update

.helmignore

+docs/*
+.git/*
+.gitignore
+CONTRIBUTING.md
\ No newline at end of file

CONTRIBUTING.md

 # Contributing to Helm Chart for Harbor
 
-Please follow [Harbor contributing guide](https://github.com/vmware/harbor/blob/master/CONTRIBUTING.md) to learn how to make code contribution.
+Please follow [Harbor contributing guide](https://github.com/goharbor/harbor/blob/master/CONTRIBUTING.md) to learn how to make code contribution.
 
 # Contributers
 

Chart.yaml

 name: harbor
-version: 0.2.0
-appVersion: 1.5.0
-description: An Enterprise-class Docker Registry by VMware
+version: dev
+appVersion: dev
+description: An open source trusted cloud native registry that stores, signs, and scans content
 keywords:
-- vmware
 - docker
 - registry
 - harbor
-home: https://github.com/vmware/harbor
-icon: https://raw.githubusercontent.com/vmware/harbor/master/docs/img/harbor_logo.png
+home: https://goharbor.io
+icon: https://raw.githubusercontent.com/goharbor/harbor/master/docs/img/harbor_logo.png
 sources:
-- https://github.com/vmware/harbor/tree/master/contrib/helm/harbor
+- https://github.com/goharbor/harbor
+- https://github.com/goharbor/harbor-helm
 maintainers:
 - name: Jesse Hu
   email: huh@vmware.com

Deploy.md

+# harbor
+
+## install
+
+```bash
+# 1.install
+
+# label node
+kubectl label node <nodename> harbor=enabled
+
+helm install \
+/etc/kubernetes/helm/harbor \
+--name=harbor \
+--namespace=devops \
+-f /etc/kubernetes/helm/harbor/values-overrides.yaml
+
+# uninstall
+helm delete harbor --purge
+
+# update
+helm upgrade harbor /etc/kubernetes/helm/harbor \
+-f /etc/kubernetes/helm/harbor/values-overrides.yaml
+```
+
+## images
+
+```bash
+# goharbor/harbor-portal
+docker pull goharbor/harbor-portal:v1.7.5 && \
+docker tag goharbor/harbor-portal:v1.7.5 registry-vpc.cn-qingdao.aliyuncs.com/wod/harbor-portal:v1.7.5 && \
+docker push registry-vpc.cn-qingdao.aliyuncs.com/wod/harbor-portal:v1.7.5
+
+# goharbor/harbor-core
+docker pull goharbor/harbor-core:v1.7.5 && \
+docker tag goharbor/harbor-core:v1.7.5 registry-vpc.cn-qingdao.aliyuncs.com/wod/harbor-core:v1.7.5 && \
+docker push registry-vpc.cn-qingdao.aliyuncs.com/wod/harbor-core:v1.7.5
+
+# goharbor/harbor-jobservice
+docker pull goharbor/harbor-jobservice:v1.7.5 && \
+docker tag goharbor/harbor-jobservice:v1.7.5 registry-vpc.cn-qingdao.aliyuncs.com/wod/harbor-jobservice:v1.7.5 && \
+docker push registry-vpc.cn-qingdao.aliyuncs.com/wod/harbor-jobservice:v1.7.5
+
+# goharbor/registry-photon
+docker pull goharbor/registry-photon:v2.6.2-v1.7.5 && \
+docker tag goharbor/registry-photon:v2.6.2-v1.7.5 registry-vpc.cn-qingdao.aliyuncs.com/wod/registry-photon:v2.6.2-v1.7.5 && \
+docker push registry-vpc.cn-qingdao.aliyuncs.com/wod/registry-photon:v2.6.2-v1.7.5
+
+# goharbor/harbor-registryctl
+docker pull goharbor/harbor-registryctl:v1.7.5 && \
+docker tag goharbor/harbor-registryctl:v1.7.5 registry-vpc.cn-qingdao.aliyuncs.com/wod/harbor-registryctl:v1.7.5 && \
+docker push registry-vpc.cn-qingdao.aliyuncs.com/wod/harbor-registryctl:v1.7.5
+
+# goharbor/chartmuseum-photon
+docker pull goharbor/chartmuseum-photon:v0.8.1-v1.7.5 && \
+docker tag goharbor/chartmuseum-photon:v0.8.1-v1.7.5 registry-vpc.cn-qingdao.aliyuncs.com/wod/chartmuseum-photon:v0.8.1-v1.7.5 && \
+docker push registry-vpc.cn-qingdao.aliyuncs.com/wod/chartmuseum-photon:v0.8.1-v1.7.5
+
+# goharbor/clair-photon
+docker pull goharbor/clair-photon:v2.0.8-v1.7.5 && \
+docker tag goharbor/clair-photon:v2.0.8-v1.7.5 registry-vpc.cn-qingdao.aliyuncs.com/wod/clair-photon:v2.0.8-v1.7.5 && \
+docker push registry-vpc.cn-qingdao.aliyuncs.com/wod/clair-photon:v2.0.8-v1.7.5
+
+# goharbor/notary-server-photon
+docker pull goharbor/notary-server-photon:v0.6.1-v1.7.5 && \
+docker tag goharbor/notary-server-photon:v0.6.1-v1.7.5 registry-vpc.cn-qingdao.aliyuncs.com/wod/notary-server-photon:v0.6.1-v1.7.5 && \
+docker push registry-vpc.cn-qingdao.aliyuncs.com/wod/notary-server-photon:v0.6.1-v1.7.5
+
+# goharbor/notary-signer-photon
+docker pull goharbor/notary-signer-photon:v0.6.1-v1.7.5 && \
+docker tag goharbor/notary-signer-photon:v0.6.1-v1.7.5 registry-vpc.cn-qingdao.aliyuncs.com/wod/notary-signer-photon:v0.6.1-v1.7.5 && \
+docker push registry-vpc.cn-qingdao.aliyuncs.com/wod/notary-signer-photon:v0.6.1-v1.7.5
+
+# goharbor/harbor-db
+docker pull goharbor/harbor-db:v1.7.5 && \
+docker tag goharbor/harbor-db:v1.7.5 registry-vpc.cn-qingdao.aliyuncs.com/wod/harbor-db:v1.7.5 && \
+docker push registry-vpc.cn-qingdao.aliyuncs.com/wod/harbor-db:v1.7.5
+```
\ No newline at end of file

docs/High Availability.md

+# Harbor High Availability Guide
+
+## Goal
+Deploy Harbor on K8S via helm to make it highly available, that is, if one of node that has Harbor's container running becomes un accessible. Users does not experience interrupt of service of Harbor.
+
+## Prerequisites
+- Kubernetes cluster 1.10+
+- Helm 2.8.0+
+- High available ingress controller (Harbor does not manage the external endpoint)
+- High available PostgreSQL database (Harbor does not handle the deployment of HA of database)
+- High available Redis (Harbor does not handle the deployment of HA of Redis)
+- PVC that can be shared across nodes or external object storage
+
+## Architecture
+Most of Harbor's components are stateless now.  So we can simply increase the replica of the pods to make sure the components are distributed to multiple worker nodes, and leverage the "Service" mechanism of K8S to ensure the connectivity across pods.
+
+As for storage layer, it is expected that the user provide high available PostgreSQL, Redis cluster for application data and PVCs or object storage for storing images and charts.
+
+![HA](img/ha.png)
+
+## Installation
+
+### Download Chart
+Download Harbor helm chart code.
+```bash
+git clone https://github.com/goharbor/harbor-helm
+cd harbor-helm
+```
+
+### Configuration
+Configure the followings items in `values.yaml`, you can also set them as parameters via `--set` flag during running `helm install`:
+- **Ingress rule**  
+   Configure the `expose.ingress.hosts.core` and `expose.ingress.hosts.notary`.
+- **External URL**  
+   Configure the `externalURL`.
+- **External PostgreSQL**  
+   Set the `database.type` to `external` and fill the information in `database.external` section.  
+   
+   Four empty databases should be created manually for `Harbor core`, `Clair`, `Notary server` and `Notary signer` and configure them in the section. Harbor will create tables automatically when starting up.
+- **External Redis**  
+   Set the `redis.type` to `external` and fill the information in `redis.external` section.  
+
+   As the Redis client used by Harbor's upstream projects doesn't support `Sentinel`, Harbor can only work with a single entry point Redis. You can refer to this [guide](https://community.pivotal.io/s/article/How-to-setup-HAProxy-and-Redis-Sentinel-for-automatic-failover-between-Redis-Master-and-Slave-servers) to setup a HAProxy before the Redis to expose a single entry point.
+- **Storage**   
+   By default, a default `StorageClass` is needed in the K8S cluster to provision volumes to store images, charts and job logs.  
+
+   If you want to specify the `StorageClass`, set `persistence.persistentVolumeClaim.registry.storageClass`, `persistence.persistentVolumeClaim.chartmuseum.storageClass` and `persistence.persistentVolumeClaim.jobservice.storageClass`.  
+
+   If you use `StorageClass`, for both default or specified one, set `persistence.persistentVolumeClaim.registry.accessMode`, `persistence.persistentVolumeClaim.chartmuseum.accessMode` and `persistence.persistentVolumeClaim.jobservice.accessMode` as `ReadWriteMany`, and make sure that the persistent volumes must can be shared cross different nodes.  
+
+   You can also use the existing PVCs to store data, set `persistence.persistentVolumeClaim.registry.existingClaim`, `persistence.persistentVolumeClaim.chartmuseum.existingClaim` and `persistence.persistentVolumeClaim.jobservice.existingClaim`.  
+
+   If you have no PVCs that can be shared across nodes, you can use external object storage to store images and charts and store the job logs in database. Set the `persistence.imageChartStorage.type` to the value you want to use and fill the corresponding section and set `jobservice.jobLogger` to `database`.  
+
+- **Replica**   
+   Set `portal.replicas`, `core.replicas`, `jobservice.replicas`, `registry.replicas`, `chartmuseum.replicas`, `clair.replicas`, `notary.server.replicas` and `notary.signer.replicas` to `n`(`n`>=2).
+
+### Installation
+Install the Harbor helm chart with a release name `my-release`:
+```bash
+helm install --name my-release .
+```
+

docs/Upgrade.md

+# Upgrade Guide
+
+This guide is used to upgrade Harbor deployed by chart since version 0.3.0.  
+
+**Notes**:
+- As the database schema may change between different versions of Harbor, there is a progress to migrate the schema during the upgrade and the downtime cannot be avoid  
+- The database schema cannot be downgraded automatically, so the `helm rollback` is not supported  
+
+## Upgrade
+1. **Backup database**  
+Backup the database used by Harbor in case the upgrade process fails.  
+2. **Download new chart**  
+Download the latest version of Harbor chart.  
+3. **Configure new chart**  
+Configure the new chart to make sure that the configuration items have the same values with the old one.  
+
+    **Note**: if TLS is enabled and the certificate is generated by chart automatically, a new certificate will be generated and overwrite the old one during the upgrade, this may cause some issues if you have distributed the certificate. You can follow the below steps to configure the new chart to use the old certificate:  
+
+    1) Get the secret name which certificate is stored in:
+        ```
+        kubectl get secret
+        ```  
+        Find the secret whose name ends with `-harbor-ingress`(expose service via `Ingress`) or `-harbor-nginx`(expose service via `ClusterIP` or `NodePort`)  
+
+    2) Export the secret as yaml file:  
+        ```
+        kubectl get secret secret-name -o yaml > secret.yaml
+        ```  
+        Replace the `secret-name` with the one got in step i  
+
+    3) Rename the secret by setting `metadata.name` in `secret.yaml`  
+   
+    4) Create a new secret:  
+        ```
+        kubectl create -f secret.yaml
+        ```  
+
+    5) Configure the chart to use the new secret by setting `expose.tls.secretName` as the value you set in step iii  
+
+4. **Upgrade**  
+Run upgrade command:  
+    ```
+    helm upgrade release-name --force .
+    ```  
+    The `--force` is necessary if upgrade from version 0.3.0 due to issue [#30](https://github.com/goharbor/harbor-helm/issues/30).  
+
+## Known issues
+- The job logs will be lost if you upgrade from version 0.3.0 as the logs are store in a `emptyDir` in 0.3.0.  

package.json

-{
-  "name": "harbor-chart",
-  "version": "v1.6.3"
-}
\ No newline at end of file

templates/NOTES.txt

 Please wait for several minutes for Harbor deployment to complete.
-Then you should be able to visit the UI portal at {{ template "harbor.externalURL" . }}. 
-For more details, please visit https://github.com/vmware/harbor.
\ No newline at end of file
+Then you should be able to visit the Harbor portal at {{ .Values.externalURL }}. 
+For more details, please visit https://github.com/goharbor/harbor.
\ No newline at end of file

templates/adminserver/secret.yaml

-apiVersion: v1
-kind: Secret
-metadata:
-  name: "{{ template "harbor.fullname" . }}-adminserver"
-  labels:
-{{ include "harbor.labels" . | indent 4 }}
-    app: harbor-adminserver
-type: Opaque
-data:
-  secretKey: {{ .Values.secretKey | b64enc | quote }}
-  EMAIL_PWD: {{ .Values.email.password | b64enc | quote }}
-  HARBOR_ADMIN_PASSWORD: {{ .Values.harborAdminPassword | b64enc | quote }}
-  POSTGRESQL_PASSWORD: {{ template "harbor.database.password" . }}
-  JOBSERVICE_SECRET: {{ .Values.jobservice.secret | b64enc | quote }}
-  UI_SECRET: {{ .Values.ui.secret | b64enc | quote }}
-{{- if eq .Values.authenticationMode "ldap_auth" }} 
-  LDAP_SEARCH_PWD: {{ .Values.ldap.searchPassword | b64enc | quote }} 
-{{- end }}
-{{ if .Values.clair.enabled }}
-  CLAIR_DB_PASSWORD: {{ template "harbor.database.password" . }}
-{{ end }}

templates/adminserver/service.yaml

-apiVersion: v1
-kind: Service
-metadata:
-  name: "{{ template "harbor.fullname" . }}-adminserver"
-  labels:
-{{ include "harbor.labels" . | indent 4 }}  
-spec:
-  ports:
-    - name: http
-      port: 80
-      targetPort: 8080
-  selector:
-{{ include "harbor.matchLabels" . | indent 4 }}
-    app: harbor-adminserver
\ No newline at end of file

