2.13.2

.github/workflows/integration.yaml

-name: Integration test
-
-on:
-  pull_request:
-  push:
-
-jobs:
-  integration-test:
-    runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        k8s_version: [v1.18.2, v1.17.5, v1.16.9]
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v2
-
-      - name: Setup Docker
-        uses: docker-practice/actions-setup-docker@0.0.1
-        with:
-          docker_version: 18.09
-          docker_channel: stable
-          docker_daemon_json: '{"insecure-registries":["0.0.0.0/0"]}'
-
-      - name: Create kind cluster
-        uses: helm/kind-action@v1.0.0-rc.1
-        with:
-          version: v0.8.1
-          node_image: kindest/node:${{ matrix.k8s_version }}
-          cluster_name: kind-cluster-${{ matrix.k8s_version }}
-          config: test/integration/kind-cluster.yaml
-
-      - name: Install Nginx ingress controller
-        run: |
-          kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/ingress-nginx-2.3.0/deploy/static/provider/kind/deploy.yaml
-          kubectl wait --namespace ingress-nginx --for=condition=ready pod --selector=app.kubernetes.io/component=controller --timeout=120s
-
-      - name: Set up Go 1.13
-        uses: actions/setup-go@v2
-        with:
-          go-version: 1.13
-
-      - name: Cache go mod
-        uses: actions/cache@v2
-        with:
-          path: ~/go/pkg/mod
-          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
-          restore-keys: |
-            ${{ runner.os }}-go-
-
-      - name: Set /etc/hosts
-        run: |
-         sudo -- sh -c "echo '127.0.0.1 harbor.local' >> /etc/hosts"
-         sudo -- sh -c "echo '127.0.0.1 notary.harbor.local' >> /etc/hosts"
-
-      - name: Run integration tests
-        working-directory: ./test
-        run:
-          go test -v -timeout 30m github.com/goharbor/harbor-helm/integration
\ No newline at end of file

.github/workflows/lint.yaml

-name: Lint
-
-on:
-  pull_request:
-  push:
-
-jobs:
-  lint:
-    runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        helm_version: [3.2.3, 2.16.8]
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v2
-        with:
-          path: harbor
-
-      - name: Set up Helm
-        uses: azure/setup-helm@v1
-        with:
-          version: '${{ matrix.helm_version }}'
-
-      - name: Helm version
-        run:
-          helm version -c
-
-      - name: Run lint
-        working-directory: ./harbor
-        run:
-          helm lint .
-
-      - name: Update dependency
-        working-directory: ./harbor
-        run:
-          helm dependency update .
-
-      - name: Run template for ingress expose
-        working-directory: ./harbor
-        run:
-          helm template --set "expose.type=ingress" --output-dir $(mktemp -d -t output-XXXXXXXXXX) .
-
-      - name: Run template for nodePort expose
-        working-directory: ./harbor
-        run:
-          helm template --set "expose.type=nodePort,expose.tls.auto.commonName=127.0.0.1" --output-dir $(mktemp -d -t output-XXXXXXXXXX) .
\ No newline at end of file

.github/workflows/unittest.yaml

-name: Unit test
-
-on:
-  pull_request:
-  push:
-
-jobs:
-  unit-test:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v2
-
-      - name: Set up Helm 3.2.3
-        uses: azure/setup-helm@v1
-        with:
-          version: '3.2.3'
-
-      - name: Set up Go 1.13
-        uses: actions/setup-go@v2
-        with:
-          go-version: 1.13
-
-      - name: Cache go mod
-        uses: actions/cache@v2
-        with:
-          path: ~/go/pkg/mod
-          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
-          restore-keys: |
-            ${{ runner.os }}-go-
-
-      - name: Run unit tests
-        working-directory: ./test
-        run:
-          go test -v github.com/goharbor/harbor-helm/unittest

Chart.yaml

-apiVersion: v1
-name: beagle-harbor
-version: 2.1.7
-appVersion: 2.1.7
-description: An open source trusted cloud native registry that stores, signs, and scans content
-keywords:
-  - docker
-  - registry
-  - harbor
-home: https://goharbor.io
-icon: https://raw.githubusercontent.com/goharbor/website/master/static/img/logos/harbor-icon-color.png
-sources:
-  - https://github.com/goharbor/harbor
-  - https://github.com/goharbor/harbor-helm
-maintainers:
-  - name: Wenkai Yin
-    email: yinw@vmware.com
-  - name: Weiwei He
-    email: hweiwei@vmware.com
-  - name: Qian Deng
-    email: dengq@vmware.com
-engine: gotpl
+apiVersion: v1
+appVersion: 2.13.2
+description: An open source trusted cloud native registry that stores, signs, and
+  scans content
+home: https://goharbor.io
+icon: https://raw.githubusercontent.com/goharbor/website/main/static/img/logos/harbor-icon-color.png
+keywords:
+- docker
+- registry
+- harbor
+maintainers:
+- email: yan-yw.wang@broadcom.com
+  name: Yan Wang
+- email: wenkai.yin@broadcom.com
+  name: Wenkai Yin
+- email: miner.yang@broadcom.com
+  name: Miner Yang
+- email: shengwen.yu@broadcom.com
+  name: Shengwen Yu
+name: harbor
+sources:
+- https://github.com/goharbor/harbor
+- https://github.com/goharbor/harbor-helm
+version: 1.17.2

