.nodePorts.https }} {{- else if eq .Values.service.type "ClusterIP" }} nodePort: null @@ -49,12 +56,15 @@ spec: - name: notary port: {{ .Values.service.ports.notary }} targetPort: notary - {{- if and .Values.service.nodePorts.notary }} + {{- if and (or (eq .Values.service.type "NodePort") (eq .Values.service.type "LoadBalancer")) (not (empty .Values.service.nodePorts.notary)) }} nodePort: {{ .Values.service.nodePorts.notary }} {{- else if eq .Values.service.type "ClusterIP" }} nodePort: null {{- end }} {{- end }} + {{- if .Values.service.extraPorts }} + {{- include "common.tplvalues.render" (dict "value" .Values.service.extraPorts "context" $) | nindent 4 }} + {{- end }} selector: {{- include "common.labels.matchLabels" . | nindent 4 }} app.kubernetes.io/component: nginx {{- end }} diff --git a/bitnami/harbor/templates/nginx/secret.yaml b/bitnami/harbor/templates/nginx/tls-secret.yaml similarity index 84% rename from bitnami/harbor/templates/nginx/secret.yaml rename to bitnami/harbor/templates/nginx/tls-secret.yaml index 3d68ed231..e0d943a1b 100644 --- a/bitnami/harbor/templates/nginx/secret.yaml +++ b/bitnami/harbor/templates/nginx/tls-secret.yaml @@ -1,10 +1,11 @@ -{{- if eq (include "harbor.autoGenCertForNginx" .) "true" }} +{{- if (include "harbor.autoGenCertForNginx" .) }} {{- $ca := genCA "harbor-ca" 365 }} -{{- $cn := (required "The \"service.tls.commonName\" is required!" .Values.service.tls.commonName) }} +{{- $cn := (required "The \"nginx.tls.commonName\" is required!" .Values.nginx.tls.commonName) }} apiVersion: v1 kind: Secret metadata: name: {{ include "harbor.nginx" . }} + namespace: {{ .Release.Namespace | quote }} labels: {{- include "common.labels.standard" . | nindent 4 }} {{- if .Values.commonLabels }} {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} diff --git a/bitnami/harbor/templates/notary/notary-secret-envvars.yaml b/bitnami/harbor/templates/notary/notary-secret-envvars.yaml index 4b892b836..2ee3d79d7 100644 --- a/bitnami/harbor/templates/notary/notary-secret-envvars.yaml +++ b/bitnami/harbor/templates/notary/notary-secret-envvars.yaml @@ -2,7 +2,8 @@ apiVersion: v1 kind: Secret metadata: - name: {{ include "harbor.notary-server" . }}-envvars + name: {{ printf "%s-envvars" (include "harbor.notary-server" .) }} + namespace: {{ .Release.Namespace | quote }} labels: {{- include "common.labels.standard" . | nindent 4 }} {{- if .Values.commonLabels }} {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} diff --git a/bitnami/harbor/templates/notary/notary-secret.yaml b/bitnami/harbor/templates/notary/notary-secret.yaml index 31baf9dcb..36e0b7144 100644 --- a/bitnami/harbor/templates/notary/notary-secret.yaml +++ b/bitnami/harbor/templates/notary/notary-secret.yaml @@ -3,6 +3,7 @@ apiVersion: v1 kind: Secret metadata: name: {{ include "harbor.notary-server" . }} + namespace: {{ .Release.Namespace | quote }} labels: {{- include "common.labels.standard" . | nindent 4 }} {{- if .Values.commonLabels }} {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} @@ -15,7 +16,7 @@ type: Opaque data: {{- if not .Values.notary.secretName }} {{- $ca := genCA "harbor-notary-ca" 365 }} - {{- $altNames := list (printf "%s.%s.svc" (include "harbor.notary-signer" .) .Release.Namespace) (printf "%s.%s" (include "harbor.notary-signer" .) .Release.Namespace) (include "harbor.notary-signer" .) -}} + {{- $altNames := list (printf "%s.%s.svc" (include "harbor.notary-signer" .) .Release.Namespace | quote) (printf "%s.%s" (include "harbor.notary-signer" .) .Release.Namespace | quote) (include "harbor.notary-signer" .) -}} {{- $cert := genSignedCert (include "harbor.notary-signer" .) nil $altNames 365 $ca }} notary-signer-ca.crt: {{ $ca.Cert | b64enc | quote }} notary-signer.crt: {{ $cert.Cert | b64enc | quote }} diff --git a/bitnami/harbor/templates/notary/notary-server.yaml b/bitnami/harbor/templates/notary/notary-server.yaml index 44e18d6c1..f8b9394d5 100644 --- a/bitnami/harbor/templates/notary/notary-server.yaml +++ b/bitnami/harbor/templates/notary/notary-server.yaml @@ -3,6 +3,7 @@ apiVersion: apps/v1 kind: Deployment metadata: name: {{ include "harbor.notary-server" . }} + namespace: {{ .Release.Namespace | quote }} labels: {{- include "common.labels.standard" . | nindent 4 }} {{- if .Values.commonLabels }} {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} @@ -12,13 +13,13 @@ metadata: annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} {{- end }} spec: - replicas: {{ .Values.notary.server.replicas }} - {{- if .Values.notary.server.updateStrategy }} - strategy: {{- toYaml .Values.notary.server.updateStrategy | nindent 4 }} - {{- end }} + replicas: {{ .Values.notary.server.replicaCount }} selector: matchLabels: {{- include "common.labels.matchLabels" . | nindent 6 }} app.kubernetes.io/component: notary-server + {{- if .Values.notary.server.updateStrategy }} + strategy: {{- toYaml .Values.notary.server.updateStrategy | nindent 4 }} + {{- end }} template: metadata: labels: {{- include "common.labels.standard" . | nindent 8 }} @@ -38,8 +39,8 @@ spec: spec: {{- include "harbor.imagePullSecrets" . | nindent 6 }} automountServiceAccountToken: {{ .Values.notary.server.automountServiceAccountToken }} - {{- if .Values.notary.server.priorityClassName }} - priorityClassName: {{ .Values.notary.server.priorityClassName | quote }} + {{- if .Values.notary.server.hostAliases }} + hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.notary.server.hostAliases "context" $) | nindent 8 }} {{- end }} {{- if .Values.notary.server.affinity }} affinity: {{- include "common.tplvalues.render" (dict "value" .Values.notary.server.affinity "context" $) | nindent 8 }} @@ -55,43 +56,47 @@ spec: {{- if .Values.notary.server.tolerations }} tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.notary.server.tolerations "context" $) | nindent 8 }} {{- end }} - {{- if .Values.podSecurityContext }} - securityContext: {{- include "common.tplvalues.render" (dict "value" .Values.podSecurityContext "context" $) | nindent 8 }} + {{- if .Values.notary.server.topologySpreadConstraints }} + topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.notary.server.topologySpreadConstraints "context" .) | nindent 8 }} + {{- end }} + {{- if .Values.notary.server.priorityClassName }} + priorityClassName: {{ .Values.notary.server.priorityClassName | quote }} + {{- end }} + {{- if .Values.notary.server.schedulerName }} + schedulerName: {{ .Values.notary.server.schedulerName }} + {{- end }} + {{- if .Values.notary.server.podSecurityContext.enabled }} + securityContext: {{- omit .Values.notary.server.podSecurityContext "enabled" | toYaml | nindent 8 }} {{- end }} {{- if .Values.notary.server.initContainers }} initContainers: {{- include "common.tplvalues.render" (dict "value" .Values.notary.server.initContainers "context" $) | nindent 8 }} {{- end }} - {{- if .Values.notary.server.hostAliases }} - hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.notary.server.hostAliases "context" $) | nindent 8 }} - {{- end }} containers: - name: notary-server - image: {{ include "harbor.notaryServerImage" . | quote }} - imagePullPolicy: {{ .Values.notaryServerImage.pullPolicy | quote }} - {{- if .Values.containerSecurityContext }} - securityContext: {{- include "common.tplvalues.render" (dict "value" .Values.containerSecurityContext "context" $) | nindent 12 }} + image: {{ include "harbor.notary.server.image" . | quote }} + imagePullPolicy: {{ .Values.notary.server.image.pullPolicy | quote }} + {{- if .Values.notary.server.containerSecurityContext.enabled }} + securityContext: {{- omit .Values.notary.server.containerSecurityContext "enabled" | toYaml | nindent 12 }} {{- end }} - {{- if .Values.notary.server.command }} + {{- if .Values.diagnosticMode.enabled }} + command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }} + {{- else if .Values.notary.server.command }} command: {{- include "common.tplvalues.render" (dict "value" .Values.notary.server.command "context" $) | nindent 12 }} {{- end }} - {{- if .Values.notary.server.args }} + {{- if .Values.diagnosticMode.enabled }} + args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }} + {{- else if .Values.notary.server.args }} args: {{- include "common.tplvalues.render" (dict "value" .Values.notary.server.args "context" $) | nindent 12 }} {{- end }} - {{- if .Values.notary.server.resources }} - resources: {{- toYaml .Values.notary.server.resources | nindent 12 }} - {{- end }} - {{- if .Values.notary.server.lifecycleHooks }} - lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.notary.server.lifecycleHooks "context" $) | nindent 12 }} - {{- end }} env: - name: BITNAMI_DEBUG - value: {{ ternary "true" "false" .Values.notaryServerImage.debug | quote }} + value: {{ ternary "true" "false" .Values.notary.server.image.debug | quote }} - name: MIGRATIONS_PATH value: migrations/server/postgresql - name: DB_URL valueFrom: secretKeyRef: - name: {{ include "harbor.notary-server" . }}-envvars + name: {{ printf "%s-envvars" (include "harbor.notary-server" .) }} key: server_db_url {{- if .Values.notary.server.extraEnvVars }} {{- include "common.tplvalues.render" (dict "value" .Values.notary.server.extraEnvVars "context" $) | nindent 12 }} @@ -105,6 +110,38 @@ spec: - secretRef: name: {{ include "common.tplvalues.render" (dict "value" .Values.notary.server.extraEnvVarsSecret "context" $) }} {{- end }} + ports: + - containerPort: {{ .Values.notary.server.containerPorts.server }} + name: notary-server + {{- if not .Values.diagnosticMode.enabled }} + {{- if .Values.notary.server.startupProbe.enabled }} + startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.notary.server.startupProbe "enabled") "context" $) | nindent 12 }} + tcpSocket: + port: notary-server + {{- else if .Values.notary.server.customStartupProbe }} + startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.notary.server.customStartupProbe "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.notary.server.livenessProbe.enabled }} + livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.notary.server.livenessProbe "enabled") "context" $) | nindent 12 }} + tcpSocket: + port: notary-server + {{- else if .Values.notary.server.customLivenessProbe }} + livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.notary.server.customLivenessProbe "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.notary.server.readinessProbe.enabled }} + readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.notary.server.readinessProbe "enabled") "context" $) | nindent 12 }} + tcpSocket: + port: notary-server + {{- else if .Values.notary.server.customReadinessProbe }} + readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.notary.server.customReadinessProbe "context" $) | nindent 12 }} + {{- end }} + {{- end }} + {{- if .Values.notary.server.lifecycleHooks }} + lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.notary.server.lifecycleHooks "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.notary.server.resources }} + resources: {{- toYaml .Values.notary.server.resources | nindent 12 }} + {{- end }} volumeMounts: - name: notary-config mountPath: /etc/notary @@ -119,33 +156,6 @@ spec: {{- if .Values.notary.server.extraVolumeMounts }} {{- include "common.tplvalues.render" (dict "value" .Values.notary.server.extraVolumeMounts "context" $) | nindent 12 }} {{- end }} - ports: - - containerPort: 4443 - name: notary-server - {{- if .Values.notary.server.livenessProbe.enabled }} - livenessProbe: - tcpSocket: - port: notary-server - initialDelaySeconds: {{ .Values.notary.server.livenessProbe.initialDelaySeconds }} - periodSeconds: {{ .Values.notary.server.livenessProbe.periodSeconds }} - timeoutSeconds: {{ .Values.notary.server.livenessProbe.timeoutSeconds }} - successThreshold: {{ .Values.notary.server.livenessProbe.successThreshold }} - failureThreshold: {{ .Values.notary.server.livenessProbe.failureThreshold }} - {{- else if .Values.notary.server.customLivenessProbe }} - livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.notary.server.customLivenessProbe "context" $) | nindent 12 }} - {{- end }} - {{- if .Values.notary.server.readinessProbe.enabled }} - readinessProbe: - tcpSocket: - port: notary-server - initialDelaySeconds: {{ .Values.notary.server.readinessProbe.initialDelaySeconds }} - periodSeconds: {{ .Values.notary.server.readinessProbe.periodSeconds }} - timeoutSeconds: {{ .Values.notary.server.readinessProbe.timeoutSeconds }} - successThreshold: {{ .Values.notary.server.readinessProbe.successThreshold }} - failureThreshold: {{ .Values.notary.server.readinessProbe.failureThreshold }} - {{- else if .Values.notary.server.customReadinessProbe }} - readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.notary.server.customReadinessProbe "context" $) | nindent 12 }} - {{- end }} {{- if .Values.notary.server.sidecars }} {{- include "common.tplvalues.render" (dict "value" .Values.notary.server.sidecars "context" $) | nindent 8 }} {{- end }} diff --git a/bitnami/harbor/templates/notary/notary-signer.yaml b/bitnami/harbor/templates/notary/notary-signer.yaml index 4c799d8e6..a96e92c7b 100644 --- a/bitnami/harbor/templates/notary/notary-signer.yaml +++ b/bitnami/harbor/templates/notary/notary-signer.yaml @@ -3,6 +3,7 @@ apiVersion: apps/v1 kind: Deployment metadata: name: {{ include "harbor.notary-signer" . }} + namespace: {{ .Release.Namespace | quote }} labels: {{- include "common.labels.standard" . | nindent 4 }} {{- if .Values.commonLabels }} {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} @@ -12,13 +13,13 @@ metadata: annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} {{- end }} spec: - replicas: {{ .Values.notary.signer.replicas }} - {{- if .Values.notary.signer.updateStrategy }} - strategy: {{- toYaml .Values.notary.signer.updateStrategy | nindent 4 }} - {{- end }} + replicas: {{ .Values.notary.signer.replicaCount }} selector: matchLabels: {{- include "common.labels.matchLabels" . | nindent 6 }} app.kubernetes.io/component: notary-signer + {{- if .Values.notary.signer.updateStrategy }} + strategy: {{- toYaml .Values.notary.signer.updateStrategy | nindent 4 }} + {{- end }} template: metadata: labels: {{- include "common.labels.standard" . | nindent 8 }} @@ -37,8 +38,8 @@ spec: spec: {{- include "harbor.imagePullSecrets" . | nindent 6 }} automountServiceAccountToken: {{ .Values.notary.signer.automountServiceAccountToken }} - {{- if .Values.notary.signer.priorityClassName }} - priorityClassName: {{ .Values.notary.signer.priorityClassName | quote }} + {{- if .Values.notary.signer.hostAliases }} + hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.notary.signer.hostAliases "context" $) | nindent 8 }} {{- end }} {{- if .Values.notary.signer.affinity }} affinity: {{- include "common.tplvalues.render" (dict "value" .Values.notary.signer.affinity "context" $) | nindent 8 }} @@ -54,43 +55,47 @@ spec: {{- if .Values.notary.signer.tolerations }} tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.notary.signer.tolerations "context" $) | nindent 8 }} {{- end }} - {{- if .Values.podSecurityContext }} - securityContext: {{- include "common.tplvalues.render" (dict "value" .Values.podSecurityContext "context" $) | nindent 8 }} + {{- if .Values.notary.signer.topologySpreadConstraints }} + topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.notary.signer.topologySpreadConstraints "context" .) | nindent 8 }} + {{- end }} + {{- if .Values.notary.signer.priorityClassName }} + priorityClassName: {{ .Values.notary.signer.priorityClassName | quote }} + {{- end }} + {{- if .Values.notary.signer.schedulerName }} + schedulerName: {{ .Values.notary.signer.schedulerName }} + {{- end }} + {{- if .Values.notary.signer.podSecurityContext.enabled }} + securityContext: {{- omit .Values.notary.signer.podSecurityContext "enabled" | toYaml | nindent 8 }} {{- end }} {{- if .Values.notary.signer.initContainers }} initContainers: {{- include "common.tplvalues.render" (dict "value" .Values.notary.signer.initContainers "context" $) | nindent 8 }} {{- end }} - {{- if .Values.notary.signer.hostAliases }} - hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.notary.signer.hostAliases "context" $) | nindent 8 }} - {{- end }} containers: - name: notary-signer - image: {{ include "harbor.notarySignerImage" . }} - imagePullPolicy: {{ .Values.notarySignerImage.pullPolicy | quote }} - {{- if .Values.notary.signer.command }} + image: {{ include "harbor.notary.signer.image" . }} + imagePullPolicy: {{ .Values.notary.signer.image.pullPolicy | quote }} + {{- if .Values.notary.signer.containerSecurityContext.enabled }} + securityContext: {{- omit .Values.notary.signer.containerSecurityContext "enabled" | toYaml | nindent 12 }} + {{- end }} + {{- if .Values.diagnosticMode.enabled }} + command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }} + {{- else if .Values.notary.signer.command }} command: {{- include "common.tplvalues.render" (dict "value" .Values.notary.signer.command "context" $) | nindent 12 }} {{- end }} - {{- if .Values.notary.signer.args }} + {{- if .Values.diagnosticMode.enabled }} + args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }} + {{- else if .Values.notary.signer.args }} args: {{- include "common.tplvalues.render" (dict "value" .Values.notary.signer.args "context" $) | nindent 12 }} {{- end }} - {{- if .Values.notary.signer.lifecycleHooks }} - lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.notary.signer.lifecycleHooks "context" $) | nindent 12 }} - {{- end }} - {{- if .Values.containerSecurityContext }} - securityContext: {{- include "common.tplvalues.render" (dict "value" .Values.containerSecurityContext "context" $) | nindent 12 }} - {{- end }} - {{- if .Values.notary.signer.resources }} - resources: {{- toYaml .Values.notary.signer.resources | nindent 12 }} - {{- end }} env: - name: BITNAMI_DEBUG - value: {{ ternary "true" "false" .Values.notarySignerImage.debug | quote }} + value: {{ ternary "true" "false" .Values.notary.signer.image.debug | quote }} - name: MIGRATIONS_PATH value: migrations/signer/postgresql - name: DB_URL valueFrom: secretKeyRef: - name: {{ include "harbor.notary-server" . }}-envvars + name: {{ printf "%s-envvars" (include "harbor.notary-server" .) }} key: signer_db_url - name: NOTARY_SIGNER_DEFAULTALIAS value: defaultalias @@ -106,6 +111,38 @@ spec: - secretRef: name: {{ include "common.tplvalues.render" (dict "value" .Values.notary.signer.extraEnvVarsSecret "context" $) }} {{- end }} + ports: + - containerPort: {{ .Values.notary.signer.containerPorts.signer }} + name: notary-signer + {{- if not .Values.diagnosticMode.enabled }} + {{- if .Values.notary.signer.startupProbe.enabled }} + startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.notary.signer.startupProbe "enabled") "context" $) | nindent 12 }} + tcpSocket: + port: notary-signer + {{- else if .Values.notary.signer.customStartupProbe }} + startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.notary.signer.customStartupProbe "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.notary.signer.livenessProbe.enabled }} + livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.notary.signer.livenessProbe "enabled") "context" $) | nindent 12 }} + tcpSocket: + port: notary-signer + {{- else if .Values.notary.signer.customLivenessProbe }} + livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.notary.signer.customLivenessProbe "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.notary.signer.readinessProbe.enabled }} + readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.notary.signer.readinessProbe "enabled") "context" $) | nindent 12 }} + tcpSocket: + port: notary-signer + {{- else if .Values.notary.signer.customReadinessProbe }} + readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.notary.signer.customReadinessProbe "context" $) | nindent 12 }} + {{- end }} + {{- end }} + {{- if .Values.notary.signer.lifecycleHooks }} + lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.notary.signer.lifecycleHooks "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.notary.signer.resources }} + resources: {{- toYaml .Values.notary.signer.resources | nindent 12 }} + {{- end }} volumeMounts: - name: notary-config mountPath: /etc/notary @@ -123,33 +160,6 @@ spec: {{- if .Values.notary.signer.extraVolumeMounts }} {{- include "common.tplvalues.render" (dict "value" .Values.notary.signer.extraVolumeMounts "context" $) | nindent 12 }} {{- end }} - ports: - - containerPort: 7899 - name: notary-signer - {{- if .Values.notary.signer.livenessProbe.enabled }} - livenessProbe: - tcpSocket: - port: notary-signer - initialDelaySeconds: {{ .Values.notary.signer.livenessProbe.initialDelaySeconds }} - periodSeconds: {{ .Values.notary.signer.livenessProbe.periodSeconds }} - timeoutSeconds: {{ .Values.notary.signer.livenessProbe.timeoutSeconds }} - successThreshold: {{ .Values.notary.signer.livenessProbe.successThreshold }} - failureThreshold: {{ .Values.notary.signer.livenessProbe.failureThreshold }} - {{- else if .Values.notary.signer.customLivenessProbe }} - livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.notary.signer.customLivenessProbe "context" $) | nindent 12 }} - {{- end }} - {{- if .Values.notary.signer.readinessProbe.enabled }} - readinessProbe: - tcpSocket: - port: notary-signer - initialDelaySeconds: {{ .Values.notary.signer.readinessProbe.initialDelaySeconds }} - periodSeconds: {{ .Values.notary.signer.readinessProbe.periodSeconds }} - timeoutSeconds: {{ .Values.notary.signer.readinessProbe.timeoutSeconds }} - successThreshold: {{ .Values.notary.signer.readinessProbe.successThreshold }} - failureThreshold: {{ .Values.notary.signer.readinessProbe.failureThreshold }} - {{- else if .Values.notary.signer.customReadinessProbe }} - readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.notary.signer.customReadinessProbe "context" $) | nindent 12 }} - {{- end }} {{- if .Values.notary.signer.sidecars }} {{- include "common.tplvalues.render" (dict "value" .Values.notary.signer.sidecars "context" $) | nindent 8 }} {{- end }} diff --git a/bitnami/harbor/templates/notary/notary-svc.yaml b/bitnami/harbor/templates/notary/notary-svc.yaml index 19fe5d95b..83866ae80 100644 --- a/bitnami/harbor/templates/notary/notary-svc.yaml +++ b/bitnami/harbor/templates/notary/notary-svc.yaml @@ -3,6 +3,7 @@ apiVersion: v1 kind: Service metadata: name: {{ include "harbor.notary-server" . }} + namespace: {{ .Release.Namespace | quote }} labels: {{- include "common.labels.standard" . | nindent 4 }} {{- if .Values.commonLabels }} {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} @@ -11,12 +12,12 @@ metadata: annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} {{- end }} spec: -{{- if (eq .Values.ingress.controller "gce") }} + {{- if (eq .Values.ingress.notary.controller "gce") }} type: NodePort -{{- end }} + {{- end }} ports: - name: notary-server - port: 4443 + port: {{ .Values.notary.service.ports.server }} targetPort: notary-server selector: {{- include "common.labels.matchLabels" . | nindent 4 }} app.kubernetes.io/component: notary-server @@ -35,7 +36,7 @@ metadata: spec: ports: - name: notary-signer - port: 7899 + port: {{ .Values.notary.service.ports.signer }} targetPort: notary-signer selector: {{- include "common.labels.matchLabels" . | nindent 4 }} app.kubernetes.io/component: notary-signer diff --git a/bitnami/harbor/templates/portal/portal-cm.yaml b/bitnami/harbor/templates/portal/portal-cm.yaml index d66aaf560..17332ce5e 100644 --- a/bitnami/harbor/templates/portal/portal-cm.yaml +++ b/bitnami/harbor/templates/portal/portal-cm.yaml @@ -1,7 +1,9 @@ +{{- $port := ternary .Values.portal.containerPorts.https .Values.portal.containerPorts.http .Values.internalTLS.enabled | int -}} apiVersion: v1 kind: ConfigMap metadata: name: {{ include "harbor.portal" . }} + namespace: {{ .Release.Namespace | quote }} labels: {{- include "common.labels.standard" . | nindent 4 }} {{- if .Values.commonLabels }} {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} @@ -26,10 +28,10 @@ data: server { {{- if .Values.internalTLS.enabled }} {{- if .Values.ipFamily.ipv4.enabled }} - listen {{ template "harbor.portal.containerPort" . }} ssl; + listen {{ $port }} ssl; {{- end }} {{- if .Values.ipFamily.ipv6.enabled }} - listen [::]:{{ template "harbor.portal.containerPort" . }} ssl; + listen [::]:{{ $port }} ssl; {{- end }} # SSL ssl_certificate /etc/harbor/ssl/portal/tls.crt; @@ -42,10 +44,10 @@ data: ssl_session_cache shared:SSL:10m; {{- else }} {{- if .Values.ipFamily.ipv4.enabled }} - listen {{ template "harbor.portal.containerPort" . }}; + listen {{ $port }}; {{- end }} {{- if .Values.ipFamily.ipv6.enabled }} - listen [::]:{{ template "harbor.portal.containerPort" . }}; + listen [::]:{{ $port }}; {{- end }} {{- end }} server_name localhost; diff --git a/bitnami/harbor/templates/portal/portal-dpl.yaml b/bitnami/harbor/templates/portal/portal-dpl.yaml index d46c2d698..bdae70244 100644 --- a/bitnami/harbor/templates/portal/portal-dpl.yaml +++ b/bitnami/harbor/templates/portal/portal-dpl.yaml @@ -2,6 +2,7 @@ apiVersion: {{ template "common.capabilities.deployment.apiVersion" . }} kind: Deployment metadata: name: {{ include "harbor.portal" . }} + namespace: {{ .Release.Namespace | quote }} labels: {{- include "common.labels.standard" . | nindent 4 }} {{- if .Values.commonLabels }} {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} @@ -11,13 +12,13 @@ metadata: annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} {{- end }} spec: - replicas: {{ .Values.portal.replicas }} - {{- if .Values.portal.updateStrategy }} - strategy: {{- toYaml .Values.portal.updateStrategy | nindent 4 }} - {{- end }} + replicas: {{ .Values.portal.replicaCount }} selector: matchLabels: {{- include "common.labels.matchLabels" . | nindent 6 }} app.kubernetes.io/component: portal + {{- if .Values.portal.updateStrategy }} + strategy: {{- toYaml .Values.portal.updateStrategy | nindent 4 }} + {{- end }} template: metadata: labels: {{- include "common.labels.standard" . | nindent 8 }} @@ -38,8 +39,8 @@ spec: spec: {{- include "harbor.imagePullSecrets" . | nindent 6 }} automountServiceAccountToken: {{ .Values.portal.automountServiceAccountToken }} - {{- if .Values.portal.priorityClassName }} - priorityClassName: {{ .Values.portal.priorityClassName | quote }} + {{- if .Values.portal.hostAliases }} + hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.portal.hostAliases "context" $) | nindent 8 }} {{- end }} {{- if .Values.portal.affinity }} affinity: {{- include "common.tplvalues.render" (dict "value" .Values.portal.affinity "context" $) | nindent 8 }} @@ -55,65 +56,41 @@ spec: {{- if .Values.portal.tolerations }} tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.portal.tolerations "context" $) | nindent 8 }} {{- end }} - {{- if .Values.podSecurityContext }} - securityContext: {{- include "common.tplvalues.render" (dict "value" .Values.podSecurityContext "context" $) | nindent 8 }} + {{- if .Values.portal.topologySpreadConstraints }} + topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.portal.topologySpreadConstraints "context" .) | nindent 8 }} + {{- end }} + {{- if .Values.portal.priorityClassName }} + priorityClassName: {{ .Values.portal.priorityClassName | quote }} + {{- end }} + {{- if .Values.portal.schedulerName }} + schedulerName: {{ .Values.portal.schedulerName }} + {{- end }} + {{- if .Values.portal.podSecurityContext.enabled }} + securityContext: {{- omit .Values.portal.podSecurityContext "enabled" | toYaml | nindent 8 }} {{- end }} {{- if .Values.portal.initContainers }} initContainers: {{- include "common.tplvalues.render" (dict "value" .Values.portal.initContainers "context" $) | nindent 8 }} {{- end }} - {{- if .Values.portal.hostAliases }} - hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.portal.hostAliases "context" $) | nindent 8 }} - {{- end }} containers: - name: portal - image: {{ include "harbor.portalImage" . }} - imagePullPolicy: {{ .Values.portalImage.pullPolicy | quote }} - {{- if .Values.portal.command }} + image: {{ include "harbor.portal.image" . }} + imagePullPolicy: {{ .Values.portal.image.pullPolicy | quote }} + {{- if .Values.portal.containerSecurityContext.enabled }} + securityContext: {{- omit .Values.portal.containerSecurityContext "enabled" | toYaml | nindent 12 }} + {{- end }} + {{- if .Values.diagnosticMode.enabled }} + command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }} + {{- else if .Values.portal.command }} command: {{- include "common.tplvalues.render" (dict "value" .Values.portal.command "context" $) | nindent 12 }} {{- end }} - {{- if .Values.portal.args }} + {{- if .Values.diagnosticMode.enabled }} + args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }} + {{- else if .Values.portal.args }} args: {{- include "common.tplvalues.render" (dict "value" .Values.portal.args "context" $) | nindent 12 }} {{- end }} - {{- if .Values.portal.lifecycleHooks }} - lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.portal.lifecycleHooks "context" $) | nindent 12 }} - {{- end }} - {{- if .Values.portal.resources }} - resources: {{- toYaml .Values.portal.resources | nindent 12 }} - {{- end }} - {{- if .Values.containerSecurityContext }} - securityContext: {{- include "common.tplvalues.render" (dict "value" .Values.containerSecurityContext "context" $) | nindent 12 }} - {{- end }} - {{- if .Values.portal.livenessProbe.enabled }} - livenessProbe: - httpGet: - path: / - port: http - scheme: {{ include "harbor.component.scheme" . | upper }} - initialDelaySeconds: {{ .Values.portal.livenessProbe.initialDelaySeconds }} - periodSeconds: {{ .Values.portal.livenessProbe.periodSeconds }} - timeoutSeconds: {{ .Values.portal.livenessProbe.timeoutSeconds }} - successThreshold: {{ .Values.portal.livenessProbe.successThreshold }} - failureThreshold: {{ .Values.portal.livenessProbe.failureThreshold }} - {{- else if .Values.portal.customLivenessProbe }} - livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.portal.customLivenessProbe "context" $) | nindent 12 }} - {{- end }} - {{- if .Values.portal.readinessProbe.enabled }} - readinessProbe: - httpGet: - path: / - port: http - scheme: {{ include "harbor.component.scheme" . | upper }} - initialDelaySeconds: {{ .Values.portal.readinessProbe.initialDelaySeconds }} - periodSeconds: {{ .Values.portal.readinessProbe.periodSeconds }} - timeoutSeconds: {{ .Values.portal.readinessProbe.timeoutSeconds }} - successThreshold: {{ .Values.portal.readinessProbe.successThreshold }} - failureThreshold: {{ .Values.portal.readinessProbe.failureThreshold }} - {{- else if .Values.portal.customReadinessProbe }} - readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.portal.customReadinessProbe "context" $) | nindent 12 }} - {{- end }} env: - name: BITNAMI_DEBUG - value: {{ ternary "true" "false" .Values.portalImage.debug | quote }} + value: {{ ternary "true" "false" .Values.portal.image.debug | quote }} {{- if .Values.portal.extraEnvVars }} {{- include "common.tplvalues.render" (dict "value" .Values.portal.extraEnvVars "context" $) | nindent 12 }} {{- end }} @@ -127,8 +104,41 @@ spec: name: {{ include "common.tplvalues.render" (dict "value" .Values.portal.extraEnvVarsSecret "context" $) }} {{- end }} ports: - - containerPort: {{ include "harbor.portal.containerPort" . }} - name: http + - containerPort: {{ ternary .Values.portal.containerPorts.https .Values.portal.containerPorts.http .Values.internalTLS.enabled }} + name: {{ ternary "https" "http" .Values.internalTLS.enabled }} + {{- if not .Values.diagnosticMode.enabled }} + {{- if .Values.portal.startupProbe.enabled }} + startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.portal.startupProbe "enabled") "context" $) | nindent 12 }} + tcpSocket: + port: {{ ternary "https" "http" .Values.internalTLS.enabled }} + {{- else if .Values.portal.customStartupProbe }} + startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.portal.customStartupProbe "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.portal.livenessProbe.enabled }} + livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.portal.livenessProbe "enabled") "context" $) | nindent 12 }} + httpGet: + path: / + port: {{ ternary "https" "http" .Values.internalTLS.enabled }} + scheme: {{ ternary "https" "http" .Values.internalTLS.enabled | upper }} + {{- else if .Values.portal.customLivenessProbe }} + livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.portal.customLivenessProbe "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.portal.readinessProbe.enabled }} + readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.portal.readinessProbe "enabled") "context" $) | nindent 12 }} + httpGet: + path: / + port: {{ ternary "https" "http" .Values.internalTLS.enabled }} + scheme: {{ ternary "https" "http" .Values.internalTLS.enabled | upper }} + {{- else if .Values.portal.customReadinessProbe }} + readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.portal.customReadinessProbe "context" $) | nindent 12 }} + {{- end }} + {{- end }} + {{- if .Values.portal.lifecycleHooks }} + lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.portal.lifecycleHooks "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.portal.resources }} + resources: {{- toYaml .Values.portal.resources | nindent 12 }} + {{- end }} volumeMounts: - name: portal-config mountPath: /opt/bitnami/nginx/conf/nginx.conf diff --git a/bitnami/harbor/templates/portal/portal-svc.yaml b/bitnami/harbor/templates/portal/portal-svc.yaml index 6a054bfc7..cea197429 100644 --- a/bitnami/harbor/templates/portal/portal-svc.yaml +++ b/bitnami/harbor/templates/portal/portal-svc.yaml @@ -2,6 +2,7 @@ apiVersion: v1 kind: Service metadata: name: {{ include "harbor.portal" . }} + namespace: {{ .Release.Namespace | quote }} labels: {{- include "common.labels.standard" . | nindent 4 }} {{- if .Values.commonLabels }} {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} @@ -10,12 +11,12 @@ metadata: annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} {{- end }} spec: - {{- if (eq .Values.ingress.controller "gce") }} + {{- if (eq .Values.ingress.core.controller "gce") }} type: NodePort {{- end }} ports: - - name: http - port: {{ include "harbor.portal.servicePort" . }} - targetPort: http + - name: {{ ternary "https" "http" .Values.internalTLS.enabled }} + port: {{ ternary .Values.portal.service.ports.https .Values.portal.service.ports.http .Values.internalTLS.enabled }} + targetPort: {{ ternary "https" "http" .Values.internalTLS.enabled }} selector: {{- include "common.labels.matchLabels" . | nindent 4 }} app.kubernetes.io/component: portal diff --git a/bitnami/harbor/templates/registry/registry-cm.yaml b/bitnami/harbor/templates/registry/registry-cm.yaml index 659b4fe08..3feb20a08 100644 --- a/bitnami/harbor/templates/registry/registry-cm.yaml +++ b/bitnami/harbor/templates/registry/registry-cm.yaml @@ -2,6 +2,7 @@ apiVersion: v1 kind: ConfigMap metadata: name: {{ include "harbor.registry" . }} + namespace: {{ .Release.Namespace | quote }} labels: {{- include "common.labels.standard" . | nindent 4 }} {{- if .Values.commonLabels }} {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} @@ -72,8 +73,8 @@ data: {{- if .Values.persistence.imageChartStorage.s3.rootdirectory }} rootdirectory: {{ .Values.persistence.imageChartStorage.s3.rootdirectory }} {{- end }} - {{- if .Values.persistence.imageChartStorage.s3.storageclass }} - storageclass: {{ .Values.persistence.imageChartStorage.s3.storageclass }} + {{- if .Values.persistence.imageChartStorage.s3.storageClass }} + storageclass: {{ .Values.persistence.imageChartStorage.s3.storageClass }} {{- end }} {{- else if eq .Values.persistence.imageChartStorage.type "swift" }} swift: @@ -157,7 +158,7 @@ data: db: {{ template "harbor.redis.registryDatabaseIndex" . }} http: relativeurls: {{ .Values.registry.relativeurls }} - addr: :{{ include "harbor.registry.containerPort" . }} + addr: :{{ ternary .Values.registry.server.containerPorts.https .Values.registry.server.containerPorts.http .Values.internalTLS.enabled }} {{- if .Values.internalTLS.enabled }} tls: certificate: /etc/harbor/ssl/registry/tls.crt @@ -167,7 +168,7 @@ data: # set via environment variable # secret: placeholder debug: - addr: localhost:5001 + addr: localhost:{{ .Values.registry.server.containerPorts.debug }} auth: htpasswd: realm: harbor-registry-basic-realm @@ -192,13 +193,13 @@ data: --- {{- if .Values.internalTLS.enabled }} protocol: "https" - port: 8443 + port: {{ .Values.registry.controller.containerPorts.https }} https_config: cert: "/etc/harbor/ssl/registry/tls.crt" key: "/etc/harbor/ssl/registry/tls.key" {{- else }} protocol: "http" - port: 8080 + port: {{ .Values.registry.controller.containerPorts.http }} {{- end }} log_level: {{ .Values.logLevel }} registry_config: "/etc/registry/config.yml" diff --git a/bitnami/harbor/templates/registry/registry-dpl.yaml b/bitnami/harbor/templates/registry/registry-dpl.yaml index fed335ec5..b6d035a1d 100644 --- a/bitnami/harbor/templates/registry/registry-dpl.yaml +++ b/bitnami/harbor/templates/registry/registry-dpl.yaml @@ -2,6 +2,7 @@ apiVersion: {{ template "common.capabilities.deployment.apiVersion" . }} kind: Deployment metadata: name: {{ include "harbor.registry" . }} + namespace: {{ .Release.Namespace | quote }} labels: {{- include "common.labels.standard" . | nindent 4 }} {{- if .Values.commonLabels }} {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} @@ -11,13 +12,13 @@ metadata: annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} {{- end }} spec: - replicas: {{ .Values.registry.replicas }} - {{- if .Values.registry.updateStrategy }} - strategy: {{- toYaml .Values.registry.updateStrategy | nindent 4 }} - {{- end }} + replicas: {{ .Values.registry.replicaCount }} selector: matchLabels: {{- include "common.labels.matchLabels" . | nindent 6 }} app.kubernetes.io/component: registry + {{- if .Values.registry.updateStrategy }} + strategy: {{- toYaml .Values.registry.updateStrategy | nindent 4 }} + {{- end }} template: metadata: labels: {{- include "common.labels.standard" . | nindent 8 }} @@ -42,8 +43,8 @@ spec: spec: {{- include "harbor.imagePullSecrets" . | nindent 6 }} automountServiceAccountToken: {{ .Values.registry.automountServiceAccountToken }} - {{- if .Values.registry.priorityClassName }} - priorityClassName: {{ .Values.registry.priorityClassName | quote }} + {{- if .Values.registry.hostAliases }} + hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.registry.hostAliases "context" $) | nindent 8 }} {{- end }} {{- if .Values.registry.affinity }} affinity: {{- include "common.tplvalues.render" (dict "value" .Values.registry.affinity "context" $) | nindent 8 }} @@ -59,22 +60,33 @@ spec: {{- if .Values.registry.tolerations }} tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.registry.tolerations "context" $) | nindent 8 }} {{- end }} - {{- if .Values.podSecurityContext }} - securityContext: {{- include "common.tplvalues.render" (dict "value" .Values.podSecurityContext "context" $) | nindent 8 }} + {{- if .Values.registry.topologySpreadConstraints }} + topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.registry.topologySpreadConstraints "context" .) | nindent 8 }} + {{- end }} + {{- if .Values.registry.priorityClassName }} + priorityClassName: {{ .Values.registry.priorityClassName | quote }} + {{- end }} + {{- if .Values.registry.schedulerName }} + schedulerName: {{ .Values.registry.schedulerName }} + {{- end }} + {{- if .Values.registry.podSecurityContext.enabled }} + securityContext: {{- omit .Values.registry.podSecurityContext "enabled" | toYaml | nindent 8 }} {{- end }} initContainers: - {{- if and .Values.volumePermissions.enabled .Values.persistence.enabled }} + {{- if and .Values.volumePermissions.enabled .Values.persistence.enabled }} - name: volume-permissions image: {{ include "harbor.volumePermissions.image" . }} imagePullPolicy: {{ .Values.volumePermissions.image.pullPolicy | quote }} command: - - sh - - -c + - /bin/bash + args: + - -ec - | - mkdir -p "{{ .Values.persistence.imageChartStorage.filesystem.rootdirectory }}" - chown -R "{{ .Values.containerSecurityContext.runAsUser }}:{{ .Values.podSecurityContext.fsGroup }}" "{{ .Values.persistence.imageChartStorage.filesystem.rootdirectory }}" - securityContext: - runAsUser: 0 + mkdir -p {{ .Values.persistence.imageChartStorage.filesystem.rootdirectory }} + find {{ .Values.persistence.imageChartStorage.filesystem.rootdirectory }} -mindepth 1 -maxdepth 1 -not -name ".snapshot" -not -name "lost+found" | xargs -r chown -R {{ .Values.registry.server.containerSecurityContext.runAsUser }}:{{ .Values.registry.podSecurityContext.fsGroup }} + {{- if .Values.volumePermissions.containerSecurityContext.enabled }} + securityContext: {{- omit .Values.volumePermissions.containerSecurityContext "enabled" | toYaml | nindent 12 }} + {{- end }} {{- if .Values.volumePermissions.resources }} resources: {{- toYaml .Values.volumePermissions.resources | nindent 12 }} {{- end }} @@ -82,63 +94,30 @@ spec: - name: registry-data mountPath: {{ .Values.persistence.imageChartStorage.filesystem.rootdirectory }} subPath: {{ .Values.persistence.persistentVolumeClaim.registry.subPath }} - {{- end }} - {{- if .Values.registry.initContainers }} - {{- include "common.tplvalues.render" (dict "value" .Values.registry.initContainers "context" $) | nindent 8 }} - {{- end }} - {{- if .Values.registry.hostAliases }} - hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.registry.hostAliases "context" $) | nindent 8 }} - {{- end }} + {{- end }} + {{- if .Values.registry.initContainers }} + {{- include "common.tplvalues.render" (dict "value" .Values.registry.initContainers "context" $) | nindent 8 }} + {{- end }} containers: - name: registry - image: {{ include "harbor.registryImage" . }} - imagePullPolicy: {{ .Values.registryImage.pullPolicy | quote }} - {{- if .Values.registry.server.command }} + image: {{ include "harbor.registry.server.image" . }} + imagePullPolicy: {{ .Values.registry.server.image.pullPolicy | quote }} + {{- if .Values.registry.server.containerSecurityContext.enabled }} + securityContext: {{- omit .Values.registry.server.containerSecurityContext "enabled" | toYaml | nindent 12 }} + {{- end }} + {{- if .Values.diagnosticMode.enabled }} + command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }} + {{- else if .Values.registry.server.command }} command: {{- include "common.tplvalues.render" (dict "value" .Values.registry.server.command "context" $) | nindent 12 }} {{- end }} - {{- if .Values.registry.server.args }} + {{- if .Values.diagnosticMode.enabled }} + args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }} + {{- else if .Values.registry.server.args }} args: {{- include "common.tplvalues.render" (dict "value" .Values.registry.server.args "context" $) | nindent 12 }} {{- end }} - {{- if .Values.containerSecurityContext }} - securityContext: {{- include "common.tplvalues.render" (dict "value" .Values.containerSecurityContext "context" $) | nindent 12 }} - {{- end }} - {{- if .Values.registry.server.livenessProbe.enabled }} - livenessProbe: - httpGet: - path: / - scheme: {{ include "harbor.component.scheme" . | upper }} - port: registry - initialDelaySeconds: {{ .Values.registry.server.livenessProbe.initialDelaySeconds }} - periodSeconds: {{ .Values.registry.server.livenessProbe.periodSeconds }} - timeoutSeconds: {{ .Values.registry.server.livenessProbe.timeoutSeconds }} - successThreshold: {{ .Values.registry.server.livenessProbe.successThreshold }} - failureThreshold: {{ .Values.registry.server.livenessProbe.failureThreshold }} - {{- else if .Values.registry.server.customLivenessProbe }} - livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.registry.server.customLivenessProbe "context" $) | nindent 12 }} - {{- end }} - {{- if .Values.registry.server.readinessProbe.enabled }} - readinessProbe: - httpGet: - path: / - scheme: {{ include "harbor.component.scheme" . | upper }} - port: registry - initialDelaySeconds: {{ .Values.registry.server.readinessProbe.initialDelaySeconds }} - periodSeconds: {{ .Values.registry.server.readinessProbe.periodSeconds }} - timeoutSeconds: {{ .Values.registry.server.readinessProbe.timeoutSeconds }} - successThreshold: {{ .Values.registry.server.readinessProbe.successThreshold }} - failureThreshold: {{ .Values.registry.server.readinessProbe.failureThreshold }} - {{- else if .Values.registry.server.customReadinessProbe }} - readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.registry.server.customReadinessProbe "context" $) | nindent 12 }} - {{- end }} - {{- if .Values.registry.server.lifecycleHooks }} - lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.registry.server.lifecycleHooks "context" $) | nindent 12 }} - {{- end }} - {{- if .Values.registry.server.resources }} - resources: {{- toYaml .Values.registry.server.resources | nindent 12 }} - {{- end }} env: - name: BITNAMI_DEBUG - value: {{ ternary "true" "false" .Values.registryImage.debug | quote }} + value: {{ ternary "true" "false" .Values.registry.server.image.debug | quote }} {{- if .Values.internalTLS.enabled }} - name: INTERNAL_TLS_ENABLED value: "true" @@ -172,10 +151,43 @@ spec: name: {{ include "common.tplvalues.render" (dict "value" .Values.registry.server.extraEnvVarsSecret "context" $) }} {{- end }} ports: - - containerPort: {{ include "harbor.registry.containerPort" . }} + - containerPort: {{ ternary .Values.registry.server.containerPorts.https .Values.registry.server.containerPorts.http .Values.internalTLS.enabled }} name: registry - - containerPort: 5001 + - containerPort: {{ .Values.registry.server.containerPorts.debug }} name: debug + {{- if not .Values.diagnosticMode.enabled }} + {{- if .Values.registry.server.startupProbe.enabled }} + startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.registry.server.startupProbe "enabled") "context" $) | nindent 12 }} + tcpSocket: + port: {{ ternary "https" "http" .Values.internalTLS.enabled }} + {{- else if .Values.registry.server.customStartupProbe }} + startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.registry.server.customStartupProbe "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.registry.server.livenessProbe.enabled }} + livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.registry.server.livenessProbe "enabled") "context" $) | nindent 12 }} + httpGet: + path: / + scheme: {{ ternary "https" "http" .Values.internalTLS.enabled | upper }} + port: registry + {{- else if .Values.registry.server.customLivenessProbe }} + livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.registry.server.customLivenessProbe "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.registry.server.readinessProbe.enabled }} + readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.registry.server.readinessProbe "enabled") "context" $) | nindent 12 }} + httpGet: + path: / + scheme: {{ ternary "https" "http" .Values.internalTLS.enabled | upper }} + port: registry + {{- else if .Values.registry.server.customReadinessProbe }} + readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.registry.server.customReadinessProbe "context" $) | nindent 12 }} + {{- end }} + {{- end }} + {{- if .Values.registry.server.lifecycleHooks }} + lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.registry.server.lifecycleHooks "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.registry.server.resources }} + resources: {{- toYaml .Values.registry.server.resources | nindent 12 }} + {{- end }} volumeMounts: - name: registry-data mountPath: {{ .Values.persistence.imageChartStorage.filesystem.rootdirectory }} @@ -193,15 +205,15 @@ spec: - name: internal-tls-certs mountPath: /etc/harbor/ssl/registry {{- end }} - {{- if .Values.caBundleSecretName }} -{{ include "harbor.caBundleVolumeMount" . | indent 12 }} + {{- if .Values.internalTLS.caBundleSecret }} + {{- include "harbor.caBundleVolumeMount" . | nindent 12 }} {{- end }} {{- if and .Values.persistence.enabled (eq .Values.persistence.imageChartStorage.type "gcs") }} - name: gcs-key mountPath: /etc/registry/gcs-key.json subPath: gcs-key.json {{- end }} - {{- if .Values.persistence.imageChartStorage.caBundleSecretName }} + {{- if .Values.persistence.imageChartStorage.caBundleSecret }} - name: storage-service-ca mountPath: /harbor_cust_cert/custom-ca-bundle.crt subPath: ca.crt @@ -217,51 +229,21 @@ spec: {{- include "common.tplvalues.render" (dict "value" .Values.registry.server.extraVolumeMounts "context" $) | nindent 12 }} {{- end }} - name: registryctl - image: {{ include "harbor.registryctlImage" . }} - imagePullPolicy: {{ .Values.registryctlImage.pullPolicy | quote }} - {{- if .Values.registry.controller.command }} + image: {{ include "harbor.registry.controller.image" . }} + imagePullPolicy: {{ .Values.registry.controller.image.pullPolicy | quote }} + {{- if .Values.registry.controller.containerSecurityContext.enabled }} + securityContext: {{- omit .Values.registry.controller.containerSecurityContext "enabled" | toYaml | nindent 12 }} + {{- end }} + {{- if .Values.diagnosticMode.enabled }} + command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }} + {{- else if .Values.registry.controller.command }} command: {{- include "common.tplvalues.render" (dict "value" .Values.registry.controller.command "context" $) | nindent 12 }} {{- end }} - {{- if .Values.registry.controller.args }} + {{- if .Values.diagnosticMode.enabled }} + args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }} + {{- else if .Values.registry.controller.args }} args: {{- include "common.tplvalues.render" (dict "value" .Values.registry.controller.args "context" $) | nindent 12 }} {{- end }} - {{- if .Values.registry.controller.lifecycleHooks }} - lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.registry.controller.lifecycleHooks "context" $) | nindent 12 }} - {{- end }} - {{- if .Values.containerSecurityContext }} - securityContext: {{- include "common.tplvalues.render" (dict "value" .Values.containerSecurityContext "context" $) | nindent 12 }} - {{- end }} - {{- if .Values.registry.controller.livenessProbe.enabled }} - livenessProbe: - httpGet: - path: /api/health - scheme: {{ include "harbor.component.scheme" . | upper }} - port: registryctl - initialDelaySeconds: {{ .Values.registry.controller.livenessProbe.initialDelaySeconds }} - periodSeconds: {{ .Values.registry.controller.livenessProbe.periodSeconds }} - timeoutSeconds: {{ .Values.registry.controller.livenessProbe.timeoutSeconds }} - successThreshold: {{ .Values.registry.controller.livenessProbe.successThreshold }} - failureThreshold: {{ .Values.registry.controller.livenessProbe.failureThreshold }} - {{- else if .Values.registry.controller.customLivenessProbe }} - livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.registry.controller.customLivenessProbe "context" $) | nindent 12 }} - {{- end }} - {{- if .Values.registry.controller.readinessProbe.enabled }} - readinessProbe: - httpGet: - path: /api/health - scheme: {{ include "harbor.component.scheme" . | upper }} - port: registryctl - initialDelaySeconds: {{ .Values.registry.controller.readinessProbe.initialDelaySeconds }} - periodSeconds: {{ .Values.registry.controller.readinessProbe.periodSeconds }} - timeoutSeconds: {{ .Values.registry.controller.readinessProbe.timeoutSeconds }} - successThreshold: {{ .Values.registry.controller.readinessProbe.successThreshold }} - failureThreshold: {{ .Values.registry.controller.readinessProbe.failureThreshold }} - {{- else if .Values.registry.controller.customReadinessProbe }} - readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.registry.controller.customReadinessProbe "context" $) | nindent 12 }} - {{- end }} - {{- if .Values.registry.controller.resources }} - resources: {{- toYaml .Values.registry.controller.resources | nindent 12 }} - {{- end }} envFrom: - secretRef: name: {{ include "harbor.registry" . }} @@ -275,7 +257,7 @@ spec: {{- end }} env: - name: BITNAMI_DEBUG - value: {{ ternary "true" "false" .Values.registryctlImage.debug | quote }} + value: {{ ternary "true" "false" .Values.registry.controller.image.debug | quote }} - name: CORE_SECRET valueFrom: secretKeyRef: @@ -300,8 +282,41 @@ spec: {{- include "common.tplvalues.render" (dict "value" .Values.registry.controller.extraEnvVars "context" $) | nindent 12 }} {{- end }} ports: - - containerPort: {{ include "harbor.registryCtl.containerPort" . }} + - containerPort: {{ ternary .Values.registry.controller.containerPorts.https .Values.registry.controller.containerPorts.http .Values.internalTLS.enabled }} name: registryctl + {{- if not .Values.diagnosticMode.enabled }} + {{- if .Values.registry.controller.startupProbe.enabled }} + startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.registry.controller.startupProbe "enabled") "context" $) | nindent 12 }} + tcpSocket: + port: {{ ternary "https" "http" .Values.internalTLS.enabled }} + {{- else if .Values.registry.controller.customStartupProbe }} + startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.registry.controller.customStartupProbe "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.registry.controller.livenessProbe.enabled }} + livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.registry.controller.livenessProbe "enabled") "context" $) | nindent 12 }} + httpGet: + path: /api/health + scheme: {{ ternary "https" "http" .Values.internalTLS.enabled | upper }} + port: registryctl + {{- else if .Values.registry.controller.customLivenessProbe }} + livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.registry.controller.customLivenessProbe "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.registry.controller.readinessProbe.enabled }} + readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.registry.controller.readinessProbe "enabled") "context" $) | nindent 12 }} + httpGet: + path: /api/health + scheme: {{ ternary "https" "http" .Values.internalTLS.enabled | upper }} + port: registryctl + {{- else if .Values.registry.controller.customReadinessProbe }} + readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.registry.controller.customReadinessProbe "context" $) | nindent 12 }} + {{- end }} + {{- end }} + {{- if .Values.registry.controller.lifecycleHooks }} + lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.registry.controller.lifecycleHooks "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.registry.controller.resources }} + resources: {{- toYaml .Values.registry.controller.resources | nindent 12 }} + {{- end }} volumeMounts: - name: registry-data mountPath: {{ .Values.persistence.imageChartStorage.filesystem.rootdirectory }} @@ -316,13 +331,13 @@ spec: - name: registry-config mountPath: /etc/registryctl/config.yml subPath: ctl-config.yml - {{- if .Values.persistence.imageChartStorage.caBundleSecretName }} + {{- if .Values.persistence.imageChartStorage.caBundleSecret }} - name: storage-service-ca mountPath: /harbor_cust_cert/custom-ca-bundle.crt subPath: ca.crt {{- end }} - {{- if .Values.caBundleSecretName }} -{{ include "harbor.caBundleVolumeMount" . | indent 12 }} + {{- if .Values.internalTLS.caBundleSecret }} + {{- include "harbor.caBundleVolumeMount" . | nindent 12 }} {{- end }} {{- if and .Values.persistence.enabled (eq .Values.persistence.imageChartStorage.type "gcs") }} - name: gcs-key @@ -364,8 +379,8 @@ spec: {{- else }} emptyDir: {} {{- end }} - {{- if .Values.caBundleSecretName }} -{{ include "harbor.caBundleVolume" . | indent 8 }} + {{- if .Values.internalTLS.caBundleSecret }} + {{- include "harbor.caBundleVolume" . | nindent 8 }} {{- end }} {{- if and .Values.persistence.enabled (eq .Values.persistence.imageChartStorage.type "gcs") }} - name: gcs-key @@ -375,10 +390,10 @@ spec: - key: GCS_KEY_DATA path: gcs-key.json {{- end }} - {{- if .Values.persistence.imageChartStorage.caBundleSecretName }} + {{- if .Values.persistence.imageChartStorage.caBundleSecret }} - name: storage-service-ca secret: - secretName: {{ .Values.persistence.imageChartStorage.caBundleSecretName }} + secretName: {{ .Values.persistence.imageChartStorage.caBundleSecret }} {{- end }} {{- if .Values.registry.middleware.enabled }} {{- if eq .Values.registry.middleware.type "cloudFront" }} diff --git a/bitnami/harbor/templates/registry/registry-pvc.yaml b/bitnami/harbor/templates/registry/registry-pvc.yaml index 7bfdf921b..c0117c10b 100644 --- a/bitnami/harbor/templates/registry/registry-pvc.yaml +++ b/bitnami/harbor/templates/registry/registry-pvc.yaml @@ -4,24 +4,33 @@ kind: PersistentVolumeClaim apiVersion: v1 metadata: name: {{ include "harbor.registry" . }} - {{- if eq .Values.persistence.resourcePolicy "keep" }} - annotations: - helm.sh/resource-policy: keep - {{- end }} + namespace: {{ .Release.Namespace | quote }} labels: {{- include "common.labels.standard" . | nindent 4 }} {{- if .Values.commonLabels }} {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} {{- end }} app.kubernetes.io/component: registry - {{- if .Values.commonAnnotations }} - annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} + annotations: + {{- if eq .Values.persistence.resourcePolicy "keep" }} + helm.sh/resource-policy: keep + {{- end }} + {{- if .Values.commonAnnotations }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} + {{- if .Values.persistence.persistentVolumeClaim.registry.annotations }} + {{- toYaml .Values.persistence.persistentVolumeClaim.registry.annotations | nindent 4 }} + {{- end }} spec: accessModes: - - {{ .Values.persistence.persistentVolumeClaim.registry.accessMode }} + {{- range .Values.persistence.persistentVolumeClaim.registry.accessModes }} + - {{ . | quote }} + {{- end }} resources: requests: storage: {{ .Values.persistence.persistentVolumeClaim.registry.size }} - {{- include "harbor.registry.storageClass" . | nindent 2 }} + {{- if .Values.persistence.persistentVolumeClaim.registry.selector }} + selector: {{- include "common.tplvalues.render" (dict "value" .Values.persistence.persistentVolumeClaim.registry.selector "context" $) | nindent 2 }} + {{- end }} + {{- include "common.storage.class" ( dict "persistence" .Values.persistence.persistentVolumeClaim.registry "global" .Values.global ) | nindent 2 }} {{- end }} {{- end }} diff --git a/bitnami/harbor/templates/registry/registry-secret.yaml b/bitnami/harbor/templates/registry/registry-secret.yaml index dbaa8aeb8..69b3a64ea 100644 --- a/bitnami/harbor/templates/registry/registry-secret.yaml +++ b/bitnami/harbor/templates/registry/registry-secret.yaml @@ -2,6 +2,7 @@ apiVersion: v1 kind: Secret metadata: name: {{ include "harbor.registry" . }} + namespace: {{ .Release.Namespace | quote }} labels: {{- include "common.labels.standard" . | nindent 4 }} {{- if .Values.commonLabels }} {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} @@ -12,7 +13,7 @@ metadata: type: Opaque data: REGISTRY_HTPASSWD: {{ .Values.registry.credentials.htpasswd | b64enc | quote }} - REGISTRY_HTTP_SECRET: {{ .Values.registry.secret | default (randAlphaNum 16) | b64enc | quote }} + REGISTRY_HTTP_SECRET: {{ include "common.secrets.passwords.manage" (dict "secret" (include "harbor.registry" .) "key" "REGISTRY_HTTP_SECRET" "length" 16 "providedValues" (list "registry.secret") "context" $) }} REGISTRY_REDIS_PASSWORD: {{ (include "harbor.redis.rawPassword" .) | b64enc | quote }} {{- if eq .Values.persistence.imageChartStorage.type "azure" }} REGISTRY_STORAGE_AZURE_ACCOUNTKEY: {{ .Values.persistence.imageChartStorage.azure.accountkey | b64enc | quote }} diff --git a/bitnami/harbor/templates/registry/registry-svc.yaml b/bitnami/harbor/templates/registry/registry-svc.yaml index 58bf56f24..43d13c924 100644 --- a/bitnami/harbor/templates/registry/registry-svc.yaml +++ b/bitnami/harbor/templates/registry/registry-svc.yaml @@ -2,6 +2,7 @@ apiVersion: v1 kind: Service metadata: name: {{ include "harbor.registry" . }} + namespace: {{ .Release.Namespace | quote }} labels: {{- include "common.labels.standard" . | nindent 4 }} {{- if .Values.commonLabels }} {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} @@ -12,8 +13,8 @@ metadata: spec: ports: - name: registry - port: {{ include "harbor.registry.servicePort" . }} + port: {{ ternary .Values.registry.server.service.ports.https .Values.registry.server.service.ports.http .Values.internalTLS.enabled }} - name: controller - port: {{ include "harbor.registryctl.servicePort" . }} + port: {{ ternary .Values.registry.controller.service.ports.https .Values.registry.controller.service.ports.http .Values.internalTLS.enabled }} selector: {{- include "common.labels.matchLabels" . | nindent 4 }} app.kubernetes.io/component: registry diff --git a/bitnami/harbor/templates/trivy/trivy-cm-envvars.yaml b/bitnami/harbor/templates/trivy/trivy-cm-envvars.yaml index 4a1881d81..6c0d2a644 100644 --- a/bitnami/harbor/templates/trivy/trivy-cm-envvars.yaml +++ b/bitnami/harbor/templates/trivy/trivy-cm-envvars.yaml @@ -1,7 +1,8 @@ apiVersion: v1 kind: ConfigMap metadata: - name: {{ template "harbor.trivy" . }}-envvars + name: {{ printf "%s-envvars" (include "harbor.trivy" .) }} + namespace: {{ .Release.Namespace | quote }} labels: {{- include "common.labels.standard" . | nindent 4 }} {{- if .Values.commonLabels }} {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} @@ -20,7 +21,7 @@ data: SCANNER_TRIVY_IGNORE_UNFIXED: {{ .Values.trivy.ignoreUnfixed | quote }} SCANNER_TRIVY_SKIP_UPDATE: {{ .Values.trivy.skipUpdate | quote }} SCANNER_TRIVY_INSECURE: {{ .Values.trivy.insecure | quote }} - SCANNER_API_SERVER_ADDR: {{ printf ":%s" (include "harbor.trivy.containerPort" .) | quote }} + SCANNER_API_SERVER_ADDR: {{ printf ":%d" (ternary .Values.trivy.containerPorts.https .Values.trivy.containerPorts.http .Values.internalTLS.enabled | int) | quote }} {{- if .Values.internalTLS.enabled }} INTERNAL_TLS_ENABLED: "true" SCANNER_API_SERVER_TLS_KEY: /etc/harbor/ssl/trivy/tls.key diff --git a/bitnami/harbor/templates/trivy/trivy-secret-envvars.yaml b/bitnami/harbor/templates/trivy/trivy-secret-envvars.yaml index 69845d03c..060397d08 100644 --- a/bitnami/harbor/templates/trivy/trivy-secret-envvars.yaml +++ b/bitnami/harbor/templates/trivy/trivy-secret-envvars.yaml @@ -2,7 +2,8 @@ apiVersion: v1 kind: Secret metadata: - name: {{ include "harbor.trivy" . }}-envvars + name: {{ printf "%s-envvars" (include "harbor.trivy" .) }} + namespace: {{ .Release.Namespace | quote }} labels: {{- include "common.labels.standard" . | nindent 4 }} {{- if .Values.commonLabels }} {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} diff --git a/bitnami/harbor/templates/trivy/trivy-sts.yaml b/bitnami/harbor/templates/trivy/trivy-sts.yaml index 680f24e4c..c4dd62a98 100644 --- a/bitnami/harbor/templates/trivy/trivy-sts.yaml +++ b/bitnami/harbor/templates/trivy/trivy-sts.yaml @@ -1,9 +1,9 @@ {{- if .Values.trivy.enabled }} - apiVersion: apps/v1 kind: StatefulSet metadata: name: {{ include "harbor.trivy" . }} + namespace: {{ .Release.Namespace | quote }} labels: {{- include "common.labels.standard" . | nindent 4 }} {{- if .Values.commonLabels }} {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} @@ -13,7 +13,7 @@ metadata: annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} {{- end }} spec: - replicas: {{ .Values.trivy.replicas }} + replicas: {{ .Values.trivy.replicaCount }} serviceName: {{ template "harbor.trivy" . }} updateStrategy: {{- toYaml .Values.trivy.updateStrategy | nindent 4 }} selector: @@ -40,8 +40,8 @@ spec: {{- end }} spec: {{- include "harbor.imagePullSecrets" . | nindent 6 }} - {{- if .Values.trivy.priorityClassName }} - priorityClassName: {{ .Values.trivy.priorityClassName | quote }} + {{- if .Values.trivy.hostAliases }} + hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.trivy.hostAliases "context" $) | nindent 8 }} {{- end }} {{- if .Values.trivy.affinity }} affinity: {{- include "common.tplvalues.render" (dict "value" .Values.trivy.affinity "context" $) | nindent 8 }} @@ -57,62 +57,72 @@ spec: {{- if .Values.trivy.tolerations }} tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.trivy.tolerations "context" $) | nindent 8 }} {{- end }} - {{- if .Values.podSecurityContext }} - securityContext: {{- include "common.tplvalues.render" (dict "value" .Values.podSecurityContext "context" $) | nindent 8 }} + {{- if .Values.trivy.topologySpreadConstraints }} + topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.trivy.topologySpreadConstraints "context" .) | nindent 8 }} + {{- end }} + {{- if .Values.trivy.priorityClassName }} + priorityClassName: {{ .Values.trivy.priorityClassName | quote }} + {{- end }} + {{- if .Values.trivy.schedulerName }} + schedulerName: {{ .Values.trivy.schedulerName }} + {{- end }} + {{- if .Values.trivy.podSecurityContext.enabled }} + securityContext: {{- omit .Values.trivy.podSecurityContext "enabled" | toYaml | nindent 8 }} {{- end }} automountServiceAccountToken: {{ .Values.trivy.automountServiceAccountToken }} initContainers: - {{- if and .Values.volumePermissions.enabled .Values.persistence.enabled }} + {{- if and .Values.volumePermissions.enabled .Values.persistence.enabled }} - name: volume-permissions image: {{ include "harbor.volumePermissions.image" . }} imagePullPolicy: {{ .Values.volumePermissions.image.pullPolicy | quote }} command: - - sh - - -c + - /bin/bash + args: + - -ec - | - mkdir -p "{{ .Values.trivy.cacheDir }}" - mkdir -p "{{ .Values.trivy.cacheDir }}/trivy" - mkdir -p "{{ .Values.trivy.cacheDir }}/reports" - chown -R "{{ .Values.containerSecurityContext.runAsUser }}:{{ .Values.podSecurityContext.fsGroup }}" "{{ .Values.trivy.cacheDir }}" - securityContext: - runAsUser: 0 + mkdir -p {{ .Values.trivy.cacheDir }} {{ .Values.trivy.cacheDir }}/trivy {{ .Values.trivy.cacheDir }}/reports + find {{ .Values.trivy.cacheDir }} -mindepth 1 -maxdepth 1 -not -name ".snapshot" -not -name "lost+found" | xargs -r chown -R {{ .Values.trivy.containerSecurityContext.runAsUser }}:{{ .Values.trivy.podSecurityContext.fsGroup }} + {{- if .Values.volumePermissions.containerSecurityContext.enabled }} + securityContext: {{- omit .Values.volumePermissions.containerSecurityContext "enabled" | toYaml | nindent 12 }} + {{- end }} {{- if .Values.volumePermissions.resources }} resources: {{- toYaml .Values.volumePermissions.resources | nindent 12 }} {{- end }} volumeMounts: - name: data mountPath: {{ .Values.trivy.cacheDir }} - {{- end }} - {{- if .Values.trivy.initContainers }} - {{- include "common.tplvalues.render" (dict "value" .Values.trivy.initContainers "context" $) | nindent 8 }} - {{- end }} - {{- if .Values.trivy.hostAliases }} - hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.trivy.hostAliases "context" $) | nindent 8 }} - {{- end }} + {{- end }} + {{- if .Values.trivy.initContainers }} + {{- include "common.tplvalues.render" (dict "value" .Values.trivy.initContainers "context" $) | nindent 8 }} + {{- end }} containers: - name: trivy - image: {{ include "harbor.trivyImage" . }} - imagePullPolicy: {{ .Values.trivyImage.pullPolicy | quote }} - {{- if .Values.containerSecurityContext }} - securityContext: {{- include "common.tplvalues.render" (dict "value" .Values.containerSecurityContext "context" $) | nindent 12 }} + image: {{ include "harbor.trivy.image" . }} + imagePullPolicy: {{ .Values.trivy.image.pullPolicy | quote }} + {{- if .Values.trivy.containerSecurityContext.enabled }} + securityContext: {{- omit .Values.trivy.containerSecurityContext "enabled" | toYaml | nindent 12 }} {{- end }} - {{- if .Values.trivy.command }} + {{- if .Values.diagnosticMode.enabled }} + command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }} + {{- else if .Values.trivy.command }} command: {{- include "common.tplvalues.render" (dict "value" .Values.trivy.command "context" $) | nindent 12 }} {{- end }} - {{- if .Values.trivy.args }} + {{- if .Values.diagnosticMode.enabled }} + args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }} + {{- else if .Values.trivy.args }} args: {{- include "common.tplvalues.render" (dict "value" .Values.trivy.args "context" $) | nindent 12 }} {{- end }} env: - name: BITNAMI_DEBUG - value: {{ ternary "true" "false" .Values.trivyImage.debug | quote }} + value: {{ ternary "true" "false" .Values.trivy.image.debug | quote }} {{- if .Values.trivy.extraEnvVars }} {{- include "common.tplvalues.render" (dict "value" .Values.trivy.extraEnvVars "context" $) | nindent 12 }} {{- end }} envFrom: - configMapRef: - name: {{ template "harbor.trivy" . }}-envvars + name: {{ printf "%s-envvars" (include "harbor.trivy" .) }} - secretRef: - name: {{ template "harbor.trivy" . }}-envvars + name: {{ printf "%s-envvars" (include "harbor.trivy" .) }} {{- if .Values.trivy.extraEnvVarsCM }} - configMapRef: name: {{ include "common.tplvalues.render" (dict "value" .Values.trivy.extraEnvVarsCM "context" $) }} @@ -123,7 +133,40 @@ spec: {{- end }} ports: - name: api-server - containerPort: {{ template "harbor.trivy.containerPort" . }} + containerPort: {{ ternary .Values.trivy.containerPorts.https .Values.trivy.containerPorts.http .Values.internalTLS.enabled }} + {{- if not .Values.diagnosticMode.enabled }} + {{- if .Values.trivy.startupProbe.enabled }} + startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.trivy.startupProbe "enabled") "context" $) | nindent 12 }} + tcpSocket: + port: api-server + {{- else if .Values.trivy.customStartupProbe }} + startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.trivy.customStartupProbe "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.trivy.livenessProbe.enabled }} + livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.trivy.livenessProbe "enabled") "context" $) | nindent 12 }} + httpGet: + scheme: {{ ternary "https" "http" .Values.internalTLS.enabled | upper }} + path: /probe/healthy + port: api-server + {{- else if .Values.trivy.customLivenessProbe }} + livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.trivy.customLivenessProbe "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.trivy.readinessProbe.enabled }} + readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.trivy.readinessProbe "enabled") "context" $) | nindent 12 }} + httpGet: + scheme: {{ ternary "https" "http" .Values.internalTLS.enabled | upper }} + path: /probe/ready + port: api-server + {{- else if .Values.trivy.customReadinessProbe }} + readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.trivy.customReadinessProbe "context" $) | nindent 12 }} + {{- end }} + {{- end }} + {{- if .Values.trivy.lifecycleHooks }} + lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.trivy.lifecycleHooks "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.trivy.resources }} + resources: {{- toYaml .Values.trivy.resources | nindent 12 }} + {{- end }} volumeMounts: - name: data mountPath: {{ .Values.trivy.cacheDir }} @@ -132,44 +175,12 @@ spec: - name: internal-tls-certs mountPath: /etc/harbor/ssl/trivy {{- end }} - {{- if .Values.caBundleSecretName }} -{{ include "harbor.caBundleVolumeMount" . | indent 12 }} + {{- if .Values.internalTLS.caBundleSecret }} + {{- include "harbor.caBundleVolumeMount" . | nindent 12 }} {{- end }} {{- if .Values.trivy.extraVolumeMounts }} {{- include "common.tplvalues.render" (dict "value" .Values.trivy.extraVolumeMounts "context" $) | nindent 12 }} {{- end }} - {{- if .Values.trivy.lifecycleHooks }} - lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.trivy.lifecycleHooks "context" $) | nindent 12 }} - {{- end }} - {{- if .Values.trivy.livenessProbe.enabled }} - livenessProbe: - httpGet: - scheme: {{ include "harbor.component.scheme" . | upper }} - path: /probe/healthy - port: api-server - initialDelaySeconds: {{ .Values.trivy.livenessProbe.initialDelaySeconds }} - periodSeconds: {{ .Values.trivy.livenessProbe.periodSeconds }} - timeoutSeconds: {{ .Values.trivy.livenessProbe.timeoutSeconds }} - successThreshold: {{ .Values.trivy.livenessProbe.successThreshold }} - failureThreshold: {{ .Values.trivy.livenessProbe.failureThreshold }} - {{- else if .Values.trivy.customLivenessProbe }} - livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.trivy.customLivenessProbe "context" $) | nindent 12 }} - {{- end }} - {{- if .Values.trivy.readinessProbe.enabled }} - readinessProbe: - httpGet: - scheme: {{ include "harbor.component.scheme" . | upper }} - path: /probe/ready - port: api-server - initialDelaySeconds: {{ .Values.trivy.readinessProbe.initialDelaySeconds }} - periodSeconds: {{ .Values.trivy.readinessProbe.periodSeconds }} - timeoutSeconds: {{ .Values.trivy.readinessProbe.timeoutSeconds }} - successThreshold: {{ .Values.trivy.readinessProbe.successThreshold }} - failureThreshold: {{ .Values.trivy.readinessProbe.failureThreshold }} - {{- else if .Values.trivy.customReadinessProbe }} - readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.trivy.customReadinessProbe "context" $) | nindent 12 }} - {{- end }} - resources: {{- toYaml .Values.trivy.resources | nindent 12 }} {{- if .Values.trivy.sidecars }} {{- include "common.tplvalues.render" (dict "value" .Values.trivy.sidecars "context" $) | nindent 8 }} {{- end }} @@ -179,8 +190,8 @@ spec: secret: secretName: {{ include "harbor.trivy.tls.secretName" . }} {{- end }} - {{- if .Values.caBundleSecretName }} -{{ include "harbor.caBundleVolume" . | indent 8 }} + {{- if .Values.internalTLS.caBundleSecret }} + {{- include "harbor.caBundleVolume" . | nindent 8 }} {{- end }} {{- if not .Values.persistence.enabled }} - name: data @@ -194,12 +205,20 @@ spec: - metadata: name: data labels: {{- include "common.labels.matchLabels" . | nindent 10 }} + {{- if .Values.persistence.persistentVolumeClaim.trivy.annotations }} + annotations: {{- toYaml .Values.persistence.persistentVolumeClaim.trivy.annotations | nindent 10 }} + {{- end }} spec: accessModes: - - {{ .Values.persistence.persistentVolumeClaim.trivy.accessMode | quote }} - {{- include "harbor.trivy.storageClass" . | nindent 8 }} + {{- range .Values.persistence.persistentVolumeClaim.trivy.accessModes }} + - {{ . | quote }} + {{- end }} resources: requests: storage: {{ .Values.persistence.persistentVolumeClaim.trivy.size | quote }} + {{- if .Values.persistence.persistentVolumeClaim.trivy.selector }} + selector: {{- include "common.tplvalues.render" (dict "value" .Values.persistence.persistentVolumeClaim.trivy.selector "context" $) | nindent 10 }} + {{- end }} + {{- include "common.storage.class" ( dict "persistence" .Values.persistence.persistentVolumeClaim.trivy "global" .Values.global ) | nindent 8 }} {{- end }} {{- end }} diff --git a/bitnami/harbor/templates/trivy/trivy-svc.yaml b/bitnami/harbor/templates/trivy/trivy-svc.yaml index 82295034b..fb20123f4 100644 --- a/bitnami/harbor/templates/trivy/trivy-svc.yaml +++ b/bitnami/harbor/templates/trivy/trivy-svc.yaml @@ -3,6 +3,7 @@ apiVersion: v1 kind: Service metadata: name: {{ include "harbor.trivy" . }} + namespace: {{ .Release.Namespace | quote }} labels: {{- include "common.labels.standard" . | nindent 4 }} {{- if .Values.commonLabels }} {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} @@ -15,7 +16,7 @@ spec: ports: - name: api-server protocol: TCP - port: {{ include "harbor.trivy.servicePort" . }} + port: {{ ternary .Values.trivy.service.ports.https .Values.trivy.service.ports.http .Values.internalTLS.enabled }} targetPort: api-server selector: {{- include "common.labels.matchLabels" . | nindent 4 }} app.kubernetes.io/component: trivy diff --git a/bitnami/harbor/values.yaml b/bitnami/harbor/values.yaml index 620a6411e..d139d5287 100644 --- a/bitnami/harbor/values.yaml +++ b/bitnami/harbor/values.yaml @@ -5,7 +5,7 @@ ## @param global.imageRegistry Global Docker image registry ## @param global.imagePullSecrets Global Docker registry secret names as an array -## @param global.storageClass Global storage class for dynamic provisioning +## @param global.storageClass Global StorageClass for Persistent Volume(s) ## global: imageRegistry: "" @@ -27,6 +27,9 @@ fullnameOverride: "" ## @param kubeVersion Force target Kubernetes version (using Helm capabilities if not set) ## kubeVersion: "" +## @param clusterDomain Kubernetes Cluster Domain +## +clusterDomain: cluster.local ## @param commonAnnotations Annotations to add to all deployed objects ## commonAnnotations: {} @@ -36,115 +39,45 @@ commonLabels: {} ## @param extraDeploy Array of extra objects to deploy with the release (evaluated as a template). ## extraDeploy: [] - -## @section Harbor parameters - -## Init containers parameters: -## volumePermissions: Change the owner and group of the persistent volume mountpoint to runAsUser:fsGroup values from the securityContext section. +## Enable diagnostic mode in the deployment(s)/statefulset(s) ## -volumePermissions: - ## @param volumePermissions.enabled Enable init container that changes volume permissions in the data directory (for cases where the default k8s `runAsUser` and `fsUser` values do not work) +diagnosticMode: + ## @param diagnosticMode.enabled Enable diagnostic mode (all probes will be disabled and the command will be overridden) ## enabled: false - ## @param volumePermissions.image.registry Init container volume-permissions image registry - ## @param volumePermissions.image.repository Init container volume-permissions image name - ## @param volumePermissions.image.tag Init container volume-permissions image tag - ## @param volumePermissions.image.pullPolicy Init container volume-permissions image pull policy - ## @param volumePermissions.image.pullSecrets Specify docker-registry secret names as an array + ## @param diagnosticMode.command Command to override all containers in the the deployment(s)/statefulset(s) ## - image: - registry: docker.io - repository: bitnami/bitnami-shell - tag: 10-debian-10-r355 - pullPolicy: IfNotPresent - ## Optionally specify an array of imagePullSecrets. - ## Secrets must be manually created in the namespace. - ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ - ## - pullSecrets: [] - ## - myRegistryKeySecretName - ## Init containers' resource requests and limits - ## ref: https://kubernetes.io/docs/user-guide/compute-resources/ - ## We usually recommend not to specify default resources and to leave this as a conscious - ## choice for the user. This also increases chances charts run on environments with little - ## resources, such as Minikube. If you do want to specify resources, uncomment the following - ## lines, adjust them as necessary, and remove the curly braces after 'resources:'. - ## @param volumePermissions.resources.limits The resources limits for the container - ## @param volumePermissions.resources.requests The requested resources for the container + command: + - sleep + ## @param diagnosticMode.args Args to override all containers in the the deployment(s)/statefulset(s) ## - resources: - ## Example: - ## limits: - ## cpu: 100m - ## memory: 128Mi - limits: {} - ## Examples: - ## requests: - ## cpu: 100m - ## memory: 128Mi - requests: {} -## @param internalTLS.enabled Use TLS in all the supported containers: chartmuseum, clair, core, jobservice, portal, registry and trivy -## In order to enable https in each components tls cert files need to provided in advance. -## -internalTLS: - enabled: false + args: + - infinity -ipFamily: - ## Enable