templates/adminserver/statefulset.yaml

-apiVersion: apps/v1
-kind: StatefulSet
-metadata:
-  name: "{{ template "harbor.fullname" . }}-adminserver"
-  labels:
-{{ include "harbor.labels" . | indent 4 }}
-    app: harbor-adminserver
-    version: {{ .Values.adminserver.image.tag }}
-spec:
-  replicas: 1
-  serviceName: "{{ template "harbor.fullname" . }}-adminserver"
-  selector:
-    matchLabels:
-{{ include "harbor.matchLabels" . | indent 6 }}
-      app: harbor-adminserver
-  template:
-    metadata:
-      labels:
-{{ include "harbor.labels" . | indent 8 }}
-        app: harbor-adminserver
-        version: {{ .Values.adminserver.image.tag }}
-    spec:
-      containers:
-      - name: adminserver
-        image: "{{ .Values.adminserver.image.repository }}:{{ .Values.adminserver.image.tag }}"
-        imagePullPolicy: "{{ .Values.adminserver.image.pullPolicy }}"
-        resources:
-{{ toYaml .Values.adminserver.resources | indent 10 }}
-        envFrom:
-        - configMapRef:
-            name: "{{ template "harbor.fullname" . }}-adminserver"
-        - secretRef:
-            name: "{{ template "harbor.fullname" . }}-adminserver"
-        env:
-          - name: PORT
-            value: "8080"
-          - name: JSON_CFG_STORE_PATH
-            value: /etc/adminserver/config/config.json
-          - name: KEY_PATH
-            value: /etc/adminserver/key
-        ports:
-        - containerPort: 8080
-        volumeMounts:
-        - name: data
-          mountPath: /etc/adminserver/config
-        - name: adminserver-key
-          mountPath: /etc/adminserver/key
-          subPath: key
-        - name: etc-localtime
-          mountPath: /etc/localtime          
-      volumes:
-      - name: etc-localtime
-        hostPath:
-          path: /etc/localtime       
-      {{- if not .Values.persistence.enabled }}
-      - name: data
-        hostPath:
-          path: /data/{{ .Release.Namespace }}/{{ .Release.Name }}/adminserver
-      {{- end }}
-      - name: adminserver-key
-        secret:
-          secretName: "{{ template "harbor.fullname" . }}-adminserver"
-          items:
-          - key: secretKey
-            path: key
-    {{- with .Values.adminserver.nodeSelector }}
-      nodeSelector:
-{{ toYaml . | indent 8 }}
-    {{- end }}
-    {{- with .Values.adminserver.affinity }}
-      affinity:
-{{ toYaml . | indent 8 }}
-    {{- end }}
-    {{- with .Values.adminserver.tolerations }}
-      tolerations:
-{{ toYaml . | indent 8 }}
-    {{- end }}
-  {{- if .Values.persistence.enabled }}
-  volumeClaimTemplates:
-  - metadata:
-      name: data
-    spec:
-      accessModes: [{{ .Values.adminserver.volumes.config.accessMode | quote }}]
-      {{- if .Values.adminserver.volumes.config.storageClass }}
-      {{- if (eq "-" .Values.adminserver.volumes.config.storageClass) }}
-      storageClassName: ""
-      {{- else }}
-      storageClassName: "{{ .Values.adminserver.volumes.config.storageClass }}"
-      {{- end }}
-      {{- end }}
-      resources:
-        requests:
-          storage: {{ .Values.adminserver.volumes.config.size | quote }}
-  {{- end -}}

templates/chartmuseum/chartmuseum-cm.yaml

+{{- if .Values.chartmuseum.enabled }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: "{{ template "harbor.chartmuseum" . }}"
+  labels:
+{{ include "harbor.labels" . | indent 4 }}
+data:
+  PORT: "9999"
+  CACHE: "redis"
+  CACHE_REDIS_ADDR: "{{ template "harbor.redis.host" . }}:{{ template "harbor.redis.port" . }}"
+  CACHE_REDIS_DB: "{{ template "harbor.redis.chartmuseumDatabaseIndex" . }}"
+  BASIC_AUTH_USER: "chart_controller"
+  DEPTH: "1"
+{{- if eq .Values.logLevel "debug" }}
+  DEBUG: "true"
+{{- else }}
+  DEBUG: "false"
+{{- end }}
+  LOG_JSON: "true"
+  DISABLE_METRICS: "false"
+  DISABLE_API: "false"
+  DISABLE_STATEFILES: "false"
+  ALLOW_OVERWRITE: "true"
+  #CHART_URL: {{ .Values.externalURL }}/chartrepo
+  AUTH_ANONYMOUS_GET: "false"
+  TLS_CERT:
+  TLS_KEY:
+  CONTEXT_PATH:
+  INDEX_LIMIT: "0"
+  MAX_STORAGE_OBJECTS: "0"
+  MAX_UPLOAD_SIZE: "20971520"
+  CHART_POST_FORM_FIELD_NAME: "chart"
+  PROV_POST_FORM_FIELD_NAME: "prov"
+{{- $storage := .Values.persistence.imageChartStorage }}
+{{- $storageType := $storage.type }}
+{{- if eq $storageType "filesystem" }}
+  STORAGE: "local"
+  STORAGE_LOCAL_ROOTDIR: "/chart_storage"
+{{- else if eq $storageType "azure" }}
+  STORAGE: "microsoft"
+  STORAGE_MICROSOFT_CONTAINER: {{ $storage.azure.container }}
+  AZURE_STORAGE_ACCOUNT: {{ $storage.azure.accountname }}
+  STORAGE_MICROSOFT_PREFIX: "/azure/harbor/charts"
+{{- else if eq $storageType "gcs" }}
+  STORAGE: "google"
+  STORAGE_GOOGLE_BUCKET: {{ $storage.gcs.bucket }}
+  GOOGLE_APPLICATION_CREDENTIALS: /etc/chartmuseum/gcs-key.json
+  {{- if $storage.gcs.rootdirectory }}
+  STORAGE_GOOGLE_PREFIX: {{ $storage.gcs.rootdirectory }}
+  {{- end }}
+{{- else if eq $storageType "s3" }}
+  STORAGE: "amazon"
+  STORAGE_AMAZON_BUCKET: {{ $storage.s3.bucket }}
+  {{- if $storage.s3.rootdirectory }}
+  STORAGE_AMAZON_PREFIX: {{ $storage.s3.rootdirectory }}
+  {{- end }}
+  STORAGE_AMAZON_REGION: {{ $storage.s3.region }}
+  {{- if $storage.s3.regionendpoint }}
+  STORAGE_AMAZON_ENDPOINT: {{ $storage.s3.regionendpoint }}
+  {{- end }}
+  {{- if $storage.s3.accesskey }}
+  AWS_ACCESS_KEY_ID: {{ $storage.s3.accesskey }}
+  {{- end }}
+{{- else if eq $storageType "swift" }}
+  STORAGE: "openstack"
+  STORAGE_OPENSTACK_CONTAINER: {{ $storage.swift.container }}
+  {{- if $storage.swift.secretkey }}
+  STORAGE_OPENSTACK_PREFIX: {{ $storage.swift.prefix }}
+  {{- end }}
+  {{- if $storage.swift.secretkey }}
+  STORAGE_OPENSTACK_REGION: {{ $storage.swift.region }}
+  {{- end }}
+  OS_AUTH_URL: {{ $storage.swift.authurl }}
+  OS_USERNAME: {{ $storage.swift.username }}
+  {{- if $storage.swift.secretkey }}
+  OS_PROJECT_ID: {{ $storage.swift.tenantid }}
+  {{- end }}
+  {{- if $storage.swift.secretkey }}
+  OS_PROJECT_NAME: {{ $storage.swift.tenant }}
+  {{- end }}
+  {{- if $storage.swift.secretkey }}
+  OS_DOMAIN_ID: {{ $storage.swift.domainid }}
+  {{- end }}
+  {{- if $storage.swift.secretkey }}
+  OS_DOMAIN_NAME: {{ $storage.swift.domain }}
+  {{- end }}
+{{- else if eq $storageType "oss" }}
+  STORAGE: "alibaba"
+  STORAGE_ALIBABA_BUCKET: {{ $storage.oss.bucket }}
+  {{- if $storage.oss.secretkey }}
+  STORAGE_ALIBABA_PREFIX: {{ $storage.oss.rootdirectory }}
+  {{- end }}
+  {{- if $storage.oss.secretkey }}
+  STORAGE_ALIBABA_ENDPOINT: {{ $storage.oss.endpoint }}
+  {{- end }}
+  ALIBABA_CLOUD_ACCESS_KEY_ID: {{ $storage.oss.accesskeyid }}
+{{- end }}
+{{- end }}
\ No newline at end of file

templates/chartmuseum/statefulset.yaml → templates/chartmuseum/chartmuseum-dpl.yaml

 {{- if .Values.chartmuseum.enabled }}
 apiVersion: apps/v1
-kind: StatefulSet
+kind: Deployment
 metadata:
-  name: "{{ template "harbor.fullname" . }}-chartmuseum"
+  name: "{{ template "harbor.chartmuseum" . }}"
   labels:
 {{ include "harbor.labels" . | indent 4 }}
-    app: harbor-chartmuseum
-    version: {{ .Values.chartmuseum.image.tag }}
+    component: chartmuseum
 spec:
-  replicas: 1
-  serviceName: "{{ template "harbor.fullname" . }}-chartmuseum"
+  replicas: {{ .Values.chartmuseum.replicas }}
   selector:
     matchLabels:
 {{ include "harbor.matchLabels" . | indent 6 }}
-      app: harbor-chartmuseum
+      component: chartmuseum
   template:
     metadata:
       labels:
 {{ include "harbor.labels" . | indent 8 }}
-        app: harbor-chartmuseum
-        version: {{ .Values.chartmuseum.image.tag }}
+        component: chartmuseum
+      annotations:
+        checksum/configmap: {{ include (print $.Template.BasePath "/chartmuseum/chartmuseum-cm.yaml") . | sha256sum }}
+        checksum/secret: {{ include (print $.Template.BasePath "/chartmuseum/chartmuseum-secret.yaml") . | sha256sum }}
+        checksum/secret-core: {{ include (print $.Template.BasePath "/core/core-secret.yaml") . | sha256sum }}
+{{- if .Values.chartmuseum.podAnnotations }}
+{{ toYaml .Values.chartmuseum.podAnnotations | indent 8 }}
+{{- end }}
     spec:
       containers:
       - name: chartmuseum
         image: {{ .Values.chartmuseum.image.repository }}:{{ .Values.chartmuseum.image.tag }}
-        imagePullPolicy: {{ .Values.chartmuseum.image.pullPolicy }}
+        imagePullPolicy: {{ .Values.imagePullPolicy }}
+        livenessProbe:
+          httpGet:
+            path: /health
+            port: 9999
+          initialDelaySeconds: 1
+          periodSeconds: 10
+        readinessProbe:
+          httpGet:
+            path: /health
+            port: 9999
+          initialDelaySeconds: 1
+          periodSeconds: 10
+{{- if .Values.chartmuseum.resources }}
         resources:
 {{ toYaml .Values.chartmuseum.resources | indent 10 }}
+{{- end }}
         envFrom:
         - configMapRef:
-            name: "{{ template "harbor.fullname" . }}-chartmuseum"
+            name: "{{ template "harbor.chartmuseum" . }}"
         - secretRef:
-            name: "{{ template "harbor.fullname" . }}-chartmuseum"
+            name: "{{ template "harbor.chartmuseum" . }}"
+        env:
+          - name: BASIC_AUTH_PASS
+            valueFrom:
+              secretKeyRef:
+                name: {{ template "harbor.core" . }}
+                key: secret
         ports:
         - containerPort: 9999
-        # TODO: update it after moving the storage out of registry scope
-        {{- if (.Values.persistence.enabled) and eq .Values.registry.storage.type "filesystem" }}
         volumeMounts:
-        - name: data
+        - name: chartmuseum-data
           mountPath: /chart_storage
-        {{- end }}
+        - name: etc-localtime
+          mountPath: /etc/localtime           
+      volumes:
+      - name: etc-localtime
+        hostPath:
+          path: /etc/localtime
+      - name: chartmuseum-data
+        hostPath:
+          path: /data/{{ .Release.Namespace }}/{{ .Release.Name }}/chartmuseum 
       {{- with .Values.chartmuseum.nodeSelector }}
       nodeSelector:
 {{ toYaml . | indent 8 }}
@@ -52,23 +82,4 @@ spec:
       tolerations:
 {{ toYaml . | indent 8 }}
       {{- end }}
-  {{- if (.Values.persistence.enabled) and eq .Values.registry.storage.type "filesystem" }}
-  volumeClaimTemplates:
-  - metadata:
-      name: data
-      labels:
-{{ include "harbor.labels" . | indent 8 }}
-    spec:
-      accessModes: [{{ .Values.chartmuseum.volumes.data.accessMode | quote }}]
-      {{- if .Values.chartmuseum.volumes.data.storageClass }}
-      {{- if (eq "-" .Values.chartmuseum.volumes.data.storageClass) }}
-      storageClassName: ""
-      {{- else }}
-      storageClassName: "{{ .Values.chartmuseum.volumes.data.storageClass }}"
-      {{- end }}
-      {{- end }}
-      resources:
-        requests:
-          storage: {{ .Values.chartmuseum.volumes.data.size | quote }}
-  {{- end -}}
 {{- end }}

templates/chartmuseum/chartmuseum-secret.yaml

+{{- if .Values.chartmuseum.enabled }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: "{{ template "harbor.chartmuseum" . }}"
+  labels:
+{{ include "harbor.labels" . | indent 4 }}
+type: Opaque
+data:
+  CACHE_REDIS_PASSWORD: {{ include "harbor.redis.rawPassword" . | b64enc | quote }}
+{{- $storage := .Values.persistence.imageChartStorage }}
+{{- $storageType := $storage.type }}
+{{- if eq $storageType "azure" }}
+  AZURE_STORAGE_ACCESS_KEY: {{ $storage.azure.accountkey | b64enc | quote }}
+{{- else if eq $storageType "gcs" }}
+  # TODO support the keyfile of gcs
+{{- else if eq $storageType "s3" }}
+  {{- if $storage.s3.secretkey }}
+  AWS_SECRET_ACCESS_KEY: {{ $storage.s3.secretkey | b64enc | quote }}
+  {{- end }}
+{{- else if eq $storageType "swift" }}
+  OS_PASSWORD: {{ $storage.swift.password | b64enc | quote }}
+{{- else if eq $storageType "oss" }}
+  ALIBABA_CLOUD_ACCESS_KEY_SECRET: {{ $storage.oss.accesskeysecret | b64enc | quote }}
+{{- end }}
+{{- end }}
\ No newline at end of file

templates/chartmuseum/service.yaml → templates/chartmuseum/chartmuseum-svc.yaml

@@ -2,15 +2,14 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: "{{ template "harbor.fullname" . }}-chartmuseum"
+  name: "{{ template "harbor.chartmuseum" . }}"
   labels:
 {{ include "harbor.labels" . | indent 4 }}
 spec:
   ports:
-    - name: http
-      port: 80
+    - port: 80
       targetPort: 9999
   selector:
 {{ include "harbor.matchLabels" . | indent 4 }}
-    app: harbor-chartmuseum
+    component: chartmuseum
 {{- end }}
\ No newline at end of file

templates/chartmuseum/configmap.yaml

-{{- if .Values.chartmuseum.enabled }}
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: "{{ template "harbor.fullname" . }}-chartmuseum"
-  labels:
-{{ include "harbor.labels" . | indent 4 }}
-data:
-  PORT: "9999"
-  CACHE: "redis"
-  CACHE_REDIS_ADDR: "{{ template "harbor.redis.host" . }}:{{ template "harbor.redis.port" . }}"
-  CACHE_REDIS_DB: "{{ template "harbor.redis.databaseIndex" }}"
-  BASIC_AUTH_USER: "chart_controller"
-  DEPTH: "1"
-  STORAGE: "local"
-  STORAGE_LOCAL_ROOTDIR: "/chart_storage"
-  DEBUG: "false"
-  LOG_JSON: "true"
-  DISABLE_METRICS: "false"
-  DISABLE_API: "false"
-  DISABLE_STATEFILES: "false"
-  ALLOW_OVERWRITE: "true"
-  CHART_URL: ""
-  AUTH_ANONYMOUS_GET: "false"
-  TLS_CERT: ""
-  TLS_KEY: ""
-  CONTEXT_PATH: ""
-  INDEX_LIMIT: "0"
-  MAX_STORAGE_OBJECTS: "0"
-  MAX_UPLOAD_SIZE: "20971520"
-  CHART_POST_FORM_FIELD_NAME: "chart"
-  PROV_POST_FORM_FIELD_NAME: "prov"
-{{- end }}
\ No newline at end of file

templates/chartmuseum/secret.yaml

-{{- if .Values.chartmuseum.enabled }}
-apiVersion: v1
-kind: Secret
-metadata:
-  name: "{{ template "harbor.fullname" . }}-chartmuseum"
-  labels:
-{{ include "harbor.labels" . | indent 4 }}
-type: Opaque
-data:
-  CACHE_REDIS_PASSWORD: "{{ template "harbor.redis.password" }}"
-  BASIC_AUTH_PASS: {{ .Values.ui.secret | b64enc | quote }}
-{{- end }}
\ No newline at end of file

templates/clair/configmap.yaml → templates/clair/clair-cm.yaml

@@ -2,10 +2,10 @@
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: {{ template "harbor.fullname" . }}-clair
+  name: {{ template "harbor.clair" . }}
   labels:
 {{ include "harbor.labels" . | indent 4 }}
-    app: harbor-clair
+    component: clair
 data:
   config.yaml: |
     clair:
@@ -25,11 +25,11 @@ data:
         # Deadline before an API request will respond with a 503
         timeout: 300s
       updater:
-        interval: 12h
+        interval: {{ .Values.clair.updatersInterval }}h
 
       notifier:
         attempts: 3
         renotifyinterval: 2h
         http:
-          endpoint: "http://{{ template "harbor.fullname" . }}-ui/service/notifications/clair"
+          endpoint: "http://{{ template "harbor.core" . }}/service/notifications/clair"
 {{ end }}

templates/clair/deployment.yaml → templates/clair/clair-dpl.yaml

@@ -2,31 +2,59 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: {{ template "harbor.fullname" . }}-clair
+  name: {{ template "harbor.clair" . }}
   labels:
 {{ include "harbor.labels" . | indent 4 }}
-    app: harbor-clair
-    version: {{ .Values.clair.image.tag }}
+    component: clair
 spec:
-  replicas: 1
+  replicas: {{ .Values.clair.replicas }}
   selector:
     matchLabels:
-{{ include "harbor.labels" . | indent 6 }}
-      app: harbor-clair
+{{ include "harbor.matchLabels" . | indent 6 }}
+      component: clair
   template:
     metadata:
       labels:
 {{ include "harbor.labels" . | indent 8 }}
-        app: harbor-clair
-        version: {{ .Values.clair.image.tag }}
+        component: clair
+      annotations:
+        checksum/configmap: {{ include (print $.Template.BasePath "/clair/clair-cm.yaml") . | sha256sum }}
+{{- if .Values.clair.podAnnotations }}
+{{ toYaml .Values.clair.podAnnotations | indent 8 }}
+{{- end }}
     spec:
       containers:
       - name: clair
         image: {{ .Values.clair.image.repository }}:{{ .Values.clair.image.tag }}
-        imagePullPolicy: {{ .Values.clair.image.pullPolicy }}
-        args: ["-insecure-tls", "-config", "/etc/clair/config.yaml"]
+        imagePullPolicy: {{ .Values.imagePullPolicy }}
+        livenessProbe:
+          httpGet:
+            path: /health
+            port: 6061
+          initialDelaySeconds: 30
+          periodSeconds: 10
+        readinessProbe:
+          httpGet:
+            path: /health
+            port: 6061
+          initialDelaySeconds: 30
+          periodSeconds: 10
+        args: ["-log-level", "{{ .Values.logLevel }}"]
+        env:
+        {{- if .Values.clair.httpProxy }}
+        - name: HTTP_PROXY
+          value: {{ .Values.clair.httpProxy }}
+        {{- end }}
+        {{- if .Values.clair.httpsProxy }}
+        - name: HTTPS_PROXY
+          value: {{ .Values.clair.httpsProxy }}
+        {{- end }}
+        - name: NO_PROXY
+          value: "{{ template "harbor.registry" . }},{{ template "harbor.core" . }}"
+{{- if .Values.clair.resources }}
         resources:
 {{ toYaml .Values.clair.resources | indent 10 }}
+{{- end }}
         ports:
         - containerPort: 6060
         volumeMounts:
@@ -41,7 +69,7 @@ spec:
           path: /etc/localtime
       - name: clair-config
         configMap:
-          name: "{{ template "harbor.fullname" . }}-clair"
+          name: "{{ template "harbor.clair" . }}"
           items:
             - key: config.yaml
               path: config.yaml

templates/clair/service.yaml → templates/clair/clair-svc.yaml

 {{ if .Values.clair.enabled }}
-# clair host isn't configurable yet.  this creates a service
-# to get it working for now.
-# see https://github.com/vmware/harbor/issues/3250
 apiVersion: v1
 kind: Service
 metadata:
-  name: "{{ template "harbor.fullname" . }}-clair"
+  name: "{{ template "harbor.clair" . }}"
   labels:
 {{ include "harbor.labels" . | indent 4 }}
 spec:
   ports:
-    - name: http
+    - name: clair
       port: 6060
+    - name: health
+      port: 6061
   selector:
 {{ include "harbor.matchLabels" . | indent 4 }}
-    app: harbor-clair
+    component: clair
 {{ end }}

templates/common/certificate-secret.yaml

+{{- if eq (include "harbor.autoGenCert" .) "true" }}
+{{- $cn := (required "The \"expose.tls.commonName\" is required!" (include "harbor.common-name" .)) }}
+{{- $ca := genCA "harbor-ca" 365 }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: "{{ template "harbor.certificate" . }}"
+  labels:
+{{ include "harbor.labels" . | indent 4 }}
+type: kubernetes.io/tls
+data:
+  {{- if regexMatch `^((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$` $cn }}
+  {{- $cert := genSignedCert $cn (list $cn) nil 365 $ca }}
+  tls.crt: {{ $cert.Cert | b64enc | quote }}
+  tls.key: {{ $cert.Key | b64enc | quote }}
+  ca.crt: {{ $ca.Cert | b64enc | quote }}
+  {{- else }}
+  {{- $cert := genSignedCert $cn nil (list $cn) 365 $ca }}
+  tls.crt: {{ $cert.Cert | b64enc | quote }}
+  tls.key: {{ $cert.Key | b64enc | quote }}
+  ca.crt: {{ $ca.Cert | b64enc | quote }}
+  {{- end }}
+{{- end }}
\ No newline at end of file

templates/adminserver/configmap.yaml → templates/core/core-cm.yaml

 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: "{{ template "harbor.fullname" . }}-adminserver"
+  name: {{ template "harbor.core" . }}
   labels:
 {{ include "harbor.labels" . | indent 4 }}
-    app: harbor-adminserver
 data:
+  app.conf: |+
+    appname = Harbor
+    runmode = dev
+    enablegzip = true
+
+    [dev]
+    httpport = 8080
+  DATABASE_TYPE: "postgresql"
   POSTGRESQL_HOST: "{{ template "harbor.database.host" . }}"
   POSTGRESQL_PORT: "{{ template "harbor.database.port" . }}"
   POSTGRESQL_USERNAME: "{{ template "harbor.database.username" . }}"
   POSTGRESQL_DATABASE: "{{ template "harbor.database.coreDatabase" . }}"
-  EMAIL_HOST: "{{ .Values.email.host }}"
-  EMAIL_PORT: "{{ .Values.email.port }}"
-  EMAIL_USR: "{{ .Values.email.username }}"
-  EMAIL_SSL: "{{ .Values.email.ssl }}"
-  EMAIL_FROM: "{{ .Values.email.from }}"
-  EMAIL_IDENTITY: "{{ .Values.email.identity }}"
-  EMAIL_INSECURE: "{{ .Values.email.insecure }}"
-  EXT_ENDPOINT: "{{ template "harbor.externalURL" . }}"
-  UI_URL: "http://{{ template "harbor.fullname" . }}-ui"
+  POSTGRESQL_SSLMODE: "{{ template "harbor.database.sslmode" . }}"
+  EXT_ENDPOINT: "{{ .Values.externalURL }}"
+  CORE_URL: "http://{{ template "harbor.core" . }}"
   JOBSERVICE_URL: "http://{{ template "harbor.fullname" . }}-jobservice"
-  REGISTRY_URL: "http://{{ template "harbor.fullname" . }}-registry:5000"
-  TOKEN_SERVICE_URL: "http://{{ template "harbor.fullname" . }}-ui/service/token"
+  REGISTRY_URL: "http://{{ template "harbor.registry" . }}:5000"
+  TOKEN_SERVICE_URL: "http://{{ template "harbor.core" . }}/service/token"
   WITH_NOTARY: "{{ .Values.notary.enabled }}"
-  NOTARY_URL: "http://{{ template "harbor.notaryServiceName" . }}:4443"
-  LOG_LEVEL: "info"
-  IMAGE_STORE_PATH: "/" # This is a temporary hack.
-  AUTH_MODE: "{{ .Values.authenticationMode }}"
-  SELF_REGISTRATION: "{{ .Values.selfRegistration }}"
-  LDAP_URL: "{{ .Values.ldap.url }}"
-  LDAP_SEARCH_DN: "{{ .Values.ldap.searchDN }}"
-  LDAP_BASE_DN: "{{ .Values.ldap.baseDN }}"
-  LDAP_FILTER: "{{ .Values.ldap.filter }}"
-  LDAP_UID: "{{ .Values.ldap.uid }}"
-  LDAP_SCOPE: "{{ .Values.ldap.scope }}"
-  LDAP_TIMEOUT: "{{ .Values.ldap.timeout }}"
-  LDAP_VERIFY_CERT: "{{ .Values.ldap.verifyCert }}"
-  DATABASE_TYPE: "postgresql"
-  PROJECT_CREATION_RESTRICTION: "everyone"
-  VERIFY_REMOTE_CERT: "off"
-  MAX_JOB_WORKERS: "3"
-  TOKEN_EXPIRATION: "30"
+  NOTARY_URL: "http://{{ template "harbor.notary-server" . }}:4443"
   CFG_EXPIRATION: "5"
-  GODEBUG: "netdns=cgo"
-  ADMIRAL_URL: "NA"
-  RESET: "false"
   WITH_CLAIR: "{{ .Values.clair.enabled }}"
   CLAIR_DB_HOST: "{{ template "harbor.database.host" . }}"
   CLAIR_DB_PORT: "{{ template "harbor.database.port" . }}"
   CLAIR_DB_USERNAME: "{{ template "harbor.database.username" . }}"
   CLAIR_DB: "{{ template "harbor.database.clairDatabase" . }}"
+  CLAIR_DB_SSLMODE: "{{ template "harbor.database.sslmode" . }}"
   CLAIR_URL: "http://{{ template "harbor.fullname" . }}-clair:6060"
-  UAA_ENDPOINT: ""
-  UAA_CLIENTID: ""
-  UAA_CLIENTSECRET: ""
-  UAA_VERIFY_CERT: "True"
-  REGISTRY_STORAGE_PROVIDER_NAME: "{{ .Values.registry.storage.type }}"
+  REGISTRY_STORAGE_PROVIDER_NAME: "{{ .Values.persistence.imageChartStorage.type }}"
   WITH_CHARTMUSEUM: "{{ .Values.chartmuseum.enabled }}"
-  CHART_REPOSITORY_URL: "http://{{ template "harbor.fullname" . }}-chartmuseum"
\ No newline at end of file
+  CHART_REPOSITORY_URL: "http://{{ template "harbor.chartmuseum" . }}"
+  LOG_LEVEL: "{{ .Values.logLevel }}"
+  CONFIG_PATH: "/etc/core/app.conf"
+  SYNC_REGISTRY: "false"
+  CHART_CACHE_DRIVER: "redis"
+  _REDIS_URL: "{{ template "harbor.redisForCore" . }}"
+  _REDIS_URL_REG: "{{ template "harbor.redisForGC" . }}"
+  PORTAL_URL: "http://{{ template "harbor.portal" . }}"
+  REGISTRYCTL_URL: "http://{{ template "harbor.registry" . }}:8080"
+  CLAIR_HEALTH_CHECK_SERVER_URL: "http://{{ template "harbor.clair" . }}:6061"
\ No newline at end of file

templates/ui/deployment.yaml → templates/core/core-dpl.yaml

 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: "{{ template "harbor.fullname" . }}-ui"
+  name: {{ template "harbor.core" . }}
   labels:
 {{ include "harbor.labels" . | indent 4 }}
-    app: harbor-ui
-    version: {{ .Values.ui.image.tag }}
+    component: core
 spec:
-  replicas: 1
+  replicas: {{ .Values.core.replicas }}
   selector:
     matchLabels:
-{{ include "harbor.labels" . | indent 6 }}
-      app: harbor-ui
+{{ include "harbor.matchLabels" . | indent 6 }}
+      component: core
   template:
     metadata:
       labels:
-{{ include "harbor.labels" . | indent 8 }}
-        app: harbor-ui
-        version: {{ .Values.ui.image.tag }}
+{{ include "harbor.matchLabels" . | indent 8 }}
+        component: core
+      annotations:
+        checksum/configmap: {{ include (print $.Template.BasePath "/core/core-cm.yaml") . | sha256sum }}
+        checksum/secret: {{ include (print $.Template.BasePath "/core/core-secret.yaml") . | sha256sum }}
+        checksum/secret-jobservice: {{ include (print $.Template.BasePath "/jobservice/jobservice-secrets.yaml") . | sha256sum }}
+{{- if .Values.core.podAnnotations }}
+{{ toYaml .Values.core.podAnnotations | indent 8 }}
+{{- end }}
     spec:
       containers:
-      - name: ui
-        image: {{ .Values.ui.image.repository }}:{{ .Values.ui.image.tag }}
-        imagePullPolicy: {{ .Values.ui.image.pullPolicy }}
+      - name: core
+        image: {{ .Values.core.image.repository }}:{{ .Values.core.image.tag }}
+        imagePullPolicy: {{ .Values.imagePullPolicy }}
+        livenessProbe:
+          httpGet:
+            path: /api/ping
+            port: 8080
+          initialDelaySeconds: 20
+          periodSeconds: 10
+        readinessProbe:
+          httpGet:
+            path: /api/ping
+            port: 8080
+          initialDelaySeconds: 20
+          periodSeconds: 10
+        envFrom:
+        - configMapRef:
+            name: "{{ template "harbor.core" . }}"
+        - secretRef:
+            name: "{{ template "harbor.core" . }}"
         env:
-          - name: UI_SECRET
+          - name: CORE_SECRET
             valueFrom:
               secretKeyRef:
-                name: "{{ template "harbor.fullname" . }}-ui"
+                name: {{ template "harbor.core" . }}
                 key: secret
           - name: JOBSERVICE_SECRET
             valueFrom:
               secretKeyRef:
-                name: "{{ template "harbor.fullname" . }}-ui"
-                key: jobserviceSecret
-          - name: _REDIS_URL
-            value: {{ template "harbor.redisForUI" . }}
-          - name: GODEBUG
-            value: netdns=cgo
-          - name: LOG_LEVEL
-            value: info
-          - name: CONFIG_PATH
-            value: /etc/ui/app.conf
-          - name: ENABLE_HARBOR_SCAN_ON_PUSH
-            value: "1"
-          - name: ADMINSERVER_URL
-            value: "http://{{ template "harbor.fullname" . }}-adminserver"
-          - name: CHART_CACHE_DRIVER
-            value: "redis"
+                name: "{{ template "harbor.jobservice" . }}"
+                key: secret
         ports:
         - containerPort: 8080
         volumeMounts:
-        - name: ui-config
-          mountPath: /etc/ui/app.conf
+        - name: config
+          mountPath: /etc/core/app.conf
           subPath: app.conf
-        - name: ui-secrets-key
-          mountPath: /etc/ui/key
+        - name: secret-key
+          mountPath: /etc/core/key
           subPath: key
-        - name: ui-secrets-private-key
-          mountPath: /etc/ui/private_key.pem
+        - name: token-service-private-key
+          mountPath: /etc/core/private_key.pem
           subPath: tokenServicePrivateKey
-        {{- if eq .Values.externalProtocol "https" }}
-        {{- if .Values.ingress.enabled }}
-        {{- if eq .Values.ingress.tls.secretName "" }}
+        - name: etc-localtime
+          mountPath: /etc/localtime          
+        {{- if .Values.expose.tls.enabled }}
         - name: ca-download
-          mountPath: /etc/ui/ca/ca.crt
+          mountPath: /etc/core/ca/ca.crt
           subPath: ca.crt
         {{- end }}
-        {{- end }}
-        {{- end }}
         - name: psc
-          mountPath: /etc/ui/token
-        - name: etc-localtime
-          mountPath: /etc/localtime         
+          mountPath: /etc/core/token
+{{- if .Values.core.resources }}
+        resources:
+{{ toYaml .Values.core.resources | indent 10 }}
+{{- end }}
       volumes:
       - name: etc-localtime
         hostPath:
           path: /etc/localtime
-      - name: ui-config
+      - name: config
         configMap:
-          name: "{{ template "harbor.fullname" . }}-ui"
-      - name: ui-secrets-key
+          name: {{ template "harbor.core" . }}
+      - name: secret-key
         secret:
-          secretName: "{{ template "harbor.fullname" . }}-ui"
+          secretName: {{ template "harbor.core" . }}
           items:
             - key: secretKey
               path: key
-      - name: ui-secrets-private-key
+      - name: token-service-private-key
         secret:
-          secretName: "{{ template "harbor.fullname" . }}-ui"
-      {{- if eq .Values.externalProtocol "https" }}
-      {{- if .Values.ingress.enabled }}
-      {{- if eq .Values.ingress.tls.secretName "" }}
+          {{- if .Values.core.secretName }}
+          secretName: {{ .Values.core.secretName }}
+          {{- else }}
+          secretName: {{ template "harbor.core" . }}
+          {{- end }}
+      {{- if .Values.expose.tls.enabled }}
       - name: ca-download
         secret:
-          secretName: "{{ template "harbor.fullname" . }}-ingress"
+          secretName: "{{ template "harbor.certificate-secret" . }}"
           items:
             - key: ca.crt
               path: ca.crt
       {{- end }}
-      {{- end }}
-      {{- end }}
       - name: psc
         emptyDir: {}
-    {{- with .Values.ui.nodeSelector }}
+    {{- with .Values.core.nodeSelector }}
       nodeSelector:
 {{ toYaml . | indent 8 }}
     {{- end }}
-    {{- with .Values.ui.affinity }}
+    {{- with .Values.core.affinity }}
       affinity:
 {{ toYaml . | indent 8 }}
     {{- end }}
-    {{- with .Values.ui.tolerations }}
+    {{- with .Values.core.tolerations }}
       tolerations:
 {{ toYaml . | indent 8 }}
     {{- end }}
\ No newline at end of file