listening on IPv6 ([::]) for nginx-based components (nginx,portal) - ## Note that enabling ipv6 will cause nginx to crash on start on systems - ## with IPv6 disabled using the `ipv6.disable` kernel flag) - ## @param ipFamily.ipv6.enabled Enable listening on IPv6 ([::]) for nginx-based components (nginx,portal) - ipv6: - enabled: true - ## ipv4Enabled set to true if ipv4 is enabled in cluster - ## @param ipFamily.ipv4.enabled Enable listening on IPv4 for nginx-based components (nginx,portal) - ipv4: - enabled: true +## @section Harbor common parameters -## @param caBundleSecretName The custom ca bundle secret name, the secret must contain key named "ca.crt" which will be injected into the trust store for chartmuseum, clair, core, jobservice, registry, trivy components. +## @param adminPassword The initial password of Harbor admin. Change it from portal after launching Harbor ## -caBundleSecretName: "" -## @param externalURL The external URL for Harbor core service +adminPassword: "" +## @param externalURL The external URL for Harbor Core service ## It is used to ## 1) populate the docker/helm commands showed on portal ## 2) populate the token service URL returned to docker/notary client ## ## Format: protocol://domain[:port]. Usually: -## 1) if "service.type" is "ingress", the "domain" should be -## the value of "ingress.hosts.core" -## 2) if "service.type" is "clusterIP", the "domain" should be -## the value of "service.clusterIP.name" -## 3) if "service.type" is "nodePort", the "domain" should be -## the IP address of k8s node. If Harbor is deployed behind the proxy, -## set it as the URL of proxy +## 1) if "exposureType" is "ingress", the "domain" should be +## the value of "ingress.hostname" +## 2) if "exposureType" is "proxy" and "service.type" is "ClusterIP", +## the "domain" should be the value of "service.clusterIP" +## 3) if "exposureType" is "proxy" and "service.type" is "NodePort", +## the "domain" should be the IP address of k8s node +## 4) if "exposureType" is "proxy" and "service.type" is "LoadBalancer", +## the "domain" should be the LoadBalancer IP ## externalURL: https://core.harbor.domain -## SecurityContext configuration -## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ -## @param containerSecurityContext.runAsUser Set container's Security Context runAsUser -## @param containerSecurityContext.runAsNonRoot Set container's Security Context runAsNonRoot -## -containerSecurityContext: - runAsUser: 1001 - runAsNonRoot: true -## @param podSecurityContext.fsGroup Set pod's Security Context fsGroup -## -podSecurityContext: - fsGroup: 1001 -## @param logLevel The log level used for Harbor services. Allowed values are [ fatal | error | warn | info | debug | trace ] -## -logLevel: debug -## @param forcePassword Option to force users to specify passwords (core.secret, harborAdminPassword, and secretKey). That is required for 'helm upgrade' to work properly. -## If it is not forced, random values will be generated. -## -forcePassword: false -## @param harborAdminPassword The initial password of Harbor admin. Change it from portal after launching Harbor -## -harborAdminPassword: "" -## If expose the service via Ingress, the NGINX server will not be used -## ## The proxy settings for updating clair vulnerabilities from the Internet and replicating ## artifacts from/to the registries that cannot be reached directly +## Note: If Harbor is exposed via Ingress, the NGINX server will not be used ## @param proxy.httpProxy The URL of the HTTP proxy server ## @param proxy.httpsProxy The URL of the HTTPS proxy server ## @param proxy.noProxy The URLs that the proxy settings not apply to @@ -159,102 +92,285 @@ proxy: - jobservice - clair - trivy +## @param logLevel The log level used for Harbor services. Allowed values are [ fatal | error | warn | info | debug | trace ] +## +logLevel: debug +## TLS settings +## Note: TLS cert files need to provided in each components in advance. +## +internalTLS: + ## @param internalTLS.enabled Use TLS in all the supported containers: chartmuseum, clair, core, jobservice, portal, registry and trivy + ## + enabled: false + ## @param internalTLS.caBundleSecret Name of an existing secret with a custom CA that will be injected into the trust store for chartmuseum, clair, core, jobservice, registry, trivy components + ## The secret must contain the key "ca.crt" + ## + caBundleSecret: "" +## IP family parameters +## +ipFamily: + ## @param ipFamily.ipv6.enabled Enable listening on IPv6 ([::]) for NGINX-based components (NGINX,portal) + ## Note: enabling IPv6 will cause NGINX to crash on start on systems with IPv6 disabled (`ipv6.disable` kernel flag) + ## + ipv6: + enabled: true + ## @param ipFamily.ipv4.enabled Enable listening on IPv4 for NGINX-based components (NGINX,portal) + ## + ipv4: + enabled: true ## @section Traffic Exposure Parameters +## @param exposureType The way to expose Harbor. Allowed values are [ ingress | proxy ] +## Use "proxy" to use a deploy NGINX proxy in front of Harbor services +## Use "ingress" to use an Ingress Controller as proxy +## +exposureType: proxy + ## Service parameters ## service: - ## @param service.type The way how to expose the service: `Ingress`, `ClusterIP`, `NodePort` or `LoadBalancer` + ## @param service.type NGINX proxy service type ## type: LoadBalancer - ## TLS parameters - ## - tls: - ## @param service.tls.enabled Enable the tls or not (for external access) - ## Note: When type is "Ingress" and TLS is disabled, the port must be included - ## in the command when pulling/pushing images. - ## ref: https://github.com/goharbor/harbor/issues/5291 - ## - enabled: true - ## @param service.tls.existingSecret Existing secret name containing your own TLS certificates. The secret must contain the keys: `tls.crt` - the certificate (required), `tls.key` - the private key (required), `ca.crt` - the certificate of CA (optional). Self-signed TLS certificates will be used otherwise. - ## - existingSecret: "" - ## @param service.tls.notaryExistingSecret By default, the Notary service will use the same cert and key as described above. Fill the name of secret if you want to use a separated one. Only needed when the `service.type` is `ingress`. - ## - notaryExistingSecret: "" - ## @param service.tls.commonName The common name used to generate the certificate, it's necessary when the `service.type` is `ClusterIP` or `NodePort` and `service.tls.existingSecret` is null - ## Mandatory when "secretName" is not provided or type is not "Ingress". - ## - commonName: 'core.harbor.domain' - ## Service parameters when type is "clusterIP" + ## @param service.ports.http NGINX proxy service HTTP port + ## @param service.ports.https NGINX proxy service HTTPS port + ## @param service.ports.notary Notary service port ## ports: - ## @param service.ports.http The service port Harbor listens on when serving with HTTP - ## http: 80 - ## @param service.ports.https The service port Harbor listens on when serving with HTTPS - ## https: 443 - ## @param service.ports.notary The service port Notary listens on. Only needed when `notary.enabled` is set to `true` - ## notary: 4443 - ## @param service.nodePorts [object] Service parameters when type is "nodePort" + ## Node ports to expose + ## @param service.nodePorts.http Node port for HTTP + ## @param service.nodePorts.https Node port for HTTPS + ## @param service.nodePorts.notary Node port for Notary + ## NOTE: choose port between <30000-32767> ## nodePorts: http: "" https: "" notary: "" - ## @param service.loadBalancerIP Load Balancer IP + ## @param service.sessionAffinity Control where client requests go, to the same pod or round-robin + ## Values: ClientIP or None + ## ref: https://kubernetes.io/docs/user-guide/services/ + ## + sessionAffinity: None + ## @param service.clusterIP NGINX proxy service Cluster IP + ## e.g.: + ## clusterIP: None + ## + clusterIP: "" + ## @param service.loadBalancerIP NGINX proxy service Load Balancer IP + ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#type-loadbalancer ## loadBalancerIP: "" - ## @param service.annotations The annotations attached to the loadBalancer service - ## - annotations: {} - ## @param service.loadBalancerSourceRanges List of IP address ranges to assign to loadBalancerSourceRanges + ## @param service.loadBalancerSourceRanges NGINX proxy service Load Balancer sources + ## ref: https://kubernetes.io/docs/tasks/access-application-cluster/configure-cloud-provider-firewall/#restrict-access-for-loadbalancer-service + ## e.g: + ## loadBalancerSourceRanges: + ## - 10.10.10.0/24 ## loadBalancerSourceRanges: [] - ## @param service.externalTrafficPolicy Enable client source IP preservation + ## @param service.externalTrafficPolicy NGINX proxy service external traffic policy + ## ref https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip ## - externalTrafficPolicy: "" -## Ingress parameters -## -ingress: - ## @param ingress.enabled Deploy ingress rules + externalTrafficPolicy: Cluster + ## @param service.annotations Additional custom annotations for NGINX proxy service ## - enabled: false - ## @param ingress.pathType Ingress path type - ## - pathType: ImplementationSpecific - ## @param ingress.apiVersion Override ingress api version - ## - apiVersion: "" - ## DEPRECATED: Use ingress.annotations instead of ingress.certManager - ## certManager: false + annotations: {} + ## @param service.extraPorts Extra port to expose on NGINX proxy service ## + extraPorts: [] - ## @param ingress.hosts [object] The list of hostnames to be covered with this ingress record + +ingress: + ## Configure the ingress resource that allows you to access Harbor Core + ## ref: https://kubernetes.io/docs/user-guide/ingress/ ## - hosts: - core: core.harbor.domain - notary: notary.harbor.domain - ## @param ingress.controller The ingress controller type. Currently supports `default`, `gce` and `ncp` - ## leave as `default` for most ingress controllers. - ## set to `gce` if using the GCE ingress controller - ## set to `ncp` if using the NCP (NSX-T Container Plugin) ingress controller + core: + ## @param ingress.core.ingressClassName IngressClass that will be be used to implement the Ingress (Kubernetes 1.18+) + ## This is supported in Kubernetes 1.18+ and required if you have more than one IngressClass marked as the default for your cluster . + ## ref: https://kubernetes.io/blog/2020/04/02/improvements-to-the-ingress-api-in-kubernetes-1.18/ + ## + ingressClassName: "" + ## @param ingress.core.pathType Ingress path type + ## + pathType: ImplementationSpecific + ## @param ingress.core.apiVersion Force Ingress API version (automatically detected if not set) + ## + apiVersion: "" + ## @param ingress.core.controller The ingress controller type. Currently supports `default`, `gce` and `ncp` + ## leave as `default` for most ingress controllers. + ## set to `gce` if using the GCE ingress controller + ## set to `ncp` if using the NCP (NSX-T Container Plugin) ingress controller + ## + controller: default + ## @param ingress.core.hostname Default host for the ingress record + ## + hostname: core.harbor.domain + ## @param ingress.core.annotations [object] Additional annotations for the Ingress resource. To enable certificate autogeneration, place here your cert-manager annotations. + ## Use this parameter to set the required annotations for cert-manager, see + ## ref: https://cert-manager.io/docs/usage/ingress/#supported-annotations + ## e.g: + ## annotations: + ## kubernetes.io/ingress.class: nginx + ## cert-manager.io/cluster-issuer: cluster-issuer-name + ## + annotations: + ingress.kubernetes.io/ssl-redirect: 'true' + ingress.kubernetes.io/proxy-body-size: '0' + nginx.ingress.kubernetes.io/ssl-redirect: 'true' + nginx.ingress.kubernetes.io/proxy-body-size: '0' + ## @param ingress.core.tls Enable TLS configuration for the host defined at `ingress.core.hostname` parameter + ## TLS certificates will be retrieved from a TLS secret with name: `{{- printf "%s-tls" .Values.ingress.core.hostname }}` + ## You can: + ## - Use the `ingress.core.secrets` parameter to create this TLS secret + ## - Relay on cert-manager to create it by setting the corresponding annotations + ## - Relay on Helm to create self-signed certificates by setting `ingress.core.selfSigned=true` + ## + tls: false + ## @param ingress.core.selfSigned Create a TLS secret for this ingress record using self-signed certificates generated by Helm + ## + selfSigned: false + ## @param ingress.core.extraHosts An array with additional hostname(s) to be covered with the ingress record + ## e.g: + ## extraHosts: + ## - name: core.harbor.domain + ## path: / + ## + extraHosts: [] + ## @param ingress.core.extraPaths An array with additional arbitrary paths that may need to be added to the ingress under the main host + ## e.g: + ## extraPaths: + ## - path: /* + ## backend: + ## serviceName: ssl-redirect + ## servicePort: use-annotation + ## + extraPaths: [] + ## @param ingress.core.extraTls TLS configuration for additional hostname(s) to be covered with this ingress record + ## ref: https://kubernetes.io/docs/concepts/services-networking/ingress/#tls + ## e.g: + ## extraTls: + ## - hosts: + ## - core.harbor.domain + ## secretName: core.harbor.domain-tls + ## + extraTls: [] + ## @param ingress.core.secrets Custom TLS certificates as secrets + ## NOTE: 'key' and 'certificate' are expected in PEM format + ## NOTE: 'name' should line up with a 'secretName' set further up + ## If it is not set and you're using cert-manager, this is unneeded, as it will create a secret for you with valid certificates + ## If it is not set and you're NOT using cert-manager either, self-signed certificates will be created valid for 365 days + ## It is also possible to create and manage the certificates outside of this helm chart + ## Please see README.md for more information + ## e.g: + ## secrets: + ## - name: core.harbor.domain-tls + ## key: |- + ## -----BEGIN RSA PRIVATE KEY----- + ## ... + ## -----END RSA PRIVATE KEY----- + ## certificate: |- + ## -----BEGIN CERTIFICATE----- + ## ... + ## -----END CERTIFICATE----- + ## + secrets: [] + ## Configure the ingress resource that allows you to access Notary + ## ref: https://kubernetes.io/docs/user-guide/ingress/ ## - controller: default - ## @param ingress.annotations [object] Additional annotations for the Ingress resource. To enable certificate autogeneration, place here your cert-manager annotations. - ## For a full list of possible ingress annotations, please see - ## ref: https://github.com/kubernetes/ingress-nginx/blob/master/docs/user-guide/nginx-configuration/annotations.md - ## Use this parameter to set the required annotations for cert-manager, see - ## ref: https://cert-manager.io/docs/usage/ingress/#supported-annotations - ## - annotations: - ingress.kubernetes.io/ssl-redirect: 'true' - ingress.kubernetes.io/proxy-body-size: '0' - nginx.ingress.kubernetes.io/ssl-redirect: 'true' - nginx.ingress.kubernetes.io/proxy-body-size: '0' + notary: + ## @param ingress.notary.ingressClassName IngressClass that will be be used to implement the Ingress (Kubernetes 1.18+) + ## This is supported in Kubernetes 1.18+ and required if you have more than one IngressClass marked as the default for your cluster . + ## ref: https://kubernetes.io/blog/2020/04/02/improvements-to-the-ingress-api-in-kubernetes-1.18/ + ## + ingressClassName: "" + ## @param ingress.notary.pathType Ingress path type + ## + pathType: ImplementationSpecific + ## @param ingress.notary.apiVersion Force Ingress API version (automatically detected if not set) + ## + apiVersion: "" + ## @param ingress.notary.controller The ingress controller type. Currently supports `default`, `gce` and `ncp` + ## leave as `default` for most ingress controllers. + ## set to `gce` if using the GCE ingress controller + ## set to `ncp` if using the NCP (NSX-T Container Plugin) ingress controller + ## + controller: default + ## @param ingress.notary.hostname Default host for the ingress record + ## + hostname: notary.harbor.domain + ## @param ingress.notary.annotations [object] Additional annotations for the Ingress resource. To enable certificate autogeneration, place here your cert-manager annotations. + ## Use this parameter to set the required annotations for cert-manager, see + ## ref: https://cert-manager.io/docs/usage/ingress/#supported-annotations + ## e.g: + ## annotations: + ## kubernetes.io/ingress.class: nginx + ## cert-manager.io/cluster-issuer: cluster-issuer-name + ## + annotations: + ingress.kubernetes.io/ssl-redirect: 'true' + ingress.kubernetes.io/proxy-body-size: '0' + nginx.ingress.kubernetes.io/ssl-redirect: 'true' + nginx.ingress.kubernetes.io/proxy-body-size: '0' + ## @param ingress.notary.tls Enable TLS configuration for the host defined at `ingress.hostname` parameter + ## TLS certificates will be retrieved from a TLS secret with name: `{{- printf "%s-tls" .Values.ingress.notary.hostname }}` + ## You can: + ## - Use the `ingress.notary.secrets` parameter to create this TLS secret + ## - Relay on cert-manager to create it by setting the corresponding annotations + ## - Relay on Helm to create self-signed certificates by setting `ingress.notary.selfSigned=true` + ## + tls: false + ## @param ingress.notary.selfSigned Create a TLS secret for this ingress record using self-signed certificates generated by Helm + ## + selfSigned: false + ## @param ingress.notary.extraHosts An array with additional hostname(s) to be covered with the ingress record + ## e.g: + ## extraHosts: + ## - name: notary.harbor.domain + ## path: / + ## + extraHosts: [] + ## @param ingress.notary.extraPaths An array with additional arbitrary paths that may need to be added to the ingress under the main host + ## e.g: + ## extraPaths: + ## - path: /* + ## backend: + ## serviceName: ssl-redirect + ## servicePort: use-annotation + ## + extraPaths: [] + ## @param ingress.notary.extraTls TLS configuration for additional hostname(s) to be covered with this ingress record + ## ref: https://kubernetes.io/docs/concepts/services-networking/ingress/#tls + ## e.g: + ## extraTls: + ## - hosts: + ## - notary.harbor.domain + ## secretName: notary.harbor.domain-tls + ## + extraTls: [] + ## @param ingress.notary.secrets Custom TLS certificates as secrets + ## NOTE: 'key' and 'certificate' are expected in PEM format + ## NOTE: 'name' should line up with a 'secretName' set further up + ## If it is not set and you're using cert-manager, this is unneeded, as it will create a secret for you with valid certificates + ## If it is not set and you're NOT using cert-manager either, self-signed certificates will be created valid for 365 days + ## It is also possible to create and manage the certificates outside of this helm chart + ## Please see README.md for more information + ## e.g: + ## secrets: + ## - name: notary.harbor.domain-tls + ## key: |- + ## -----BEGIN RSA PRIVATE KEY----- + ## ... + ## -----END RSA PRIVATE KEY----- + ## certificate: |- + ## -----BEGIN CERTIFICATE----- + ## ... + ## -----END CERTIFICATE----- + ## + secrets: [] ## @section Persistence Parameters @@ -275,58 +391,82 @@ persistence: ## resourcePolicy: 'keep' persistentVolumeClaim: - ## @param persistence.persistentVolumeClaim.registry.existingClaim Use the existing PVC which must be created manually before bound, and specify the `subPath` if the PVC is shared with other components - ## @param persistence.persistentVolumeClaim.registry.storageClass Specify the `storageClass` used to provision the volume. Or the default StorageClass will be used (the default). Set it to `-` to disable dynamic provisioning + ## @param persistence.persistentVolumeClaim.registry.existingClaim Name of an existing PVC to use + ## @param persistence.persistentVolumeClaim.registry.storageClass PVC Storage Class for Harbor Registry data volume + ## Note: The default StorageClass will be used if not defined. Set it to `-` to disable dynamic provisioning ## @param persistence.persistentVolumeClaim.registry.subPath The sub path used in the volume - ## @param persistence.persistentVolumeClaim.registry.accessMode The access mode of the volume + ## @param persistence.persistentVolumeClaim.registry.accessModes The access mode of the volume ## @param persistence.persistentVolumeClaim.registry.size The size of the volume + ## @param persistence.persistentVolumeClaim.registry.annotations Annotations for the PVC + ## @param persistence.persistentVolumeClaim.registry.selector Selector to match an existing Persistent Volume ## registry: existingClaim: "" storageClass: "" subPath: "" - accessMode: ReadWriteOnce + accessModes: + - ReadWriteOnce size: 5Gi - ## @param persistence.persistentVolumeClaim.jobservice.existingClaim Use the existing PVC which must be created manually before bound, and specify the `subPath` if the PVC is shared with other components - ## @param persistence.persistentVolumeClaim.jobservice.storageClass Specify the `storageClass` used to provision the volume. Or the default StorageClass will be used(the default). Set it to `-` to disable dynamic provisioning + annotations: {} + selector: {} + ## @param persistence.persistentVolumeClaim.jobservice.existingClaim Name of an existing PVC to use + ## @param persistence.persistentVolumeClaim.jobservice.storageClass PVC Storage Class for Harbor Jobservice data volume + ## Note: The default StorageClass will be used if not defined. Set it to `-` to disable dynamic provisioning ## @param persistence.persistentVolumeClaim.jobservice.subPath The sub path used in the volume - ## @param persistence.persistentVolumeClaim.jobservice.accessMode The access mode of the volume + ## @param persistence.persistentVolumeClaim.jobservice.accessModes The access mode of the volume ## @param persistence.persistentVolumeClaim.jobservice.size The size of the volume + ## @param persistence.persistentVolumeClaim.jobservice.annotations Annotations for the PVC + ## @param persistence.persistentVolumeClaim.jobservice.selector Selector to match an existing Persistent Volume ## jobservice: existingClaim: "" storageClass: "" subPath: "" - accessMode: ReadWriteOnce + accessModes: + - ReadWriteOnce size: 1Gi - ## @param persistence.persistentVolumeClaim.chartmuseum.existingClaim Use the existing PVC which must be created manually before bound, and specify the `subPath` if the PVC is shared with other components - ## @param persistence.persistentVolumeClaim.chartmuseum.storageClass Specify the `storageClass` used to provision the volume. Or the default StorageClass will be used(the default). Set it to `-` to disable dynamic provisioning + annotations: {} + selector: {} + ## @param persistence.persistentVolumeClaim.chartmuseum.existingClaim Name of an existing PVC to use + ## @param persistence.persistentVolumeClaim.chartmuseum.storageClass PVC Storage Class for Chartmuseum data volume + ## Note: The default StorageClass will be used if not defined. Set it to `-` to disable dynamic provisioning ## @param persistence.persistentVolumeClaim.chartmuseum.subPath The sub path used in the volume - ## @param persistence.persistentVolumeClaim.chartmuseum.accessMode The access mode of the volume + ## @param persistence.persistentVolumeClaim.chartmuseum.accessModes The access mode of the volume ## @param persistence.persistentVolumeClaim.chartmuseum.size The size of the volume + ## @param persistence.persistentVolumeClaim.chartmuseum.annotations Annotations for the PVC + ## @param persistence.persistentVolumeClaim.chartmuseum.selector Selector to match an existing Persistent Volume ## chartmuseum: existingClaim: "" storageClass: "" subPath: "" - accessMode: ReadWriteOnce + accessModes: + - ReadWriteOnce size: 5Gi - ## @param persistence.persistentVolumeClaim.trivy.storageClass Specify the `storageClass` used to provision the volume. Or the default StorageClass will be used(the default). Set it to `-` to disable dynamic provisioning - ## @param persistence.persistentVolumeClaim.trivy.accessMode The access mode of the volume + annotations: {} + selector: {} + ## @param persistence.persistentVolumeClaim.trivy.storageClass PVC Storage Class for Trivy data volume + ## Note: The default StorageClass will be used if not defined. Set it to `-` to disable dynamic provisioning + ## @param persistence.persistentVolumeClaim.trivy.accessModes The access mode of the volume ## @param persistence.persistentVolumeClaim.trivy.size The size of the volume + ## @param persistence.persistentVolumeClaim.trivy.annotations Annotations for the PVC + ## @param persistence.persistentVolumeClaim.trivy.selector Selector to match an existing Persistent Volume ## trivy: storageClass: "" - accessMode: ReadWriteOnce + accessModes: + - ReadWriteOnce size: 5Gi + annotations: {} + selector: {} ## Define which storage backend is used for registry and chartmuseum to store ## images and charts. ## ref: https://github.com/docker/distribution/blob/master/docs/configuration.md#storage ## imageChartStorage: - ## @param persistence.imageChartStorage.caBundleSecretName Specify the `caBundleSecretName` if the storage service uses a self-signed certificate. The secret must contain keys named `ca.crt` which will be injected into the trust store of registry's and chartmuseum's containers. + ## @param persistence.imageChartStorage.caBundleSecret Specify the `caBundleSecret` if the storage service uses a self-signed certificate. The secret must contain keys named `ca.crt` which will be injected into the trust store of registry's and chartmuseum's containers. ## - caBundleSecretName: "" + caBundleSecret: "" ## @param persistence.imageChartStorage.disableredirect The configuration for managing redirects from content backends. For backends which do not supported it (such as using MinIO® for `s3` storage type), please set it to `true` to disable redirects. Refer to the [guide](https://github.com/docker/distribution/blob/master/docs/configuration.md#redirect) for more information about the detail ## disableredirect: false @@ -468,111 +608,234 @@ persistence: rootdirectory: "" secretkey: "" -## @section Nginx Parameters +## @section Volume Permissions parameters -## Bitnami Nginx image -## ref: https://hub.docker.com/r/bitnami/nginx/tags/ +## Init containers parameters: +## volumePermissions: Change the owner and group of the persistent volume(s) mountpoint(s) to 'runAsUser:fsGroup' on each node ## -nginxImage: - ## @param nginxImage.registry Registry for Nginx image - ## @param nginxImage.repository Repository for Nginx image - ## @param nginxImage.tag Tag for Nginx image - ## @param nginxImage.pullPolicy Harbor Portal image pull policy - ## @param nginxImage.pullSecrets Specify docker-registry secret names as an array - ## @param nginxImage.debug Specify if debug logs should be enabled +volumePermissions: + ## @param volumePermissions.enabled Enable init container that changes the owner and group of the persistent volume ## - registry: docker.io - repository: bitnami/nginx - tag: 1.21.6-debian-10-r35 - ## Specify a imagePullPolicy - ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' - ## ref: https://kubernetes.io/docs/user-guide/images/#pre-pulling-images + enabled: false + ## @param volumePermissions.image.registry Init container volume-permissions image registry + ## @param volumePermissions.image.repository Init container volume-permissions image repository + ## @param volumePermissions.image.tag Init container volume-permissions image tag (immutable tags are recommended) + ## @param volumePermissions.image.pullPolicy Init container volume-permissions image pull policy + ## @param volumePermissions.image.pullSecrets Init container volume-permissions image pull secrets ## - pullPolicy: IfNotPresent - ## Optionally specify an array of imagePullSecrets. - ## Secrets must be manually created in the namespace. - ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ - ## e.g: - ## pullSecrets: - ## - myRegistryKeySecretName + image: + registry: docker.io + repository: bitnami/bitnami-shell + tag: 10-debian-10-r355 + pullPolicy: IfNotPresent + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## Example: + ## pullSecrets: + ## - myRegistryKeySecretName + ## + pullSecrets: [] + ## Init container resource requests and limits + ## ref: https://kubernetes.io/docs/user-guide/compute-resources/ + ## @param volumePermissions.resources.limits Init container volume-permissions resource limits + ## @param volumePermissions.resources.requests Init container volume-permissions resource requests ## - pullSecrets: [] - ## Set to true if you would like to see extra information on logs - ## It turns BASH and/or NAMI debugging in the image + resources: + limits: {} + requests: {} + ## Init container' Security Context + ## Note: the chown of the data folder is done to containerSecurityContext.runAsUser + ## and not the below volumePermissions.containerSecurityContext.runAsUser + ## @param volumePermissions.containerSecurityContext.enabled Enable init container Security Context + ## @param volumePermissions.containerSecurityContext.runAsUser User ID for the init container ## - debug: false -## Nginx Parameters -## + containerSecurityContext: + enabled: true + runAsUser: 0 + +## @section NGINX Parameters + nginx: + ## Bitnami NGINX image + ## ref: https://hub.docker.com/r/bitnami/nginx/tags/ + ## @param nginx.image.registry NGINX image registry + ## @param nginx.image.repository NGINX image repository + ## @param nginx.image.tag NGINX image tag (immutable tags are recommended) + ## @param nginx.image.pullPolicy NGINX image pull policy + ## @param nginx.image.pullSecrets NGINX image pull secrets + ## @param nginx.image.debug Enable NGINX image debug mode + ## + image: + registry: docker.io + repository: bitnami/nginx + tag: 1.21.6-debian-10-r35 + ## Specify a imagePullPolicy + ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' + ## ref: https://kubernetes.io/docs/user-guide/images/#pre-pulling-images + ## + pullPolicy: IfNotPresent + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## e.g: + ## pullSecrets: + ## - myRegistryKeySecretName + ## + pullSecrets: [] + ## Enable debug mode + ## + debug: false + ## TLS parameters + ## + tls: + ## @param nginx.tls.enabled Enable TLS termination + ## + enabled: true + ## @param nginx.tls.existingSecret Existing secret name containing your own TLS certificates. + ## The secret must contain the keys: + ## `tls.crt` - the certificate (required), + ## `tls.key` - the private key (required), + ## `ca.crt` - CA certificate (optional) + ## Self-signed TLS certificates will be used otherwise. + ## + existingSecret: "" + ## @param nginx.tls.commonName The common name used to generate the self-signed TLS certificates + ## + commonName: core.harbor.domain + ## @param nginx.behindReverseProxy If NGINX is behind another reverse proxy, set to true + ## if the reverse proxy already provides the 'X-Forwarded-Proto' header field. + ## This is, for example, the case for the OpenShift HAProxy router. + ## + behindReverseProxy: false ## @param nginx.command Override default container command (useful when using custom images) ## command: [] ## @param nginx.args Override default container args (useful when using custom images) ## args: [] - ## @param nginx.replicas The replica count + ## @param nginx.extraEnvVars Array with extra environment variables to add NGINX pods ## - replicas: 1 - ## @param nginx.updateStrategy.type Update strategy - only really applicable for deployments with RWO PVs attached + extraEnvVars: [] + ## @param nginx.extraEnvVarsCM ConfigMap containing extra environment variables for NGINX pods + ## + extraEnvVarsCM: "" + ## @param nginx.extraEnvVarsSecret Secret containing extra environment variables (in case of sensitive data) for NGINX pods + ## + extraEnvVarsSecret: "" + ## @param nginx.containerPorts.http NGINX HTTP container port + ## @param nginx.containerPorts.https NGINX HTTPS container port + ## @param nginx.containerPorts.notary NGINX container port where Notary svc is exposed + ## + containerPorts: + http: 8080 + https: 8443 + notary: 4443 + ## @param nginx.replicaCount Number of NGINX replicas + ## + replicaCount: 1 + ## Configure extra options for NGINX containers' liveness, readiness and startup probes + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#configure-probes + ## @param nginx.livenessProbe.enabled Enable livenessProbe on NGINX containers + ## @param nginx.livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe + ## @param nginx.livenessProbe.periodSeconds Period seconds for livenessProbe + ## @param nginx.livenessProbe.timeoutSeconds Timeout seconds for livenessProbe + ## @param nginx.livenessProbe.failureThreshold Failure threshold for livenessProbe + ## @param nginx.livenessProbe.successThreshold Success threshold for livenessProbe + ## + livenessProbe: + enabled: true + initialDelaySeconds: 20 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 6 + successThreshold: 1 + ## @param nginx.readinessProbe.enabled Enable readinessProbe on NGINX containers + ## @param nginx.readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe + ## @param nginx.readinessProbe.periodSeconds Period seconds for readinessProbe + ## @param nginx.readinessProbe.timeoutSeconds Timeout seconds for readinessProbe + ## @param nginx.readinessProbe.failureThreshold Failure threshold for readinessProbe + ## @param nginx.readinessProbe.successThreshold Success threshold for readinessProbe + ## + readinessProbe: + enabled: true + initialDelaySeconds: 20 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 6 + successThreshold: 1 + ## @param nginx.startupProbe.enabled Enable startupProbe on NGINX containers + ## @param nginx.startupProbe.initialDelaySeconds Initial delay seconds for startupProbe + ## @param nginx.startupProbe.periodSeconds Period seconds for startupProbe + ## @param nginx.startupProbe.timeoutSeconds Timeout seconds for startupProbe + ## @param nginx.startupProbe.failureThreshold Failure threshold for startupProbe + ## @param nginx.startupProbe.successThreshold Success threshold for startupProbe + ## + startupProbe: + enabled: false + initialDelaySeconds: 10 + periodSeconds: 10 + timeoutSeconds: 1 + failureThreshold: 15 + successThreshold: 1 + ## @param nginx.customLivenessProbe Custom livenessProbe that overrides the default one + ## + customLivenessProbe: {} + ## @param nginx.customReadinessProbe Custom readinessProbe that overrides the default one + ## + customReadinessProbe: {} + ## @param nginx.customStartupProbe Custom startupProbe that overrides the default one + ## + customStartupProbe: {} + ## NGINX resource requests and limits + ## ref: https://kubernetes.io/docs/user-guide/compute-resources/ + ## @param nginx.resources.limits The resources limits for the NGINX containers + ## @param nginx.resources.requests The requested resources for the NGINX containers + ## + resources: + limits: {} + requests: {} + ## Configure NGINX pods Security Context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod + ## @param nginx.podSecurityContext.enabled Enabled NGINX pods' Security Context + ## @param nginx.podSecurityContext.fsGroup Set NGINX pod's Security Context fsGroup + ## + podSecurityContext: + enabled: true + fsGroup: 1001 + ## Configure NGINX containers (only main one) Security Context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container + ## @param nginx.containerSecurityContext.enabled Enabled NGINX containers' Security Context + ## @param nginx.containerSecurityContext.runAsUser Set NGINX containers' Security Context runAsUser + ## @param nginx.containerSecurityContext.runAsNonRoot Set NGINX containers' Security Context runAsNonRoot + ## + containerSecurityContext: + enabled: true + runAsUser: 1001 + runAsNonRoot: true + ## @param nginx.updateStrategy.type NGINX deployment strategy type - only really applicable for deployments with RWO PVs attached + ## @param nginx.updateStrategy.rollingUpdate NGINX deployment rolling update configuration parameters ## If replicas = 1, an update can get "stuck", as the previous pod remains attached to the ## PV, and the "incoming" pod can never start. Changing the strategy to "Recreate" will ## terminate the single previous pod, so that the new, incoming pod can attach to the PV ## updateStrategy: type: RollingUpdate - ## @param nginx.customLivenessProbe Override default liveness probe + rollingUpdate: {} + ## @param nginx.lifecycleHooks LifecycleHook for the NGINX container(s) to automate configuration before or after startup ## - customLivenessProbe: {} - ## @param nginx.customReadinessProbe Override default readiness probe - ## - customReadinessProbe: {} - ## @param nginx.extraEnvVars Array containing extra env vars - ## For example: - ## - name: BEARER_AUTH - ## value: true - ## - extraEnvVars: [] - ## @param nginx.extraEnvVarsCM ConfigMap containing extra env vars - ## - extraEnvVarsCM: "" - ## @param nginx.extraEnvVarsSecret Secret containing extra env vars (in case of sensitive data) - ## - extraEnvVarsSecret: "" - ## @param nginx.extraVolumes Array of extra volumes to be added to the deployment (evaluated as template). Requires setting `extraVolumeMounts` - ## - extraVolumes: [] - ## @param nginx.extraVolumeMounts Array of extra volume mounts to be added to the container (evaluated as template). Normally used with `extraVolumes`. - ## - extraVolumeMounts: [] - ## @param nginx.hostAliases Specify hostAliases for the Pod to use + lifecycleHooks: {} + ## @param nginx.hostAliases NGINX pods host aliases ## hostAliases: [] - ## @param nginx.initContainers Add additional init containers to the pod (evaluated as a template) + ## @param nginx.podLabels Add additional labels to the NGINX pods (evaluated as a template) + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ ## - initContainers: [] - ## @param nginx.sidecars Attach additional containers to the pod (evaluated as a template) + podLabels: {} + ## @param nginx.podAnnotations Annotations to add to the NGINX pods (evaluated as a template) + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ ## - sidecars: [] - ## NGINX containers' resource requests and limits - ## ref: https://kubernetes.io/docs/user-guide/compute-resources/ - ## We usually recommend not to specify default resources and to leave this as a conscious - ## choice for the user. This also increases chances charts run on environments with little - ## resources, such as Minikube. If you do want to specify resources, uncomment the following - ## lines, adjust them as necessary, and remove the curly braces after 'resources:'. - ## @param nginx.resources.limits The resources limits for the container - ## @param nginx.resources.requests The requested resources for the container - ## - resources: - ## Example: - ## limits: - ## cpu: 500m - ## memory: 1Gi - limits: {} - ## Examples: - ## requests: - ## cpu: 250m - ## memory: 256Mi - requests: {} + podAnnotations: {} ## @param nginx.podAffinityPreset NGINX Pod affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity ## @@ -606,10 +869,6 @@ nginx: ## Note: podAffinityPreset, podAntiAffinityPreset, and nodeAffinityPreset will be ignored when it's set ## affinity: {} - ## @param nginx.priorityClassName NGINX pods Priority Class Name - ## ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass - ## - priorityClassName: "" ## @param nginx.nodeSelector NGINX Node labels for pod assignment ## Ref: https://kubernetes.io/docs/user-guide/node-selection/ ## @@ -618,228 +877,114 @@ nginx: ## Ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ ## tolerations: [] - ## @param