templates/ui/secret.yaml → templates/core/core-secret.yaml

@@ -2,14 +2,19 @@
 apiVersion: v1
 kind: Secret
 metadata:
-  name: "{{ template "harbor.fullname" . }}-ui"
+  name: {{ template "harbor.core" . }}
   labels:
 {{ include "harbor.labels" . | indent 4 }}
 type: Opaque
 data:
   secretKey: {{ .Values.secretKey | b64enc | quote }}
-  secret: {{ .Values.ui.secret | b64enc | quote }}
-  jobserviceSecret: {{ .Values.jobservice.secret | b64enc | quote }}
+  secret: {{ .Values.core.secret | default (randAlphaNum 16) | b64enc | quote }}
+{{- if not .Values.core.secretName }}
   tokenServiceRootCertBundle: {{ $cert.Cert | b64enc | quote }}
   tokenServicePrivateKey: {{ $cert.Key | b64enc | quote }}
-  
\ No newline at end of file
+{{- end }}
+  HARBOR_ADMIN_PASSWORD: {{ .Values.harborAdminPassword | b64enc | quote }}
+  POSTGRESQL_PASSWORD: {{ template "harbor.database.encryptedPassword" . }}
+{{ if .Values.clair.enabled }}
+  CLAIR_DB_PASSWORD: {{ template "harbor.database.encryptedPassword" . }}
+{{ end }}

templates/jobservice/service.yaml → templates/core/core-svc.yaml

 apiVersion: v1
 kind: Service
 metadata:
-  name: "{{ template "harbor.fullname" . }}-jobservice"
+  name: {{ template "harbor.core" . }}
   labels:
 {{ include "harbor.labels" . | indent 4 }}
 spec:
+{{- if  (eq .Values.expose.ingress.controller "gce") }}
+  type: NodePort
+{{- end }}
   ports:
-    - name: http
-      port: 80
+    - port: 80
       targetPort: 8080
   selector:
 {{ include "harbor.matchLabels" . | indent 4 }}
-    app: harbor-jobservice
+    component: core

templates/database/secret.yaml → templates/database/database-secret.yaml

@@ -2,10 +2,10 @@
 apiVersion: v1
 kind: Secret
 metadata:
-  name: "{{ template "harbor.fullname" . }}-database"
+  name: "{{ template "harbor.database" . }}"
   labels:
 {{ include "harbor.labels" . | indent 4 }}
 type: Opaque
 data:
-  POSTGRES_PASSWORD: {{ template "harbor.database.password" . }}
+  POSTGRES_PASSWORD: {{ template "harbor.database.encryptedPassword" . }}
 {{- end -}}

templates/database/statefulset.yaml → templates/database/database-ss.yaml

 {{- if eq .Values.database.type "internal" -}}
+{{- $database := .Values.persistence.persistentVolumeClaim.database -}}
 apiVersion: apps/v1
 kind: StatefulSet
 metadata:
-  name: "{{ template "harbor.fullname" . }}-database"
+  name: "{{ template "harbor.database" . }}"
   labels:
 {{ include "harbor.labels" . | indent 4 }}
-    app: harbor-database
-    version: {{ .Values.database.internal.image.tag }}
+    component: database
 spec:
   replicas: 1
-  serviceName: "{{ template "harbor.fullname" . }}-database"
+  serviceName: "{{ template "harbor.database" . }}"
   selector:
     matchLabels:
 {{ include "harbor.matchLabels" . | indent 6 }}
-      app: harbor-database
+      component: database
   template:
     metadata:
       labels:
 {{ include "harbor.labels" . | indent 8 }}
-        app: harbor-database
-        version: {{ .Values.database.internal.image.tag }}
+        component: database
+      annotations:
+        checksum/secret: {{ include (print $.Template.BasePath "/database/database-secret.yaml") . | sha256sum }}
+{{- if .Values.database.podAnnotations }}
+{{ toYaml .Values.database.podAnnotations | indent 8 }}
+{{- end }}
     spec:
       initContainers:
       - name: "remove-lost-found"
-        image: "{{ .Values.busybox.image.repository }}:{{ .Values.busybox.image.tag }}"
-        command: 
-        - /bin/sh
-        - "-c"
-        - "rm -Rf /var/lib/postgresql/data/lost+found"
+        image: {{ .Values.database.internal.image.repository }}:{{ .Values.database.internal.image.tag }}
+        imagePullPolicy: {{ .Values.imagePullPolicy }}
+        command: ["rm", "-Rf", "/var/lib/postgresql/data/lost+found"]
         volumeMounts:
-        - name: data
+        - name: database-data
           mountPath: /var/lib/postgresql/data
       containers:
       - name: database
         image: {{ .Values.database.internal.image.repository }}:{{ .Values.database.internal.image.tag }}
-        imagePullPolicy: {{ .Values.database.internal.image.pullPolicy }}
+        imagePullPolicy: {{ .Values.imagePullPolicy }}
+        livenessProbe:
+          exec:
+            command:
+            - /docker-healthcheck.sh
+          initialDelaySeconds: 1
+          periodSeconds: 10
+        readinessProbe:
+          exec:
+            command:
+            - /docker-healthcheck.sh
+          initialDelaySeconds: 1
+          periodSeconds: 10
+{{- if .Values.database.internal.resources }}
         resources:
 {{ toYaml .Values.database.internal.resources | indent 10 }}
+{{- end }}
         envFrom:
           - secretRef:
-              name: "{{ template "harbor.fullname" . }}-database"
+              name: "{{ template "harbor.database" . }}"
         volumeMounts:
-        - name: data
+        - name: database-data
           mountPath: /var/lib/postgresql/data
         - name: etc-localtime
           mountPath: /etc/localtime           
@@ -49,11 +65,9 @@ spec:
       - name: etc-localtime
         hostPath:
           path: /etc/localtime
-      {{- if not .Values.persistence.enabled }}   
-      - name: data
+      - name: "database-data"
         hostPath:
           path: /data/{{ .Release.Namespace }}/{{ .Release.Name }}/database 
-      {{- end -}}
     {{- with .Values.database.internal.nodeSelector }}
       nodeSelector:
 {{ toYaml . | indent 8 }}
@@ -66,23 +80,4 @@ spec:
       tolerations:
 {{ toYaml . | indent 8 }}
     {{- end }}
-  {{- if .Values.persistence.enabled }}
-  volumeClaimTemplates:
-  - metadata:
-      name: "data"
-      labels:
-{{ include "harbor.labels" . | indent 8 }}
-    spec:
-      accessModes: [{{ .Values.database.internal.volumes.data.accessMode | quote }}]
-      {{- if .Values.database.internal.volumes.data.storageClass }}
-      {{- if (eq "-" .Values.database.internal.volumes.data.storageClass) }}
-      storageClassName: ""
-      {{- else }}
-      storageClassName: "{{ .Values.database.internal.volumes.data.storageClass }}"
-      {{- end }}
-      {{- end }}
-      resources:
-        requests:
-          storage: {{ .Values.database.internal.volumes.data.size | quote }}
-  {{- end -}}
   {{- end -}}

templates/database/service.yaml → templates/database/database-svc.yaml

@@ -2,14 +2,13 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: "{{ template "harbor.fullname" . }}-database"
+  name: "{{ template "harbor.database" . }}"
   labels:
 {{ include "harbor.labels" . | indent 4 }}
 spec:
   ports:
-    - name: postgre
-      port: 5432
+    - port: 5432
   selector:
 {{ include "harbor.matchLabels" . | indent 4 }}
-    app: harbor-database
+    component: database
 {{- end -}}
\ No newline at end of file

templates/ingress/ingress.yaml

-{{ if .Values.ingress.enabled }}
+{{- if eq .Values.expose.type "ingress" }}
+{{- $ingress := .Values.expose.ingress -}}
 apiVersion: extensions/v1beta1
 kind: Ingress
 metadata:
-  name: "{{ template "harbor.fullname" . }}"
+  name: "{{ template "harbor.ingress.core" . }}"
   labels:
 {{ include "harbor.labels" . | indent 4 }}
   annotations:
-{{ toYaml .Values.ingress.annotations | indent 4 }}
+{{ toYaml $ingress.annotations | indent 4 }}
 spec:
-# {{ if eq .Values.externalProtocol "https" }}
-#   tls:
-#   - hosts:
-#     - "{{ .Values.externalDomain }}"
-#     - "{{ template "harbor.notaryFQDN" . }}"
-#     {{ if eq .Values.ingress.tls.secretName "" }}
-#     secretName: "{{ template "harbor.fullname" . }}-ingress"
-#     {{ else }}
-#     secretName: {{ .Values.ingress.tls.secretName }}
-#     {{ end }}
-# {{ end }}
+  {{- if .Values.expose.tls.enabled }}
+  tls:
+  - secretName: {{ template "harbor.certificate-secret" . }}
+    {{- if $ingress.host }}
+    hosts:
+    - {{ $ingress.host }}
+    {{- end }}
+  {{- end }}
+{{- if  eq .Values.expose.ingress.controller "gce" }}
   rules:
-  - host: "{{ .Values.externalDomain }}"
-    http:
+  - http:
       paths:
-      - path: /
+      - path: /*
+        backend:
+          serviceName: {{ template "harbor.portal" . }}
+          servicePort: 80
+      - path: /api/*
+        backend:
+          serviceName: {{ template "harbor.core" . }}
+          servicePort: 80
+      - path: /service/*
+        backend:
+          serviceName: {{ template "harbor.core" . }}
+          servicePort: 80
+      - path: /v2/*
+        backend:
+          serviceName: {{ template "harbor.core" . }}
+          servicePort: 80
+      - path: /chartrepo/*
         backend:
-          serviceName: {{ template "harbor.fullname" . }}-ui
+          serviceName: {{ template "harbor.core" . }}
           servicePort: 80
-  - host: "{{ template "harbor.notaryFQDN" . }}"
-    http:
+      - path: /c/*
+        backend:
+          serviceName: {{ template "harbor.core" . }}
+          servicePort: 80
+    {{- if $ingress.host }}
+    host: {{ $ingress.host }}
+    {{- end }}
+{{- else }}
+  rules:
+  - http:
       paths:
       - path: /
         backend:
-          serviceName: {{ template "harbor.notaryServiceName" . }}
-          servicePort: 4443
-{{ end }}
\ No newline at end of file
+          serviceName: {{ template "harbor.portal" . }}
+          servicePort: 80
+      - path: /api/
+        backend:
+          serviceName: {{ template "harbor.core" . }}
+          servicePort: 80
+      - path: /service/
+        backend:
+          serviceName: {{ template "harbor.core" . }}
+          servicePort: 80
+      - path: /v2/
+        backend:
+          serviceName: {{ template "harbor.core" . }}
+          servicePort: 80
+      - path: /chartrepo/
+        backend:
+          serviceName: {{ template "harbor.core" . }}
+          servicePort: 80
+      - path: /c/
+        backend:
+          serviceName: {{ template "harbor.core" . }}
+          servicePort: 80
+    {{- if $ingress.host }}
+    host: {{ $ingress.host }}
+    {{- end }}
+{{- end }}
+{{- end }}
\ No newline at end of file

templates/ingress/notary-ingress.yaml

+{{- if .Values.notary.enabled }}
+{{- if eq .Values.expose.type "ingress" }}
+{{- $ingress := .Values.expose.ingress -}}
+apiVersion: extensions/v1beta1
+kind: Ingress
+metadata:
+  name: "{{ template "harbor.ingress.notary" . }}"
+  labels:
+{{ include "harbor.labels" . | indent 4 }}
+  annotations:
+{{ toYaml $ingress.annotations | indent 4 }}
+    {{ printf "%s: /" $ingress.rewriteAnnotation }}
+spec:
+  {{- if .Values.expose.tls.enabled }}
+  tls:
+  - secretName: {{ template "harbor.certificate-secret" . }}
+    {{- if $ingress.host }}
+    hosts: 
+    - {{ $ingress.host }}
+    {{- end }}
+  {{- end }}
+  rules:
+  - http:
+      paths:
+      - path: /notary/
+        backend:
+          serviceName: {{ template "harbor.notary-server" . }}
+          servicePort: 4443
+    {{- if $ingress.host }}
+    host: {{ $ingress.host }}
+    {{- end }}
+{{- end }}
+{{- end }} 
\ No newline at end of file

templates/ingress/secret.yaml

-{{ if eq .Values.externalProtocol "https" }}
-{{ if .Values.ingress.enabled }}
-{{ if eq .Values.ingress.tls.secretName "" }}
-{{ $ca := genCA "harbor-ca" 3650 }}
-{{ $cert := genSignedCert (include "harbor.certCommonName" .) nil nil 3650 $ca }}
-apiVersion: v1
-kind: Secret
-metadata:
-  name: "{{ template "harbor.fullname" . }}-ingress"
-  labels:
-{{ include "harbor.labels" . | indent 4 }}
-type: kubernetes.io/tls
-data:
-  tls.crt: {{ .Values.tlsCrt | default $cert.Cert | b64enc | quote }}
-  tls.key: {{ .Values.tlsKey | default $cert.Key | b64enc | quote }}
-  ca.crt: {{ .Values.caCrt | default $ca.Cert | b64enc | quote }}
-{{ end }}
-{{ end }}
-{{ end }}
\ No newline at end of file

templates/istio/notary.gateway.yaml

-{{ if .Values.istio.enabled }}
-apiVersion: networking.istio.io/v1alpha3
-kind: Gateway
-metadata:
-  name: {{ template "harbor.fullname" . }}-notary
-spec:
-  selector:
-    istio: ingressgateway # use istio default controller
-  servers:
-  - port:
-      number: 80
-      name: http
-      protocol: HTTP
-    hosts:
-    - "{{ template "harbor.notaryFQDN" . }}"
----
-apiVersion: networking.istio.io/v1alpha3
-kind: VirtualService
-metadata:
-  name: {{ template "harbor.fullname" . }}-notary
-spec:
-  hosts:
-  - "{{ template "harbor.notaryFQDN" . }}"
-  gateways:
-  - {{ template "harbor.fullname" . }}-notary
-  http:
-  - route:
-    - destination:
-        host: {{ template "harbor.notaryServiceName" . }}
-        port:
-          number: 4443
-{{ end }}          

templates/istio/ui.gateway.yaml

-{{ if .Values.istio.enabled }}
-apiVersion: networking.istio.io/v1alpha3
-kind: Gateway
-metadata:
-  name: {{ template "harbor.fullname" . }}-ui
-spec:
-  selector:
-    istio: ingressgateway # use istio default controller
-  servers:
-  - port:
-      number: 80
-      name: http
-      protocol: HTTP
-    hosts:
-    - "{{ .Values.externalDomain }}"
----
-apiVersion: networking.istio.io/v1alpha3
-kind: VirtualService
-metadata:
-  name: {{ template "harbor.fullname" . }}-ui
-spec:
-  hosts:
-  - "{{ .Values.externalDomain }}"
-  gateways:
-  - {{ template "harbor.fullname" . }}-ui
-  http:
-  - route:
-    - destination:
-        host: {{ template "harbor.fullname" . }}-ui
-        port:
-          number: 80
-{{ end }}          

templates/jobservice/configmap.yaml

-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: "{{ template "harbor.fullname" . }}-jobservice"
-  labels:
-{{ include "harbor.labels" . | indent 4 }}
-data:
-  config.yml: |+
-    protocol: "http"
-    port: 8080
-    worker_pool:
-      workers: {{ .Values.jobservice.maxWorkers }}
-      backend: "redis"
-      redis_pool:
-        redis_url: "{{ template "harbor.redisForJobservice" . }}"
-        namespace: "harbor_job_service_namespace"
-    logger:
-      path: "/var/log/jobs"
-      level: "INFO"
-      archive_period: 14 #days
-    admin_server: "http://{{ template "harbor.fullname" . }}-adminserver"

templates/jobservice/jobservice-cm.yaml

+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: "{{ template "harbor.jobservice" . }}"
+  labels:
+{{ include "harbor.labels" . | indent 4 }}
+data:
+  config.yml: |+
+    protocol: "http"
+    port: 8080
+    worker_pool:
+      workers: {{ .Values.jobservice.maxJobWorkers }}
+      backend: "redis"
+      redis_pool:
+        redis_url: "{{ template "harbor.redisForJobservice" . }}"
+        namespace: "harbor_job_service_namespace"
+    job_loggers:
+      {{- if eq .Values.jobservice.jobLogger "file" }}
+      - name: "FILE"
+        level: {{ .Values.logLevel | upper }}
+        settings: # Customized settings of logger
+          base_dir: "/var/log/jobs"
+        sweeper:
+          duration: 14 #days
+          settings: # Customized settings of sweeper
+            work_dir: "/var/log/jobs"
+      {{- else if eq .Values.jobservice.jobLogger "database" }}
+      - name: "DB"
+        level: {{ .Values.logLevel | upper }}
+        sweeper:
+          duration: 14 #days
+      {{- else }}
+      - name: "STD_OUTPUT"
+        level: {{ .Values.logLevel | upper }}
+      {{- end }}
+    #Loggers for the job service
+    loggers:
+      - name: "STD_OUTPUT"
+        level: {{ .Values.logLevel | upper }}
\ No newline at end of file

templates/jobservice/deployment.yaml → templates/jobservice/jobservice-dpl.yaml

 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: "{{ template "harbor.fullname" . }}-jobservice"
+  name: "{{ template "harbor.jobservice" . }}"
   labels:
 {{ include "harbor.labels" . | indent 4 }}
-    app: harbor-jobservice
-    version: {{ .Values.jobservice.image.tag }}
+    component: jobservice
 spec:
-  replicas: 1
+  replicas: {{ .Values.jobservice.replicas }}
   selector:
     matchLabels:
-{{ include "harbor.labels" . | indent 6 }}
-      app: harbor-jobservice  
+{{ include "harbor.matchLabels" . | indent 6 }}
+      component: jobservice
   template:
     metadata:
       labels:
 {{ include "harbor.labels" . | indent 8 }}
-        app: harbor-jobservice
-        version: {{ .Values.jobservice.image.tag }}
+        component: jobservice
+      annotations:
+        checksum/configmap: {{ include (print $.Template.BasePath "/jobservice/jobservice-cm.yaml") . | sha256sum }}
+        checksum/secret: {{ include (print $.Template.BasePath "/jobservice/jobservice-secrets.yaml") . | sha256sum }}
+        checksum/secret-core: {{ include (print $.Template.BasePath "/core/core-secret.yaml") . | sha256sum }}
+{{- if .Values.jobservice.podAnnotations }}
+{{ toYaml .Values.jobservice.podAnnotations | indent 8 }}
+{{- end }}
     spec:
       containers:
       - name: jobservice
         image: {{ .Values.jobservice.image.repository }}:{{ .Values.jobservice.image.tag }}
-        imagePullPolicy: {{ .Values.jobservice.image.pullPolicy }}
+        imagePullPolicy: {{ .Values.imagePullPolicy }}
+        livenessProbe:
+          httpGet:
+            path: /api/v1/stats
+            port: 8080
+          initialDelaySeconds: 20
+          periodSeconds: 10
+        readinessProbe:
+          httpGet:
+            path: /api/v1/stats
+            port: 8080
+          initialDelaySeconds: 20
+          periodSeconds: 10
+{{- if .Values.jobservice.resources }}
         resources:
 {{ toYaml .Values.jobservice.resources | indent 10 }}
-        envFrom:
-        - secretRef:
-            name: "{{ template "harbor.fullname" . }}-jobservice"
+{{- end }}
         env:
+          - name: CORE_SECRET
+            valueFrom:
+              secretKeyRef:
+                name: {{ template "harbor.core" . }}
+                key: secret
+          - name: JOBSERVICE_SECRET
+            valueFrom:
+              secretKeyRef:
+                name: "{{ template "harbor.jobservice" . }}"
+                key: secret
+          - name: CORE_URL
+            value: "http://{{ template "harbor.core" . }}"
+          - name: REGISTRY_CONTROLLER_URL
+            value: "http://{{ template "harbor.registry" . }}:8080"
           - name: LOG_LEVEL
             value: debug
-          - name: GODEBUG
-            value: netdns=cgo
         ports:
         - containerPort: 8080
         volumeMounts:
@@ -49,7 +77,7 @@ spec:
           path: /etc/localtime
       - name: jobservice-config
         configMap:
-          name: "{{ template "harbor.fullname" . }}-jobservice"
+          name: "{{ template "harbor.jobservice" . }}"
       - name: job-logs
         emptyDir: {}
     {{- with .Values.jobservice.nodeSelector }}

templates/ui/configmap.yaml → templates/jobservice/jobservice-secrets.yaml

 apiVersion: v1
-kind: ConfigMap
+kind: Secret
 metadata:
-  name: "{{ template "harbor.fullname" . }}-ui"
+  name: "{{ template "harbor.jobservice" . }}"
   labels:
 {{ include "harbor.labels" . | indent 4 }}
+type: Opaque
 data:
-  app.conf: |+
-    appname = Harbor
-    runmode = prod
-    enablegzip = true
-
-    [prod]
-    httpport = 8080
+  secret: {{ .Values.jobservice.secret | default (randAlphaNum 16) | b64enc | quote }}

templates/ui/service.yaml → templates/jobservice/jobservice-svc.yaml

 apiVersion: v1
 kind: Service
 metadata:
-  name: "{{ template "harbor.fullname" . }}-ui"
+  name: "{{ template "harbor.jobservice" . }}"
   labels:
 {{ include "harbor.labels" . | indent 4 }}
 spec:
   ports:
-    - name: http
-      port: 80
+    - port: 80
       targetPort: 8080
   selector:
 {{ include "harbor.matchLabels" . | indent 4 }}
-    app: harbor-ui
+    component: jobservice

templates/jobservice/secret.yaml

-apiVersion: v1
-kind: Secret
-metadata:
-  name: "{{ template "harbor.fullname" . }}-jobservice"
-  labels:
-{{ include "harbor.labels" . | indent 4 }}
-type: Opaque
-data:
-  secretKey: {{ .Values.secretKey | b64enc | quote }}
-  JOBSERVICE_SECRET: {{ .Values.jobservice.secret | b64enc | quote }}
-  UI_SECRET: {{ .Values.ui.secret | b64enc | quote }}
\ No newline at end of file

templates/nginx/configmap-http.yaml

+{{- if and (ne .Values.expose.type "ingress") (not .Values.expose.tls.enabled) }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ template "harbor.nginx" . }}
+  labels:
+{{ include "harbor.labels" . | indent 4 }}
+data:
+  nginx.conf: |+
+    worker_processes auto;
+
+    events {
+      worker_connections 1024;
+      use epoll;
+      multi_accept on;
+    }
+
+    http {
+      tcp_nodelay on;
+
+      # this is necessary for us to be able to disable request buffering in all cases
+      proxy_http_version 1.1;
+
+      upstream core {
+        server {{ template "harbor.core" . }};
+      }
+
+      upstream portal {
+        server {{ template "harbor.portal" . }};
+      }
+
+      log_format timed_combined '$remote_addr - '
+        '"$request" $status $body_bytes_sent '
+        '"$http_referer" "$http_user_agent" '
+        '$request_time $upstream_response_time $pipe';
+
+      access_log /dev/stdout timed_combined;
+
+      server {
+        listen 80;
+        server_tokens off;
+        # disable any limits to avoid HTTP 413 for large image uploads
+        client_max_body_size 0;
+
+        location / {
+          proxy_pass http://portal/;
+          proxy_set_header Host $host;
+          proxy_set_header X-Real-IP $remote_addr;
+          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+          
+          # When setting up Harbor behind other proxy, such as an Nginx instance, remove the below line if the proxy already has similar settings.
+          proxy_set_header X-Forwarded-Proto $scheme;
+          
+          proxy_buffering off;
+          proxy_request_buffering off;
+        }
+
+        location /api/ {
+          proxy_pass http://core/api/;
+          proxy_set_header Host $host;
+          proxy_set_header X-Real-IP $remote_addr;
+          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+
+          # When setting up Harbor behind other proxy, such as an Nginx instance, remove the below line if the proxy already has similar settings.
+          proxy_set_header X-Forwarded-Proto $scheme;
+          
+          proxy_buffering off;
+          proxy_request_buffering off;
+        }
+        
+        location /chartrepo/ {
+          proxy_pass http://core/chartrepo/;
+          proxy_set_header Host $host;
+          proxy_set_header X-Real-IP $remote_addr;
+          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+
+          # When setting up Harbor behind other proxy, such as an Nginx instance, remove the below line if the proxy already has similar settings.
+          proxy_set_header X-Forwarded-Proto $scheme;
+
+          proxy_buffering off;
+          proxy_request_buffering off;
+        }
+
+        location /c/ {
+          proxy_pass http://core/c/;
+          proxy_set_header Host $host;
+          proxy_set_header X-Real-IP $remote_addr;
+          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+
+          # When setting up Harbor behind other proxy, such as an Nginx instance, remove the below line if the proxy already has similar settings.
+          proxy_set_header X-Forwarded-Proto $scheme;
+          
+          proxy_buffering off;
+          proxy_request_buffering off;
+        }
+
+        location /v1/ {
+          return 404;
+        }
+
+        location /v2/ {
+          proxy_pass http://core/v2/;
+          proxy_set_header Host $http_host;
+          proxy_set_header X-Real-IP $remote_addr;
+          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+          
+          # When setting up Harbor behind other proxy, such as an Nginx instance, remove the below line if the proxy already has similar settings.
+          proxy_set_header X-Forwarded-Proto $scheme;
+          proxy_buffering off;
+          proxy_request_buffering off;
+        }
+
+        location /service/ {
+          proxy_pass http://core/service/;
+          proxy_set_header Host $host;
+          proxy_set_header X-Real-IP $remote_addr;
+          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+          
+          # When setting up Harbor behind other proxy, such as an Nginx instance, remove the below line if the proxy already has similar settings.
+          proxy_set_header X-Forwarded-Proto $scheme;
+          
+          proxy_buffering off;
+          proxy_request_buffering off;
+        }
+      
+      location /service/notifications {
+          return 404;
+        }
+      }
+    }
+{{- end }}
+    
\ No newline at end of file

templates/nginx/configmap-https.yaml

+{{- if and (ne .Values.expose.type "ingress") .Values.expose.tls.enabled }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ template "harbor.nginx" . }}
+  labels:
+{{ include "harbor.labels" . | indent 4 }}
+data:
+  nginx.conf: |+
+    worker_processes auto;
+
+    events {
+      worker_connections 1024;
+      use epoll;
+      multi_accept on;
+    }
+
+    http {
+      tcp_nodelay on;
+
+      # this is necessary for us to be able to disable request buffering in all cases
+      proxy_http_version 1.1;
+
+      upstream core {
+        server {{ template "harbor.core" . }};
+      }
+
+      upstream portal {
+        server {{ template "harbor.portal" . }};
+      }
+
+      {{- if .Values.notary.enabled }}
+      upstream notary-server {
+        server {{ template "harbor.notary-server" . }}:4443;
+      }
+      {{- end }}
+      
+      log_format timed_combined 'remote_addr - '
+        '"$request" $status $body_bytes_sent '
+        '"$http_referer" "$http_user_agent" '
+        '$request_time $upstream_response_time $pipe';
+
+      access_log /dev/stdout timed_combined;
+
+      server {
+        listen 443 ssl;
+    #    server_name harbordomain.com;
+        server_tokens off;
+        # SSL
+        ssl_certificate /etc/nginx/cert/tls.crt;
+        ssl_certificate_key /etc/nginx/cert/tls.key;
+      
+        # Recommendations from https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html
+        ssl_protocols TLSv1.1 TLSv1.2;
+        ssl_ciphers '!aNULL:kECDH+AESGCM:ECDH+AESGCM:RSA+AESGCM:kECDH+AES:ECDH+AES:RSA+AES:';
+        ssl_prefer_server_ciphers on;
+        ssl_session_cache shared:SSL:10m;
+      
+        # disable any limits to avoid HTTP 413 for large image uploads
+        client_max_body_size 0;
+      
+        # required to avoid HTTP 411: see Issue #1486 (https://github.com/docker/docker/issues/1486)
+        chunked_transfer_encoding on;
+
+        location / {
+          proxy_pass http://portal/;
+          proxy_set_header Host $http_host;
+          proxy_set_header X-Real-IP $remote_addr;
+          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+          
+          # When setting up Harbor behind other proxy, such as an Nginx instance, remove the below line if the proxy already has similar settings.
+          proxy_set_header X-Forwarded-Proto $scheme;
+
+          # Add Secure flag when serving HTTPS
+          proxy_cookie_path / "/; secure";
+
+          proxy_buffering off;
+          proxy_request_buffering off;
+        }
+
+        location /api/ {
+          proxy_pass http://core/api/;
+          proxy_set_header Host $host;
+          proxy_set_header X-Real-IP $remote_addr;
+          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+
+          # When setting up Harbor behind other proxy, such as an Nginx instance, remove the below line if the proxy already has similar settings.
+          proxy_set_header X-Forwarded-Proto $scheme;
+          
+          proxy_buffering off;
+          proxy_request_buffering off;
+        }
+        
+        location /chartrepo/ {
+          proxy_pass http://core/chartrepo/;
+          proxy_set_header Host $host;
+          proxy_set_header X-Real-IP $remote_addr;
+          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+
+          # When setting up Harbor behind other proxy, such as an Nginx instance, remove the below line if the proxy already has similar settings.
+          proxy_set_header X-Forwarded-Proto $scheme;
+
+          proxy_buffering off;
+          proxy_request_buffering off;
+        }
+
+        location /c/ {
+          proxy_pass http://core/c/;
+          proxy_set_header Host $host;
+          proxy_set_header X-Real-IP $remote_addr;
+          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+
+          # When setting up Harbor behind other proxy, such as an Nginx instance, remove the below line if the proxy already has similar settings.
+          proxy_set_header X-Forwarded-Proto $scheme;
+          
+          proxy_buffering off;
+          proxy_request_buffering off;
+        }
+
+        location /v1/ {
+          return 404;
+        }
+
+        location /v2/ {
+          proxy_pass http://core/v2/;
+          proxy_set_header Host $http_host;
+          proxy_set_header X-Real-IP $remote_addr;
+          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+          
+          # When setting up Harbor behind other proxy, such as an Nginx instance, remove the below line if the proxy already has similar settings.
+          proxy_set_header X-Forwarded-Proto $scheme;
+          proxy_buffering off;
+          proxy_request_buffering off;
+        }
+
+        location /service/ {
+          proxy_pass http://core/service/;
+          proxy_set_header Host $http_host;
+          proxy_set_header X-Real-IP $remote_addr;
+          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+          
+          # When setting up Harbor behind other proxy, such as an Nginx instance, remove the below line if the proxy already has similar settings.
+          proxy_set_header X-Forwarded-Proto $scheme;
+
+          proxy_buffering off;
+          proxy_request_buffering off;
+        }
+      
+      location /service/notifications {
+          return 404;
+        }
+      {{- if .Values.notary.enabled }}
+      location /notary/ {
+          proxy_pass http://notary-server;
+          proxy_set_header Host $http_host;
+          proxy_set_header X-Real-IP $remote_addr;
+          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+
+          # When setting up Harbor behind other proxy, such as an Nginx instance, remove the below line if the proxy already has similar settings.
+          proxy_set_header X-Forwarded-Proto $scheme;
+
+          proxy_buffering off;
+          proxy_request_buffering off;
+
+          rewrite /notary/(.*) /$1 break;
+        }
+      {{- end }}
+      }
+        server {
+          listen 80;
+          #server_name harbordomain.com;
+          return 301 https://$host$request_uri;
+      } 
+    }
+{{- end }}
\ No newline at end of file