nginx.podLabels Add additional labels to the pod (evaluated as a template) - ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + ## @param nginx.topologySpreadConstraints Topology Spread Constraints for pod assignment spread across your cluster among failure-domains. Evaluated as a template + ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/#spread-constraints-for-pods ## - podLabels: {} - ## @param nginx.podAnnotations Annotations to add to the nginx pod - ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ + topologySpreadConstraints: {} + ## @param nginx.priorityClassName Priority Class Name + ## ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass ## - podAnnotations: {} - ## @param nginx.behindReverseProxy If nginx is behind another reverse proxy, set to true - ## if the reverse proxy already provides the 'X-Forwarded-Proto' header field. - ## This is, for example, the case for the OpenShift HAProxy router. + priorityClassName: "" + ## @param nginx.schedulerName Use an alternate scheduler, e.g. "stork". + ## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/ ## - behindReverseProxy: false - ## @param nginx.lifecycleHooks LifecycleHook to set additional configuration at startup, e.g. LDAP settings via REST API. Evaluated as a template + schedulerName: "" + ## @param nginx.sidecars Add additional sidecar containers to the NGINX pods + ## Example: + ## sidecars: + ## - name: your-image-name + ## image: your-image + ## imagePullPolicy: Always + ## ports: + ## - name: portname + ## containerPort: 1234 ## - lifecycleHooks: {} - ## NGINX containers' liveness probe - ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes - ## @param nginx.livenessProbe.enabled Enable livenessProbe - ## @param nginx.livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe - ## @param nginx.livenessProbe.periodSeconds Period seconds for livenessProbe - ## @param nginx.livenessProbe.timeoutSeconds Timeout seconds for livenessProbe - ## @param nginx.livenessProbe.failureThreshold Failure threshold for livenessProbe - ## @param nginx.livenessProbe.successThreshold Success threshold for livenessProbe + sidecars: [] + ## @param nginx.initContainers Add additional init containers to the NGINX pods + ## Example: + ## initContainers: + ## - name: your-image-name + ## image: your-image + ## imagePullPolicy: Always + ## ports: + ## - name: portname + ## containerPort: 1234 ## - livenessProbe: - enabled: true - initialDelaySeconds: 20 - periodSeconds: 10 - timeoutSeconds: 5 - failureThreshold: 6 - successThreshold: 1 - ## NGINX containers' readiness probe - ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes - ## @param nginx.readinessProbe.enabled Enable readinessProbe - ## @param nginx.readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe - ## @param nginx.readinessProbe.periodSeconds Period seconds for readinessProbe - ## @param nginx.readinessProbe.timeoutSeconds Timeout seconds for readinessProbe - ## @param nginx.readinessProbe.failureThreshold Failure threshold for readinessProbe - ## @param nginx.readinessProbe.successThreshold Success threshold for readinessProbe + initContainers: [] + ## @param nginx.extraVolumeMounts Optionally specify extra list of additional volumeMounts for the NGINX pods ## - readinessProbe: - enabled: true - initialDelaySeconds: 20 - periodSeconds: 10 - timeoutSeconds: 5 - failureThreshold: 6 - successThreshold: 1 + extraVolumeMounts: [] + ## @param nginx.extraVolumes Optionally specify extra list of additional volumes for the NGINX pods + ## + extraVolumes: [] ## @section Harbor Portal Parameters -## Bitnami Harbor Portal image -## ref: https://hub.docker.com/r/bitnami/harbor-portal/tags/ -## -portalImage: - ## @param portalImage.registry Registry for portal image - ## @param portalImage.repository Repository for portal image - ## @param portalImage.tag Tag for portal image - ## @param portalImage.pullPolicy Harbor Portal image pull policy - ## @param portalImage.pullSecrets Specify docker-registry secret names as an array - ## @param portalImage.debug Specify if debug logs should be enabled - ## - registry: docker.io - repository: bitnami/harbor-portal - tag: 2.4.1-debian-10-r57 - ## Specify a imagePullPolicy - ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' - ## ref: https://kubernetes.io/docs/user-guide/images/#pre-pulling-images - ## - pullPolicy: IfNotPresent - ## Optionally specify an array of imagePullSecrets. - ## Secrets must be manually created in the namespace. - ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ - ## e.g: - ## pullSecrets: - ## - myRegistryKeySecretName - ## - pullSecrets: [] - ## Set to true if you would like to see extra information on logs - ## It turns BASH and/or NAMI debugging in the image - ## - debug: false -## Portal Parameters -## portal: + ## Bitnami Harbor Portal image + ## ref: https://hub.docker.com/r/bitnami/harbor-portal/tags/ + ## @param portal.image.registry Harbor Portal image registry + ## @param portal.image.repository Harbor Portal image repository + ## @param portal.image.tag Harbor Portal image tag (immutable tags are recommended) + ## @param portal.image.pullPolicy Harbor Portal image pull policy + ## @param portal.image.pullSecrets Harbor Portal image pull secrets + ## @param portal.image.debug Enable Harbor Portal image debug mode + ## + image: + registry: docker.io + repository: bitnami/harbor-portal + tag: 2.4.1-debian-10-r58 + ## Specify a imagePullPolicy + ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' + ## ref: https://kubernetes.io/docs/user-guide/images/#pre-pulling-images + ## + pullPolicy: IfNotPresent + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## e.g: + ## pullSecrets: + ## - myRegistryKeySecretName + ## + pullSecrets: [] + ## Enable debug mode + ## + debug: false + ## Use TLS in the container + ## + tls: + ## @param portal.tls.existingSecret Name of an existing secret with the certificates for internal TLS access + ## Requires `internalTLS.enabled` to be set to `true`` + ## Self-signed TLS certificates will be used otherwise + ## + existingSecret: "" ## @param portal.command Override default container command (useful when using custom images) ## command: [] ## @param portal.args Override default container args (useful when using custom images) ## args: [] - ## @param portal.replicas The replica count - ## - replicas: 1 - ## @param portal.updateStrategy.type Update strategy - only really applicable for deployments with RWO PVs attached - ## If replicas = 1, an update can get "stuck", as the previous pod remains attached to the - ## PV, and the "incoming" pod can never start. Changing the strategy to "Recreate" will - ## terminate the single previous pod, so that the new, incoming pod can attach to the PV - ## - updateStrategy: - type: RollingUpdate - ## Use TLS in the container - ## - tls: - ## @param portal.tls.existingSecret Name of a secret with the certificates for internal TLS access. Requires internalTLS.enabled to be set to true. If this values is not set it will be automatically generated - ## Otherwise, it will generate a cert automatically - ## - existingSecret: "" - ## @param portal.lifecycleHooks LifecycleHook to set additional configuration at startup, e.g. LDAP settings via REST API. Evaluated as a template - ## - lifecycleHooks: {} - ## @param portal.customLivenessProbe Override default liveness probe - ## - customLivenessProbe: {} - ## @param portal.customReadinessProbe Override default readiness probe - ## - customReadinessProbe: {} - ## @param portal.extraEnvVars Array containing extra env vars - ## For example: - ## - name: BEARER_AUTH - ## value: true + ## @param portal.extraEnvVars Array with extra environment variables to add Harbor Portal pods ## extraEnvVars: [] - ## @param portal.extraEnvVarsCM ConfigMap containing extra env vars + ## @param portal.extraEnvVarsCM ConfigMap containing extra environment variables for Harbor Portal pods ## extraEnvVarsCM: "" - ## @param portal.extraEnvVarsSecret Secret containing extra env vars (in case of sensitive data) + ## @param portal.extraEnvVarsSecret Secret containing extra environment variables (in case of sensitive data) for Harbor Portal pods ## extraEnvVarsSecret: "" - ## @param portal.extraVolumes Array of extra volumes to be added to the deployment (evaluated as template). Requires setting `extraVolumeMounts` + ## @param portal.containerPorts.http Harbor Portal HTTP container port + ## @param portal.containerPorts.https Harbor Portal HTTPS container port ## - extraVolumes: [] - ## @param portal.extraVolumeMounts Array of extra volume mounts to be added to the container (evaluated as template). Normally used with `extraVolumes`. + containerPorts: + http: 8080 + https: 8443 + ## @param portal.replicaCount Number of Harbor Portal replicas ## - extraVolumeMounts: [] - ## @param portal.hostAliases Specify hostAliases for the Pod to use - ## - hostAliases: [] - ## @param portal.initContainers Add additional init containers to the pod (evaluated as a template) - ## - initContainers: [] - ## @param portal.sidecars Attach additional containers to the pod (evaluated as a template) - ## - sidecars: [] - ## Harbor Portal containers' resource requests and limits - ## ref: https://kubernetes.io/docs/user-guide/compute-resources/ - ## We usually recommend not to specify default resources and to leave this as a conscious - ## choice for the user. This also increases chances charts run on environments with little - ## resources, such as Minikube. If you do want to specify resources, uncomment the following - ## lines, adjust them as necessary, and remove the curly braces after 'resources:'. - ## @param portal.resources.limits The resources limits for the container - ## @param portal.resources.requests The requested resources for the container - ## - resources: - ## Example: - ## limits: - ## cpu: 500m - ## memory: 1Gi - limits: {} - ## Examples: - ## requests: - ## cpu: 250m - ## memory: 256Mi - requests: {} - ## @param portal.podAffinityPreset Harbor Portal Pod affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` - ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity - ## - podAffinityPreset: "" - ## @param portal.podAntiAffinityPreset Harbor Portal Pod anti-affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` - ## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity - ## - podAntiAffinityPreset: soft - ## Node affinity preset - ## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity - ## - nodeAffinityPreset: - ## @param portal.nodeAffinityPreset.type Harbor Portal Node affinity preset type. Ignored if `affinity` is set. Allowed values: `soft` or `hard` - ## - type: "" - ## @param portal.nodeAffinityPreset.key Harbor Portal Node label key to match Ignored if `affinity` is set. - ## E.g. - ## key: "kubernetes.io/e2e-az-name" - ## - key: "" - ## @param portal.nodeAffinityPreset.values Harbor Portal Node label values to match. Ignored if `affinity` is set. - ## E.g. - ## values: - ## - e2e-az1 - ## - e2e-az2 - ## - values: [] - ## @param portal.affinity Harbor Portal Affinity for pod assignment - ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity - ## Note: podAffinityPreset, podAntiAffinityPreset, and nodeAffinityPreset will be ignored when it's set - ## - affinity: {} - ## @param portal.priorityClassName Portal pods Priority Class Name - ## ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass - ## - priorityClassName: "" - ## @param portal.nodeSelector Harbor Portal Node labels for pod assignment - ## Ref: https://kubernetes.io/docs/user-guide/node-selection/ - ## - nodeSelector: {} - ## @param portal.tolerations Harbor Portal Tolerations for pod assignment - ## Ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ - ## - tolerations: [] - ## @param portal.podLabels Add additional labels to the pod (evaluated as a template) - ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ - ## - podLabels: {} - ## @param portal.podAnnotations Annotations to add to the portal pod - ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ - ## - podAnnotations: {} - ## @param portal.automountServiceAccountToken Automount service account token - ## - automountServiceAccountToken: false - ## Harbor Portal containers' liveness probe - ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes - ## @param portal.livenessProbe.enabled Enable livenessProbe + replicaCount: 1 + ## Configure extra options for Harbor Portal containers' liveness, readiness and startup probes + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#configure-probes + ## @param portal.livenessProbe.enabled Enable livenessProbe on Harbor Portal containers ## @param portal.livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe ## @param portal.livenessProbe.periodSeconds Period seconds for livenessProbe ## @param portal.livenessProbe.timeoutSeconds Timeout seconds for livenessProbe @@ -853,9 +998,7 @@ portal: timeoutSeconds: 5 failureThreshold: 6 successThreshold: 1 - ## Harbor Portal containers' readiness probe - ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes - ## @param portal.readinessProbe.enabled Enable readinessProbe + ## @param portal.readinessProbe.enabled Enable readinessProbe on Harbor Portal containers ## @param portal.readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe ## @param portal.readinessProbe.periodSeconds Period seconds for readinessProbe ## @param portal.readinessProbe.timeoutSeconds Timeout seconds for readinessProbe @@ -869,135 +1012,83 @@ portal: timeoutSeconds: 5 failureThreshold: 6 successThreshold: 1 - -## @section Harbor Core Parameters - -## Bitnami Harbor Core image -## ref: https://hub.docker.com/r/bitnami/harbor-core/tags/ -## -coreImage: - ## @param coreImage.registry Registry for core image - ## @param coreImage.repository Repository for Harbor core image - ## @param coreImage.tag Tag for Harbor core image - ## @param coreImage.pullPolicy Harbor Core image pull policy - ## @param coreImage.pullSecrets Specify docker-registry secret names as an array - ## @param coreImage.debug Specify if debug logs should be enabled + ## @param portal.startupProbe.enabled Enable startupProbe on Harbor Portal containers + ## @param portal.startupProbe.initialDelaySeconds Initial delay seconds for startupProbe + ## @param portal.startupProbe.periodSeconds Period seconds for startupProbe + ## @param portal.startupProbe.timeoutSeconds Timeout seconds for startupProbe + ## @param portal.startupProbe.failureThreshold Failure threshold for startupProbe + ## @param portal.startupProbe.successThreshold Success threshold for startupProbe ## - registry: docker.io - repository: bitnami/harbor-core - tag: 2.4.1-debian-10-r70 - ## Specify a imagePullPolicy - ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' - ## ref: https://kubernetes.io/docs/user-guide/images/#pre-pulling-images + startupProbe: + enabled: false + initialDelaySeconds: 5 + periodSeconds: 10 + timeoutSeconds: 1 + failureThreshold: 15 + successThreshold: 1 + ## @param portal.customLivenessProbe Custom livenessProbe that overrides the default one ## - pullPolicy: IfNotPresent - ## Optionally specify an array of imagePullSecrets. - ## Secrets must be manually created in the namespace. - ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ - ## e.g: - ## pullSecrets: - ## - myRegistryKeySecretName + customLivenessProbe: {} + ## @param portal.customReadinessProbe Custom readinessProbe that overrides the default one ## - pullSecrets: [] - ## Set to true if you would like to see extra information on logs - ## It turns BASH and/or NAMI debugging in the image + customReadinessProbe: {} + ## @param portal.customStartupProbe Custom startupProbe that overrides the default one ## - debug: false -## Harbor Core Parameters -## -core: - ## @param core.command Override default container command (useful when using custom images) + customStartupProbe: {} + ## Harbor Portal resource requests and limits + ## ref: https://kubernetes.io/docs/user-guide/compute-resources/ + ## @param portal.resources.limits The resources limits for the Harbor Portal containers + ## @param portal.resources.requests The requested resources for the Harbor Portal containers ## - command: [] - ## @param core.args Override default container args (useful when using custom images) + resources: + limits: {} + requests: {} + ## Configure Harbor Portal pods Security Context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod + ## @param portal.podSecurityContext.enabled Enabled Harbor Portal pods' Security Context + ## @param portal.podSecurityContext.fsGroup Set Harbor Portal pod's Security Context fsGroup ## - args: [] - ## @param core.uaaSecretName If using external UAA auth which has a self signed cert, you can provide a pre-created secret containing it under the key `ca.crt`. + podSecurityContext: + enabled: true + fsGroup: 1001 + ## Configure Harbor Portal containers (only main one) Security Context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container + ## @param portal.containerSecurityContext.enabled Enabled Harbor Portal containers' Security Context + ## @param portal.containerSecurityContext.runAsUser Set Harbor Portal containers' Security Context runAsUser + ## @param portal.containerSecurityContext.runAsNonRoot Set Harbor Portal containers' Security Context runAsNonRoot ## - uaaSecretName: "" - ## @param core.secretKey The key used for encryption. Must be a string of 16 chars - ## e.g: - ## secretKey: "not-a-secure-string" - ## - secretKey: "" - ## @param core.updateStrategy.type Update strategy - only really applicable for deployments with RWO PVs attached + containerSecurityContext: + enabled: true + runAsUser: 1001 + runAsNonRoot: true + ## @param portal.updateStrategy.type Harbor Portal deployment strategy type - only really applicable for deployments with RWO PVs attached + ## @param portal.updateStrategy.rollingUpdate Harbor Portal deployment rolling update configuration parameters ## If replicas = 1, an update can get "stuck", as the previous pod remains attached to the ## PV, and the "incoming" pod can never start. Changing the strategy to "Recreate" will ## terminate the single previous pod, so that the new, incoming pod can attach to the PV ## updateStrategy: type: RollingUpdate - ## @param core.replicas The replica count + rollingUpdate: {} + ## @param portal.lifecycleHooks LifecycleHook for the Harbor Portal container(s) to automate configuration before or after startup ## - replicas: 1 - ## Use TLS in the container - ## - tls: - ## @param core.tls.existingSecret Name of a secret with the certificates for internal TLS access. Requires internalTLS.enabled to be set to true. If this values is not set it will be automatically generated - ## Otherwise, it will generate a cert automatically - ## - existingSecret: "" - ## @param core.customLivenessProbe Override default liveness probe - ## - customLivenessProbe: {} - ## @param core.customReadinessProbe Override default readiness probe - ## - customReadinessProbe: {} - ## @param core.customStartupProbe Override default Startup Probe probe - ## - customStartupProbe: {} - ## @param core.extraEnvVars Array containing extra env vars - ## For example: - ## - name: BEARER_AUTH - ## value: true - ## - extraEnvVars: [] - ## @param core.extraEnvVarsCM ConfigMap containing extra env vars - ## - extraEnvVarsCM: "" - ## @param core.extraEnvVarsSecret Secret containing extra env vars (in case of sensitive data) - ## - extraEnvVarsSecret: "" - ## @param core.extraVolumes Array of extra volumes to be added to the deployment (evaluated as template). Requires setting `extraVolumeMounts` - ## - extraVolumes: [] - ## @param core.extraVolumeMounts Array of extra volume mounts to be added to the container (evaluated as template). Normally used with `extraVolumes`. - ## - extraVolumeMounts: [] - ## @param core.hostAliases Specify hostAliases for the Pod to use + lifecycleHooks: {} + ## @param portal.hostAliases Harbor Portal pods host aliases ## hostAliases: [] - ## @param core.initContainers Add additional init containers to the pod (evaluated as a template) + ## @param portal.podLabels Add additional labels to the Harbor Portal pods (evaluated as a template) + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ ## - initContainers: [] - ## @param core.sidecars Attach additional containers to the pod (evaluated as a template) + podLabels: {} + ## @param portal.podAnnotations Annotations to add to the Harbor Portal pods (evaluated as a template) + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ ## - sidecars: [] - ## Harbor Core containers' resource requests and limits - ## ref: https://kubernetes.io/docs/user-guide/compute-resources/ - ## We usually recommend not to specify default resources and to leave this as a conscious - ## choice for the user. This also increases chances charts run on environments with little - ## resources, such as Minikube. If you do want to specify resources, uncomment the following - ## lines, adjust them as necessary, and remove the curly braces after 'resources:'. - ## @param core.resources.limits The resources limits for the container - ## @param core.resources.requests The requested resources for the container - ## - resources: - ## Example: - ## limits: - ## cpu: 500m - ## memory: 1Gi - limits: {} - ## Examples: - ## requests: - ## cpu: 250m - ## memory: 256Mi - requests: {} - ## @param core.podAffinityPreset Harbor core Pod affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` + podAnnotations: {} + ## @param portal.podAffinityPreset Harbor Portal Pod affinity preset. Ignored if `portal.affinity` is set. Allowed values: `soft` or `hard` ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity ## podAffinityPreset: "" - ## @param core.podAntiAffinityPreset Harbor core Pod anti-affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` + ## @param portal.podAntiAffinityPreset Harbor Portal Pod anti-affinity preset. Ignored if `portal.affinity` is set. Allowed values: `soft` or `hard` ## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity ## podAntiAffinityPreset: soft @@ -1005,46 +1096,127 @@ core: ## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity ## nodeAffinityPreset: - ## @param core.nodeAffinityPreset.type Harbor core Node affinity preset type. Ignored if `affinity` is set. Allowed values: `soft` or `hard` + ## @param portal.nodeAffinityPreset.type Harbor Portal Node affinity preset type. Ignored if `portal.affinity` is set. Allowed values: `soft` or `hard` ## type: "" - ## @param core.nodeAffinityPreset.key Harbor core Node label key to match Ignored if `affinity` is set. + ## @param portal.nodeAffinityPreset.key Harbor Portal Node label key to match Ignored if `portal.affinity` is set. ## E.g. ## key: "kubernetes.io/e2e-az-name" ## key: "" - ## @param core.nodeAffinityPreset.values Harbor core Node label values to match. Ignored if `affinity` is set. + ## @param portal.nodeAffinityPreset.values Harbor Portal Node label values to match. Ignored if `portal.affinity` is set. ## E.g. ## values: ## - e2e-az1 ## - e2e-az2 ## values: [] - ## @param core.affinity Harbor core Affinity for pod assignment + ## @param portal.affinity Harbor Portal Affinity for pod assignment ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity - ## Note: podAffinityPreset, podAntiAffinityPreset, and nodeAffinityPreset will be ignored when it's set + ## Note: portal.podAffinityPreset, portal.podAntiAffinityPreset, and portal.nodeAffinityPreset will be ignored when it's set ## affinity: {} - ## @param core.priorityClassName Core pods Priority Class Name - ## ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass - ## - priorityClassName: "" - ## @param core.nodeSelector Harbor core Node labels for pod assignment + ## @param portal.nodeSelector Harbor Portal Node labels for pod assignment ## Ref: https://kubernetes.io/docs/user-guide/node-selection/ ## nodeSelector: {} - ## @param core.tolerations Harbor core Tolerations for pod assignment + ## @param portal.tolerations Harbor Portal Tolerations for pod assignment ## Ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ ## tolerations: [] - ## @param core.podLabels Add additional labels to the pod (evaluated as a template) - ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + ## @param portal.topologySpreadConstraints Topology Spread Constraints for pod assignment spread across your cluster among failure-domains. Evaluated as a template + ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/#spread-constraints-for-pods ## - podLabels: {} - ## @param core.podAnnotations Annotations to add to the core pod - ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ + topologySpreadConstraints: {} + ## @param portal.priorityClassName Priority Class Name + ## ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass ## - podAnnotations: {} + priorityClassName: "" + ## @param portal.schedulerName Use an alternate scheduler, e.g. "stork". + ## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/ + ## + schedulerName: "" + ## @param portal.sidecars Add additional sidecar containers to the Harbor Portal pods + ## Example: + ## sidecars: + ## - name: your-image-name + ## image: your-image + ## imagePullPolicy: Always + ## ports: + ## - name: portname + ## containerPort: 1234 + ## + sidecars: [] + ## @param portal.initContainers Add additional init containers to the Harbor Portal pods + ## Example: + ## initContainers: + ## - name: your-image-name + ## image: your-image + ## imagePullPolicy: Always + ## ports: + ## - name: portname + ## containerPort: 1234 + ## + initContainers: [] + ## @param portal.extraVolumeMounts Optionally specify extra list of additional volumeMounts for the Harbor Portal pods + ## + extraVolumeMounts: [] + ## @param portal.extraVolumes Optionally specify extra list of additional volumes for the Harbor Portal pods + ## + extraVolumes: [] + ## @param portal.automountServiceAccountToken Automount service account token + ## + automountServiceAccountToken: false + ## Harbor Portal service configuration + ## + service: + ## @param portal.service.ports.http Harbor Portal HTTP service port + ## @param portal.service.ports.https Harbor Portal HTTPS service port + ## + ports: + http: 80 + https: 443 + +## @section Harbor Core Parameters + +core: + ## Bitnami Harbor Core image + ## ref: https://hub.docker.com/r/bitnami/harbor-core/tags/ + ## @param core.image.registry Harbor Core image registry + ## @param core.image.repository Harbor Core image repository + ## @param core.image.tag Harbor Core image tag (immutable tags are recommended) + ## @param core.image.pullPolicy Harbor Core image pull policy + ## @param core.image.pullSecrets Harbor Core image pull secrets + ## @param core.image.debug Enable Harbor Core image debug mode + ## + image: + registry: docker.io + repository: bitnami/harbor-core + tag: 2.4.1-debian-10-r70 + ## Specify a imagePullPolicy + ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' + ## ref: https://kubernetes.io/docs/user-guide/images/#pre-pulling-images + ## + pullPolicy: IfNotPresent + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## e.g: + ## pullSecrets: + ## - myRegistryKeySecretName + ## + pullSecrets: [] + ## Enable debug mode + ## + debug: false + ## @param core.uaaSecret If using external UAA auth which has a self signed cert, you can provide a pre-created secret containing it under the key `ca.crt`. + ## + uaaSecret: "" + ## @param core.secretKey The key used for encryption. Must be a string of 16 chars + ## e.g: + ## secretKey: "not-a-secure-string" + ## + secretKey: "" ## @param core.secret Secret used when the core server communicates with other components. If a secret key is not specified, Helm will generate one. Must be a string of 16 chars. ## secret: "" @@ -1054,15 +1226,41 @@ core: ## @param core.csrfKey The CSRF key. Will be generated automatically if it isn't specified ## csrfKey: "" - ## @param core.lifecycleHooks LifecycleHook to set additional configuration at startup, e.g. LDAP settings via REST API. Evaluated as a template + ## Use TLS in the container ## - lifecycleHooks: {} - ## @param core.automountServiceAccountToken Automount service account token + tls: + ## @param core.tls.existingSecret Name of an existing secret with the certificates for internal TLS access + ## Requires `internalTLS.enabled` to be set to `true`` + ## Self-signed TLS certificates will be used otherwise + ## + existingSecret: "" + ## @param core.command Override default container command (useful when using custom images) ## - automountServiceAccountToken: false - ## Harbor Core containers' liveness probe - ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes - ## @param core.livenessProbe.enabled Enable livenessProbe + command: [] + ## @param core.args Override default container args (useful when using custom images) + ## + args: [] + ## @param core.extraEnvVars Array with extra environment variables to add Harbor Core pods + ## + extraEnvVars: [] + ## @param core.extraEnvVarsCM ConfigMap containing extra environment variables for Harbor Core pods + ## + extraEnvVarsCM: "" + ## @param core.extraEnvVarsSecret Secret containing extra environment variables (in case of sensitive data) for Harbor Core pods + ## + extraEnvVarsSecret: "" + ## @param core.containerPorts.http Harbor Core HTTP container port + ## @param core.containerPorts.https Harbor Core HTTPS container port + ## + containerPorts: + http: 8080 + https: 8443 + ## @param core.replicaCount Number of Harbor Core replicas + ## + replicaCount: 1 + ## Configure extra options for Harbor Core containers' liveness, readiness and startup probes + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#configure-probes + ## @param core.livenessProbe.enabled Enable livenessProbe on Harbor Core containers ## @param core.livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe ## @param core.livenessProbe.periodSeconds Period seconds for livenessProbe ## @param core.livenessProbe.timeoutSeconds Timeout seconds for livenessProbe @@ -1076,9 +1274,7 @@ core: timeoutSeconds: 5 failureThreshold: 6 successThreshold: 1 - ## Harbor Core containers' readiness probe - ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes - ## @param core.readinessProbe.enabled Enable readinessProbe + ## @param core.readinessProbe.enabled Enable readinessProbe on Harbor Core containers ## @param core.readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe ## @param core.readinessProbe.periodSeconds Period seconds for readinessProbe ## @param core.readinessProbe.timeoutSeconds Timeout seconds for readinessProbe @@ -1092,9 +1288,7 @@ core: timeoutSeconds: 5 failureThreshold: 6 successThreshold: 1 - ## Harbor Core containers' startup probe - ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes - ## @param core.startupProbe.enabled Enable startupProbe + ## @param core.startupProbe.enabled Enable startupProbe on Harbor Core containers ## @param core.startupProbe.initialDelaySeconds Initial delay seconds for startupProbe ## @param core.startupProbe.periodSeconds Period seconds for startupProbe ## @param core.startupProbe.timeoutSeconds Timeout seconds for startupProbe @@ -1102,138 +1296,75 @@ core: ## @param core.startupProbe.successThreshold Success threshold for startupProbe ## startupProbe: - enabled: true - initialDelaySeconds: 10 + enabled: false + initialDelaySeconds: 5 periodSeconds: 10 - timeoutSeconds: 5 - failureThreshold: 30 + timeoutSeconds: 1 + failureThreshold: 15 successThreshold: 1 - -## @section Harbor Jobservice Parameters - -## Bitnami Harbor Job Service image -## ref: https://hub.docker.com/r/bitnami/harbor-jobservice/tags/ -## -jobserviceImage: - ## @param jobserviceImage.registry Registry for jobservice image - ## @param jobserviceImage.repository Repository for jobservice image - ## @param jobserviceImage.tag Tag for jobservice image - ## @param jobserviceImage.pullPolicy Harbor Jobservice image pull policy - ## @param jobserviceImage.pullSecrets Specify docker-registry secret names as an array - ## @param jobserviceImage.debug Specify if debug logs should be enabled + ## @param core.customLivenessProbe Custom livenessProbe that overrides the default one ## - registry: docker.io - repository: bitnami/harbor-jobservice - tag: 2.4.1-debian-10-r72 - ## Specify a imagePullPolicy - ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' - ## ref: https://kubernetes.io/docs/user-guide/images/#pre-pulling-images + customLivenessProbe: {} + ## @param core.customReadinessProbe Custom readinessProbe that overrides the default one ## - pullPolicy: IfNotPresent - ## Optionally specify an array of imagePullSecrets. - ## Secrets must be manually created in the namespace. - ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ - ## e.g: - ## pullSecrets: - ## - myRegistryKeySecretName + customReadinessProbe: {} + ## @param core.customStartupProbe Custom startupProbe that overrides the default one ## - pullSecrets: [] - ## Set to true if you would like to see extra information on logs - ## It turns BASH and/or NAMI debugging in the image + customStartupProbe: {} + ## Harbor Core resource requests and limits + ## ref: https://kubernetes.io/docs/user-guide/compute-resources/ + ## @param core.resources.limits The resources limits for the Harbor Core containers + ## @param core.resources.requests The requested resources for the Harbor Core containers ## - debug: false -## Jobservice Parameters -## -jobservice: - ## @param jobservice.command Override default container command (useful when using custom images) + resources: + limits: {} + requests: {} + ## Configure Harbor Core pods Security Context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod + ## @param core.podSecurityContext.enabled Enabled Harbor Core pods' Security Context + ## @param core.podSecurityContext.fsGroup Set Harbor Core pod's Security Context fsGroup ## - command: [] - ## @param jobservice.args Override default container args (useful when using custom images) + podSecurityContext: + enabled: true + fsGroup: 1001 + ## Configure Harbor Core containers (only main one) Security Context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container + ## @param core.containerSecurityContext.enabled Enabled Harbor Core containers' Security Context + ## @param core.containerSecurityContext.runAsUser Set Harbor Core containers' Security Context runAsUser + ## @param core.containerSecurityContext.runAsNonRoot Set Harbor Core containers' Security Context runAsNonRoot ## - args: [] - ## @param jobservice.replicas The replica count - ## - replicas: 1 - ## @param jobservice.updateStrategy.type The update strategy for deployments with persistent volumes: RollingUpdate or Recreate. Set it as Recreate when RWM for volumes isn't supported + containerSecurityContext: + enabled: true + runAsUser: 1001 + runAsNonRoot: true + ## @param core.updateStrategy.type Harbor Core deployment strategy type - only really applicable for deployments with RWO PVs attached + ## @param core.updateStrategy.rollingUpdate Harbor Core deployment rolling update configuration parameters ## If replicas = 1, an update can get "stuck", as the previous pod remains attached to the ## PV, and the "incoming" pod can never start. Changing the strategy to "Recreate" will ## terminate the single previous pod, so that the new, incoming pod can attach to the PV ## updateStrategy: type: RollingUpdate - ## @param jobservice.maxJobWorkers The max job workers - ## - maxJobWorkers: 10 - ## @param jobservice.jobLogger The logger for jobs: `file`, `database` or `stdout` - ## - jobLogger: file - ## Use TLS in the container - ## - tls: - ## @param jobservice.tls.existingSecret Name of a secret with the certificates for internal TLS access. Requires internalTLS.enabled to be set to true. If this values is not set it will be automatically generated - ## - existingSecret: "" - ## @param jobservice.lifecycleHooks LifecycleHook to set additional configuration at startup, e.g. LDAP settings via REST API. Evaluated as a template + rollingUpdate: {} + ## @param core.lifecycleHooks LifecycleHook for the Harbor Core container(s) to automate configuration before or after startup ## lifecycleHooks: {} - ## @param jobservice.customLivenessProbe Override default liveness probe - ## - customLivenessProbe: {} - ## @param jobservice.customReadinessProbe Override default readiness probe - ## - customReadinessProbe: {} - ## @param jobservice.extraEnvVars Array containing extra env vars - ## For example: - ## - name: BEARER_AUTH - ## value: true - ## - extraEnvVars: [] - ## @param jobservice.extraEnvVarsCM ConfigMap containing extra env vars - ## - extraEnvVarsCM: "" - ## @param jobservice.extraEnvVarsSecret Secret containing extra env vars (in case of sensitive data) - ## - extraEnvVarsSecret: "" - ## @param jobservice.extraVolumes Array of extra volumes to be added to the deployment (evaluated as template). Requires setting `extraVolumeMounts` - ## - extraVolumes: [] - ## @param jobservice.extraVolumeMounts Array of extra volume mounts to be added to the container (evaluated as template). Normally used with `extraVolumes`. - ## - extraVolumeMounts: [] - ## @param jobservice.hostAliases Specify hostAliases for the Pod to use + ## @param core.hostAliases Harbor Core pods host aliases ## hostAliases: [] - ## @param jobservice.initContainers Add additional init containers to the pod (evaluated as a template) + ## @param core.podLabels Add additional labels to the Harbor Core pods (evaluated as a template) + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ ## - initContainers: [] - ## @param jobservice.sidecars Attach additional containers to the pod (evaluated as a template) + podLabels: {} + ## @param core.podAnnotations Annotations to add to the Harbor Core pods (evaluated as a template) + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ ## - sidecars: [] - ## Harbor Jobservice containers' resource requests and limits - ## ref: https://kubernetes.io/docs/user-guide/compute-resources/ - ## We usually recommend not to specify default resources and to leave this as a conscious - ## choice for the user. This also increases chances charts run on environments with little - ## resources, such as Minikube. If you do want to specify resources, uncomment the following - ## lines, adjust them as necessary, and remove the curly braces after 'resources:'. - ## @param jobservice.resources.limits The resources limits for the container - ## @param jobservice.resources.requests The requested resources for the container - ## - resources: - ## Example: - ## limits: - ## cpu: 500m - ## memory: 1Gi - limits: {} - ## Examples: - ## requests: - ## cpu: 250m - ## memory: 256Mi - requests: {} - ## @param jobservice.podAffinityPreset Harbor Jobservice Pod affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` + podAnnotations: {} + ## @param core.podAffinityPreset Harbor Core Pod affinity preset. Ignored if `core.affinity` is set. Allowed values: `soft` or `hard` ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity ## podAffinityPreset: "" - ## @param jobservice.podAntiAffinityPreset Harbor Jobservice Pod anti-affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` + ## @param core.podAntiAffinityPreset Harbor Core Pod anti-affinity preset. Ignored if `core.affinity` is set. Allowed values: `soft` or `hard` ## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity ## podAntiAffinityPreset: soft @@ -1241,57 +1372,165 @@ jobservice: ## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity ## nodeAffinityPreset: - ## @param jobservice.nodeAffinityPreset.type Harbor Jobservice Node affinity preset type. Ignored if `affinity` is set. Allowed values: `soft` or `hard` + ## @param core.nodeAffinityPreset.type Harbor Core Node affinity preset type. Ignored if `core.affinity` is set. Allowed values: `soft` or `hard` ## type: "" - ## @param jobservice.nodeAffinityPreset.key Harbor Jobservice Node label key to match Ignored if `affinity` is set. + ## @param core.nodeAffinityPreset.key Harbor Core Node label key to match Ignored if `core.affinity` is set. ## E.g. ## key: "kubernetes.io/e2e-az-name" ## key: "" - ## @param jobservice.nodeAffinityPreset.values Harbor Jobservice Node label values to match. Ignored if `affinity` is set. + ## @param core.nodeAffinityPreset.values Harbor Core Node label values to match. Ignored if `core.affinity` is set. ## E.g. ## values: ## - e2e-az1 ## - e2e-az2 ## values: [] - ## @param jobservice.affinity Harbor Jobservice Affinity for pod assignment + ## @param core.affinity Harbor Core Affinity for pod assignment ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity - ## Note: podAffinityPreset, podAntiAffinityPreset, and nodeAffinityPreset will be ignored when it's set + ## Note: core.podAffinityPreset, core.podAntiAffinityPreset, and core.nodeAffinityPreset will be ignored when it's set ## affinity: {} - ## @param jobservice.priorityClassName Jobservice pods Priority Class Name - ## ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass - ## - priorityClassName: "" - ## @param jobservice.nodeSelector Harbor Jobservice Node labels for pod assignment + ## @param core.nodeSelector Harbor Core Node labels for pod assignment ## Ref: https://kubernetes.io/docs/user-guide/node-selection/ ## nodeSelector: {} - ## @param jobservice.tolerations Harbor Jobservice Tolerations for pod assignment + ## @param core.tolerations Harbor Core Tolerations for pod assignment ## Ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ ## tolerations: [] - ## @param jobservice.podLabels Add additional labels to the pod (evaluated as a template) - ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + ## @param core.topologySpreadConstraints Topology Spread Constraints for pod assignment spread across your cluster among failure-domains. Evaluated as a template + ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/#spread-constraints-for-pods ## - podLabels: {} - ## @param jobservice.podAnnotations Annotations to add to the jobservice pod - ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ + topologySpreadConstraints: {} + ## @param core.priorityClassName Priority Class Name + ## ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass ## - podAnnotations: {} + priorityClassName: "" + ## @param core.schedulerName Use an alternate scheduler, e.g. "stork". + ## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/ + ## + schedulerName: "" + ## @param core.sidecars Add additional sidecar containers to the Harbor Core pods + ## Example: + ## sidecars: + ## - name: your-image-name + ## image: your-image + ## imagePullPolicy: Always + ## ports: + ## - name: portname + ## containerPort: 1234 + ## + sidecars: [] + ## @param core.initContainers Add additional init containers to the Harbor Core pods + ## Example: + ## initContainers: + ## - name: your-image-name + ## image: your-image + ## imagePullPolicy: Always + ## ports: + ## - name: portname + ## containerPort: 1234 + ## + initContainers: [] + ## @param core.extraVolumeMounts Optionally specify extra list of additional volumeMounts for the Harbor Core pods + ## + extraVolumeMounts: [] + ## @param core.extraVolumes Optionally specify extra list of additional volumes for the Harbor Core pods + ## + extraVolumes: [] + ## @param core.automountServiceAccountToken Automount service account token + ## + automountServiceAccountToken: false + ## Harbor Core service configuration + ## + service: + ## @param core.service.ports.http Harbor Core HTTP service port + ## @param core.service.ports.https Harbor Core HTTPS service port + ## + ports: + http: 80 + https: 443 + +## @section Harbor Jobservice Parameters + +jobservice: + ## Bitnami Harbor Jobservice image + ## ref: https://hub.docker.com/r/bitnami/harbor-jobservice/tags/ + ## @param jobservice.image.registry Harbor Jobservice image registry + ## @param jobservice.image.repository Harbor Jobservice image repository + ## @param jobservice.image.tag Harbor Jobservice image tag (immutable tags are recommended) + ## @param jobservice.image.pullPolicy Harbor Jobservice image pull policy + ## @param jobservice.image.pullSecrets Harbor Jobservice image pull secrets + ## @param jobservice.image.debug Enable Harbor Jobservice image debug mode + ## + image: + registry: docker.io + repository: bitnami/harbor-jobservice + tag: 2.4.1-debian-10-r72 + ## Specify a imagePullPolicy + ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' + ## ref: https://kubernetes.io/docs/user-guide/images/#pre-pulling-images + ## + pullPolicy: IfNotPresent + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## e.g: + ## pullSecrets: + ## - myRegistryKeySecretName + ## + pullSecrets: [] + ## Enable debug mode + ## + debug: false + ## @param jobservice.maxJobWorkers The max job workers + ## + maxJobWorkers: 10 + ## @param jobservice.jobLogger The logger for jobs: `file`, `database` or `stdout` + ## + jobLogger: file ## @param jobservice.secret Secret used when the job service communicates with other components. If a secret key is not specified, Helm will generate one. Must be a string of 16 chars. ## If a secret key is not specified, Helm will generate one. ## Must be a string of 16 chars. ## secret: "" - ## @param jobservice.automountServiceAccountToken Automount service account token + ## Use TLS in the container ## - automountServiceAccountToken: false - ## Harbor Jobservice containers' liveness probe - ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes - ## @param jobservice.livenessProbe.enabled Enable livenessProbe + tls: + ## @param jobservice.tls.existingSecret Name of an existing secret with the certificates for internal TLS access + ## Requires `internalTLS.enabled` to be set to `true`` + ## Self-signed TLS certificates will be used otherwise + ## + existingSecret: "" + ## @param jobservice.command Override default container command (useful when using custom images) + ## + command: [] + ## @param jobservice.args Override default container args (useful when using custom images) + ## + args: [] + ## @param jobservice.extraEnvVars Array with extra environment variables to add Harbor Jobservice pods + ## + extraEnvVars: [] + ## @param jobservice.extraEnvVarsCM ConfigMap containing extra environment variables for Harbor Jobservice pods + ## + extraEnvVarsCM: "" + ## @param jobservice.extraEnvVarsSecret Secret containing extra environment variables (in case of sensitive data) for Harbor Jobservice pods + ## + extraEnvVarsSecret: "" + ## @param jobservice.containerPorts.http Harbor Jobservice HTTP container port + ## @param jobservice.containerPorts.https Harbor Jobservice HTTPS container port + ## + containerPorts: + http: 8080 + https: 8443 + ## @param jobservice.replicaCount Number of Harbor Jobservice replicas + ## + replicaCount: 1 + ## Configure extra options for Harbor Jobservice containers' liveness, readiness and startup probes + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#configure-probes + ## @param jobservice.livenessProbe.enabled Enable livenessProbe on Harbor Jobservice containers ## @param jobservice.livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe ## @param jobservice.livenessProbe.periodSeconds Period seconds for livenessProbe ## @param jobservice.livenessProbe.timeoutSeconds Timeout seconds for livenessProbe @@ -1305,9 +1544,7 @@ jobservice: timeoutSeconds: 5 failureThreshold: 6 successThreshold: 1 - ## Harbor Jobservice containers' readiness probe - ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes - ## @param jobservice.readinessProbe.enabled Enable readinessProbe + ## @param jobservice.readinessProbe.enabled Enable readinessProbe on Harbor Jobservice containers ## @param jobservice.readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe ## @param jobservice.readinessProbe.periodSeconds Period seconds for readinessProbe ## @param jobservice.readinessProbe.timeoutSeconds Timeout seconds for readinessProbe @@ -1321,271 +1558,83 @@ jobservice: timeoutSeconds: 5 failureThreshold: 6 successThreshold: 1 - -## @section Harbor Registry Parameters - -## Bitnami Harbor Registry image -## ref: https://hub.docker.com/r/bitnami/harbor-registry/tags/ -## -registryImage: - ## @param registryImage.registry Registry for registry image - ## @param registryImage.repository Repository for registry image - ## @param registryImage.tag Tag for registry image - ## @param registryImage.pullPolicy Harbor Registry image pull policy - ## @param registryImage.pullSecrets Specify docker-registry secret names as an array - ## @param registryImage.debug Specify if debug logs should be enabled + ## @param jobservice.startupProbe.enabled Enable startupProbe on Harbor Jobservice containers + ## @param jobservice.startupProbe.initialDelaySeconds Initial delay seconds for startupProbe + ## @param jobservice.startupProbe.periodSeconds Period seconds for startupProbe + ## @param jobservice.startupProbe.timeoutSeconds Timeout seconds for startupProbe + ## @param jobservice.startupProbe.failureThreshold Failure threshold for startupProbe + ## @param jobservice.startupProbe.successThreshold Success threshold for startupProbe ## - registry: docker.io - repository: bitnami/harbor-registry - tag: 2.4.1-debian-10-r75 - ## Specify a imagePullPolicy - ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' - ## ref: https://kubernetes.io/docs/user-guide/images/#pre-pulling-images + startupProbe: + enabled: false + initialDelaySeconds: 5 + periodSeconds: 10 + timeoutSeconds: 1 + failureThreshold: 15 + successThreshold: 1 + ## @param jobservice.customLivenessProbe Custom livenessProbe that overrides the default one ## - pullPolicy: IfNotPresent - ## Optionally specify an array of imagePullSecrets. - ## Secrets must be manually created in the namespace. - ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ - ## e.g: - ## pullSecrets: - ## - myRegistryKeySecretName + customLivenessProbe: {} + ## @param jobservice.customReadinessProbe Custom readinessProbe that overrides the default one ## - pullSecrets: [] - ## Set to true if you would like to see extra information on logs - ## It turns BASH and/or NAMI debugging in the image + customReadinessProbe: {} + ## @param jobservice.customStartupProbe Custom startupProbe that overrides the default one ## - debug: false -## Bitnami Harbor Registryctl image -## ref: https://hub.docker.com/r/bitnami/harbor-registryctl/tags/ -## -registryctlImage: - ## @param registryctlImage.registry Registry for registryctl image - ## @param registryctlImage.repository Repository for registryctl controller image - ## @param registryctlImage.tag Tag for registrycrtl controller image - ## @param registryctlImage.pullPolicy Harbor Registryctl image pull policy - ## @param registryctlImage.pullSecrets Specify docker-registry secret names as an array - ## @param registryctlImage.debug Specify if debug logs should be enabled + customStartupProbe: {} + ## Harbor Jobservice resource requests and limits + ## ref: https://kubernetes.io/docs/user-guide/compute-resources/ + ## @param jobservice.resources.limits The resources limits for the Harbor Jobservice containers + ## @param jobservice.resources.requests The requested resources for the Harbor Jobservice containers ## - registry: docker.io - repository: bitnami/harbor-registryctl - tag: 2.4.1-debian-10-r75 - ## Specify a imagePullPolicy - ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' - ## ref: https://kubernetes.io/docs/user-guide/images/#pre-pulling-images + resources: + limits: {} + requests: {} + ## Configure Harbor Jobservice pods Security Context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod + ## @param jobservice.podSecurityContext.enabled Enabled Harbor Jobservice pods' Security Context + ## @param jobservice.podSecurityContext.fsGroup Set Harbor Jobservice pod's Security Context fsGroup ## - pullPolicy: IfNotPresent - ## Optionally specify an array of imagePullSecrets. - ## Secrets must be manually created in the namespace. - ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ - ## e.g: - ## pullSecrets: - ## - myRegistryKeySecretName + podSecurityContext: + enabled: true + fsGroup: 1001 + ## Configure Harbor Jobservice containers (only main one) Security Context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container + ## @param jobservice.containerSecurityContext.enabled Enabled Harbor Jobservice containers' Security Context + ## @param jobservice.containerSecurityContext.runAsUser Set Harbor Jobservice containers' Security Context runAsUser + ## @param jobservice.containerSecurityContext.runAsNonRoot Set Harbor Jobservice containers' Security Context runAsNonRoot ## - pullSecrets: [] - ## Set to true if you would like to see extra information on logs - ## It turns BASH and/or NAMI debugging in the image - ## - debug: false -## Registry Parameters -## -registry: - ## @param registry.replicas The replica count - ## - replicas: 1 - ## @param registry.updateStrategy.type The update strategy for deployments with persistent volumes: RollingUpdate or Recreate. Set it as Recreate when RWM for volumes isn't supported + containerSecurityContext: + enabled: true + runAsUser: 1001 + runAsNonRoot: true + ## @param jobservice.updateStrategy.type Harbor Jobservice deployment strategy type - only really applicable for deployments with RWO PVs attached + ## @param jobservice.updateStrategy.rollingUpdate Harbor Jobservice deployment rolling update configuration parameters ## If replicas = 1, an update can get "stuck", as the previous pod remains attached to the ## PV, and the "incoming" pod can never start. Changing the strategy to "Recreate" will ## terminate the single previous pod, so that the new, incoming pod can attach to the PV ## updateStrategy: type: RollingUpdate - ## Use TLS in the containers + rollingUpdate: {} + ## @param jobservice.lifecycleHooks LifecycleHook for the Harbor Jobservice container(s) to automate configuration before or after startup ## - tls: - ## @param registry.tls.existingSecret Name of a secret with the certificates for internal TLS access. Requires internalTLS.enabled to be set to true. If this values is not set it will be automatically generated - ## - existingSecret: "" - ## Harbor Registry main container parameters - ## - server: - ## @param registry.server.command Override default container command (useful when using custom images) - ## - command: [] - ## @param registry.server.args Override default container args (useful when using custom images) - ## - args: [] - ## @param registry.server.extraEnvVars Array containing extra env vars - ## - extraEnvVars: [] - ## @param registry.server.extraEnvVarsCM ConfigMap containing extra env vars - ## - extraEnvVarsCM: "" - ## @param registry.server.extraEnvVarsSecret Secret containing extra env vars (in case of sensitive data) - ## - extraEnvVarsSecret: "" - ## @param registry.server.extraVolumeMounts Array of extra volume mounts to be added to the container (evaluated as template). Normally used with `extraVolumes`. - ## - extraVolumeMounts: [] - ## @param registry.server.lifecycleHooks LifecycleHook to set additional configuration at startup, e.g. LDAP settings via REST API. Evaluated as a template - ## - lifecycleHooks: {} - ## Harbor Registry containers' resource requests and limits - ## ref: https://kubernetes.io/docs/user-guide/compute-resources/ - ## We usually recommend not to specify default resources and to leave this as a conscious - ## choice for the user. This also increases chances charts run on environments with little - ## resources, such as Minikube. If you do want to specify resources, uncomment the following - ## lines, adjust them as necessary, and remove the curly braces after 'resources:'. - ## @param registry.server.resources.limits The resources limits for the container - ## @param registry.server.resources.requests The requested resources for the container - ## - resources: - ## Example: - ## limits: - ## cpu: 500m - ## memory: 1Gi - limits: {} - ## Examples: - ## requests: - ## cpu: 250m - ## memory: 256Mi - requests: {} - ## Harbor Registry containers' liveness and readiness probes - ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes - ## @param registry.server.livenessProbe.enabled Enable livenessProbe - ## @param registry.server.livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe - ## @param registry.server.livenessProbe.periodSeconds Period seconds for livenessProbe - ## @param registry.server.livenessProbe.timeoutSeconds Timeout seconds for livenessProbe - ## @param registry.server.livenessProbe.failureThreshold Failure threshold for livenessProbe - ## @param registry.server.livenessProbe.successThreshold Success threshold for livenessProbe - ## - livenessProbe: - enabled: true - initialDelaySeconds: 10 - periodSeconds: 10 - timeoutSeconds: 5 - failureThreshold: 6 - successThreshold: 1 - ## Harbor Registry containers' readiness probe - ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes - ## @param registry.server.readinessProbe.enabled Enable readinessProbe - ## @param registry.server.readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe - ## @param registry.server.readinessProbe.periodSeconds Period seconds for readinessProbe - ## @param registry.server.readinessProbe.timeoutSeconds Timeout seconds for readinessProbe - ## @param registry.server.readinessProbe.failureThreshold Failure threshold for readinessProbe - ## @param registry.server.readinessProbe.successThreshold Success threshold for readinessProbe - ## - readinessProbe: - enabled: true - initialDelaySeconds: 10 - periodSeconds: 10 - timeoutSeconds: 5 - failureThreshold: 6 - successThreshold: 1 - ## @param registry.server.customLivenessProbe Override default liveness probe - ## - customLivenessProbe: {} - ## @param registry.server.customReadinessProbe Override default readiness probe - ## - customReadinessProbe: {} - ## Harbor Registryctl parameters - ## - controller: - ## @param registry.controller.command Override default container command (useful when using custom images) - ## - command: [] - ## @param registry.controller.args Override default container args (useful when using custom images) - ## - args: [] - ## @param registry.controller.extraEnvVars Array containing extra env vars - ## - extraEnvVars: [] - ## @param registry.controller.extraEnvVarsCM ConfigMap containing extra env vars - ## - extraEnvVarsCM: "" - ## @param registry.controller.extraEnvVarsSecret Secret containing extra env vars (in case of sensitive data) - ## - extraEnvVarsSecret: "" - ## @param registry.controller.extraVolumeMounts Array of extra volume mounts to be added to the container (evaluated as template). Normally used with `extraVolumes`. - ## - extraVolumeMounts: [] - ## @param registry.controller.lifecycleHooks LifecycleHook to set additional configuration at startup, e.g. LDAP settings via REST API. Evaluated as a template - ## - lifecycleHooks: {} - ## Harbor Registryctl containers' resource requests and limits - ## ref: https://kubernetes.io/docs/user-guide/compute-resources/ - ## We usually recommend not to specify default resources and to leave this as a conscious - ## choice for the user. This also increases chances charts run on environments with little - ## resources, such as Minikube. If you do want to specify resources, uncomment the following - ## lines, adjust them as necessary, and remove the curly braces after 'resources:'. - ## @param registry.controller.resources.limits The resources limits for the container - ## @param registry.controller.resources.requests The requested resources for the container - ## - resources: - ## Example: - ## limits: - ## cpu: 500m - ## memory: 1Gi - limits: {} - ## Examples: - ## requests: - ## cpu: 250m - ## memory: 256Mi - requests: {} - ## Harbor Registryctl containers' liveness probes - ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes - ## @param registry.controller.livenessProbe.enabled Enable livenessProbe - ## @param registry.controller.livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe - ## @param registry.controller.livenessProbe.periodSeconds Period seconds for livenessProbe - ## @param registry.controller.livenessProbe.timeoutSeconds Timeout seconds for livenessProbe - ## @param registry.controller.livenessProbe.failureThreshold Failure threshold for livenessProbe - ## @param registry.controller.livenessProbe.successThreshold Success threshold for livenessProbe - ## - livenessProbe: - enabled: true - initialDelaySeconds: 10 - periodSeconds: 10 - timeoutSeconds: 5 - failureThreshold: 6 - successThreshold: 1 - ## Harbor Registryctl containers' readiness probes - ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes - ## @param registry.controller.readinessProbe.enabled Enable readinessProbe - ## @param registry.controller.readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe - ## @param registry.controller.readinessProbe.periodSeconds Period seconds for readinessProbe - ## @param registry.controller.readinessProbe.timeoutSeconds Timeout seconds for readinessProbe - ## @param registry.controller.readinessProbe.failureThreshold Failure threshold for readinessProbe - ## @param registry.controller.readinessProbe.successThreshold Success threshold for readinessProbe - ## - readinessProbe: - enabled: true - initialDelaySeconds: 10 - periodSeconds: 10 - timeoutSeconds: 5 - failureThreshold: 6 - successThreshold: 1 - ## @param registry.controller.customLivenessProbe Override default liveness probe - ## - customLivenessProbe: {} - ## @param registry.controller.customReadinessProbe Override default readiness probe - ## - customReadinessProbe: {} - ## @param registry.extraVolumes Array of extra volumes to be added to the deployment (evaluated as template). Requires setting `extraVolumeMounts` - ## - extraVolumes: [] - ## @param registry.hostAliases Specify hostAliases for the Pod to use + lifecycleHooks: {} + ## @param jobservice.hostAliases Harbor Jobservice pods host aliases ## hostAliases: [] - ## @param registry.initContainers Add additional init containers to the pod (evaluated as a template) + ## @param jobservice.podLabels Add additional labels to the Harbor Jobservice pods (evaluated as a template) + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ ## - initContainers: [] - ## @param registry.sidecars Attach additional containers to the pod (evaluated as a template) + podLabels: {} + ## @param jobservice.podAnnotations Annotations to add to the Harbor Jobservice pods (evaluated as a template) + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ ## - sidecars: [] - ## @param registry.podAffinityPreset Harbor Registry Pod affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` + podAnnotations: {} + ## @param jobservice.podAffinityPreset Harbor Jobservice Pod affinity preset. Ignored if `jobservice.affinity` is set. Allowed values: `soft` or `hard` ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity ## podAffinityPreset: "" - ## @param registry.podAntiAffinityPreset Harbor Registry Pod anti-affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` + ## @param jobservice.podAntiAffinityPreset Harbor Jobservice Pod anti-affinity preset. Ignored if `jobservice.affinity` is set. Allowed values: `soft` or `hard` ## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity ## podAntiAffinityPreset: soft @@ -1593,49 +1642,92 @@ registry: ## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity ## nodeAffinityPreset: - ## @param registry.nodeAffinityPreset.type Harbor Registry Node affinity preset type. Ignored if `affinity` is set. Allowed values: `soft` or `hard` + ## @param jobservice.nodeAffinityPreset.type Harbor Jobservice Node affinity preset type. Ignored if `jobservice.affinity` is set. Allowed values: `soft` or `hard` ## type: "" - ## @param registry.nodeAffinityPreset.key Harbor Registry Node label key to match Ignored if `affinity` is set. + ## @param jobservice.nodeAffinityPreset.key Harbor Jobservice Node label key to match Ignored if `jobservice.affinity` is set. ## E.g. ## key: "kubernetes.io/e2e-az-name" ## key: "" - ## @param registry.nodeAffinityPreset.values Harbor Registry Node label values to match. Ignored if `affinity` is set. + ## @param jobservice.nodeAffinityPreset.values Harbor Jobservice Node label values to match. Ignored if `jobservice.affinity` is set. ## E.g. ## values: ## - e2e-az1 ## - e2e-az2 ## values: [] - ## @param registry.affinity Harbor Registry Affinity for pod assignment + ## @param jobservice.affinity Harbor Jobservice Affinity for pod assignment ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity - ## Note: podAffinityPreset, podAntiAffinityPreset, and nodeAffinityPreset will be ignored when it's set + ## Note: jobservice.podAffinityPreset, jobservice.podAntiAffinityPreset, and jobservice.nodeAffinityPreset will be ignored when it's set ## affinity: {} - ## @param registry.priorityClassName Registry pods Priority Class Name - ## ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass - ## - priorityClassName: "" - ## @param registry.nodeSelector Harbor Registry Node labels for pod assignment + ## @param jobservice.nodeSelector Harbor Jobservice Node labels for pod assignment ## Ref: https://kubernetes.io/docs/user-guide/node-selection/ ## nodeSelector: {} - ## @param registry.tolerations Harbor Registry Tolerations for pod assignment + ## @param jobservice.tolerations Harbor Jobservice Tolerations for pod assignment ## Ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ ## tolerations: [] - ## @param registry.podLabels Add additional labels to the pod (evaluated as a template) - ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + ## @param jobservice.topologySpreadConstraints Topology Spread Constraints for pod assignment spread across your cluster among failure-domains. Evaluated as a template + ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/#spread-constraints-for-pods ## - podLabels: {} - ## @param registry.podAnnotations Annotations to add to the registry pod - ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ + topologySpreadConstraints: {} + ## @param jobservice.priorityClassName Priority Class Name + ## ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass ## - podAnnotations: {} - ## @param registry.automountServiceAccountToken Automount service account token + priorityClassName: "" + ## @param jobservice.schedulerName Use an alternate scheduler, e.g. "stork". + ## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/ + ## + schedulerName: "" + ## @param jobservice.sidecars Add additional sidecar containers to the Harbor Jobservice pods + ## Example: + ## sidecars: + ## - name: your-image-name + ## image: your-image + ## imagePullPolicy: Always + ## ports: + ## - name: portname + ## containerPort: 1234 + ## + sidecars: [] + ## @param jobservice.initContainers Add additional init containers to the Harbor Jobservice pods + ## Example: + ## initContainers: + ## - name: your-image-name + ## image: your-image + ## imagePullPolicy: Always + ## ports: + ## - name: portname + ## containerPort: 1234 + ## + initContainers: [] + ## @param jobservice.extraVolumeMounts Optionally specify extra list of additional volumeMounts for the Harbor Jobservice pods + ## + extraVolumeMounts: [] + ## @param jobservice.extraVolumes Optionally specify extra list of additional volumes for the Harbor Jobservice pods + ## + extraVolumes: [] + ## @param jobservice.automountServiceAccountToken Automount service account token ## automountServiceAccountToken: false + ## Harbor Jobservice service configuration + ## + service: + ## @param jobservice.service.ports.http Harbor Jobservice HTTP service port + ## @param jobservice.service.ports.https Harbor Jobservice HTTPS service port + ## + ports: + http: 80 + https: 443 + +## @section Harbor Registry Parameters + +## Registry Parameters +## +registry: ## @param registry.secret Secret is used to secure the upload state from client and registry storage backend. See: https://github.com/docker/distribution/blob/master/docs/configuration.md ## and registry storage backend. ## See: https://github.com/docker/distribution/blob/master/docs/configuration.md#http @@ -1679,62 +1771,441 @@ registry: ## that allows access to CloudFront ## privateKeySecret: 'my-secret' - -## @section ChartMuseum Parameters - -## Bitnami ChartMuseum image -## ref: https://hub.docker.com/r/bitnami/chartmuseum/tags/ -## -chartMuseumImage: - ## @param chartMuseumImage.registry Registry for ChartMuseum image - ## @param chartMuseumImage.repository Repository for clair image - ## @param chartMuseumImage.tag Tag for ChartMuseum image - ## @param chartMuseumImage.pullPolicy ChartMuseum image pull policy - ## @param chartMuseumImage.pullSecrets Specify docker-registry secret names as an array - ## @param chartMuseumImage.debug Specify if debug logs should be enabled + ## Use TLS in the container ## - registry: docker.io - repository: bitnami/chartmuseum - tag: 0.14.0-debian-10-r30 - ## Specify a imagePullPolicy - ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' - ## ref: https://kubernetes.io/docs/user-guide/images/#pre-pulling-images + tls: + ## @param registry.tls.existingSecret Name of an existing secret with the certificates for internal TLS access + ## Requires `internalTLS.enabled` to be set to `true`` + ## Self-signed TLS certificates will be used otherwise + ## + existingSecret: "" + ## @param registry.replicaCount Number of Harbor Registry replicas ## - pullPolicy: IfNotPresent - ## Optionally specify an array of imagePullSecrets. - ## Secrets must be manually created in the namespace. - ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ - ## e.g: - ## pullSecrets: - ## - myRegistryKeySecretName + replicaCount: 1 + ## Configure Harbor Registry pods Security Context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod + ## @param registry.podSecurityContext.enabled Enabled Harbor Registry pods' Security Context + ## @param registry.podSecurityContext.fsGroup Set Harbor Registry pod's Security Context fsGroup ## - pullSecrets: [] - ## Set to true if you would like to see extra information on logs - ## It turns BASH and/or NAMI debugging in the image - ## - debug: false -## ChartMuseum Parameters -## -chartmuseum: - ## @param chartmuseum.enabled Enable ChartMuseum - ## - enabled: true - ## @param chartmuseum.command Override default container command (useful when using custom images) - ## - command: [] - ## @param chartmuseum.args Override default container args (useful when using custom images) - ## - args: [] - ## @param chartmuseum.replicas Number of ChartMuseum replicas - ## - replicas: 1 - ## @param chartmuseum.updateStrategy.type Update strategy - only really applicable for deployments with RWO PVs attached + podSecurityContext: + enabled: true + fsGroup: 1001 + ## @param registry.updateStrategy.type Harbor Registry deployment strategy type - only really applicable for deployments with RWO PVs attached + ## @param registry.updateStrategy.rollingUpdate Harbor Registry deployment rolling update configuration parameters ## If replicas = 1, an update can get "stuck", as the previous pod remains attached to the ## PV, and the "incoming" pod can never start. Changing the strategy to "Recreate" will ## terminate the single previous pod, so that the new, incoming pod can attach to the PV ## updateStrategy: type: RollingUpdate + rollingUpdate: {} + ## @param registry.hostAliases Harbor Registry pods host aliases + ## + hostAliases: [] + ## @param registry.podLabels Add additional labels to the Harbor Registry pods (evaluated as a template) + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + ## + podLabels: {} + ## @param registry.podAnnotations Annotations to add to the Harbor Registry pods (evaluated as a template) + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ + ## + podAnnotations: {} + ## @param registry.podAffinityPreset Harbor Registry Pod affinity preset. Ignored if `registry.affinity` is set. Allowed values: `soft` or `hard` + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity + ## + podAffinityPreset: "" + ## @param registry.podAntiAffinityPreset Harbor Registry Pod anti-affinity preset. Ignored if `registry.affinity` is set. Allowed values: `soft` or `hard` + ## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity + ## + podAntiAffinityPreset: soft + ## Node affinity preset + ## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity + ## + nodeAffinityPreset: + ## @param registry.nodeAffinityPreset.type Harbor Registry Node affinity preset type. Ignored if `registry.affinity` is set. Allowed values: `soft` or `hard` + ## + type: "" + ## @param registry.nodeAffinityPreset.key Harbor Registry Node label key to match Ignored if `registry.affinity` is set. + ## E.g. + ## key: "kubernetes.io/e2e-az-name" + ## + key: "" + ## @param registry.nodeAffinityPreset.values Harbor Registry Node label values to match. Ignored if `registry.affinity` is set. + ## E.g. + ## values: + ## - e2e-az1 + ## - e2e-az2 + ## + values: [] + ## @param registry.affinity Harbor Registry Affinity for pod assignment + ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity + ## Note: registry.podAffinityPreset, registry.podAntiAffinityPreset, and registry.nodeAffinityPreset will be ignored when it's set + ## + affinity: {} + ## @param registry.nodeSelector Harbor Registry Node labels for pod assignment + ## Ref: https://kubernetes.io/docs/user-guide/node-selection/ + ## + nodeSelector: {} + ## @param registry.tolerations Harbor Registry Tolerations for pod assignment + ## Ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ + ## + tolerations: [] + ## @param registry.topologySpreadConstraints Topology Spread Constraints for pod assignment spread across your cluster among failure-domains. Evaluated as a template + ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/#spread-constraints-for-pods + ## + topologySpreadConstraints: {} + ## @param registry.priorityClassName Priority Class Name + ## ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass + ## + priorityClassName: "" + ## @param registry.schedulerName Use an alternate scheduler, e.g. "stork". + ## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/ + ## + schedulerName: "" + ## @param registry.sidecars Add additional sidecar containers to the Harbor Registry pods + ## Example: + ## sidecars: + ## - name: your-image-name + ## image: your-image + ## imagePullPolicy: Always + ## ports: + ## - name: portname + ## containerPort: 1234 + ## + sidecars: [] + ## @param registry.initContainers Add additional init containers to the Harbor Registry pods + ## Example: + ## initContainers: + ## - name: your-image-name + ## image: your-image + ## imagePullPolicy: Always + ## ports: + ## - name: portname + ## containerPort: 1234 + ## + initContainers: [] + ## @param registry.extraVolumes Optionally specify extra list of additional volumes for the Harbor Registry pods + ## + extraVolumes: [] + ## @param registry.automountServiceAccountToken Automount service account token + ## + automountServiceAccountToken: false + ## Harbor Registry main container parameters + ## + server: + ## Bitnami Harbor Registry image + ## ref: https://hub.docker.com/r/bitnami/harbor-registry/tags/ + ## @param registry.server.image.registry Harbor Registry image registry + ## @param registry.server.image.repository Harbor Registry image repository + ## @param registry.server.image.tag Harbor Registry image tag (immutable tags are recommended) + ## @param registry.server.image.pullPolicy Harbor Registry image pull policy + ## @param registry.server.image.pullSecrets Harbor Registry image pull secrets + ## @param registry.server.image.debug Enable Harbor Registry image debug mode + ## + image: + registry: docker.io + repository: bitnami/harbor-registry + tag: 2.4.1-debian-10-r75 + ## Specify a imagePullPolicy + ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' + ## ref: https://kubernetes.io/docs/user-guide/images/#pre-pulling-images + ## + pullPolicy: IfNotPresent + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## e.g: + ## pullSecrets: + ## - myRegistryKeySecretName + ## + pullSecrets: [] + ## Enable debug mode + ## + debug: false + ## @param registry.server.command Override default container command (useful when using custom images) + ## + command: [] + ## @param registry.server.args Override default container args (useful when using custom images) + ## + args: [] + ## @param registry.server.extraEnvVars Array with extra environment variables to add Harbor Registry main containers + ## + extraEnvVars: [] + ## @param registry.server.extraEnvVarsCM ConfigMap containing extra environment variables for Harbor Registry main containers + ## + extraEnvVarsCM: "" + ## @param registry.server.extraEnvVarsSecret Secret containing extra environment variables (in case of sensitive data) for Harbor Registry main containers + ## + extraEnvVarsSecret: "" + ## @param registry.server.containerPorts.http Harbor Registry HTTP container port + ## @param registry.server.containerPorts.https Harbor Registry HTTPS container port + ## @param registry.server.containerPorts.debug Harbor Registry debug container port + ## + containerPorts: + http: 5000 + https: 5443 + debug: 5001 + ## Configure extra options for Harbor Registry main containers' liveness, readiness and startup probes + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#configure-probes + ## @param registry.server.livenessProbe.enabled Enable livenessProbe on Harbor Registry main containers + ## @param registry.server.livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe + ## @param registry.server.livenessProbe.periodSeconds Period seconds for livenessProbe + ## @param registry.server.livenessProbe.timeoutSeconds Timeout seconds for livenessProbe + ## @param registry.server.livenessProbe.failureThreshold Failure threshold for livenessProbe + ## @param registry.server.livenessProbe.successThreshold Success threshold for livenessProbe + ## + livenessProbe: + enabled: true + initialDelaySeconds: 20 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 6 + successThreshold: 1 + ## @param registry.server.readinessProbe.enabled Enable readinessProbe on Harbor Registry main containers + ## @param registry.server.readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe + ## @param registry.server.readinessProbe.periodSeconds Period seconds for readinessProbe + ## @param registry.server.readinessProbe.timeoutSeconds Timeout seconds for readinessProbe + ## @param registry.server.readinessProbe.failureThreshold Failure threshold for readinessProbe + ## @param registry.server.readinessProbe.successThreshold Success threshold for readinessProbe + ## + readinessProbe: + enabled: true + initialDelaySeconds: 20 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 6 + successThreshold: 1 + ## @param registry.server.startupProbe.enabled Enable startupProbe on Harbor Registry main containers + ## @param registry.server.startupProbe.initialDelaySeconds Initial delay seconds for startupProbe + ## @param registry.server.startupProbe.periodSeconds