templates/nginx/deployment.yaml

+{{- if ne .Values.expose.type "ingress" }}
+apiVersion: extensions/v1beta1
+kind: Deployment
+metadata:
+  name: {{ template "harbor.nginx" . }}
+  labels:
+{{ include "harbor.labels" . | indent 4 }}
+    component: nginx
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+{{ include "harbor.matchLabels" . | indent 6 }}
+      component: nginx
+  template:
+    metadata:
+      labels:
+{{ include "harbor.labels" . | indent 8 }}
+        component: nginx
+      annotations:
+      {{- if not .Values.expose.tls.enabled }}
+        checksum/configmap: {{ include (print $.Template.BasePath "/nginx/configmap-http.yaml") . | sha256sum }}
+      {{- else }}
+        checksum/configmap: {{ include (print $.Template.BasePath "/nginx/configmap-https.yaml") . | sha256sum }}
+      {{- end }}
+      {{- if eq (include "harbor.autoGenCert" .) "true" }}
+        checksum/secret: {{ include (print $.Template.BasePath "/common/certificate-secret.yaml") . | sha256sum }}
+      {{- end }}
+{{- if .Values.nginx.podAnnotations }}
+{{ toYaml .Values.nginx.podAnnotations | indent 8 }}
+{{- end }}
+    spec:
+      containers:
+      - name: nginx
+        image: "{{ .Values.nginx.image.repository }}:{{ .Values.nginx.image.tag }}"
+        imagePullPolicy: "{{ .Values.imagePullPolicy }}"
+        livenessProbe:
+          httpGet:
+            path: /
+            port: 80
+          initialDelaySeconds: 1
+          periodSeconds: 10
+        readinessProbe:
+          httpGet:
+            path: /
+            port: 80
+          initialDelaySeconds: 1
+          periodSeconds: 10
+{{- if .Values.nginx.resources }}
+        resources:
+{{ toYaml .Values.nginx.resources | indent 10 }}
+{{- end }}
+        ports:
+        - containerPort: 80
+        - containerPort: 443
+        volumeMounts:
+        - name: config
+          mountPath: /etc/nginx/nginx.conf
+          subPath: nginx.conf
+        {{- if .Values.expose.tls.enabled }}
+        - name: certificate
+          mountPath: /etc/nginx/cert
+        {{- end }}
+      volumes:
+      - name: config
+        configMap:
+          name: {{ template "harbor.nginx" . }}
+      {{- if .Values.expose.tls.enabled }}
+      - name: certificate
+        secret:
+          secretName: {{ template "harbor.certificate-secret" . }}
+      {{- end }}
+    {{- with .Values.nginx.nodeSelector }}
+      nodeSelector:
+{{ toYaml . | indent 8 }}
+    {{- end }}
+    {{- with .Values.nginx.affinity }}
+      affinity:
+{{ toYaml . | indent 8 }}
+    {{- end }}
+    {{- with .Values.nginx.tolerations }}
+      tolerations:
+{{ toYaml . | indent 8 }}
+    {{- end }}
+{{- end }}
\ No newline at end of file

templates/nginx/service.yaml

+{{- if ne .Values.expose.type "ingress" }}
+apiVersion: v1
+kind: Service
+metadata:
+{{- if eq .Values.expose.type "clusterIP" }}
+{{- $clusterIP := .Values.expose.clusterIP }}
+  name: {{ $clusterIP.name }}
+  labels:
+{{ include "harbor.labels" . | indent 4 }}
+spec:
+  type: ClusterIP
+  ports:
+    - name: http
+      port: {{ $clusterIP.ports.http }}
+      targetPort: 80
+    {{- if .Values.expose.tls.enabled }}
+    - name: https
+      port: {{ $clusterIP.ports.https }}
+      targetPort: 443
+    {{- end }}
+{{- else if eq .Values.expose.type "nodePort" }}
+{{- $nodePort := .Values.expose.nodePort }}
+  name: {{ $nodePort.name }}
+  labels:
+{{ include "harbor.labels" . | indent 4 }}
+spec:
+  type: NodePort
+  ports:
+    - name: http
+      port: {{ $nodePort.ports.http.port }}
+      targetPort: 80
+      {{- if $nodePort.ports.http.nodePort }}
+      nodePort: {{ $nodePort.ports.http.nodePort }}
+      {{- end }}
+    {{- if .Values.expose.tls.enabled }}
+    - name: https
+      port: {{ $nodePort.ports.https.port }}
+      targetPort: 443
+      {{- if $nodePort.ports.https.nodePort }}
+      nodePort: {{ $nodePort.ports.https.nodePort }}
+      {{- end }}
+    {{- end }}
+{{- else if eq .Values.expose.type "loadBalancer" }}
+{{- $loadBalancer := .Values.expose.loadBalancer }}
+  name: {{ $loadBalancer.name }}
+  labels:
+{{ include "harbor.labels" . | indent 4 }}
+spec:
+  type: LoadBalancer
+  ports:
+    - name: http
+      port: {{ $loadBalancer.ports.http }}
+      targetPort: 80
+    {{- if .Values.expose.tls.enabled }}
+    - name: https
+      port: {{ $loadBalancer.ports.https }}
+      targetPort: 443
+    {{- end }}
+{{- end }}
+  selector:
+{{ include "harbor.matchLabels" . | indent 4 }}
+    component: nginx
+{{- end }}
\ No newline at end of file

templates/notary/configmap.yaml → templates/notary/notary-cm.yaml

@@ -2,19 +2,21 @@
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: {{ template "harbor.fullname" . }}-notary
+  name: {{ template "harbor.notary-server" . }}
   labels:
 {{ include "harbor.labels" . | indent 4 }}
-    app: harbor-notary
+    component: notary
 data:
-  {{ $ca := genCA "harbor-notary-ca" 3650 }}
-  {{ $cert := genSignedCert (printf "%s-notary-signer" (include "harbor.fullname" .)) nil nil 3650 $ca }}
+  {{ $ca := genCA "harbor-notary-ca" 365 }}
+  {{ $cert := genSignedCert (include "harbor.notary-signer" .) nil nil 365 $ca }}
+  {{- if not .Values.notary.secretName }}
   notary-signer-ca.crt: |
-{{ .Values.notary.signer.caCrt  | default $ca.Cert   | indent 4 }}
+{{ $ca.Cert | indent 4 }}
   notary-signer.crt: |
-{{ .Values.notary.signer.tlsCrt | default $cert.Cert | indent 4 }}
+{{ $cert.Cert | indent 4 }}
   notary-signer.key: |
-{{ .Values.notary.signer.tlsKey | default $cert.Key  | indent 4 }}
+{{ $cert.Key | indent 4 }}
+  {{- end }}
   server-config.postgres.json: |
     {
       "server": {
@@ -22,13 +24,17 @@ data:
       },
       "trust_service": {
         "type": "remote",
-        "hostname": "{{ template "harbor.fullname" . }}-notary-signer",
+        "hostname": "{{ template "harbor.notary-signer" . }}",
         "port": "7899",
+{{- if not .Values.notary.secretName }}
         "tls_ca_file": "./notary-signer-ca.crt",
+{{- else }}
+        "tls_ca_file": "/etc/ssl/notary/cert/notary-signer-ca.crt",
+{{- end }}
         "key_algorithm": "ecdsa"
       },
       "logging": {
-        "level": "debug"
+        "level": "{{ .Values.logLevel }}"
       },
       "storage": {
         "backend": "postgres",
@@ -37,7 +43,7 @@ data:
       "auth": {
           "type": "token",
           "options": {
-              "realm": "{{ template "harbor.externalURL" . }}/service/token",
+              "realm": "{{ .Values.externalURL }}/service/token",
               "service": "harbor-notary",
               "issuer": "harbor-token-issuer",
               "rootcertbundle": "/root.crt"
@@ -48,11 +54,16 @@ data:
     {
       "server": {
         "grpc_addr": ":7899",
+{{- if not .Values.notary.secretName }}
         "tls_cert_file": "./notary-signer.crt",
         "tls_key_file": "./notary-signer.key"
+{{- else }}
+        "tls_cert_file": "/etc/ssl/notary/cert/notary-signer.crt",
+        "tls_key_file": "/etc/ssl/notary/cert/notary-signer.key"
+{{- end }}
       },
       "logging": {
-        "level": "debug"
+        "level": "{{ .Values.logLevel }}"
       },
       "storage": {
         "backend": "postgres",

templates/notary/notary-server.yaml

@@ -2,30 +2,36 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: {{ template "harbor.fullname" . }}-notary-server
+  name: {{ template "harbor.notary-server" . }}
   labels:
 {{ include "harbor.labels" . | indent 4 }}
-    app: harbor-notary-server
-    version: {{ .Values.notary.server.image.tag }}
+    component: notary-server
 spec:
-  replicas: 1
+  replicas: {{ .Values.notary.server.replicas }}
   selector:
     matchLabels:
-{{ include "harbor.labels" . | indent 6 }}
-      app: harbor-notary-server
+{{ include "harbor.matchLabels" . | indent 6 }}
+      component: notary-server
   template:
     metadata:
       labels:
 {{ include "harbor.labels" . | indent 8 }}
-        app: harbor-notary-server
-        version: {{ .Values.notary.server.image.tag }}
+        component: notary-server
+      annotations:
+        checksum/configmap: {{ include (print $.Template.BasePath "/notary/notary-cm.yaml") . | sha256sum }}
+        checksum/secret-core: {{ include (print $.Template.BasePath "/core/core-secret.yaml") . | sha256sum }}
+{{- if .Values.notary.podAnnotations }}
+{{ toYaml .Values.notary.podAnnotations | indent 8 }}
+{{- end }}
     spec:
       containers:
       - name: notary-server
         image: {{ .Values.notary.server.image.repository }}:{{ .Values.notary.server.image.tag }}
-        imagePullPolicy: {{ .Values.notary.server.image.pullPolicy }}
+        imagePullPolicy: {{ .Values.imagePullPolicy }}
+{{- if .Values.notary.server.resources }}
         resources:
 {{ toYaml .Values.notary.server.resources | indent 10 }}
+{{- end }}
         env:
         - name: MIGRATIONS_PATH
           value: migrations/server/postgresql
@@ -34,21 +40,35 @@ spec:
         volumeMounts:
         - name: notary-config
           mountPath: /etc/notary
+        - name: etc-localtime
+          mountPath: /etc/localtime           
         - name: root-certificate
           mountPath: /root.crt
           subPath: tokenServiceRootCertBundle
-        - name: etc-localtime
-          mountPath: /etc/localtime          
+        {{- if .Values.notary.secretName }}
+        - name: notary-ca
+          mountPath: /etc/ssl/notary/cert/notary-signer-ca.crt
+          subPath: ca
+        {{- end }}
       volumes:
       - name: etc-localtime
         hostPath:
           path: /etc/localtime
       - name: notary-config
         configMap:
-          name: "{{ template "harbor.fullname" . }}-notary"
+          name: "{{ template "harbor.notary-server" . }}"
       - name: root-certificate
         secret:
-          secretName: "{{ template "harbor.fullname" . }}-ui"
+          {{- if .Values.core.secretName }}
+          secretName: {{ .Values.core.secretName }}
+          {{- else }}
+          secretName: {{ template "harbor.core" . }}
+          {{- end }}
+      {{- if .Values.notary.secretName }}
+      - name: notary-ca
+        secret:
+          secretName: {{ .Values.notary.secretName }}
+      {{- end }}
     {{- with .Values.notary.nodeSelector }}
       nodeSelector:
 {{ toYaml . | indent 8 }}

templates/notary/notary-signer.yaml

@@ -2,47 +2,77 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: {{ template "harbor.fullname" . }}-notary-signer
+  name: {{ template "harbor.notary-signer" . }}
   labels:
 {{ include "harbor.labels" . | indent 4 }}
-    app: harbor-notary-signer
-    version: {{ .Values.notary.signer.image.tag }}
+    component: notary-signer
 spec:
-  replicas: 1
+  replicas: {{ .Values.notary.signer.replicas }}
   selector:
     matchLabels:
-{{ include "harbor.labels" . | indent 6 }}
-      app: harbor-notary-signer
+{{ include "harbor.matchLabels" . | indent 6 }}
+      component: notary-signer
   template:
     metadata:
       labels:
 {{ include "harbor.labels" . | indent 8 }}
-        app: harbor-notary-signer
-        version: {{ .Values.notary.signer.image.tag }}
+        component: notary-signer
+      annotations:
+        checksum/configmap: {{ include (print $.Template.BasePath "/notary/notary-cm.yaml") . | sha256sum }}
     spec:
       containers:
       - name: notary-signer
         image: {{ .Values.notary.signer.image.repository }}:{{ .Values.notary.signer.image.tag }}
-        imagePullPolicy: {{ .Values.notary.signer.image.pullPolicy }}
+        imagePullPolicy: {{ .Values.imagePullPolicy }}
+{{- if .Values.notary.signer.resources }}
         resources:
 {{ toYaml .Values.notary.signer.resources | indent 10 }}
+{{- end }}
         env:
         - name: MIGRATIONS_PATH
           value: migrations/signer/postgresql
         - name: DB_URL
           value: {{ template "harbor.database.notarySigner" . }}
         - name: NOTARY_SIGNER_DEFAULTALIAS
-          value: {{ .Values.notary.signer.env.NOTARY_SIGNER_DEFAULTALIAS }}
+          value: defaultalias
         volumeMounts:
         - name: notary-config
           mountPath: /etc/notary
         - name: etc-localtime
           mountPath: /etc/localtime           
+        {{- if .Values.notary.secretName }}
+        - name: notary-cert
+          mountPath: /etc/ssl/notary/cert/notary-signer-ca.crt
+          subPath: ca
+        - name: notary-cert
+          mountPath: /etc/ssl/notary/cert/notary-signer.crt
+          subPath: crt
+        - name: notary-cert
+          mountPath: /etc/ssl/notary/cert/notary-signer.key
+          subPath: key
+        {{- end }}
       volumes:
       - name: etc-localtime
         hostPath:
           path: /etc/localtime
       - name: notary-config
         configMap:
-          name: "{{ template "harbor.fullname" . }}-notary"
+          name: "{{ template "harbor.notary-server" . }}"
+      {{- if .Values.notary.secretName }}
+      - name: notary-cert
+        secret:
+          secretName: {{ .Values.notary.secretName }}
+      {{- end }}
+    {{- with .Values.notary.nodeSelector }}
+      nodeSelector:
+{{ toYaml . | indent 8 }}
+    {{- end }}
+    {{- with .Values.notary.affinity }}
+      affinity:
+{{ toYaml . | indent 8 }}
+    {{- end }}
+    {{- with .Values.notary.tolerations }}
+      tolerations:
+{{ toYaml . | indent 8 }}
+    {{- end }}
 {{ end }}

templates/notary/service.yaml → templates/notary/notary-svc.yaml

@@ -2,21 +2,24 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: {{ template "harbor.notaryServiceName" . }}
+  name: {{ template "harbor.notary-server" . }}
   labels:
 {{ include "harbor.labels" . | indent 4 }}
 spec:
+{{- if  (eq .Values.expose.ingress.controller "gce") }}
+  type: NodePort
+{{- end }}
   ports:
   - port: 4443
   selector:
 {{ include "harbor.matchLabels" . | indent 4 }}
-    app: harbor-notary-server
+    component: notary-server
 
 ---
 apiVersion: v1
 kind: Service
 metadata:
-  name: {{ template "harbor.fullname" . }}-notary-signer
+  name: {{ template "harbor.notary-signer" . }}
   labels:
 {{ include "harbor.labels" . | indent 4 }}
 spec:
@@ -24,5 +27,5 @@ spec:
   - port: 7899
   selector:
 {{ include "harbor.matchLabels" . | indent 4 }}
-    app: harbor-notary-signer
+    component: notary-signer
 {{ end }}
\ No newline at end of file

templates/portal/deployment.yaml

+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: "{{ template "harbor.portal" . }}"
+  labels:
+{{ include "harbor.labels" . | indent 4 }}
+    component: portal
+spec:
+  replicas: {{ .Values.portal.replicas }}
+  selector:
+    matchLabels:
+{{ include "harbor.matchLabels" . | indent 6 }}
+      component: portal
+  template:
+    metadata:
+      labels:
+{{ include "harbor.matchLabels" . | indent 8 }}
+        component: portal
+      annotations:
+{{- if .Values.portal.podAnnotations }}
+{{ toYaml .Values.portal.podAnnotations | indent 8 }}
+{{- end }}
+    spec:
+      containers:
+      - name: portal
+        image: {{ .Values.portal.image.repository }}:{{ .Values.portal.image.tag }}
+        imagePullPolicy: {{ .Values.imagePullPolicy }}
+{{- if .Values.portal.resources }}
+        resources:
+{{ toYaml .Values.portal.resources | indent 10 }}
+{{- end }}
+        livenessProbe:
+          httpGet:
+            path: /
+            port: 80
+          initialDelaySeconds: 1
+          periodSeconds: 10
+        readinessProbe:
+          httpGet:
+            path: /
+            port: 80
+          initialDelaySeconds: 1
+          periodSeconds: 10
+        ports:
+        - containerPort: 80
+        volumeMounts:
+        - name: etc-localtime
+          mountPath: /etc/localtime    
+      volumes:
+      - name: etc-localtime
+        hostPath:
+          path: /etc/localtime               
+    {{- with .Values.portal.nodeSelector }}
+      nodeSelector:
+{{ toYaml . | indent 8 }}
+    {{- end }}
+    {{- with .Values.portal.affinity }}
+      affinity:
+{{ toYaml . | indent 8 }}
+    {{- end }}
+    {{- with .Values.portal.tolerations }}
+      tolerations:
+{{ toYaml . | indent 8 }}
+    {{- end }}

templates/portal/service.yaml

+apiVersion: v1
+kind: Service
+metadata:
+  name: "{{ template "harbor.portal" . }}"
+  labels:
+{{ include "harbor.labels" . | indent 4 }}
+spec:
+{{- if (eq .Values.expose.ingress.controller "gce") }}
+  type: NodePort
+{{- end }}
+  ports:
+    - port: 80
+      targetPort: 80
+  selector:
+{{ include "harbor.matchLabels" . | indent 4 }}
+    component: portal

templates/redis/deployment.yml

----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: {{ template "harbor.fullname" . }}-redis
-  labels:
-{{ include "harbor.labels" . | indent 4 }}
-    app: harbor-redis
-    version: {{ .Values.redis.image.tag }}
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-{{ include "harbor.labels" . | indent 6 }}
-      app: harbor-redis
-  template:
-    metadata:
-      labels:
-{{ include "harbor.labels" . | indent 8 }}
-        app: harbor-redis
-        version: {{ .Values.redis.image.tag }}
-    spec:
-      containers:
-      - name: redis
-        image: {{ .Values.redis.image.repository }}:{{ .Values.redis.image.tag }}
-        imagePullPolicy: {{ .Values.redis.image.pullPolicy }}
-        args: ["--save","''","--appendonly","no"]
-        ports:
-        - name: redis
-          containerPort: 6379
-        volumeMounts:  
-        - name: etc-localtime
-          mountPath: /etc/localtime           
-      volumes:
-      - name: etc-localtime
-        hostPath:
-          path: /etc/localtime          
\ No newline at end of file

templates/redis/service.yml → templates/redis/service.yaml

----
+{{- if eq .Values.redis.type "internal" -}}
 apiVersion: v1
 kind: Service
 metadata:
-  name: {{ template "harbor.fullname" . }}-redis
+  name: {{ template "harbor.redis" . }}
   labels:
 {{ include "harbor.labels" . | indent 4 }}
-    app: harbor-redis  
 spec:
+  ports:
+    - port: 6379
   selector:
 {{ include "harbor.matchLabels" . | indent 4 }}
-    app: harbor-redis
-  ports:
-  - name: redis
-    port: 6379
\ No newline at end of file
+    component: redis
+{{- end -}}
\ No newline at end of file

templates/redis/statefulset.yaml

+{{- if eq .Values.redis.type "internal" -}}
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: {{ template "harbor.redis" . }}
+  labels:
+{{ include "harbor.labels" . | indent 4 }}
+    component: redis
+spec:
+  replicas: 1
+  serviceName: {{ template "harbor.redis" . }}
+  selector:
+    matchLabels:
+{{ include "harbor.matchLabels" . | indent 6 }}
+      component: redis
+  template:
+    metadata:
+      labels:
+{{ include "harbor.labels" . | indent 8 }}
+        component: redis
+{{- if .Values.redis.podAnnotations }}
+      annotations:
+{{ toYaml .Values.redis.podAnnotations | indent 8 }}
+{{- end }}
+    spec:
+      containers:
+      - name: redis
+        image: {{ .Values.redis.internal.image.repository }}:{{ .Values.redis.internal.image.tag }}
+        imagePullPolicy: {{ .Values.imagePullPolicy }}
+        livenessProbe:
+          tcpSocket:
+            port: 6379
+          initialDelaySeconds: 1
+          periodSeconds: 10
+        readinessProbe:
+          tcpSocket:
+            port: 6379
+          initialDelaySeconds: 1
+          periodSeconds: 10
+{{- if .Values.redis.internal.resources }}
+        resources:
+{{ toYaml .Values.redis.internal.resources | indent 10 }}
+{{- end }}
+        volumeMounts:
+        - name: data
+          mountPath: /var/lib/redis
+        - name: etc-localtime
+          mountPath: /etc/localtime            
+      volumes:
+      - name: etc-localtime
+        hostPath:
+          path: /etc/localtime      
+      - name: data
+        emptyDir: {}
+    {{- with .Values.redis.internal.nodeSelector }}
+      nodeSelector:
+{{ toYaml . | indent 8 }}
+    {{- end }}
+    {{- with .Values.redis.internal.affinity }}
+      affinity:
+{{ toYaml . | indent 8 }}
+    {{- end }}
+    {{- with .Values.redis.internal.tolerations }}
+      tolerations:
+{{ toYaml . | indent 8 }}
+    {{- end }}
+{{- end -}}

templates/registry/configmap.yaml

-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: "{{ template "harbor.fullname" . }}-registry"
-  labels:
-{{ include "harbor.labels" . | indent 4 }}
-data:
-  config.yml: |+
-    version: 0.1
-    log:
-      level: {{ .Values.registry.logLevel }}
-      fields:
-        service: registry
-    storage:
-      {{- $storage := .Values.registry.storage }}
-      {{- $type := $storage.type }}
-      {{- if eq $type "filesystem" }}
-      filesystem:
-        rootdirectory: {{ $storage.filesystem.rootdirectory }}
-        {{- if $storage.filesystem.maxthreads }}
-        maxthreads: {{ $storage.filesystem.maxthreads }}
-        {{- end }}
-      {{- else if eq $type "azure" }}
-      azure:
-        accountname: {{ $storage.azure.accountname }}
-        container: {{ $storage.azure.container }}
-        {{- if $storage.azure.realm }}
-        realm: {{ $storage.azure.realm }}
-        {{- end }}
-      {{- else if eq $type "gcs" }}
-      gcs:
-        bucket: {{ $storage.gcs.bucket }}
-        {{- if $storage.gcs.rootdirectory }}
-        rootdirectory: {{ $storage.gcs.rootdirectory }}
-        {{- end }}
-        {{- if $storage.gcs.chunksize }}
-        chunksize: {{ $storage.gcs.chunksize }}
-        {{- end }}
-      {{- else if eq $type "s3" }}
-      s3:
-        region: {{ $storage.s3.region }}
-        bucket: {{ $storage.s3.bucket }}
-        {{- if $storage.s3.regionendpoint }}
-        regionendpoint: {{ $storage.s3.regionendpoint }}
-        {{- end }}
-        {{- if $storage.s3.encrypt }}
-        encrypt: {{ $storage.s3.encrypt }}
-        {{- end }}
-        {{- if $storage.s3.secure }}
-        secure: {{ $storage.s3.secure }}
-        {{- end }}
-        {{- if $storage.s3.v4auth }}
-        v4auth: {{ $storage.s3.v4auth }}
-        {{- end }}
-        {{- if $storage.s3.chunksize }}
-        chunksize: {{ $storage.s3.chunksize }}
-        {{- end }}
-        {{- if $storage.s3.rootdirectory }}
-        rootdirectory: {{ $storage.s3.rootdirectory }}
-        {{- end }}
-        {{- if $storage.s3.storageclass }}
-        storageclass: {{ $storage.s3.storageclass }}
-        {{- end }}
-      {{- else if eq $type "swift" }}
-      swift:
-        authurl: {{ $storage.swift.authurl }}
-        username: {{ $storage.swift.username }}
-        container: {{ $storage.swift.container }}
-        {{- if $storage.swift.region }}
-        region: {{ $storage.swift.region }}
-        {{- end }}
-        {{- if $storage.swift.tenant }}
-        tenant: {{ $storage.swift.tenant }}
-        {{- end }}
-        {{- if $storage.swift.tenantid }}
-        tenantid: {{ $storage.swift.tenantid }}
-        {{- end }}
-        {{- if $storage.swift.domain }}
-        domain: {{ $storage.swift.domain }}
-        {{- end }}
-        {{- if $storage.swift.domainid }}
-        domainid: {{ $storage.swift.domainid }}
-        {{- end }}
-        {{- if $storage.swift.trustid }}
-        trustid: {{ $storage.swift.trustid }}
-        {{- end }}
-        {{- if $storage.swift.insecureskipverify }}
-        insecureskipverify: {{ $storage.swift.insecureskipverify }}
-        {{- end }}
-        {{- if $storage.swift.chunksize }}
-        chunksize: {{ $storage.swift.chunksize }}
-        {{- end }}
-        {{- if $storage.swift.prefix }}
-        prefix: {{ $storage.swift.prefix }}
-        {{- end }}
-        {{- if $storage.swift.authversion }}
-        authversion: {{ $storage.swift.authversion }}
-        {{- end }}
-        {{- if $storage.swift.endpointtype }}
-        endpointtype: {{ $storage.swift.endpointtype }}
-        {{- end }}
-        {{- if $storage.swift.tempurlcontainerkey }}
-        tempurlcontainerkey: {{ $storage.swift.tempurlcontainerkey }}
-        {{- end }}
-        {{- if $storage.swift.tempurlmethods }}
-        tempurlmethods: {{ $storage.swift.tempurlmethods }}
-        {{- end }}
-      {{- else if eq $type "oss" }}
-      oss:
-        accesskeyid: {{ $storage.oss.accesskeyid }}
-        region: {{ $storage.oss.region }}
-        bucket: {{ $storage.oss.bucket }}
-        {{- if $storage.oss.endpoint }}
-        endpoint: {{ $storage.oss.endpoint }}
-        {{- end }}
-        {{- if $storage.oss.internal }}
-        internal: {{ $storage.oss.internal }}
-        {{- end }}
-        {{- if $storage.oss.encrypt }}
-        encrypt: {{ $storage.oss.encrypt }}
-        {{- end }}
-        {{- if $storage.oss.secure }}
-        secure: {{ $storage.oss.secure }}
-        {{- end }}
-        {{- if $storage.oss.chunksize }}
-        chunksize: {{ $storage.oss.chunksize }}
-        {{- end }}
-        {{- if $storage.oss.rootdirectory }}
-        rootdirectory: {{ $storage.oss.rootdirectory }}
-        {{- end }}
-      {{- end }}
-      cache:
-        layerinfo: redis
-      maintenance:
-        uploadpurging:
-          enabled: false
-      delete:
-        enabled: true
-    redis:
-      addr: "{{ template "harbor.redis.host" . }}:{{ template "harbor.redis.port" . }}"
-      password: {{ template "harbor.redis.password" . }}
-      db: {{ template "harbor.redis.databaseIndex" . }}
-    http:
-      addr: :5000
-      # set via environment variable
-      # secret: placeholder
-      debug:
-        addr: localhost:5001
-    auth:
-      token:
-        issuer: harbor-token-issuer
-        realm: "{{ template "harbor.externalURL" . }}/service/token"
-        rootcertbundle: /etc/registry/root.crt
-        service: harbor-registry
-    notifications:
-      endpoints:
-        - name: harbor
-          disabled: false
-          url: http://{{ template "harbor.fullname" . }}-ui/service/notifications
-          timeout: 3000ms
-          threshold: 5
-          backoff: 1s

templates/registry/registry-cm.yaml

+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: "{{ template "harbor.registry" . }}"
+  labels:
+{{ include "harbor.labels" . | indent 4 }}
+data:
+  config.yml: |+
+    version: 0.1
+    log:
+      level: {{ .Values.logLevel }}
+      fields:
+        service: registry
+    storage:
+      filesystem:
+        rootdirectory: /data
+      cache:
+        layerinfo: redis
+      maintenance:
+        uploadpurging:
+          enabled: false
+      delete:
+        enabled: true
+      redirect:
+        disable: false
+    redis:
+      addr: "{{ template "harbor.redis.host" . }}:{{ template "harbor.redis.port" . }}"
+      db: {{ template "harbor.redis.registryDatabaseIndex" . }}
+    http:
+      addr: :5000
+      # set via environment variable
+      # secret: placeholder
+      debug:
+        addr: localhost:5001
+    auth:
+      token:
+        issuer: harbor-token-issuer
+        realm: "{{ .Values.externalURL }}/service/token"
+        rootcertbundle: /etc/registry/root.crt
+        service: harbor-registry
+    validation:
+      disabled: true
+    notifications:
+      endpoints:
+        - name: harbor
+          disabled: false
+          url: http://{{ template "harbor.core" . }}/service/notifications
+          timeout: 3000ms
+          threshold: 5
+          backoff: 1s
+  ctl-config.yml: |+
+    ---
+    protocol: "http"
+    port: 8080
+    log_level: {{ .Values.logLevel }}