Period seconds for startupProbe + ## @param registry.server.startupProbe.timeoutSeconds Timeout seconds for startupProbe + ## @param registry.server.startupProbe.failureThreshold Failure threshold for startupProbe + ## @param registry.server.startupProbe.successThreshold Success threshold for startupProbe + ## + startupProbe: + enabled: false + initialDelaySeconds: 5 + periodSeconds: 10 + timeoutSeconds: 1 + failureThreshold: 15 + successThreshold: 1 + ## @param registry.server.customLivenessProbe Custom livenessProbe that overrides the default one + ## + customLivenessProbe: {} + ## @param registry.server.customReadinessProbe Custom readinessProbe that overrides the default one + ## + customReadinessProbe: {} + ## @param registry.server.customStartupProbe Custom startupProbe that overrides the default one + ## + customStartupProbe: {} + ## Harbor Registry main resource requests and limits + ## ref: https://kubernetes.io/docs/user-guide/compute-resources/ + ## @param registry.server.resources.limits The resources limits for the Harbor Registry main containers + ## @param registry.server.resources.requests The requested resources for the Harbor Registry main containers + ## + resources: + limits: {} + requests: {} + ## Configure Harbor Registry main containers (only main one) Security Context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container + ## @param registry.server.containerSecurityContext.enabled Enabled Harbor Registry main containers' Security Context + ## @param registry.server.containerSecurityContext.runAsUser Set Harbor Registry main containers' Security Context runAsUser + ## @param registry.server.containerSecurityContext.runAsNonRoot Set Harbor Registry main containers' Security Context runAsNonRoot + ## + containerSecurityContext: + enabled: true + runAsUser: 1001 + runAsNonRoot: true + ## @param registry.server.lifecycleHooks LifecycleHook for the Harbor Registry main container(s) to automate configuration before or after startup + ## + lifecycleHooks: {} + ## @param registry.server.extraVolumeMounts Optionally specify extra list of additional volumeMounts for the Harbor Registry main pods + ## + extraVolumeMounts: [] + ## Harbor Registry service configuration + ## + service: + ## @param registry.server.service.ports.http Harbor Registry HTTP service port + ## @param registry.server.service.ports.https Harbor Registry HTTPS service port + ## + ports: + http: 5000 + https: 5443 + ## Harbor Registryctl parameters + ## + controller: + ## Bitnami Harbor Registryctl image + ## ref: https://hub.docker.com/r/bitnami/harbor-registryctl/tags/ + ## @param registry.controller.image.registry Harbor Registryctl image registry + ## @param registry.controller.image.repository Harbor Registryctl image repository + ## @param registry.controller.image.tag Harbor Registryctl image tag (immutable tags are recommended) + ## @param registry.controller.image.pullPolicy Harbor Registryctl image pull policy + ## @param registry.controller.image.pullSecrets Harbor Registryctl image pull secrets + ## @param registry.controller.image.debug Enable Harbor Registryctl image debug mode + ## + image: + registry: docker.io + repository: bitnami/harbor-registryctl + tag: 2.4.1-debian-10-r75 + ## Specify a imagePullPolicy + ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' + ## ref: https://kubernetes.io/docs/user-guide/images/#pre-pulling-images + ## + pullPolicy: IfNotPresent + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## e.g: + ## pullSecrets: + ## - myRegistryKeySecretName + ## + pullSecrets: [] + ## Enable debug mode + ## + debug: false + ## @param registry.controller.command Override default container command (useful when using custom images) + ## + command: [] + ## @param registry.controller.args Override default container args (useful when using custom images) + ## + args: [] + ## @param registry.controller.extraEnvVars Array with extra environment variables to add Harbor Registryctl containers + ## + extraEnvVars: [] + ## @param registry.controller.extraEnvVarsCM ConfigMap containing extra environment variables for Harbor Registryctl containers + ## + extraEnvVarsCM: "" + ## @param registry.controller.extraEnvVarsSecret Secret containing extra environment variables (in case of sensitive data) for Harbor Registryctl containers + ## + extraEnvVarsSecret: "" + ## @param registry.controller.containerPorts.http Harbor Registryctl HTTP container port + ## @param registry.controller.containerPorts.https Harbor Registryctl HTTPS container port + ## + containerPorts: + http: 8080 + https: 8443 + ## Configure extra options for Harbor Registryctl containers' liveness, readiness and startup probes + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#configure-probes + ## @param registry.controller.livenessProbe.enabled Enable livenessProbe on Harbor Registryctl containers + ## @param registry.controller.livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe + ## @param registry.controller.livenessProbe.periodSeconds Period seconds for livenessProbe + ## @param registry.controller.livenessProbe.timeoutSeconds Timeout seconds for livenessProbe + ## @param registry.controller.livenessProbe.failureThreshold Failure threshold for livenessProbe + ## @param registry.controller.livenessProbe.successThreshold Success threshold for livenessProbe + ## + livenessProbe: + enabled: true + initialDelaySeconds: 20 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 6 + successThreshold: 1 + ## @param registry.controller.readinessProbe.enabled Enable readinessProbe on Harbor Registryctl containers + ## @param registry.controller.readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe + ## @param registry.controller.readinessProbe.periodSeconds Period seconds for readinessProbe + ## @param registry.controller.readinessProbe.timeoutSeconds Timeout seconds for readinessProbe + ## @param registry.controller.readinessProbe.failureThreshold Failure threshold for readinessProbe + ## @param registry.controller.readinessProbe.successThreshold Success threshold for readinessProbe + ## + readinessProbe: + enabled: true + initialDelaySeconds: 20 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 6 + successThreshold: 1 + ## @param registry.controller.startupProbe.enabled Enable startupProbe on Harbor Registryctl containers + ## @param registry.controller.startupProbe.initialDelaySeconds Initial delay seconds for startupProbe + ## @param registry.controller.startupProbe.periodSeconds Period seconds for startupProbe + ## @param registry.controller.startupProbe.timeoutSeconds Timeout seconds for startupProbe + ## @param registry.controller.startupProbe.failureThreshold Failure threshold for startupProbe + ## @param registry.controller.startupProbe.successThreshold Success threshold for startupProbe + ## + startupProbe: + enabled: false + initialDelaySeconds: 5 + periodSeconds: 10 + timeoutSeconds: 1 + failureThreshold: 15 + successThreshold: 1 + ## @param registry.controller.customLivenessProbe Custom livenessProbe that overrides the default one + ## + customLivenessProbe: {} + ## @param registry.controller.customReadinessProbe Custom readinessProbe that overrides the default one + ## + customReadinessProbe: {} + ## @param registry.controller.customStartupProbe Custom startupProbe that overrides the default one + ## + customStartupProbe: {} + ## Harbor Registryctl resource requests and limits + ## ref: https://kubernetes.io/docs/user-guide/compute-resources/ + ## @param registry.controller.resources.limits The resources limits for the Harbor Registryctl containers + ## @param registry.controller.resources.requests The requested resources for the Harbor Registryctl containers + ## + resources: + limits: {} + requests: {} + ## Configure Harbor Registryctl containers (only main one) Security Context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container + ## @param registry.controller.containerSecurityContext.enabled Enabled Harbor Registryctl containers' Security Context + ## @param registry.controller.containerSecurityContext.runAsUser Set Harbor Registryctl containers' Security Context runAsUser + ## @param registry.controller.containerSecurityContext.runAsNonRoot Set Harbor Registryctl containers' Security Context runAsNonRoot + ## + containerSecurityContext: + enabled: true + runAsUser: 1001 + runAsNonRoot: true + ## @param registry.controller.lifecycleHooks LifecycleHook for the Harbor Registryctl container(s) to automate configuration before or after startup + ## + lifecycleHooks: {} + ## @param registry.controller.extraVolumeMounts Optionally specify extra list of additional volumeMounts for the Harbor Registryctl pods + ## + extraVolumeMounts: [] + ## Harbor Registryctl service configuration + ## + service: + ## @param registry.controller.service.ports.http Harbor Registryctl HTTP service port + ## @param registry.controller.service.ports.https Harbor Registryctl HTTPS service port + ## + ports: + http: 8080 + https: 8443 + +## @section ChartMuseum Parameters + +chartmuseum: + ## Bitnami ChartMuseum image + ## ref: https://hub.docker.com/r/bitnami/chartmuseum/tags/ + ## @param chartmuseum.image.registry ChartMuseum image registry + ## @param chartmuseum.image.repository ChartMuseum image repository + ## @param chartmuseum.image.tag ChartMuseum image tag (immutable tags are recommended) + ## @param chartmuseum.image.pullPolicy ChartMuseum image pull policy + ## @param chartmuseum.image.pullSecrets ChartMuseum image pull secrets + ## @param chartmuseum.image.debug Enable ChartMuseum image debug mode + ## + image: + registry: docker.io + repository: bitnami/chartmuseum + tag: 0.14.0-debian-10-r30 + ## Specify a imagePullPolicy + ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' + ## ref: https://kubernetes.io/docs/user-guide/images/#pre-pulling-images + ## + pullPolicy: IfNotPresent + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## e.g: + ## pullSecrets: + ## - myRegistryKeySecretName + ## + pullSecrets: [] + ## Enable debug mode + ## + debug: false + ## @param chartmuseum.enabled Enable ChartMuseum + ## + enabled: true ## @param chartmuseum.useRedisCache Specify if ChartMuseum will use redis cache ## useRedisCache: true @@ -1765,12 +2236,6 @@ chartmuseum: ## @param chartmuseum.anonymousGet Allow anonymous GET operations ## anonymousGet: false - ## Use TLS in the container - ## - tls: - ## @param chartmuseum.tls.existingSecret Name of a secret with the certificates for internal TLS access. Requires internalTLS.enabled to be set to true. If this values is not set it will be automatically generated - ## - existingSecret: "" ## Optional parameters for ChartMuseum not used by default. ## ref: https://chartmuseum.com/docs/#other-cli-options ## @param chartmuseum.contextPath Set the base context path for ChartMuseum @@ -1788,120 +2253,41 @@ chartmuseum: maxStorageObjects: "" maxUploadSize: "" storageTimestampTolerance: "1s" - ## @param chartmuseum.lifecycleHooks LifecycleHook to set additional configuration at startup, e.g. LDAP settings via REST API. Evaluated as a template + ## Use TLS in the container ## - lifecycleHooks: {} - ## @param chartmuseum.customLivenessProbe Override default liveness probe + tls: + ## @param chartmuseum.tls.existingSecret Name of an existing secret with the certificates for internal TLS access + ## Requires `internalTLS.enabled` to be set to `true`` + ## Self-signed TLS certificates will be used otherwise + ## + existingSecret: "" + ## @param chartmuseum.command Override default container command (useful when using custom images) ## - customLivenessProbe: {} - ## @param chartmuseum.customReadinessProbe Override default readiness probe + command: [] + ## @param chartmuseum.args Override default container args (useful when using custom images) ## - customReadinessProbe: {} - ## @param chartmuseum.extraEnvVars Array containing extra env vars - ## For example: - ## - name: BEARER_AUTH - ## value: true + args: [] + ## @param chartmuseum.extraEnvVars Array with extra environment variables to add Chartmuseum pods ## extraEnvVars: [] - ## @param chartmuseum.extraEnvVarsCM ConfigMap containing extra env vars + ## @param chartmuseum.extraEnvVarsCM ConfigMap containing extra environment variables for Chartmuseum pods ## extraEnvVarsCM: "" - ## @param chartmuseum.extraEnvVarsSecret Secret containing extra env vars (in case of sensitive data) + ## @param chartmuseum.extraEnvVarsSecret Secret containing extra environment variables (in case of sensitive data) for Chartmuseum pods ## extraEnvVarsSecret: "" - ## @param chartmuseum.extraVolumes Array of extra volumes to be added to the deployment (evaluated as template). Requires setting `extraVolumeMounts` + ## @param chartmuseum.containerPorts.http Chartmuseum HTTP container port + ## @param chartmuseum.containerPorts.https Chartmuseum HTTPS container port ## - extraVolumes: [] - ## @param chartmuseum.extraVolumeMounts Array of extra volume mounts to be added to the container (evaluated as template). Normally used with `extraVolumes`. + containerPorts: + http: 9999 + https: 9443 + ## @param chartmuseum.replicaCount Number of Chartmuseum replicas ## - extraVolumeMounts: [] - ## @param chartmuseum.hostAliases Specify hostAliases for the Pod to use - ## - hostAliases: [] - ## @param chartmuseum.initContainers Add additional init containers to the pod (evaluated as a template) - ## - initContainers: [] - ## @param chartmuseum.sidecars Attach additional containers to the pod (evaluated as a template) - ## - sidecars: [] - ## Chartmuseum containers' resource requests and limits - ## ref: https://kubernetes.io/docs/user-guide/compute-resources/ - ## We usually recommend not to specify default resources and to leave this as a conscious - ## choice for the user. This also increases chances charts run on environments with little - ## resources, such as Minikube. If you do want to specify resources, uncomment the following - ## lines, adjust them as necessary, and remove the curly braces after 'resources:'. - ## @param chartmuseum.resources.limits The resources limits for the container - ## @param chartmuseum.resources.requests The requested resources for the container - ## - resources: - ## Example: - ## limits: - ## cpu: 500m - ## memory: 1Gi - limits: {} - ## Examples: - ## requests: - ## cpu: 250m - ## memory: 256Mi - requests: {} - ## @param chartmuseum.podAffinityPreset ChartMuseum Pod affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` - ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity - ## - podAffinityPreset: "" - ## @param chartmuseum.podAntiAffinityPreset ChartMuseum Pod anti-affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` - ## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity - ## - podAntiAffinityPreset: soft - ## Node affinity preset - ## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity - ## - nodeAffinityPreset: - ## @param chartmuseum.nodeAffinityPreset.type ChartMuseum Node affinity preset type. Ignored if `affinity` is set. Allowed values: `soft` or `hard` - ## - type: "" - ## @param chartmuseum.nodeAffinityPreset.key ChartMuseum Node label key to match Ignored if `affinity` is set. - ## E.g. - ## key: "kubernetes.io/e2e-az-name" - ## - key: "" - ## @param chartmuseum.nodeAffinityPreset.values ChartMuseum Node label values to match. Ignored if `affinity` is set. - ## E.g. - ## values: - ## - e2e-az1 - ## - e2e-az2 - ## - values: [] - ## @param chartmuseum.affinity ChartMuseum Affinity for pod assignment - ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity - ## Note: podAffinityPreset, podAntiAffinityPreset, and nodeAffinityPreset will be ignored when it's set - ## - affinity: {} - ## @param chartmuseum.priorityClassName Chartmuseum pods Priority Class Name - ## ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass - ## - priorityClassName: "" - ## @param chartmuseum.nodeSelector ChartMuseum Node labels for pod assignment - ## Ref: https://kubernetes.io/docs/user-guide/node-selection/ - ## - nodeSelector: {} - ## @param chartmuseum.tolerations ChartMuseum Tolerations for pod assignment - ## Ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ - ## - tolerations: [] - ## @param chartmuseum.podLabels Add additional labels to the pod (evaluated as a template) - ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ - ## - podLabels: {} - ## @param chartmuseum.podAnnotations Annotations to add to the chartmuseum pod - ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ - ## - podAnnotations: {} - ## @param chartmuseum.automountServiceAccountToken Automount service account token - ## - automountServiceAccountToken: false - ## Chartmuseum containers' liveness probe - ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes - ## @param chartmuseum.livenessProbe.enabled Enable livenessProbe + replicaCount: 1 + ## Configure extra options for Chartmuseum containers' liveness, readiness and startup probes + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#configure-probes + ## @param chartmuseum.livenessProbe.enabled Enable livenessProbe on Chartmuseum containers ## @param chartmuseum.livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe ## @param chartmuseum.livenessProbe.periodSeconds Period seconds for livenessProbe ## @param chartmuseum.livenessProbe.timeoutSeconds Timeout seconds for livenessProbe @@ -1910,14 +2296,12 @@ chartmuseum: ## livenessProbe: enabled: true - initialDelaySeconds: 30 + initialDelaySeconds: 20 periodSeconds: 10 - timeoutSeconds: 20 - failureThreshold: 10 + timeoutSeconds: 5 + failureThreshold: 6 successThreshold: 1 - ## Chartmuseum containers' readiness probe - ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes - ## @param chartmuseum.readinessProbe.enabled Enable readinessProbe + ## @param chartmuseum.readinessProbe.enabled Enable readinessProbe on Chartmuseum containers ## @param chartmuseum.readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe ## @param chartmuseum.readinessProbe.periodSeconds Period seconds for readinessProbe ## @param chartmuseum.readinessProbe.timeoutSeconds Timeout seconds for readinessProbe @@ -1926,98 +2310,182 @@ chartmuseum: ## readinessProbe: enabled: true - initialDelaySeconds: 30 + initialDelaySeconds: 20 periodSeconds: 10 - timeoutSeconds: 20 - failureThreshold: 10 + timeoutSeconds: 5 + failureThreshold: 6 successThreshold: 1 - -## @section Clair Parameters - -## Bitnami Harbor Clair image -## ref: https://hub.docker.com/r/bitnami/harbor-clair/tags/ -## -clairImage: - ## @param clairImage.registry Registry for clair image - ## @param clairImage.repository Repository for clair image - ## @param clairImage.tag Tag for clair image - ## @param clairImage.pullPolicy Harbor clair image pull policy - ## @param clairImage.pullSecrets Specify docker-registry secret names as an array - ## @param clairImage.debug Specify if debug logs should be enabled + ## @param chartmuseum.startupProbe.enabled Enable startupProbe on Chartmuseum containers + ## @param chartmuseum.startupProbe.initialDelaySeconds Initial delay seconds for startupProbe + ## @param chartmuseum.startupProbe.periodSeconds Period seconds for startupProbe + ## @param chartmuseum.startupProbe.timeoutSeconds Timeout seconds for startupProbe + ## @param chartmuseum.startupProbe.failureThreshold Failure threshold for startupProbe + ## @param chartmuseum.startupProbe.successThreshold Success threshold for startupProbe ## - registry: docker.io - repository: bitnami/harbor-clair - tag: 2.4.1-debian-10-r78 - ## Specify a imagePullPolicy - ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' - ## ref: https://kubernetes.io/docs/user-guide/images/#pre-pulling-images + startupProbe: + enabled: false + initialDelaySeconds: 5 + periodSeconds: 10 + timeoutSeconds: 1 + failureThreshold: 15 + successThreshold: 1 + ## @param chartmuseum.customLivenessProbe Custom livenessProbe that overrides the default one ## - pullPolicy: IfNotPresent - ## Optionally specify an array of imagePullSecrets. - ## Secrets must be manually created in the namespace. - ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + customLivenessProbe: {} + ## @param chartmuseum.customReadinessProbe Custom readinessProbe that overrides the default one ## - pullSecrets: [] - ## - myRegistryKeySecretName + customReadinessProbe: {} + ## @param chartmuseum.customStartupProbe Custom startupProbe that overrides the default one ## - ## Set to true if you would like to see extra information on logs - ## It turns BASH and/or NAMI debugging in the image + customStartupProbe: {} + ## Chartmuseum resource requests and limits + ## ref: https://kubernetes.io/docs/user-guide/compute-resources/ + ## @param chartmuseum.resources.limits The resources limits for the Chartmuseum containers + ## @param chartmuseum.resources.requests The requested resources for the Chartmuseum containers ## - debug: false -## Bitnami Harbor Adapter Clair image -## ref: https://hub.docker.com/r/bitnami/harbor-adapter-clair/tags/ -## -clairAdapterImage: - ## @param clairAdapterImage.registry Registry for clair adapter image - ## @param clairAdapterImage.repository Repository for clair adapter image - ## @param clairAdapterImage.tag Tag for clair adapter image - ## @param clairAdapterImage.pullPolicy Harbor clair adapter image pull policy - ## @param clairAdapterImage.pullSecrets Specify docker-registry secret names as an array - ## @param clairAdapterImage.debug Specify if debug logs should be enabled + resources: + limits: {} + requests: {} + ## Configure Chartmuseum pods Security Context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod + ## @param chartmuseum.podSecurityContext.enabled Enabled Chartmuseum pods' Security Context + ## @param chartmuseum.podSecurityContext.fsGroup Set Chartmuseum pod's Security Context fsGroup ## - registry: docker.io - repository: bitnami/harbor-adapter-clair - tag: 2.4.1-debian-10-r76 - ## Specify a imagePullPolicy - ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' - ## ref: https://kubernetes.io/docs/user-guide/images/#pre-pulling-images + podSecurityContext: + enabled: true + fsGroup: 1001 + ## Configure Chartmuseum containers (only main one) Security Context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container + ## @param chartmuseum.containerSecurityContext.enabled Enabled Chartmuseum containers' Security Context + ## @param chartmuseum.containerSecurityContext.runAsUser Set Chartmuseum containers' Security Context runAsUser + ## @param chartmuseum.containerSecurityContext.runAsNonRoot Set Chartmuseum containers' Security Context runAsNonRoot ## - pullPolicy: IfNotPresent - ## Optionally specify an array of imagePullSecrets. - ## Secrets must be manually created in the namespace. - ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ - ## e.g: - ## pullSecrets: - ## - myRegistryKeySecretName - ## - pullSecrets: [] - ## Set to true if you would like to see extra information on logs - ## It turns BASH and/or NAMI debugging in the image - ## - debug: false -## Clair Parameters -## -clair: - ## @param clair.enabled Enable Clair scanner. Add it as an additional interrogation service by following https://goharbor.io/docs/latest/administration/vulnerability-scanning/pluggable-scanners - ## - enabled: false - ## @param clair.replicas The replica count - ## - replicas: 1 - ## Use TLS in the container - ## - tls: - ## @param clair.tls.existingSecret Name of a secret with the certificates for internal TLS access. Requires internalTLS.enabled to be set to true. If this values is not set it will be automatically generated - ## Otherwise, it will generate a cert automatically - ## - existingSecret: "" - ## @param clair.updateStrategy.type Update strategy - only really applicable for deployments with RWO PVs attached + containerSecurityContext: + enabled: true + runAsUser: 1001 + runAsNonRoot: true + ## @param chartmuseum.updateStrategy.type Chartmuseum deployment strategy type - only really applicable for deployments with RWO PVs attached + ## @param chartmuseum.updateStrategy.rollingUpdate Chartmuseum deployment rolling update configuration parameters ## If replicas = 1, an update can get "stuck", as the previous pod remains attached to the ## PV, and the "incoming" pod can never start. Changing the strategy to "Recreate" will ## terminate the single previous pod, so that the new, incoming pod can attach to the PV ## updateStrategy: type: RollingUpdate + rollingUpdate: {} + ## @param chartmuseum.lifecycleHooks LifecycleHook for the Chartmuseum container(s) to automate configuration before or after startup + ## + lifecycleHooks: {} + ## @param chartmuseum.hostAliases Chartmuseum pods host aliases + ## + hostAliases: [] + ## @param chartmuseum.podLabels Add additional labels to the Chartmuseum pods (evaluated as a template) + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + ## + podLabels: {} + ## @param chartmuseum.podAnnotations Annotations to add to the Chartmuseum pods (evaluated as a template) + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ + ## + podAnnotations: {} + ## @param chartmuseum.podAffinityPreset Chartmuseum Pod affinity preset. Ignored if `chartmuseum.affinity` is set. Allowed values: `soft` or `hard` + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity + ## + podAffinityPreset: "" + ## @param chartmuseum.podAntiAffinityPreset Chartmuseum Pod anti-affinity preset. Ignored if `chartmuseum.affinity` is set. Allowed values: `soft` or `hard` + ## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity + ## + podAntiAffinityPreset: soft + ## Node affinity preset + ## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity + ## + nodeAffinityPreset: + ## @param chartmuseum.nodeAffinityPreset.type Chartmuseum Node affinity preset type. Ignored if `chartmuseum.affinity` is set. Allowed values: `soft` or `hard` + ## + type: "" + ## @param chartmuseum.nodeAffinityPreset.key Chartmuseum Node label key to match Ignored if `chartmuseum.affinity` is set. + ## E.g. + ## key: "kubernetes.io/e2e-az-name" + ## + key: "" + ## @param chartmuseum.nodeAffinityPreset.values Chartmuseum Node label values to match. Ignored if `chartmuseum.affinity` is set. + ## E.g. + ## values: + ## - e2e-az1 + ## - e2e-az2 + ## + values: [] + ## @param chartmuseum.affinity Chartmuseum Affinity for pod assignment + ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity + ## Note: chartmuseum.podAffinityPreset, chartmuseum.podAntiAffinityPreset, and chartmuseum.nodeAffinityPreset will be ignored when it's set + ## + affinity: {} + ## @param chartmuseum.nodeSelector Chartmuseum Node labels for pod assignment + ## Ref: https://kubernetes.io/docs/user-guide/node-selection/ + ## + nodeSelector: {} + ## @param chartmuseum.tolerations Chartmuseum Tolerations for pod assignment + ## Ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ + ## + tolerations: [] + ## @param chartmuseum.topologySpreadConstraints Topology Spread Constraints for pod assignment spread across your cluster among failure-domains. Evaluated as a template + ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/#spread-constraints-for-pods + ## + topologySpreadConstraints: {} + ## @param chartmuseum.priorityClassName Priority Class Name + ## ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass + ## + priorityClassName: "" + ## @param chartmuseum.schedulerName Use an alternate scheduler, e.g. "stork". + ## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/ + ## + schedulerName: "" + ## @param chartmuseum.sidecars Add additional sidecar containers to the Chartmuseum pods + ## Example: + ## sidecars: + ## - name: your-image-name + ## image: your-image + ## imagePullPolicy: Always + ## ports: + ## - name: portname + ## containerPort: 1234 + ## + sidecars: [] + ## @param chartmuseum.initContainers Add additional init containers to the Chartmuseum pods + ## Example: + ## initContainers: + ## - name: your-image-name + ## image: your-image + ## imagePullPolicy: Always + ## ports: + ## - name: portname + ## containerPort: 1234 + ## + initContainers: [] + ## @param chartmuseum.extraVolumeMounts Optionally specify extra list of additional volumeMounts for the Chartmuseum pods + ## + extraVolumeMounts: [] + ## @param chartmuseum.extraVolumes Optionally specify extra list of additional volumes for the Chartmuseum pods + ## + extraVolumes: [] + ## @param chartmuseum.automountServiceAccountToken Automount service account token + ## + automountServiceAccountToken: false + ## Chartmuseum service configuration + ## + service: + ## @param chartmuseum.service.ports.http Chartmuseum HTTP service port + ## @param chartmuseum.service.ports.https Chartmuseum HTTPS service port + ## + ports: + http: 80 + https: 443 + +## @section Clair Parameters + +clair: + ## @param clair.enabled Enable Clair scanner. Add it as an additional interrogation service by following https://goharbor.io/docs/latest/administration/vulnerability-scanning/pluggable-scanners + ## + enabled: false ## The http(s) proxy used to update vulnerabilities database from internet ## @param clair.httpProxy The http proxy used to update vulnerabilities database from internet ## @param clair.httpsProxy The https proxy used to update vulnerabilities database from internet @@ -2028,30 +2496,181 @@ clair: ## disable the updaters ## updatersInterval: 12 + ## Use TLS in the container + ## + tls: + ## @param clair.tls.existingSecret Name of an existing secret with the certificates for internal TLS access + ## Requires `internalTLS.enabled` to be set to `true`` + ## Self-signed TLS certificates will be used otherwise + ## + existingSecret: "" + ## @param clair.replicaCount Number of Clair replicas + ## + replicaCount: 1 + ## Configure Clair pods Security Context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod + ## @param clair.podSecurityContext.enabled Enabled Clair pods' Security Context + ## @param clair.podSecurityContext.fsGroup Set Clair pod's Security Context fsGroup + ## + podSecurityContext: + enabled: true + fsGroup: 1001 + ## @param clair.updateStrategy.type Clair deployment strategy type - only really applicable for deployments with RWO PVs attached + ## @param clair.updateStrategy.rollingUpdate Clair deployment rolling update configuration parameters + ## If replicas = 1, an update can get "stuck", as the previous pod remains attached to the + ## PV, and the "incoming" pod can never start. Changing the strategy to "Recreate" will + ## terminate the single previous pod, so that the new, incoming pod can attach to the PV + ## + updateStrategy: + type: RollingUpdate + rollingUpdate: {} + ## @param clair.hostAliases Clair pods host aliases + ## + hostAliases: [] + ## @param clair.podLabels Add additional labels to the Clair pods (evaluated as a template) + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + ## + podLabels: {} + ## @param clair.podAnnotations Annotations to add to the Clair pods (evaluated as a template) + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ + ## + podAnnotations: {} + ## @param clair.podAffinityPreset Clair Pod affinity preset. Ignored if `clair.affinity` is set. Allowed values: `soft` or `hard` + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity + ## + podAffinityPreset: "" + ## @param clair.podAntiAffinityPreset Clair Pod anti-affinity preset. Ignored if `clair.affinity` is set. Allowed values: `soft` or `hard` + ## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity + ## + podAntiAffinityPreset: soft + ## Node affinity preset + ## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity + ## + nodeAffinityPreset: + ## @param clair.nodeAffinityPreset.type Clair Node affinity preset type. Ignored if `clair.affinity` is set. Allowed values: `soft` or `hard` + ## + type: "" + ## @param clair.nodeAffinityPreset.key Clair Node label key to match Ignored if `clair.affinity` is set. + ## E.g. + ## key: "kubernetes.io/e2e-az-name" + ## + key: "" + ## @param clair.nodeAffinityPreset.values Clair Node label values to match. Ignored if `clair.affinity` is set. + ## E.g. + ## values: + ## - e2e-az1 + ## - e2e-az2 + ## + values: [] + ## @param clair.affinity Clair Affinity for pod assignment + ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity + ## Note: clair.podAffinityPreset, clair.podAntiAffinityPreset, and clair.nodeAffinityPreset will be ignored when it's set + ## + affinity: {} + ## @param clair.nodeSelector Clair Node labels for pod assignment + ## Ref: https://kubernetes.io/docs/user-guide/node-selection/ + ## + nodeSelector: {} + ## @param clair.tolerations Clair Tolerations for pod assignment + ## Ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ + ## + tolerations: [] + ## @param clair.topologySpreadConstraints Topology Spread Constraints for pod assignment spread across your cluster among failure-domains. Evaluated as a template + ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/#spread-constraints-for-pods + ## + topologySpreadConstraints: {} + ## @param clair.priorityClassName Priority Class Name + ## ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass + ## + priorityClassName: "" + ## @param clair.schedulerName Use an alternate scheduler, e.g. "stork". + ## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/ + ## + schedulerName: "" + ## @param clair.sidecars Add additional sidecar containers to the Clair pods + ## Example: + ## sidecars: + ## - name: your-image-name + ## image: your-image + ## imagePullPolicy: Always + ## ports: + ## - name: portname + ## containerPort: 1234 + ## + sidecars: [] + ## @param clair.initContainers Add additional init containers to the Clair pods + ## Example: + ## initContainers: + ## - name: your-image-name + ## image: your-image + ## imagePullPolicy: Always + ## ports: + ## - name: portname + ## containerPort: 1234 + ## + initContainers: [] + ## @param clair.extraVolumes Optionally specify extra list of additional volumes for the Clair pods + ## + extraVolumes: [] + ## @param clair.automountServiceAccountToken Automount service account token + ## + automountServiceAccountToken: false ## Harbor needs Clair adapter to communicate with Clair API. ## adapter: + ## Bitnami Harbor Adapter for Clair image + ## ref: https://hub.docker.com/r/bitnami/harbor-adapter-clair/tags/ + ## @param clair.adapter.image.registry Harbor Adapter for Clair image registry + ## @param clair.adapter.image.repository Harbor Adapter for Clair image repository + ## @param clair.adapter.image.tag Harbor Adapter for Clair image tag (immutable tags are recommended) + ## @param clair.adapter.image.pullPolicy Harbor Adapter for Clair image pull policy + ## @param clair.adapter.image.pullSecrets Harbor Adapter for Clair image pull secrets + ## @param clair.adapter.image.debug Enable Harbor Adapter for Clair image debug mode + ## + image: + registry: docker.io + repository: bitnami/harbor-adapter-clair + tag: 2.4.1-debian-10-r76 + ## Specify a imagePullPolicy + ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' + ## ref: https://kubernetes.io/docs/user-guide/images/#pre-pulling-images + ## + pullPolicy: IfNotPresent + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## e.g: + ## pullSecrets: + ## - myRegistryKeySecretName + ## + pullSecrets: [] + ## Enable debug mode + ## + debug: false ## @param clair.adapter.command Override default container command (useful when using custom images) ## command: [] ## @param clair.adapter.args Override default container args (useful when using custom images) ## args: [] - ## @param clair.adapter.extraEnvVars Array containing extra env vars + ## @param clair.adapter.extraEnvVars Array with extra environment variables to add Harbor Adapter for Clair containers ## extraEnvVars: [] - ## @param clair.adapter.extraEnvVarsCM ConfigMap containing extra env vars + ## @param clair.adapter.extraEnvVarsCM ConfigMap containing extra environment variables for Harbor Adapter for Clair containers ## extraEnvVarsCM: "" - ## @param clair.adapter.extraEnvVarsSecret Secret containing extra env vars (in case of sensitive data) + ## @param clair.adapter.extraEnvVarsSecret Secret containing extra environment variables (in case of sensitive data) for Harbor Adapter for Clair containers ## extraEnvVarsSecret: "" - ## @param clair.adapter.extraVolumeMounts Array of extra volume mounts to be added to the container (evaluated as template). Normally used with `extraVolumes`. + ## @param clair.adapter.containerPorts.http Harbor Adapter for Clair HTTP container port + ## @param clair.adapter.containerPorts.https Harbor Adapter for Clair HTTPS container port ## - extraVolumeMounts: [] - ## Clair containers' liveness probes - ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes - ## @param clair.adapter.livenessProbe.enabled Enable livenessProbe + containerPorts: + http: 8080 + https: 8443 + ## Configure extra options for Harbor Adapter for Clair containers' liveness, readiness and startup probes + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#configure-probes + ## @param clair.adapter.livenessProbe.enabled Enable livenessProbe on Harbor Adapter for Clair containers ## @param clair.adapter.livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe ## @param clair.adapter.livenessProbe.periodSeconds Period seconds for livenessProbe ## @param clair.adapter.livenessProbe.timeoutSeconds Timeout seconds for livenessProbe @@ -2065,9 +2684,7 @@ clair: timeoutSeconds: 5 failureThreshold: 6 successThreshold: 1 - ## Clair containers' readiness probes - ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes - ## @param clair.adapter.readinessProbe.enabled Enable readinessProbe + ## @param clair.adapter.readinessProbe.enabled Enable readinessProbe on Harbor Adapter for Clair containers ## @param clair.adapter.readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe ## @param clair.adapter.readinessProbe.periodSeconds Period seconds for readinessProbe ## @param clair.adapter.readinessProbe.timeoutSeconds Timeout seconds for readinessProbe @@ -2081,47 +2698,118 @@ clair: timeoutSeconds: 5 failureThreshold: 6 successThreshold: 1 - ## @param clair.adapter.lifecycleHooks LifecycleHook to set additional configuration at startup, e.g. LDAP settings via REST API. Evaluated as a template + ## @param clair.adapter.startupProbe.enabled Enable startupProbe on Harbor Adapter for Clair containers + ## @param clair.adapter.startupProbe.initialDelaySeconds Initial delay seconds for startupProbe + ## @param clair.adapter.startupProbe.periodSeconds Period seconds for startupProbe + ## @param clair.adapter.startupProbe.timeoutSeconds Timeout seconds for startupProbe + ## @param clair.adapter.startupProbe.failureThreshold Failure threshold for startupProbe + ## @param clair.adapter.startupProbe.successThreshold Success threshold for startupProbe ## - lifecycleHooks: {} - ## @param clair.adapter.customLivenessProbe Override default liveness probe + startupProbe: + enabled: false + initialDelaySeconds: 5 + periodSeconds: 10 + timeoutSeconds: 1 + failureThreshold: 15 + successThreshold: 1 + ## @param clair.adapter.customLivenessProbe Custom livenessProbe that overrides the default one ## customLivenessProbe: {} - ## @param clair.adapter.customReadinessProbe Override default readiness probe + ## @param clair.adapter.customReadinessProbe Custom readinessProbe that overrides the default one ## customReadinessProbe: {} - ## Clair containers' resource requests and limits + ## @param clair.adapter.customStartupProbe Custom startupProbe that overrides the default one + ## + customStartupProbe: {} + ## Harbor Adapter for Clair resource requests and limits ## ref: https://kubernetes.io/docs/user-guide/compute-resources/ - ## We usually recommend not to specify default resources and to leave this as a conscious - ## choice for the user. This also increases chances charts run on environments with little - ## resources, such as Minikube. If you do want to specify resources, uncomment the following - ## lines, adjust them as necessary, and remove the curly braces after 'resources:'. - ## @param clair.adapter.resources.limits The resources limits for the container - ## @param clair.adapter.resources.requests The requested resources for the container + ## @param clair.adapter.resources.limits The resources limits for the Harbor Adapter for Clair containers + ## @param clair.adapter.resources.requests The requested resources for the Harbor Adapter for Clair containers ## resources: - ## Example: - ## limits: - ## cpu: 500m - ## memory: 1Gi limits: {} - ## Examples: - ## requests: - ## cpu: 250m - ## memory: 256Mi requests: {} + ## Configure Harbor Adapter for Clair containers (only main one) Security Context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container + ## @param clair.adapter.containerSecurityContext.enabled Enabled Harbor Adapter for Clair containers' Security Context + ## @param clair.adapter.containerSecurityContext.runAsUser Set Harbor Adapter for Clair containers' Security Context runAsUser + ## @param clair.adapter.containerSecurityContext.runAsNonRoot Set Harbor Adapter for Clair containers' Security Context runAsNonRoot + ## + containerSecurityContext: + enabled: true + runAsUser: 1001 + runAsNonRoot: true + ## @param clair.adapter.lifecycleHooks LifecycleHook for the Harbor Adapter for Clair container(s) to automate configuration before or after startup + ## + lifecycleHooks: {} + ## @param clair.adapter.extraVolumeMounts Optionally specify extra list of additional volumeMounts for the Harbor Adapter for Clair pods + ## + extraVolumeMounts: [] + ## Harbor Adapter for Clair service configuration + ## + service: + ## @param clair.adapter.service.ports.http Harbor Adapter for Clair HTTP service port + ## @param clair.adapter.service.ports.https Harbor Adapter for Clair HTTPS service port + ## + ports: + http: 8080 + https: 8443 ## Clair main container properties ## server: + ## Bitnami Harbor Clair image + ## ref: https://hub.docker.com/r/bitnami/harbor-clair/tags/ + ## @param clair.server.image.registry Harbor Clair image registry + ## @param clair.server.image.repository Harbor Clair image repository + ## @param clair.server.image.tag Harbor Clair image tag (immutable tags are recommended) + ## @param clair.server.image.pullPolicy Harbor Clair image pull policy + ## @param clair.server.image.pullSecrets Harbor Clair image pull secrets + ## @param clair.server.image.debug Enable Harbor Clair image debug mode + ## + image: + registry: docker.io + repository: bitnami/harbor-clair + tag: 2.4.1-debian-10-r78 + ## Specify a imagePullPolicy + ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' + ## ref: https://kubernetes.io/docs/user-guide/images/#pre-pulling-images + ## + pullPolicy: IfNotPresent + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## e.g: + ## pullSecrets: + ## - myRegistryKeySecretName + ## + pullSecrets: [] + ## Enable debug mode + ## + debug: false ## @param clair.server.command Override default container command (useful when using custom images) ## command: [] ## @param clair.server.args Override default container args (useful when using custom images) ## args: [] - ## Clair containers' liveness and readiness probes - ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes - ## @param clair.server.livenessProbe.enabled Enable livenessProbe + ## @param clair.server.extraEnvVars Array with extra environment variables to add Harbor Clair containers + ## + extraEnvVars: [] + ## @param clair.server.extraEnvVarsCM ConfigMap containing extra environment variables for Harbor Clair containers + ## + extraEnvVarsCM: "" + ## @param clair.server.extraEnvVarsSecret Secret containing extra environment variables (in case of sensitive data) for Harbor Clair containers + ## + extraEnvVarsSecret: "" + ## @param clair.server.containerPorts.api Harbor Clair API container port + ## @param clair.server.containerPorts.health Harbor Clair health container port + ## + containerPorts: + api: 6060 + health: 6061 + ## Configure extra options for Harbor Clair containers' liveness, readiness and startup probes + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#configure-probes + ## @param clair.server.livenessProbe.enabled Enable livenessProbe on Harbor Clair containers ## @param clair.server.livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe ## @param clair.server.livenessProbe.periodSeconds Period seconds for livenessProbe ## @param clair.server.livenessProbe.timeoutSeconds Timeout seconds for livenessProbe @@ -2135,9 +2823,7 @@ clair: timeoutSeconds: 5 failureThreshold: 6 successThreshold: 1 - ## Clair containers' readiness probe - ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes - ## @param clair.server.readinessProbe.enabled Enable readinessProbe + ## @param clair.server.readinessProbe.enabled Enable readinessProbe on Harbor Clair containers ## @param clair.server.readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe ## @param clair.server.readinessProbe.periodSeconds Period seconds for readinessProbe ## @param clair.server.readinessProbe.timeoutSeconds Timeout seconds for readinessProbe @@ -2151,510 +2837,71 @@ clair: timeoutSeconds: 5 failureThreshold: 6 successThreshold: 1 - ## @param clair.server.lifecycleHooks LifecycleHook to set additional configuration at startup, e.g. LDAP settings via REST API. Evaluated as a template + ## @param clair.server.startupProbe.enabled Enable startupProbe on Harbor Clair containers + ## @param clair.server.startupProbe.initialDelaySeconds Initial delay seconds for startupProbe + ## @param clair.server.startupProbe.periodSeconds Period seconds for startupProbe + ## @param clair.server.startupProbe.timeoutSeconds Timeout seconds for startupProbe + ## @param clair.server.startupProbe.failureThreshold Failure threshold for startupProbe + ## @param clair.server.startupProbe.successThreshold Success threshold for startupProbe ## - lifecycleHooks: {} - ## @param clair.server.customLivenessProbe Override default liveness probe + startupProbe: + enabled: false + initialDelaySeconds: 5 + periodSeconds: 10 + timeoutSeconds: 1 + failureThreshold: 15 + successThreshold: 1 + ## @param clair.server.customLivenessProbe Custom livenessProbe that overrides the default one ## customLivenessProbe: {} - ## @param clair.server.customReadinessProbe Override default readiness probe + ## @param clair.server.customReadinessProbe Custom readinessProbe that overrides the default one ## customReadinessProbe: {} - ## @param clair.server.extraEnvVars Array containing extra env vars + ## @param clair.server.customStartupProbe Custom startupProbe that overrides the default one ## - extraEnvVars: [] - ## @param clair.server.extraEnvVarsCM ConfigMap containing extra env vars - ## - extraEnvVarsCM: "" - ## @param clair.server.extraEnvVarsSecret Secret containing extra env vars (in case of sensitive data) - ## - extraEnvVarsSecret: "" - ## @param clair.server.extraVolumeMounts Array of extra volume mounts to be added to the container (evaluated as template). Normally used with `extraVolumes`. - ## - extraVolumeMounts: [] - ## Clair containers' resource requests and limits + customStartupProbe: {} + ## Harbor Clair resource requests and limits ## ref: https://kubernetes.io/docs/user-guide/compute-resources/ - ## We usually recommend not to specify default resources and to leave this as a conscious - ## choice for the user. This also increases chances charts run on environments with little - ## resources, such as Minikube. If you do want to specify resources, uncomment the following - ## lines, adjust them as necessary, and remove the curly braces after 'resources:'. - ## @param clair.server.resources.limits The resources limits for the container - ## @param clair.server.resources.requests The requested resources for the container + ## @param clair.server.resources.limits The resources limits for the Harbor Clair containers + ## @param clair.server.resources.requests The requested resources for the Harbor Clair containers ## resources: - ## Example: - ## limits: - ## cpu: 500m - ## memory: 1Gi limits: {} - ## Examples: - ## requests: - ## cpu: 250m - ## memory: 256Mi requests: {} - ## @param clair.extraVolumes Array of extra volumes to be added to the deployment (evaluated as template). Requires setting `extraVolumeMounts` - ## - extraVolumes: [] - ## @param clair.hostAliases Specify hostAliases for the Pod to use - ## - hostAliases: [] - ## @param clair.initContainers Add additional init containers to the pod (evaluated as a template) - ## - initContainers: [] - ## @param clair.sidecars Attach additional containers to the pod (evaluated as a template) - ## - sidecars: [] - ## @param clair.podAffinityPreset Harbor Clair Pod affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` - ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity - ## - podAffinityPreset: "" - ## @param clair.podAntiAffinityPreset Harbor Clair Pod anti-affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` - ## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity - ## - podAntiAffinityPreset: soft - ## Node affinity preset - ## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity - ## - nodeAffinityPreset: - ## @param clair.nodeAffinityPreset.type Harbor Clair Node affinity preset type. Ignored if `affinity` is set. Allowed values: `soft` or `hard` + ## Configure Harbor Clair containers (only main one) Security Context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container + ## @param clair.server.containerSecurityContext.enabled Enabled Harbor Clair containers' Security Context + ## @param clair.server.containerSecurityContext.runAsUser Set Harbor Clair containers' Security Context runAsUser + ## @param clair.server.containerSecurityContext.runAsNonRoot Set Harbor Clair containers' Security Context runAsNonRoot ## - type: "" - ## @param clair.nodeAffinityPreset.key Harbor Clair Node label key to match Ignored if `affinity` is set. - ## E.g. - ## key: "kubernetes.io/e2e-az-name" + containerSecurityContext: + enabled: true + runAsUser: 1001 + runAsNonRoot: true + ## @param clair.server.lifecycleHooks LifecycleHook for the Harbor Clair container(s) to automate configuration before or after startup ## - key: "" - ## @param clair.nodeAffinityPreset.values Harbor Clair Node label values to match. Ignored if `affinity` is set. - ## E.g. - ## values: - ## - e2e-az1 - ## - e2e-az2 + lifecycleHooks: {} + ## @param clair.server.extraVolumeMounts Optionally specify extra list of additional volumeMounts for the Harbor Clair pods ## - values: [] - ## @param clair.affinity Harbor Clair Affinity for pod assignment - ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity - ## Note: podAffinityPreset, podAntiAffinityPreset, and nodeAffinityPreset will be ignored when it's set - ## - affinity: {} - ## @param clair.priorityClassName Clair pods Priority Class Name - ## ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass - ## - priorityClassName: "" - ## @param clair.nodeSelector Harbor Clair Node labels for pod assignment - ## Ref: https://kubernetes.io/docs/user-guide/node-selection/ - ## - nodeSelector: {} - ## @param clair.tolerations Harbor Clair Tolerations for pod assignment - ## Ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ - ## - tolerations: [] - ## @param clair.podLabels Add additional labels to the pod (evaluated as a template) - ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ - ## - podLabels: {} - ## @param clair.podAnnotations Annotations to add to the clair pod - ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ - ## - podAnnotations: {} - ## @param clair.automountServiceAccountToken Automount service account token - ## - automountServiceAccountToken: false + extraVolumeMounts: [] + ## Harbor Clair service configuration + ## + service: + ## @param clair.server.service.ports.api Harbor Clair API service port + ## @param clair.server.service.ports.health Harbor Clair health service port + ## + ports: + api: 6060 + health: 6061 ## @section Notary Parameters -## Bitnami Harbor Notary Server image -## ref: https://hub.docker.com/r/bitnami/harbor-notary-server/tags/ -## -notaryServerImage: - ## @param notaryServerImage.registry Registry for notary server image - ## @param notaryServerImage.repository Repository for notary server image - ## @param notaryServerImage.tag Tag for notary server image - ## @param notaryServerImage.pullPolicy Harbor notary server image pull policy - ## @param notaryServerImage.pullSecrets Specify docker-registry secret names as an array - ## @param notaryServerImage.debug Specify if debug logs should be enabled - ## - registry: docker.io - repository: bitnami/harbor-notary-server - tag: 2.4.1-debian-10-r80 - ## Specify a imagePullPolicy - ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' - ## ref: https://kubernetes.io/docs/user-guide/images/#pre-pulling-images - ## - pullPolicy: IfNotPresent - ## Optionally specify an array of imagePullSecrets. - ## Secrets must be manually created in the namespace. - ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ - ## e.g: - ## pullSecrets: - ## - myRegistryKeySecretName - ## - pullSecrets: [] - ## Set to true if you would like to see extra information on logs - ## It turns BASH and/or NAMI debugging in the image - ## - debug: false -## Bitnami Harbor Notary Signer image -## ref: https://hub.docker.com/r/bitnami/harbor-notary-signer/tags/ -## -notarySignerImage: - ## @param notarySignerImage.registry Registry for notary signer images - ## @param notarySignerImage.repository Repository for notary signer image - ## @param notarySignerImage.tag Tag for notary signer image - ## @param notarySignerImage.pullPolicy Harbor notary signer image pull policy - ## @param notarySignerImage.pullSecrets Specify docker-registry secret names as an array - ## @param notarySignerImage.debug Specify if debug logs should be enabled - ## - registry: docker.io - repository: bitnami/harbor-notary-signer - tag: 2.4.1-debian-10-r77 - ## Specify a imagePullPolicy - ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' - ## ref: https://kubernetes.io/docs/user-guide/images/#pre-pulling-images - ## - pullPolicy: IfNotPresent - ## Optionally specify an array of imagePullSecrets. - ## Secrets must be manually created in the namespace. - ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ - ## e.g: - ## pullSecrets: - ## - myRegistryKeySecretName - ## - pullSecrets: [] - ## Set to true if you would like to see extra information on logs - ## It turns BASH and/or NAMI debugging in the image - ## - debug: false ## Notary Parameters ## notary: ## @param notary.enabled Enable Notary ## enabled: true - server: - ## @param notary.server.command Override default container command (useful when using custom images) - ## - command: [] - ## @param notary.server.args Override default container args (useful when using custom images) - ## - args: [] - ## @param notary.server.replicas The replica count - ## - replicas: 1 - ## @param notary.server.updateStrategy.type Update strategy - only really applicable for deployments with RWO PVs attached - ## If replicas = 1, an update can get "stuck", as the previous pod remains attached to the - ## PV, and the "incoming" pod can never start. Changing the strategy to "Recreate" will - ## terminate the single previous pod, so that the new, incoming pod can attach to the PV - ## - updateStrategy: - type: RollingUpdate - ## @param notary.server.extraEnvVars Array containing extra env vars - ## For example: - ## - name: BEARER_AUTH - ## value: true - ## - extraEnvVars: [] - ## @param notary.server.extraEnvVarsCM ConfigMap containing extra env vars - ## - extraEnvVarsCM: "" - ## @param notary.server.extraEnvVarsSecret Secret containing extra env vars (in case of sensitive data) - ## - extraEnvVarsSecret: "" - ## @param notary.server.extraVolumeMounts Array of extra volume mounts to be added to the container (evaluated as template). Normally used with `extraVolumes`. - ## - extraVolumeMounts: [] - ## @param notary.server.hostAliases HostAliases to add to the deployment - ## - hostAliases: [] - ## @param notary.server.lifecycleHooks LifecycleHook to set additional configuration at startup, e.g. LDAP settings via REST API. Evaluated as a template - ## - lifecycleHooks: {} - ## Notary server containers' resource requests and limits - ## ref: https://kubernetes.io/docs/user-guide/compute-resources/ - ## We usually recommend not to specify default resources and to leave this as a conscious - ## choice for the user. This also increases chances charts run on environments with little - ## resources, such as Minikube. If you do want to specify resources, uncomment the following - ## lines, adjust them as necessary, and remove the curly braces after 'resources:'. - ## @param notary.server.resources.limits The resources limits for the container - ## @param notary.server.resources.requests The requested resources for the container - ## - resources: - ## Example: - ## limits: - ## cpu: 500m - ## memory: 1Gi - limits: {} - ## Examples: - ## requests: - ## cpu: 250m - ## memory: 256Mi - requests: {} - ## Notary server containers' liveness probe - ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes - ## @param notary.server.livenessProbe.enabled Enable livenessProbe - ## @param notary.server.livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe - ## @param notary.server.livenessProbe.periodSeconds Period seconds for livenessProbe - ## @param notary.server.livenessProbe.timeoutSeconds Timeout seconds for livenessProbe - ## @param notary.server.livenessProbe.failureThreshold Failure threshold for livenessProbe - ## @param notary.server.livenessProbe.successThreshold Success threshold for livenessProbe - ## - livenessProbe: - enabled: true - initialDelaySeconds: 10 - periodSeconds: 10 - timeoutSeconds: 5 - failureThreshold: 6 - successThreshold: 1 - ## Notary server containers' readiness probe - ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes - ## @param notary.server.readinessProbe.enabled Enable readinessProbe - ## @param notary.server.readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe - ## @param notary.server.readinessProbe.periodSeconds Period seconds for readinessProbe - ## @param notary.server.readinessProbe.timeoutSeconds Timeout seconds for readinessProbe - ## @param notary.server.readinessProbe.failureThreshold Failure threshold for readinessProbe - ## @param notary.server.readinessProbe.successThreshold Success threshold for readinessProbe - ## - readinessProbe: - enabled: true - initialDelaySeconds: 10 - periodSeconds: 10 - timeoutSeconds: 5 - failureThreshold: 6 - successThreshold: 1 - ## @param notary.server.customLivenessProbe Override default liveness probe - ## - customLivenessProbe: {} - ## @param notary.server.customReadinessProbe Override default readiness probe - ## - customReadinessProbe: {} - ## @param notary.server.extraVolumes Array of extra volumes to be added to the deployment (evaluated as template). Requires setting `extraVolumeMounts` - ## - extraVolumes: [] - ## @param notary.server.initContainers Add additional init containers to the pod (evaluated as a template) - ## - initContainers: [] - ## @param notary.server.sidecars Attach additional containers to the pod (evaluated as a template) - ## - sidecars: [] - ## @param notary.server.podAffinityPreset Notary server Pod affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` - ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity - ## - podAffinityPreset: "" - ## @param notary.server.podAntiAffinityPreset Notary server Pod anti-affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` - ## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity - ## - podAntiAffinityPreset: soft - ## Node affinity preset - ## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity - ## - nodeAffinityPreset: - ## @param notary.server.nodeAffinityPreset.type Notary server Node affinity preset type. Ignored if `affinity` is set. Allowed values: `soft` or `hard` - ## - type: "" - ## @param notary.server.nodeAffinityPreset.key Notary server Node label key to match Ignored if `affinity` is set. - ## E.g. - ## key: "kubernetes.io/e2e-az-name" - ## - key: "" - ## @param notary.server.nodeAffinityPreset.values Notary server Node label values to match. Ignored if `affinity` is set. - ## E.g. - ## values: - ## - e2e-az1 - ## - e2e-az2 - ## - values: [] - ## @param notary.server.affinity Notary server Affinity for pod assignment - ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity - ## Note: podAffinityPreset, podAntiAffinityPreset, and nodeAffinityPreset will be ignored when it's set - ## - affinity: {} - ## @param notary.server.priorityClassName Notary server pods Priority Class Name - ## ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass - ## - priorityClassName: "" - ## @param notary.server.nodeSelector Notary server Node labels for pod assignment - ## Ref: https://kubernetes.io/docs/user-guide/node-selection/ - ## - nodeSelector: {} - ## @param notary.server.tolerations Notary server Tolerations for pod assignment - ## Ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ - ## - tolerations: [] - ## @param notary.server.podLabels Add additional labels to the pod (evaluated as a template) - ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ - ## - podLabels: {} - ## @param notary.server.podAnnotations Annotations to add to the notary pod - ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ - ## - podAnnotations: {} - ## @param notary.server.automountServiceAccountToken Automount service account token - ## - automountServiceAccountToken: false - signer: - ## @param notary.signer.command Override default container command (useful when using custom images) - ## - command: [] - ## @param notary.signer.args Override default container args (useful when using custom images) - ## - args: [] - ## @param notary.signer.replicas The replica count - ## - replicas: 1 - ## @param notary.signer.updateStrategy.type Update strategy - only really applicable for deployments with RWO PVs attached - ## If replicas = 1, an update can get "stuck", as the previous pod remains attached to the - ## PV, and the "incoming" pod can never start. Changing the strategy to "Recreate" will - ## terminate the single previous pod, so that the new, incoming pod can attach to the PV - ## - updateStrategy: - type: RollingUpdate - ## @param notary.signer.extraEnvVars Array containing extra env vars - ## For example: - ## extraEnvVars: - ## - name: BEARER_AUTH - ## value: true - ## - extraEnvVars: [] - ## @param notary.signer.extraEnvVarsCM ConfigMap containing extra env vars - ## - extraEnvVarsCM: "" - ## @param notary.signer.extraEnvVarsSecret Secret containing extra env vars (in case of sensitive data) - ## - extraEnvVarsSecret: "" - ## @param notary.signer.extraVolumeMounts Array of extra volume mounts to be added to the container (evaluated as template). Normally used with `extraVolumes`. - ## - extraVolumeMounts: [] - ## Notary signer containers' resource requests and limits - ## ref: https://kubernetes.io/docs/user-guide/compute-resources/ - ## We usually recommend not to specify default resources and to leave this as a conscious - ## choice for the user. This also increases chances charts run on environments with little - ## resources, such as Minikube. If you do want to specify resources, uncomment the following - ## lines, adjust them as necessary, and remove the curly braces after 'resources:'. - ## @param notary.signer.resources.limits The resources limits for the container - ## @param notary.signer.resources.requests The requested resources for the container - ## - resources: - ## Example: - ## limits: - ## cpu: 500m - ## memory: 1Gi - limits: {} - ## Examples: - ## requests: - ## cpu: 250m - ## memory: 256Mi - requests: {} - ## @param notary.signer.extraVolumes Array of extra volumes to be added to the deployment (evaluated as template). Requires setting `extraVolumeMounts` - ## - extraVolumes: [] - ## @param notary.signer.hostAliases HostAliases to add to the deployment - ## - hostAliases: [] - ## @param notary.signer.initContainers Add additional init containers to the pod (evaluated as a template) - ## - initContainers: [] - ## @param notary.signer.sidecars Attach additional containers to the pod (evaluated as a template) - ## - sidecars: [] - ## @param notary.signer.podAffinityPreset Notary signer Pod affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` - ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity - ## Allowed values: soft, hard - ## - podAffinityPreset: "" - ## @param notary.signer.podAntiAffinityPreset Notary signer Pod anti-affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` - ## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity - ## Allowed values: soft, hard - ## - podAntiAffinityPreset: soft - ## Node affinity preset - ## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity - ## Allowed values: soft, hard - ## - nodeAffinityPreset: - ## @param notary.signer.nodeAffinityPreset.type Notary signer Node affinity preset type. Ignored if `affinity` is set. Allowed values: `soft` or `hard` - ## Allowed values: soft, hard - ## - type: "" - ## @param notary.signer.nodeAffinityPreset.key Notary signer Node label key to match Ignored if `affinity` is set. - ## E.g. - ## key: "kubernetes.io/e2e-az-name" - ## - key: "" - ## @param notary.signer.nodeAffinityPreset.values Notary signer Node label values to match. Ignored if `affinity` is set. - ## E.g. - ## values: - ## - e2e-az1 - ## - e2e-az2 - ## - values: [] - ## @param notary.signer.affinity Notary signer Affinity for pod assignment - ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity - ## Note: podAffinityPreset, podAntiAffinityPreset, and nodeAffinityPreset will be ignored when it's set - ## - affinity: {} - ## @param notary.signer.priorityClassName Notary signer pods Priority Class Name - ## ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass - ## - priorityClassName: "" - ## @param notary.signer.nodeSelector Notary signer Node labels for pod assignment - ## Ref: https://kubernetes.io/docs/user-guide/node-selection/ - ## - nodeSelector: {} - ## @param notary.signer.tolerations Notary signer Tolerations for pod assignment - ## Ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ - ## - tolerations: [] - ## @param notary.signer.podLabels Add additional labels to the pod (evaluated as a template) - ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ - ## - podLabels: {} - ## @param notary.signer.podAnnotations Annotations to add to the notary.signer pod - ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ - ## - podAnnotations: {} - ## Notary signer containers' liveness probes - ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes - ## @param notary.signer.livenessProbe.enabled Enable livenessProbe - ## @param notary.signer.livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe - ## @param notary.signer.livenessProbe.periodSeconds Period seconds for livenessProbe - ## @param notary.signer.livenessProbe.timeoutSeconds Timeout seconds for livenessProbe - ## @param notary.signer.livenessProbe.failureThreshold Failure threshold for livenessProbe - ## @param notary.signer.livenessProbe.successThreshold Success threshold for livenessProbe - ## - livenessProbe: - enabled: true - initialDelaySeconds: 10 - periodSeconds: 10 - timeoutSeconds: 5 - failureThreshold: 6 - successThreshold: 1 - ## Notary signer containers' readiness probes - ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes - ## @param notary.signer.readinessProbe.enabled Enable readinessProbe - ## @param notary.signer.readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe - ## @param notary.signer.readinessProbe.periodSeconds Period seconds for readinessProbe - ## @param notary.signer.readinessProbe.timeoutSeconds Timeout seconds for readinessProbe - ## @param notary.signer.readinessProbe.failureThreshold Failure threshold for readinessProbe - ## @param notary.signer.readinessProbe.successThreshold Success threshold for readinessProbe - ## - readinessProbe: - enabled: true - initialDelaySeconds: 10 - periodSeconds: 10 - timeoutSeconds: 5 - failureThreshold: 6 - successThreshold: 1 - ## @param notary.signer.lifecycleHooks LifecycleHook to set additional configuration at startup, e.g. LDAP settings via REST API. Evaluated as a template - ## - lifecycleHooks: {} - ## @param notary.signer.customLivenessProbe Override default liveness probe - ## - customLivenessProbe: {} - ## @param notary.signer.customReadinessProbe Override default readiness probe - ## - customReadinessProbe: {} - ## @param notary.signer.automountServiceAccountToken Automount service account token - ## - automountServiceAccountToken: false ## @param notary.secretName Fill the name of a kubernetes secret if you want to use your own TLS certificate authority, certificate and private key for notary communications. The secret must contain keys named `notary-signer-ca.crt`, `notary-signer.key` and `notary-signer.crt` that contain the CA, certificate and private key. They will be generated if not set. ## TLS certificate authority, certificate and private key for notary ## communications. @@ -2663,74 +2910,531 @@ notary: ## They will be generated if not set. ## secretName: "" + server: + ## Bitnami Harbor Notary Server image + ## ref: https://hub.docker.com/r/bitnami/harbor-notary-server/tags/ + ## @param notary.server.image.registry Harbor Notary Server image registry + ## @param notary.server.image.repository Harbor Notary Server image repository + ## @param notary.server.image.tag Harbor Notary Server image tag (immutable tags are recommended) + ## @param notary.server.image.pullPolicy Harbor Notary Server image pull policy + ## @param notary.server.image.pullSecrets Harbor Notary Server image pull secrets + ## @param notary.server.image.debug Enable Harbor Notary Server image debug mode + ## + image: + registry: docker.io + repository: bitnami/harbor-notary-server + tag: 2.4.1-debian-10-r80 + ## Specify a imagePullPolicy + ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' + ## ref: https://kubernetes.io/docs/user-guide/images/#pre-pulling-images + ## + pullPolicy: IfNotPresent + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## e.g: + ## pullSecrets: + ## - myRegistryKeySecretName + ## + pullSecrets: [] + ## Enable debug mode + ## + debug: false + ## @param notary.server.command Override default container command (useful when using custom images) + ## + command: [] + ## @param notary.server.args Override default container args (useful when using custom images) + ## + args: [] + ## @param notary.server.extraEnvVars Array with extra environment variables to add Harbor Notary Server pods + ## + extraEnvVars: [] + ## @param notary.server.extraEnvVarsCM ConfigMap containing extra environment variables for Harbor Notary Server pods + ## + extraEnvVarsCM: "" + ## @param notary.server.extraEnvVarsSecret Secret containing extra environment variables (in case of sensitive data) for Harbor Notary Server pods + ## + extraEnvVarsSecret: "" + ## @param notary.server.containerPorts.server Harbor Notary Server container port + ## + containerPorts: + server: 4443 + ## @param notary.server.replicaCount Number of Harbor Notary Server replicas + ## + replicaCount: 1 + ## Configure extra options for Harbor Notary Server containers' liveness, readiness and startup probes + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#configure-probes + ## @param notary.server.livenessProbe.enabled Enable livenessProbe on Harbor Notary Server containers + ## @param notary.server.livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe + ## @param notary.server.livenessProbe.periodSeconds Period seconds for livenessProbe + ## @param notary.server.livenessProbe.timeoutSeconds Timeout seconds for livenessProbe + ## @param notary.server.livenessProbe.failureThreshold Failure threshold for livenessProbe + ## @param notary.server.livenessProbe.successThreshold Success threshold for livenessProbe + ## + livenessProbe: + enabled: true + initialDelaySeconds: 20 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 6 + successThreshold: 1 + ## @param notary.server.readinessProbe.enabled Enable readinessProbe on Harbor Notary Server containers + ## @param notary.server.readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe + ## @param notary.server.readinessProbe.periodSeconds Period seconds for readinessProbe + ## @param notary.server.readinessProbe.timeoutSeconds Timeout seconds for readinessProbe + ## @param notary.server.readinessProbe.failureThreshold Failure threshold for readinessProbe + ## @param notary.server.readinessProbe.successThreshold Success threshold for readinessProbe + ## + readinessProbe: + enabled: true + initialDelaySeconds: 20 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 6 + successThreshold: 1 + ## @param notary.server.startupProbe.enabled Enable startupProbe on Harbor Notary Server containers + ## @param notary.server.startupProbe.initialDelaySeconds Initial delay seconds for startupProbe + ## @param notary.server.startupProbe.periodSeconds Period seconds for startupProbe + ## @param notary.server.startupProbe.timeoutSeconds Timeout seconds for startupProbe + ## @param notary.server.startupProbe.failureThreshold Failure threshold for startupProbe + ## @param notary.server.startupProbe.successThreshold Success threshold for startupProbe + ## + startupProbe: + enabled: false + initialDelaySeconds: 5 + periodSeconds: 10 + timeoutSeconds: 1 + failureThreshold: 15 + successThreshold: 1 + ## @param notary.server.customLivenessProbe Custom livenessProbe that overrides the default one + ## + customLivenessProbe: {} + ## @param notary.server.customReadinessProbe Custom readinessProbe that overrides the default one + ## + customReadinessProbe: {} + ## @param notary.server.customStartupProbe Custom startupProbe that overrides the default one + ## + customStartupProbe: {} + ## Harbor Notary Server resource requests and limits + ## ref: https://kubernetes.io/docs/user-guide/compute-resources/ + ## @param notary.server.resources.limits The resources limits for the Harbor Notary Server containers + ## @param notary.server.resources.requests The requested resources for the Harbor Notary Server containers + ## + resources: + limits: {} + requests: {} + ## Configure Harbor Notary Server pods Security Context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod + ## @param notary.server.podSecurityContext.enabled Enabled Harbor Notary Server pods' Security Context + ## @param notary.server.podSecurityContext.fsGroup Set Harbor Notary Server pod's Security Context fsGroup + ## + podSecurityContext: + enabled: true + fsGroup: 1001 + ## Configure Harbor Notary Server containers (only main one) Security Context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container + ## @param notary.server.containerSecurityContext.enabled Enabled Harbor Notary Server containers' Security Context + ## @param notary.server.containerSecurityContext.runAsUser Set Harbor Notary Server containers' Security Context runAsUser + ## @param notary.server.containerSecurityContext.runAsNonRoot Set Harbor Notary Server containers' Security Context runAsNonRoot + ## + containerSecurityContext: + enabled: true + runAsUser: 1001 + runAsNonRoot: true + ## @param notary.server.updateStrategy.type Harbor Notary Server deployment strategy type - only really applicable for deployments with RWO PVs attached + ## @param notary.server.updateStrategy.rollingUpdate Harbor Notary Server deployment rolling update configuration parameters + ## If replicas = 1, an update can get "stuck", as the previous pod remains attached to the + ## PV, and the "incoming" pod can never start. Changing the strategy to "Recreate" will + ## terminate the single previous pod, so that the new, incoming pod can attach to the PV + ## + updateStrategy: + type: RollingUpdate + rollingUpdate: {} + ## @param notary.server.lifecycleHooks LifecycleHook for the Harbor Notary Server container(s) to automate configuration before or after startup + ## + lifecycleHooks: {} + ## @param notary.server.hostAliases Harbor Notary Server pods host aliases + ## + hostAliases: [] + ## @param notary.server.podLabels Add additional labels to the Harbor Notary Server pods (evaluated as a template) + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + ## + podLabels: {} + ## @param notary.server.podAnnotations Annotations to add to the Harbor Notary Server pods (evaluated as a template) + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ + ## + podAnnotations: {} + ## @param notary.server.podAffinityPreset Harbor Notary Server Pod affinity preset. Ignored if `notary.server.affinity` is set. Allowed values: `soft` or `hard` + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity + ## + podAffinityPreset: "" + ## @param notary.server.podAntiAffinityPreset Harbor Notary Server Pod anti-affinity preset. Ignored if `notary.server.affinity` is set. Allowed values: `soft` or `hard` + ## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity + ## + podAntiAffinityPreset: soft + ## Node affinity preset + ## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity + ## + nodeAffinityPreset: + ## @param notary.server.nodeAffinityPreset.type Harbor Notary Server Node affinity preset type. Ignored if `notary.server.affinity` is set. Allowed values: `soft` or `hard` + ## + type: "" + ## @param notary.server.nodeAffinityPreset.key Harbor Notary Server Node label key to match Ignored if `notary.server.affinity` is set. + ## E.g. + ## key: "kubernetes.io/e2e-az-name" + ## + key: "" + ## @param notary.server.nodeAffinityPreset.values Harbor Notary Server Node label values to match. Ignored if `notary.server.affinity` is set. + ## E.g. + ## values: + ## - e2e-az1 + ## - e2e-az2 + ## + values: [] + ## @param notary.server.affinity Harbor Notary Server Affinity for pod assignment + ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity + ## Note: notary.server.podAffinityPreset, notary.server.podAntiAffinityPreset, and notary.server.nodeAffinityPreset will be ignored when it's set + ## + affinity: {} + ## @param notary.server.nodeSelector Harbor Notary Server Node labels for pod assignment + ## Ref: https://kubernetes.io/docs/user-guide/node-selection/ + ## + nodeSelector: {} + ## @param notary.server.tolerations Harbor Notary Server Tolerations for pod assignment + ## Ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ + ## + tolerations: [] + ## @param notary.server.topologySpreadConstraints Topology Spread Constraints for pod assignment spread across your cluster among failure-domains. Evaluated as a template + ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/#spread-constraints-for-pods + ## + topologySpreadConstraints: {} + ## @param notary.server.priorityClassName Priority Class Name + ## ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass + ## + priorityClassName: "" + ## @param notary.server.schedulerName Use an alternate scheduler, e.g. "stork". + ## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/ + ## + schedulerName: "" + ## @param notary.server.sidecars Add additional sidecar containers to the Harbor Notary Server pods + ## Example: + ## sidecars: + ## - name: your-image-name + ## image: your-image + ## imagePullPolicy: Always + ## ports: + ## - name: portname + ## containerPort: 1234 + ## + sidecars: [] + ## @param notary.server.initContainers Add additional init containers to the Harbor Notary Server pods + ## Example: + ## initContainers: + ## - name: your-image-name + ## image: your-image + ## imagePullPolicy: Always + ## ports: + ## - name: portname + ## containerPort: 1234 + ## + initContainers: [] + ## @param notary.server.extraVolumeMounts Optionally specify extra list of additional volumeMounts for the Harbor Notary Server pods + ## + extraVolumeMounts: [] + ## @param notary.server.extraVolumes Optionally specify extra list of additional volumes for the Harbor Notary Server pods + ## + extraVolumes: [] + ## @param notary.server.automountServiceAccountToken Automount service account token + ## + automountServiceAccountToken: false + signer: + ## Bitnami Harbor Notary Signer image + ## ref: https://hub.docker.com/r/bitnami/harbor-notary-signer/tags/ + ## @param notary.signer.image.registry Harbor Notary Signer image registry + ## @param notary.signer.image.repository Harbor Notary Signer image repository + ## @param notary.signer.image.tag Harbor Notary Signer image tag (immutable tags are recommended) + ## @param notary.signer.image.pullPolicy Harbor Notary Signer image pull policy + ## @param notary.signer.image.pullSecrets Harbor Notary Signer image pull secrets + ## @param notary.signer.image.debug Enable Harbor Notary Signer image debug mode + ## + image: + registry: docker.io + repository: bitnami/harbor-notary-signer + tag: 2.4.1-debian-10-r77 + ## Specify a imagePullPolicy + ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' + ## ref: https://kubernetes.io/docs/user-guide/images/#pre-pulling-images + ## + pullPolicy: IfNotPresent + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## e.g: + ## pullSecrets: + ## - myRegistryKeySecretName + ## + pullSecrets: [] + ## Enable debug mode + ## + debug: false + ## @param notary.signer.command Override default container command (useful when using custom images) + ## + command: [] + ## @param notary.signer.args Override default container args (useful when using custom images) + ## + args: [] + ## @param notary.signer.extraEnvVars Array with extra environment variables to add Harbor Notary Signer pods + ## + extraEnvVars: [] + ## @param notary.signer.extraEnvVarsCM ConfigMap containing extra environment variables for Harbor Notary Signer pods + ## + extraEnvVarsCM: "" + ## @param notary.signer.extraEnvVarsSecret Secret containing extra environment variables (in case of sensitive data) for Harbor Notary Signer pods + ## + extraEnvVarsSecret: "" + ## @param notary.signer.containerPorts.signer Harbor Notary Signer container port + ## + containerPorts: + signer: 7899 + ## @param notary.signer.replicaCount Number of Harbor Notary Signer replicas + ## + replicaCount: 1 + ## Configure extra options for Harbor Notary Signer containers' liveness, readiness and startup probes + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#configure-probes + ## @param notary.signer.livenessProbe.enabled Enable livenessProbe on Harbor Notary Signer containers + ## @param notary.signer.livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe + ## @param notary.signer.livenessProbe.periodSeconds Period seconds for livenessProbe + ## @param notary.signer.livenessProbe.timeoutSeconds Timeout seconds for livenessProbe + ## @param notary.signer.livenessProbe.failureThreshold Failure threshold for livenessProbe + ## @param notary.signer.livenessProbe.successThreshold Success threshold for livenessProbe + ## + livenessProbe: + enabled: true + initialDelaySeconds: 20 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 6 + successThreshold: 1 + ## @param notary.signer.readinessProbe.enabled Enable readinessProbe on Harbor Notary Signer containers + ## @param notary.signer.readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe + ## @param notary.signer.readinessProbe.periodSeconds Period seconds for readinessProbe + ## @param notary.signer.readinessProbe.timeoutSeconds Timeout seconds for readinessProbe + ## @param notary.signer.readinessProbe.failureThreshold Failure threshold for readinessProbe + ## @param notary.signer.readinessProbe.successThreshold Success threshold for readinessProbe + ## + readinessProbe: + enabled: true + initialDelaySeconds: 20 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 6 + successThreshold: 1 + ## @param notary.signer.startupProbe.enabled Enable startupProbe on Harbor Notary Signer containers + ## @param notary.signer.startupProbe.initialDelaySeconds Initial delay seconds for startupProbe + ## @param notary.signer.startupProbe.periodSeconds Period seconds for startupProbe + ## @param notary.signer.startupProbe.timeoutSeconds Timeout seconds for startupProbe + ## @param notary.signer.startupProbe.failureThreshold Failure threshold for startupProbe + ## @param notary.signer.startupProbe.successThreshold Success threshold for startupProbe + ## + startupProbe: + enabled: false + initialDelaySeconds: 5 + periodSeconds: 10 + timeoutSeconds: 1 + failureThreshold: 15 + successThreshold: 1 + ## @param notary.signer.customLivenessProbe Custom livenessProbe that overrides the default one + ## + customLivenessProbe: {} + ## @param notary.signer.customReadinessProbe Custom readinessProbe that overrides the default one + ## + customReadinessProbe: {} + ## @param notary.signer.customStartupProbe Custom startupProbe that overrides the default one + ## + customStartupProbe: {} + ## Harbor Notary Signer resource requests and limits + ## ref: https://kubernetes.io/docs/user-guide/compute-resources/ + ## @param notary.signer.resources.limits The resources limits for the Harbor Notary Signer containers + ## @param notary.signer.resources.requests The requested resources for the Harbor Notary Signer containers + ## + resources: + limits: {} + requests: {} + ## Configure Harbor Notary Signer pods Security Context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod + ## @param notary.signer.podSecurityContext.enabled Enabled Harbor Notary Signer pods' Security Context + ## @param notary.signer.podSecurityContext.fsGroup Set Harbor Notary Signer pod's Security Context fsGroup + ## + podSecurityContext: + enabled: true + fsGroup: 1001 + ## Configure Harbor Notary Signer containers (only main one) Security Context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container + ## @param notary.signer.containerSecurityContext.enabled Enabled Harbor Notary Signer containers' Security Context + ## @param notary.signer.containerSecurityContext.runAsUser Set Harbor Notary Signer containers' Security Context runAsUser + ## @param notary.signer.containerSecurityContext.runAsNonRoot Set Harbor Notary Signer containers' Security Context runAsNonRoot + ## + containerSecurityContext: + enabled: true + runAsUser: 1001 + runAsNonRoot: true + ## @param notary.signer.updateStrategy.type Harbor Notary Signer deployment strategy type - only really applicable for deployments with RWO PVs attached + ## @param notary.signer.updateStrategy.rollingUpdate Harbor Notary Signer deployment rolling update configuration parameters + ## If replicas = 1, an update can get "stuck", as the previous pod remains attached to the + ## PV, and the "incoming" pod can never start. Changing the strategy to "Recreate" will + ## terminate the single previous pod, so that the new, incoming pod can attach to the PV + ## + updateStrategy: + type: RollingUpdate + rollingUpdate: {} + ## @param notary.signer.lifecycleHooks LifecycleHook for the Harbor Notary Signer container(s) to automate configuration before or after startup + ## + lifecycleHooks: {} + ## @param notary.signer.hostAliases Harbor Notary Signer pods host aliases + ## + hostAliases: [] + ## @param notary.signer.podLabels Add additional labels to the Harbor Notary Signer pods (evaluated as a template) + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + ## + podLabels: {} + ## @param notary.signer.podAnnotations Annotations to add to the Harbor Notary Signer pods (evaluated as a template) + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ + ## + podAnnotations: {} + ## @param notary.signer.podAffinityPreset Harbor Notary Signer Pod affinity preset. Ignored if `notary.signer.affinity` is set. Allowed values: `soft` or `hard` + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity + ## + podAffinityPreset: "" + ## @param notary.signer.podAntiAffinityPreset Harbor Notary Signer Pod anti-affinity preset. Ignored if `notary.signer.affinity` is set. Allowed values: `soft` or `hard` + ## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity + ## + podAntiAffinityPreset: soft + ## Node affinity preset + ## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity + ## + nodeAffinityPreset: + ## @param notary.signer.nodeAffinityPreset.type Harbor Notary Signer Node affinity preset type. Ignored if `notary.signer.affinity` is set. Allowed values: `soft` or `hard` + ## + type: "" + ## @param notary.signer.nodeAffinityPreset.key Harbor Notary Signer Node label key to match Ignored if `notary.signer.affinity` is set. + ## E.g. + ## key: "kubernetes.io/e2e-az-name" + ## + key: "" + ## @param notary.signer.nodeAffinityPreset.values Harbor Notary Signer Node label values to match. Ignored if `notary.signer.affinity` is set. + ## E.g. + ## values: + ## - e2e-az1 + ## - e2e-az2 + ## + values: [] + ## @param notary.signer.affinity Harbor Notary Signer Affinity for pod assignment + ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity + ## Note: notary.signer.podAffinityPreset, notary.signer.podAntiAffinityPreset, and notary.signer.nodeAffinityPreset will be ignored when it's set + ## + affinity: {} + ## @param notary.signer.nodeSelector Harbor Notary Signer Node labels for pod assignment + ## Ref: https://kubernetes.io/docs/user-guide/node-selection/ + ## + nodeSelector: {} + ## @param notary.signer.tolerations Harbor Notary Signer Tolerations for pod assignment + ## Ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ + ## + tolerations: [] + ## @param notary.signer.topologySpreadConstraints Topology Spread Constraints for pod assignment spread across your cluster among failure-domains. Evaluated as a template + ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/#spread-constraints-for-pods + ## + topologySpreadConstraints: {} + ## @param notary.signer.priorityClassName Priority Class Name + ## ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass + ## + priorityClassName: "" + ## @param notary.signer.schedulerName Use an alternate scheduler, e.g. "stork". + ## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/ + ## + schedulerName: "" + ## @param notary.signer.sidecars Add additional sidecar containers to the Harbor Notary Signer pods + ## Example: + ## sidecars: + ## - name: your-image-name + ## image: your-image + ## imagePullPolicy: Always + ## ports: + ## - name: portname + ## containerPort: 1234 + ## + sidecars: [] + ## @param notary.signer.initContainers Add additional init containers to the Harbor Notary Signer pods + ## Example: + ## initContainers: + ## - name: your-image-name + ## image: your-image + ## imagePullPolicy: Always + ## ports: + ## - name: portname + ## containerPort: 1234 + ## + initContainers: [] + ## @param notary.signer.extraVolumeMounts Optionally specify extra list of additional volumeMounts for the Harbor Notary Signer pods + ## + extraVolumeMounts: [] + ## @param notary.signer.extraVolumes Optionally specify extra list of additional volumes for the Harbor Notary Signer pods + ## + extraVolumes: [] + ## @param notary.signer.automountServiceAccountToken Automount service account token + ## + automountServiceAccountToken: false + ## Harbor Notary service configuration + ## + service: + ## @param notary.service.ports.server Harbor Notary server service port + ## @param notary.service.ports.signer Harbor Notary signer service port + ## + ports: + server: 4443 + signer: 7899 -## @section Harbor Trivy Parameters +## @section Harbor Adapter Trivy Parameters -## Bitnami Harbor Trivy image -## ref: https://hub.docker.com/r/bitnami/harbor-trivy-adapter/tags/ -## -trivyImage: - ## @param trivyImage.registry Registry for trivy image - ## @param trivyImage.repository Repository for trivy image - ## @param trivyImage.tag Tag for trivy image - ## @param trivyImage.pullPolicy Harbor trivy image pull policy - ## @param trivyImage.pullSecrets Specify docker-registry secret names as an array - ## @param trivyImage.debug Specify if debug logs should be enabled - ## - registry: docker.io - repository: bitnami/harbor-adapter-trivy - tag: 2.4.1-debian-10-r75 - ## Specify a imagePullPolicy - ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' - ## ref: https://kubernetes.io/docs/user-guide/images/#pre-pulling-images - ## - pullPolicy: IfNotPresent - ## Optionally specify an array of imagePullSecrets. - ## Secrets must be manually created in the namespace. - ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ - ## e.g: - ## pullSecrets: - ## - myRegistryKeySecretName - ## - pullSecrets: [] - ## Set to true if you would like to see extra information on logs - ## It turns BASH and/or NAMI debugging in the image - ## - debug: false -## Trivy adapter parameters -## trivy: + ## Bitnami Harbor Adapter Trivy image + ## ref: https://hub.docker.com/r/bitnami/harbor-adapter-trivy/tags/ + ## @param trivy.image.registry Harbor Adapter Trivy image registry + ## @param trivy.image.repository Harbor Adapter Trivy image repository + ## @param trivy.image.tag Harbor Adapter Trivy image tag (immutable tags are recommended) + ## @param trivy.image.pullPolicy Harbor Adapter Trivy image pull policy + ## @param trivy.image.pullSecrets Harbor Adapter Trivy image pull secrets + ## @param trivy.image.debug Enable Harbor Adapter Trivy image debug mode + ## + image: + registry: docker.io + repository: bitnami/harbor-adapter-trivy + tag: 2.4.1-debian-10-r75 + ## Specify a imagePullPolicy + ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' + ## ref: https://kubernetes.io/docs/user-guide/images/#pre-pulling-images + ## + pullPolicy: IfNotPresent + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## e.g: + ## pullSecrets: + ## - myRegistryKeySecretName + ## + pullSecrets: [] + ## Enable debug mode + ## + debug: false ## @param trivy.enabled Enable Trivy ## enabled: true - ## @param trivy.replicas The replica count - ## - replicas: 1 - ## @param trivy.command Override default container command (useful when using custom images) - ## - command: [] - ## @param trivy.args Override default container args (useful when using custom images) - ## - args: [] - ## Use TLS in the container - ## - tls: - ## @param trivy.tls.existingSecret Name of a secret with the certificates for internal TLS access. Requires internalTLS.enabled to be set to true. If this values is not set it will be automatically generated - ## - existingSecret: "" - ## @param trivy.updateStrategy.type Update strategy - ## - updateStrategy: - type: RollingUpdate ## @param trivy.debugMode The flag to enable Trivy debug mode ## debugMode: false ## @param trivy.vulnType Comma-separated list of vulnerability types. Possible values `os` and `library`. ## vulnType: 'os,library' - ## @param trivy.automountServiceAccountToken Automount service account token in the Trivy containers - ## - automountServiceAccountToken: false ## @param trivy.severity Comma-separated list of severities to be checked ## severity: 'UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL' @@ -2766,45 +3470,41 @@ trivy: ## @param trivy.cacheDir Directory to store the cache ## cacheDir: '/bitnami/harbor-adapter-trivy/.cache' - ## @param trivy.resources [object] The resources to allocate for container + ## Use TLS in the container ## - resources: - requests: - cpu: 200m - memory: 512Mi - limits: - cpu: 1 - memory: 1Gi - ## @param trivy.extraEnvVars Array containing extra env vars - ## For example: - ## - name: BEARER_AUTH - ## value: true + tls: + ## @param trivy.tls.existingSecret Name of an existing secret with the certificates for internal TLS access + ## Requires `internalTLS.enabled` to be set to `true`` + ## Self-signed TLS certificates will be used otherwise + ## + existingSecret: "" + ## @param trivy.command Override default container command (useful when using custom images) + ## + command: [] + ## @param trivy.args Override default container args (useful when using custom images) + ## + args: [] + ## @param trivy.extraEnvVars Array with extra environment variables to add Trivy pods ## extraEnvVars: [] - ## @param trivy.extraEnvVarsCM ConfigMap containing extra env vars + ## @param trivy.extraEnvVarsCM ConfigMap containing extra environment variables for Trivy pods ## extraEnvVarsCM: "" - ## @param trivy.extraEnvVarsSecret Secret containing extra env vars (in case of sensitive data) + ## @param trivy.extraEnvVarsSecret Secret containing extra environment variables (in case of sensitive data) for Trivy pods ## extraEnvVarsSecret: "" - ## @param trivy.extraVolumes Array of extra volumes to be added to the deployment (evaluated as template). Requires setting `extraVolumeMounts` + ## @param trivy.containerPorts.http Trivy HTTP container port + ## @param trivy.containerPorts.https Trivy HTTPS container port ## - extraVolumes: [] - ## @param trivy.extraVolumeMounts Array of extra volume mounts to be added to the container (evaluated as template). Normally used with `extraVolumes`. + containerPorts: + http: 8080 + https: 8443 + ## @param trivy.replicaCount Number of Trivy replicas ## - extraVolumeMounts: [] - ## @param trivy.hostAliases Specify hostAliases for the Pod to use - ## - hostAliases: [] - ## @param trivy.initContainers Add additional init containers to the pod (evaluated as a template) - ## - initContainers: [] - ## @param trivy.sidecars Attach additional containers to the pod (evaluated as a template) - ## - sidecars: [] - ## Trivy containers' liveness probe - ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes - ## @param trivy.livenessProbe.enabled Enable livenessProbe + replicaCount: 1 + ## Configure extra options for Trivy containers' liveness, readiness and startup probes + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#configure-probes + ## @param trivy.livenessProbe.enabled Enable livenessProbe on Trivy containers ## @param trivy.livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe ## @param trivy.livenessProbe.periodSeconds Period seconds for livenessProbe ## @param trivy.livenessProbe.timeoutSeconds Timeout seconds for livenessProbe @@ -2818,9 +3518,7 @@ trivy: timeoutSeconds: 5 failureThreshold: 6 successThreshold: 1 - ## Trivy containers' readiness probe - ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes - ## @param trivy.readinessProbe.enabled Enable readinessProbe + ## @param trivy.readinessProbe.enabled Enable readinessProbe on Trivy containers ## @param trivy.readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe ## @param trivy.readinessProbe.periodSeconds Period seconds for readinessProbe ## @param trivy.readinessProbe.timeoutSeconds Timeout seconds for readinessProbe @@ -2834,20 +3532,87 @@ trivy: timeoutSeconds: 5 failureThreshold: 6 successThreshold: 1 - ## @param trivy.lifecycleHooks LifecycleHook to set additional configuration at startup, e.g. LDAP settings via REST API. Evaluated as a template + ## @param trivy.startupProbe.enabled Enable startupProbe on Trivy containers + ## @param trivy.startupProbe.initialDelaySeconds Initial delay seconds for startupProbe + ## @param trivy.startupProbe.periodSeconds Period seconds for startupProbe + ## @param trivy.startupProbe.timeoutSeconds Timeout seconds for startupProbe + ## @param trivy.startupProbe.failureThreshold Failure threshold for startupProbe + ## @param trivy.startupProbe.successThreshold Success threshold for startupProbe ## - lifecycleHooks: {} - ## @param trivy.customLivenessProbe Override default liveness probe + startupProbe: + enabled: false + initialDelaySeconds: 5 + periodSeconds: 10 + timeoutSeconds: 1 + failureThreshold: 15 + successThreshold: 1 + ## @param trivy.customLivenessProbe Custom livenessProbe that overrides the default one ## customLivenessProbe: {} - ## @param trivy.customReadinessProbe Override default readiness probe + ## @param trivy.customReadinessProbe Custom readinessProbe that overrides the default one ## customReadinessProbe: {} - ## @param trivy.podAffinityPreset Trivy Pod affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` + ## @param trivy.customStartupProbe Custom startupProbe that overrides the default one + ## + customStartupProbe: {} + ## Trivy resource requests and limits + ## ref: https://kubernetes.io/docs/user-guide/compute-resources/ + ## @param trivy.resources.limits [object] The resources limits for the Trivy containers + ## @param trivy.resources.requests [object] The requested resources for the Trivy containers + ## + resources: + requests: + cpu: 200m + memory: 512Mi + limits: + cpu: 1 + memory: 1Gi + ## Configure Trivy pods Security Context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod + ## @param trivy.podSecurityContext.enabled Enabled Trivy pods' Security Context + ## @param trivy.podSecurityContext.fsGroup Set Trivy pod's Security Context fsGroup + ## + podSecurityContext: + enabled: true + fsGroup: 1001 + ## Configure Trivy containers (only main one) Security Context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container + ## @param trivy.containerSecurityContext.enabled Enabled Trivy containers' Security Context + ## @param trivy.containerSecurityContext.runAsUser Set Trivy containers' Security Context runAsUser + ## @param trivy.containerSecurityContext.runAsNonRoot Set Trivy containers' Security Context runAsNonRoot + ## + containerSecurityContext: + enabled: true + runAsUser: 1001 + runAsNonRoot: true + ## @param trivy.updateStrategy.type Trivy deployment strategy type - only really applicable for deployments with RWO PVs attached + ## @param trivy.updateStrategy.rollingUpdate Trivy deployment rolling update configuration parameters + ## If replicas = 1, an update can get "stuck", as the previous pod remains attached to the + ## PV, and the "incoming" pod can never start. Changing the strategy to "Recreate" will + ## terminate the single previous pod, so that the new, incoming pod can attach to the PV + ## + updateStrategy: + type: RollingUpdate + rollingUpdate: {} + ## @param trivy.lifecycleHooks LifecycleHook for the Trivy container(s) to automate configuration before or after startup + ## + lifecycleHooks: {} + ## @param trivy.hostAliases Trivy pods host aliases + ## + hostAliases: [] + ## @param trivy.podLabels Add additional labels to the Trivy pods (evaluated as a template) + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + ## + podLabels: {} + ## @param trivy.podAnnotations Annotations to add to the Trivy pods (evaluated as a template) + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ + ## + podAnnotations: {} + ## @param trivy.podAffinityPreset Trivy Pod affinity preset. Ignored if `trivy.affinity` is set. Allowed values: `soft` or `hard` ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity ## podAffinityPreset: "" - ## @param trivy.podAntiAffinityPreset Trivy Pod anti-affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` + ## @param trivy.podAntiAffinityPreset Trivy Pod anti-affinity preset. Ignored if `trivy.affinity` is set. Allowed values: `soft` or `hard` ## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity ## podAntiAffinityPreset: soft @@ -2855,15 +3620,15 @@ trivy: ## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity ## nodeAffinityPreset: - ## @param trivy.nodeAffinityPreset.type Trivy Node affinity preset type. Ignored if `affinity` is set. Allowed values: `soft` or `hard` + ## @param trivy.nodeAffinityPreset.type Trivy Node affinity preset type. Ignored if `trivy.affinity` is set. Allowed values: `soft` or `hard` ## type: "" - ## @param trivy.nodeAffinityPreset.key Trivy Node label key to match Ignored if `affinity` is set. + ## @param trivy.nodeAffinityPreset.key Trivy Node label key to match Ignored if `trivy.affinity` is set. ## E.g. ## key: "kubernetes.io/e2e-az-name" ## key: "" - ## @param trivy.nodeAffinityPreset.values Trivy Node label values to match. Ignored if `affinity` is set. + ## @param trivy.nodeAffinityPreset.values Trivy Node label values to match. Ignored if `trivy.affinity` is set. ## E.g. ## values: ## - e2e-az1 @@ -2872,13 +3637,9 @@ trivy: values: [] ## @param trivy.affinity Trivy Affinity for pod assignment ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity - ## Note: podAffinityPreset, podAntiAffinityPreset, and nodeAffinityPreset will be ignored when it's set + ## Note: trivy.podAffinityPreset, trivy.podAntiAffinityPreset, and trivy.nodeAffinityPreset will be ignored when it's set ## affinity: {} - ## @param trivy.priorityClassName Trivy pods Priority Class Name - ## ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass - ## - priorityClassName: "" ## @param trivy.nodeSelector Trivy Node labels for pod assignment ## Ref: https://kubernetes.io/docs/user-guide/node-selection/ ## @@ -2887,201 +3648,193 @@ trivy: ## Ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ ## tolerations: [] - ## @param trivy.podLabels Add additional labels to the pod (evaluated as a template) - ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + ## @param trivy.topologySpreadConstraints Topology Spread Constraints for pod assignment spread across your cluster among failure-domains. Evaluated as a template + ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/#spread-constraints-for-pods ## - podLabels: {} - ## @param trivy.podAnnotations Annotations to add to the trivy pod - ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ + topologySpreadConstraints: {} + ## @param trivy.priorityClassName Priority Class Name + ## ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass ## - podAnnotations: {} + priorityClassName: "" + ## @param trivy.schedulerName Use an alternate scheduler, e.g. "stork". + ## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/ + ## + schedulerName: "" + ## @param trivy.sidecars Add additional sidecar containers to the Trivy pods + ## Example: + ## sidecars: + ## - name: your-image-name + ## image: your-image + ## imagePullPolicy: Always + ## ports: + ## - name: portname + ## containerPort: 1234 + ## + sidecars: [] + ## @param trivy.initContainers Add additional init containers to the Trivy pods + ## Example: + ## initContainers: + ## - name: your-image-name + ## image: your-image + ## imagePullPolicy: Always + ## ports: + ## - name: portname + ## containerPort: 1234 + ## + initContainers: [] + ## @param trivy.extraVolumeMounts Optionally specify extra list of additional volumeMounts for the Trivy pods + ## + extraVolumeMounts: [] + ## @param trivy.extraVolumes Optionally specify extra list of additional volumes for the Trivy pods + ## + extraVolumes: [] + ## @param trivy.automountServiceAccountToken Automount service account token + ## + automountServiceAccountToken: false + ## Trivy service configuration + ## + service: + ## @param trivy.service.ports.http Trivy HTTP service port + ## @param trivy.service.ports.https Trivy HTTPS service port + ## + ports: + http: 8080 + https: 8443 ## @section PostgreSQL Parameters ## PostgreSQL chart configuration ## ref: https://github.com/bitnami/charts/blob/master/bitnami/postgresql/values.yaml -## @param postgresql.enabled If external database is used, set it to `false` -## @param postgresql.nameOverride String to partially override common.names.fullname template with a string (will prepend the release name) -## @param postgresql.postgresqlUsername Postgresql username -## @param postgresql.postgresqlPassword Postgresql password -## @param postgresql.existingSecret Set Postgresql password via an existing secret -## @param postgresql.postgresqlExtendedConf [object] Extended runtime config parameters (appended to main or default configuration) -## @param postgresql.replication.enabled Enable replicated postgresql -## @param postgresql.persistence.enabled Enable persistence for PostgreSQL +## @param postgresql.enabled Switch to enable or disable the PostgreSQL helm chart +## @param postgresql.auth.enablePostgresUser Assign a password to the "postgres" admin user. Otherwise, remote access will be blocked for this user +## @param postgresql.auth.postgresPassword Password for the "postgres" admin user +## @param postgresql.auth.existingSecret Name of existing secret to use for PostgreSQL credentials +## @param postgresql.architecture PostgreSQL architecture (`standalone` or `replication`) +## @param postgresql.primary.extendedConfiguration Extended PostgreSQL Primary configuration (appended to main or default configuration) +## @param postgresql.primary.initdb.scripts [object] Initdb scripts to create Harbor databases ## postgresql: enabled: true - nameOverride: "" - postgresqlUsername: postgres - postgresqlPassword: not-secure-database-password - ## Name of existing secret to use for PostgreSQL passwords. - ## If an existingSecret is used it will overwrite postgresqlUsername and postgresqlPassword. - ## The secret has to contain at least the key postgresql-postgres-password. + ## Override PostgreSQL default image as 14.x is not supported https://goharbor.io/docs/2.4.0/install-config/ + ## ref: https://github.com/bitnami/bitnami-docker-postgresql + ## @param postgresql.image.registry PostgreSQL image registry + ## @param postgresql.image.repository PostgreSQL image repository + ## @param postgresql.image.tag PostgreSQL image tag (immutable tags are recommended) ## - ## Example Secret: - ## apiVersion: v1 - ## kind: Secret - ## metadata: - ## name: mysecret - ## type: Opaque - ## data: - ## postgresqlUsername: YWRtaW4= - ## postgresqlPassword: MWYyZDFlMmU2N2Rm - existingSecret: "" - postgresqlExtendedConf: - maxConnections: 1024 - replication: - enabled: false - persistence: - enabled: true - ## @param postgresql.initdbScripts [object] Initdb scripts to create Harbor databases - ## - initdbScripts: - initial-notaryserver.sql: | - CREATE DATABASE notaryserver; - CREATE USER server; - alter user server with encrypted password 'password'; - GRANT ALL PRIVILEGES ON DATABASE notaryserver TO server; - initial-notarysigner.sql: | - CREATE DATABASE notarysigner; - CREATE USER signer; - alter user signer with encrypted password 'password'; - GRANT ALL PRIVILEGES ON DATABASE notarysigner TO signer; - initial-registry.sql: | - CREATE DATABASE registry ENCODING 'UTF8'; - \c registry; - CREATE TABLE schema_migrations(version bigint not null primary key, dirty boolean not null); -## If the PostgreSQL database included in the chart is disabled, Harbor will -## use below parameters to connect to an external PostgreSQL server. + image: + registry: docker.io + repository: bitnami/postgresql + tag: 11.15.0-debian-10-r20 + auth: + enablePostgresUser: true + postgresPassword: not-secure-database-password + existingSecret: "" + architecture: standalone + primary: + extendedConfiguration: | + max_connections = 1024 + initdb: + scripts: + initial-notaryserver.sql: | + CREATE DATABASE notaryserver; + CREATE USER server; + alter user server with encrypted password 'password'; + GRANT ALL PRIVILEGES ON DATABASE notaryserver TO server; + initial-notarysigner.sql: | + CREATE DATABASE notarysigner; + CREATE USER signer; + alter user signer with encrypted password 'password'; + GRANT ALL PRIVILEGES ON DATABASE notarysigner TO signer; + initial-registry.sql: | + CREATE DATABASE registry ENCODING 'UTF8'; + \c registry; + CREATE TABLE schema_migrations(version bigint not null primary key, dirty boolean not null); +## External PostgreSQL configuration +## All of these values are only used when postgresql.enabled is set to false +## @param externalDatabase.host Database host +## @param externalDatabase.port Database port number +## @param externalDatabase.user Non-root username for Harbor +## @param externalDatabase.password Password for the non-root username for Harbor +## @param externalDatabase.sslmode External database ssl mode +## @param externalDatabase.coreDatabase External database name for core +## @param externalDatabase.clairDatabase External database name for clair +## @param externalDatabase.clairUsername External database username for clair +## @param externalDatabase.clairPassword External database password for clair +## @param externalDatabase.notaryServerDatabase External database name for notary server +## @param externalDatabase.notaryServerUsername External database username for notary server +## @param externalDatabase.notaryServerPassword External database password for notary server +## @param externalDatabase.notarySignerDatabase External database name for notary signer +## @param externalDatabase.notarySignerUsername External database username for notary signer +## @param externalDatabase.notarySignerPassword External database password for notary signer ## externalDatabase: - ## @param externalDatabase.host Host of the external database - ## host: localhost - ## @param externalDatabase.user Existing username in the external db - ## - user: bn_harbor - ## @param externalDatabase.password Password for the above username - ## - password: "" - ## @param externalDatabase.port Port of the external database - ## port: 5432 - ## @param externalDatabase.sslmode External database ssl mode - ## + user: bn_harbor + password: "" sslmode: disable - ## @param externalDatabase.coreDatabase External database name for core - ## coreDatabase: "" - ## @param externalDatabase.clairDatabase External database name for clair - ## clairDatabase: "" - ## @param externalDatabase.clairUsername External database username for clair - ## clairUsername: "" - ## @param externalDatabase.clairPassword External database password for clair - ## clairPassword: "" - ## @param externalDatabase.notaryServerDatabase External database name for notary server - ## notaryServerDatabase: "" - ## @param externalDatabase.notaryServerUsername External database username for notary server - ## notaryServerUsername: "" - ## @param externalDatabase.notaryServerPassword External database password for notary server - ## notaryServerPassword: "" - ## @param externalDatabase.notarySignerDatabase External database name for notary signer - ## notarySignerDatabase: "" - ## @param externalDatabase.notarySignerUsername External database username for notary signer - ## notarySignerUsername: "" - ## @param externalDatabase.notarySignerPassword External database password for notary signer - ## notarySignerPassword: "" -## @section Redis™ Parameters +## @section Redis™ parameters ## Redis™ chart configuration ## ref: https://github.com/bitnami/charts/blob/master/bitnami/redis/values.yaml +## @param redis.enabled Switch to enable or disable the Redis™ helm +## @param redis.auth.enabled Enable password authentication +## @param redis.auth.password Redis™ password +## @param redis.auth.existingSecret The name of an existing secret with Redis™ credentials +## @param redis.architecture Redis™ architecture. Allowed values: `standalone` or `replication` ## redis: - ## @param redis.enabled If external redis is used, set it to `false` - ## enabled: true - ## @param redis.nameOverride String to partially override common.names.fullname template with a string (will prepend the release name) - ## - nameOverride: "" - ## image: - ## tag: auth: - ## @param redis.auth.enabled Use redis password - ## enabled: false - ## @param redis.auth.password Redis password - ## Defaults to a random 10-character alphanumeric string if not set and auth.enabled is true. + ## Redis™ password (both master and slave). Defaults to a random 10-character alphanumeric string if not set and auth.enabled is true. ## It should always be set using the password value or in the existingSecret to avoid issues ## with Harbor. ## The password value is ignored if existingSecret is set password: "" - ## @param redis.architecture Cluster settings - ## + existingSecret: "" architecture: standalone - ## Redis™ Master parameters - ## @param redis.master.persistence.enabled Enable persistence for master Redis - ## - master: - persistence: - enabled: true - ## @param redis.master.priorityClassName Redis pods Priority Class Name - ## ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass - ## - priorityClassName: "" - ## Redis™ Replica parameters - ## @param redis.replica.persistence.enabled Enable persistence for replica Redis - ## - replica: - persistence: - enabled: true -## If the Redis™ included in the chart is disabled, Harbor will use below -## Redis™ parameters to connect to an external Redis™ server. -## Support for both Redis™ and Redis+Sentinel™ + +## External Redis™ configuration +## All of these values are only used when redis.enabled is set to false +## @param externalRedis.host Redis™ host +## @param externalRedis.port Redis™ port number +## @param externalRedis.password Redis™ password +## @param externalRedis.coreDatabaseIndex Index for core database +## @param externalRedis.jobserviceDatabaseIndex Index for jobservice database +## @param externalRedis.registryDatabaseIndex Index for registry database +## @param externalRedis.chartmuseumDatabaseIndex Index for chartmuseum database +## @param externalRedis.clairAdapterDatabaseIndex Index for chartmuseum database +## @param externalRedis.trivyAdapterDatabaseIndex Index for chartmuseum database ## externalRedis: - ## @param externalRedis.host Host of the external redis - ## host: localhost - ## @param externalRedis.port Port of the external redis - ## port: 6379 - ## Redis™ sentinel configuration - ## If sentinel is enabled the below sentinel configurations are used as the hostname - ## - sentinel: - ## @param externalRedis.sentinel.enabled If external redis with sentinal is used, set it to `true` - ## - enabled: false - ## @param externalRedis.sentinel.masterSet Name of sentinel masterSet if sentinel is used - ## - masterSet: 'mymaster' - ## @param externalRedis.sentinel.hosts Sentinel hosts and ports in the format - ## :,:,: - ## - hosts: "" - ## @param externalRedis.password Password for the external redis - ## password: "" - ## @param externalRedis.coreDatabaseIndex Index for core database - ## @param externalRedis.jobserviceDatabaseIndex Index for jobservice database - ## @param externalRedis.registryDatabaseIndex Index for registry database - ## @param externalRedis.chartmuseumDatabaseIndex Index for chartmuseum database - ## @param externalRedis.clairAdapterDatabaseIndex Index for chartmuseum database - ## @param externalRedis.trivyAdapterDatabaseIndex Index for chartmuseum database - ## coreDatabaseIndex: '0' jobserviceDatabaseIndex: '1' registryDatabaseIndex: '2' chartmuseumDatabaseIndex: '3' clairAdapterDatabaseIndex: '4' trivyAdapterDatabaseIndex: '5' + ## Redis™ sentinel configuration + ## @param externalRedis.sentinel.enabled If external redis with sentinal is used, set it to `true` + ## @param externalRedis.sentinel.masterSet Name of sentinel masterSet if sentinel is used + ## @param externalRedis.sentinel.hosts Sentinel hosts and ports in the format + ## + sentinel: + enabled: false + masterSet: 'mymaster' + hosts: "" +