templates/registry/statefulset.yaml → templates/registry/registry-dpl.yaml

 apiVersion: apps/v1
-kind: StatefulSet
+kind: Deployment
 metadata:
-  name: "{{ template "harbor.fullname" . }}-registry"
+  name: "{{ template "harbor.registry" . }}"
   labels:
 {{ include "harbor.labels" . | indent 4 }}
-    app: harbor-registry
-    version: {{ .Values.registry.image.tag }}
+    component: registry
 spec:
-  replicas: 1
-  serviceName: "{{ template "harbor.fullname" . }}-registry"
+  replicas: {{ .Values.registry.replicas }}
   selector:
     matchLabels:
 {{ include "harbor.matchLabels" . | indent 6 }}
-      app: harbor-registry
+      component: registry
   template:
     metadata:
       labels:
 {{ include "harbor.labels" . | indent 8 }}
-        app: harbor-registry
-        version: {{ .Values.registry.image.tag }}
+        component: registry
+      annotations:
+        checksum/configmap: {{ include (print $.Template.BasePath "/registry/registry-cm.yaml") . | sha256sum }}
+        checksum/secret: {{ include (print $.Template.BasePath "/registry/registry-secret.yaml") . | sha256sum }}
+        checksum/secret-jobservice: {{ include (print $.Template.BasePath "/jobservice/jobservice-secrets.yaml") . | sha256sum }}
+        checksum/secret-core: {{ include (print $.Template.BasePath "/core/core-secret.yaml") . | sha256sum }}
+{{- if .Values.registry.podAnnotations }}
+{{ toYaml .Values.registry.podAnnotations | indent 8 }}
+{{- end }}
     spec:
       containers:
       - name: registry
-        image: {{ .Values.registry.image.repository }}:{{ .Values.registry.image.tag }}
-        imagePullPolicy: {{ .Values.registry.image.pullPolicy }}
+        image: {{ .Values.registry.registry.image.repository }}:{{ .Values.registry.registry.image.tag }}
+        imagePullPolicy: {{ .Values.imagePullPolicy }}
+        livenessProbe:
+          httpGet:
+            path: /
+            port: 5000
+          initialDelaySeconds: 1
+          periodSeconds: 10
+        readinessProbe:
+          httpGet:
+            path: /
+            port: 5000
+          initialDelaySeconds: 1
+          periodSeconds: 10
+{{- if .Values.registry.registry.resources }}
         resources:
-{{ toYaml .Values.registry.resources | indent 10 }}
+{{ toYaml .Values.registry.registry.resources | indent 10 }}
+{{- end }}
         args: ["serve", "/etc/registry/config.yml"]
-        env:
-          - name: REGISTRY_HTTP_SECRET
-            valueFrom:
-              secretKeyRef:
-                name: "{{ template "harbor.fullname" . }}-registry"
-                key: httpSecret
-          {{- $storage := .Values.registry.storage }}
-          {{- $type := $storage.type }}
-          {{- if eq $type "azure" }}
-          - name: REGISTRY_STORAGE_AZURE_ACCOUNTKEY
-            valueFrom:
-              secretKeyRef:
-                name: "{{ template "harbor.fullname" . }}-registry"
-                key: accountkey
-          {{- else if eq $type "s3" }}
-          {{- if $storage.s3.accesskey }}
-          - name: REGISTRY_STORAGE_S3_ACCESSKEY
-            valueFrom:
-              secretKeyRef:
-                name: "{{ template "harbor.fullname" . }}-registry"
-                key: accesskey
-          {{- end }}
-          {{- if $storage.s3.secretkey }}
-          - name: REGISTRY_STORAGE_S3_SECRETKEY
-            valueFrom:
-              secretKeyRef:
-                name: "{{ template "harbor.fullname" . }}-registry"
-                key: secretkey
-          {{- end }}
-          {{- else if eq $type "swift" }}
-          - name: REGISTRY_STORAGE_SWIFT_PASSWORD
-            valueFrom:
-              secretKeyRef:
-                name: "{{ template "harbor.fullname" . }}-registry"
-                key: password
-          {{- if $storage.swift.secretkey }}
-          - name: REGISTRY_STORAGE_SWIFT_SECRETKEY
-            valueFrom:
-              secretKeyRef:
-                name: "{{ template "harbor.fullname" . }}-registry"
-                key: secretkey
-          {{- end }}
-          {{- if $storage.swift.accesskey }}
-          - name: REGISTRY_STORAGE_SWIFT_ACCESSKEY
-            valueFrom:
-              secretKeyRef:
-                name: "{{ template "harbor.fullname" . }}-registry"
-                key: accesskey
-          {{- end }}
-          {{- else if eq $type "oss" }}
-          - name: REGISTRY_STORAGE_OSS_ACCESSKEYSECRET
-            valueFrom:
-              secretKeyRef:
-                name: "{{ template "harbor.fullname" . }}-registry"
-                key: accesskeysecret
-          {{- end }}
+        envFrom:
+        - secretRef:
+            name: "{{ template "harbor.registry" . }}"
         ports:
         - containerPort: 5000
         - containerPort: 5001
         volumeMounts:
-        {{- if eq .Values.registry.storage.type "filesystem" }}
         - name: registry-data
-          mountPath: {{ .Values.registry.storage.filesystem.rootdirectory }}
-        {{- end }}
+          mountPath: /data
         - name: registry-root-certificate
           mountPath: /etc/registry/root.crt
           subPath: tokenServiceRootCertBundle
@@ -99,19 +63,74 @@ spec:
           subPath: config.yml
         - name: etc-localtime
           mountPath: /etc/localtime          
+      - name: registryctl
+        image: {{ .Values.registry.controller.image.repository }}:{{ .Values.registry.controller.image.tag }}
+        imagePullPolicy: {{ .Values.imagePullPolicy }}
+        livenessProbe:
+          httpGet:
+            path: /api/health
+            port: 8080
+          initialDelaySeconds: 1
+          periodSeconds: 10
+        readinessProbe:
+          httpGet:
+            path: /api/health
+            port: 8080
+          initialDelaySeconds: 1
+          periodSeconds: 10
+{{- if .Values.registry.controller.resources }}
+        resources:
+{{ toYaml .Values.registry.controller.resources | indent 10 }}
+{{- end }}
+        args: ["serve", "/etc/registry/config.yml"]
+        envFrom:
+        - secretRef:
+            name: "{{ template "harbor.registry" . }}"
+        env:
+          - name: CORE_SECRET
+            valueFrom:
+              secretKeyRef:
+                name: {{ template "harbor.core" . }}
+                key: secret
+          - name: JOBSERVICE_SECRET
+            valueFrom:
+              secretKeyRef:
+                name: {{ template "harbor.jobservice" . }}
+                key: secret
+        ports:
+        - containerPort: 8080
+        volumeMounts:
+        - name: registry-data
+          mountPath: /data
+        - name: registry-config
+          mountPath: /etc/registry/config.yml
+          subPath: config.yml
+        - name: registry-config
+          mountPath: /etc/registryctl/config.yml
+          subPath: ctl-config.yml
+        - name: etc-localtime
+          mountPath: /etc/localtime          
       volumes:
       - name: etc-localtime
         hostPath:
           path: /etc/localtime      
       - name: registry-root-certificate
         secret:
-          secretName: "{{ template "harbor.fullname" . }}-ui"
+          {{- if .Values.core.secretName }}
+          secretName: {{ .Values.core.secretName }}
+          {{- else }}
+          secretName: {{ template "harbor.core" . }}
+          {{- end }}
       - name: registry-config
         configMap:
-          name: "{{ template "harbor.fullname" . }}-registry"
+          name: "{{ template "harbor.registry" . }}"
       - name: registry-data
         hostPath:
-          path: {{ .Values.registry.hostpath }}
+          {{- if .Values.registry.hostPath }}
+          path: {{ .Values.registry.hostPath }}
+          {{- else }}
+          path: /data/{{ .Release.Namespace }}/{{ .Release.Name }}/registry 
+          {{- end }}          
     {{- with .Values.registry.nodeSelector }}
       nodeSelector:
 {{ toYaml . | indent 8 }}

templates/registry/secret.yaml → templates/registry/registry-secret.yaml

 apiVersion: v1
 kind: Secret
 metadata:
-  name: "{{ template "harbor.fullname" . }}-registry"
+  name: "{{ template "harbor.registry" . }}"
   labels:
 {{ include "harbor.labels" . | indent 4 }}
 type: Opaque
 data:
-  httpSecret: {{ .Values.registry.httpSecret | b64enc | quote }}
-  {{- $storage := .Values.registry.storage }}
+  REGISTRY_HTTP_SECRET: {{ .Values.registry.secret | default (randAlphaNum 16) | b64enc | quote }}
+  REGISTRY_REDIS_PASSWORD: {{ (include "harbor.redis.rawPassword" .) | b64enc | quote }}
+  {{- $storage := .Values.persistence.imageChartStorage }}
   {{- $type := $storage.type }}
   {{- if eq $type "azure" }}
-  accountkey: {{ $storage.azure.accountkey | b64enc | quote }}
+  REGISTRY_STORAGE_AZURE_ACCOUNTKEY: {{ $storage.azure.accountkey | b64enc | quote }}
+  {{- else if eq $type "gcs" }}
+  GCS_KEY_DATA: {{ $storage.gcs.encodedkey | quote }}
   {{- else if eq $type "s3" }}
   {{- if $storage.s3.accesskey }}
-  accesskey: {{ $storage.s3.accesskey | b64enc | quote }}
+  REGISTRY_STORAGE_S3_ACCESSKEY: {{ $storage.s3.accesskey | b64enc | quote }}
   {{- end }}
   {{- if $storage.s3.secretkey }}
-  secretkey: {{ $storage.s3.secretkey | b64enc | quote }}
+  REGISTRY_STORAGE_S3_SECRETKEY: {{ $storage.s3.secretkey | b64enc | quote }}
   {{- end }}
   {{- else if eq $type "swift" }}
-  password: {{ $storage.swift.password }}
+  REGISTRY_STORAGE_SWIFT_PASSWORD: {{ $storage.swift.password | b64enc | quote }}
   {{- if $storage.swift.secretkey }}
-  secretkey: {{ $storage.swift.secretkey }}
+  REGISTRY_STORAGE_SWIFT_SECRETKEY: {{ $storage.swift.secretkey | b64enc | quote }}
   {{- end }}
   {{- if $storage.swift.accesskey }}
-  accesskey: {{ $storage.swift.accesskey }}
+  REGISTRY_STORAGE_SWIFT_ACCESSKEY: {{ $storage.swift.accesskey | b64enc | quote }}
   {{- end }}
   {{- else if eq $type "oss" }}
-  accesskeysecret: {{ $storage.oss.accesskeysecret }}
+  REGISTRY_STORAGE_OSS_ACCESSKEYSECRET: {{ $storage.oss.accesskeysecret | b64enc | quote }}
   {{- end }}

templates/registry/service.yaml → templates/registry/registry-svc.yaml

 apiVersion: v1
 kind: Service
 metadata:
-  name: "{{ template "harbor.fullname" . }}-registry"
+  name: "{{ template "harbor.registry" . }}"
   labels:
 {{ include "harbor.labels" . | indent 4 }}
 spec:
   ports:
-    - name: http
+    - name: registry
       port: 5000
+    - name: controller
+      port: 8080
   selector:
 {{ include "harbor.matchLabels" . | indent 4 }}
-    app: harbor-registry
\ No newline at end of file
+    component: registry
\ No newline at end of file

values-aliyun.yaml

-persistence:
+expose:
+  type: ingress
+  tls:
     enabled: false
-externalProtocol: https
-externalDomain: hub.wodcloud.local
-harborAdminPassword: "passwd"
+  ingress:
+    host: harbor.wodcloud.local
+    controller: default
+    annotations:
+      ingress.kubernetes.io/ssl-redirect: "true"  
+    rewriteAnnotation: traefik.ingress.kubernetes.io/rewrite-target
 
-ingress:
-  enabled: true
+externalURL: https://harbor.wodcloud.local
 
-adminserver:
-  image:
-    repository: registry.cn-qingdao.aliyuncs.com/wod/harbor-adminserver
-    tag: v1.6.3
-  nodeSelector:
-    harbor: enabled
+persistence:
+  enabled: false
 
-jobservice:
-  image:
-    repository: registry.cn-qingdao.aliyuncs.com/wod/harbor-jobservice
-    tag: v1.6.3
+imagePullPolicy: IfNotPresent
 
-ui:
+logLevel: debug
+harborAdminPassword: "changeit"
+secretKey: "IpTIscRIgmerlare"
+
+portal:
   image:
-    repository: registry.cn-qingdao.aliyuncs.com/wod/harbor-ui
-    tag: v1.6.3
+    repository: registry.cn-qingdao.aliyuncs.com/wod/harbor-portal
+    tag: v1.7.5
+  replicas: 1
 
-busybox:
+core:
   image:
-    repository: registry.cn-qingdao.aliyuncs.com/wod/busybox
-    tag: "1.30"
+    repository: registry.cn-qingdao.aliyuncs.com/wod/harbor-core
+    tag: v1.7.5
+  replicas: 1
 
-database:
-  internal:
+jobservice:
   image:
-      repository: registry.cn-qingdao.aliyuncs.com/wod/harbor-db
-      tag: v1.6.3
-    resources:
-      limits:
-        memory: 4Gi
-        cpu: 1000m
-      requests:
-        memory: 256Mi
-        cpu: 100m        
-    password: "passwd"
-    nodeSelector:
-      harbor: enabled
+    repository: registry.cn-qingdao.aliyuncs.com/wod/harbor-jobservice
+    tag: v1.7.5
+  replicas: 1
+  maxJobWorkers: 10
+  jobLogger: file
 
 registry:
+  registry:
     image:
       repository: registry.cn-qingdao.aliyuncs.com/wod/registry
-    tag: 2.7.1
-  hostpath: /data/registry
+      tag: v2.7.1
     resources:
       limits:
         memory: 4Gi
@@ -59,44 +54,62 @@ registry:
         cpu: 100m  
   nodeSelector:
     harbor: enabled
+  controller:
+    image:
+      repository: registry.cn-qingdao.aliyuncs.com/wod/harbor-registryctl
+      tag: v1.7.5
+  replicas: 1
 
 chartmuseum:
   enabled: true
   image:
-    repository: registry.cn-qingdao.aliyuncs.com/wod/chartmuseum
-    tag: v0.7.1
+    repository: registry.cn-qingdao.aliyuncs.com/wod/chartmuseum-photon
+    tag: v0.8.1-v1.7.5
+  replicas: 1
+  nodeSelector:
+    harbor: enabled  
 
 clair:
   enabled: true
   image:
-    repository: registry.cn-qingdao.aliyuncs.com/wod/clair
-    tag: v2.0.6
+    repository: registry.cn-qingdao.aliyuncs.com/wod/clair-photon
+    tag: v2.0.8-v1.7.5
+  replicas: 1
+  updatersInterval: 12
+
+notary:
+  enabled: true
+  server:
+    image:
+      repository: registry.cn-qingdao.aliyuncs.com/wod/notary-server-photon
+      tag: v0.6.1-v1.7.5
+    replicas: 1
+  signer:
+    image:
+      repository: registry.cn-qingdao.aliyuncs.com/wod/notary-signer-photon
+      tag: v0.6.1-v1.7.5
+    replicas: 1
+
+database:
+  type: internal
+  internal:
+    image:
+      repository: registry.cn-qingdao.aliyuncs.com/wod/harbor-db
+      tag: v1.7.5
+    password: "changeit"
     resources:
       limits:
-      memory: 1Gi
+        memory: 4Gi
         cpu: 1000m
       requests:
-      memory: 128Mi
+        memory: 256Mi
         cpu: 100m
+    nodeSelector:
+      harbor: enabled        
 
 redis:
+  type: internal
+  internal:
     image:
       repository: registry.cn-qingdao.aliyuncs.com/wod/redis
       tag: 4.0.11-alpine
\ No newline at end of file
-  usePassword: false
-  cluster:
-    enabled: false
-  master:
-    persistence:
-      enabled: false
-
-notary:
-  enabled: true
-  server:
-    image:
-      repository: registry.cn-qingdao.aliyuncs.com/wod/notary-server-photon
-      tag: dev
-  signer:
-    image:
-      repository: registry.cn-qingdao.aliyuncs.com/wod/notary-signer-photon
-      tag: dev
\ No newline at end of file