ansible/images.yaml

-IMAGES:
-  harbor-portal:
-    NAME: harbor-portal
-    VERSION: 'v2.1.6'
-  harbor-core:
-    NAME: harbor-core
-    VERSION: 'v2.1.6'
-  harbor-jobservice:
-    NAME: harbor-jobservice
-    VERSION: 'v2.1.6'
-  harbor-db:
-    NAME: harbor-db
-    VERSION: 'v2.1.6'
-  harbor-registryctl:
-    NAME: harbor-registryctl
-    VERSION: 'v2.1.6'
-  chartmuseum:
-    NAME: chartmuseum
-    VERSION: 'v0.12.0'
-  clair:
-    NAME: clair
-    VERSION: 'v2.1.7'
-  harbor-scanner-clair:
-    NAME: harbor-scanner-clair
-    VERSION: 'v1.1.1'
-  harbor-scanner-trivy:
-    NAME: harbor-scanner-trivy
-    VERSION: v0.17.0
-  notary-server:
-    NAME: notary-server
-    VERSION: v0.6.1
-  notary-signer:
-    NAME: notary-signer
-    VERSION: v0.6.1
-  registry:
-    NAME: registry
-    VERSION: 'v2.7.1'
-  redis:
-    NAME: redis
-    VERSION: '6.2.6'

cert/tls.crt

------BEGIN CERTIFICATE-----
-MIIE0zCCArugAwIBAgIJAPY/OzLMeVq2MA0GCSqGSIb3DQEBCwUAMAAwHhcNMTkw
-NDE4MDIyNzM3WhcNMjkwNDE1MDIyNzM3WjAAMIICIjANBgkqhkiG9w0BAQEFAAOC
-Ag8AMIICCgKCAgEA3xlUJs2b/aI2NLoy4OIQ+dn/yMb/O99iKDRyZKpH8rSOmS+o
-F9unmSAzL65XA/v6nY0OLI/dASDjkqkBpIdTGzogR5f8UiB6osuEY7V71XZdzWLr
-PjnJq6ZLAaoKmwG80W5+Wd6V8PygOx52mkr1w7IWKz+1ZLI5izbppon7XVGVRaAT
-RvNZDiJ6CeJpcJ5H723lkf5RvJWatZLCYIYDbRfTiKsyQ/SlRcv5BVfHg/LJSH9Q
-LGRhPMARldl9wyZCwZZDHxheI4a+26aa8MY3u9st/l0/Oo6VCTGpMiEhiGF2LVjp
-UWq/+BP4SFEvJfq/DuinI139W/5aZZ7/HwRPlmYU6pXTRLyIg7jd+19fJwR7X37q
-w0o8t06FhjmrCzaYCUjoReqDmHaNmZN/ddvG7jZWBu+jNh0YavsyQyCIVmv6yqSc
-jPiD9uivxqTwjJidIBRfuUrz3aERQ7cQgf0qhqjIzflzHbFKhILocBWq7zyNl9hr
-vUGT/WZcw0t/OtM72SPaplmTgVbbQRxf2VHzyptGIvtydlXK8thxOMpXo4e+Sl8d
-1gdQcC4oisN9F29oNs8P5yFQP//xYuv8C607nCj1DzrId5avG/NVfKB/fbDKEFgN
-2WhHInTzPLEcjF4fErcUAEuWW0buX/6FHCG3iTtrqyD92KTVDfN1J56rrcsCAwEA
-AaNQME4wHQYDVR0OBBYEFFhNhTo4UAC2PUsf8jYaWj160vGEMB8GA1UdIwQYMBaA
-FFhNhTo4UAC2PUsf8jYaWj160vGEMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEL
-BQADggIBAMAsEtVlELMwdtcifHeOT0kOmf5wo9In/eFSgscCzBMDaRx2B3q36AoS
-Il7XWAZpevaR7W7yeARKaAshBLhygUqLD0zWbKlSN9Hprd1wdpM0ffyPpN5dxOYA
-er04y12GRnCbMYqi4cvztP4TinXqq2yHSYhLbO9qkI5gbWVxkRuIcMKvixddllNY
-Q3obJaDDHmovM3+g/G+1YFgt4qES38XnJ7BrSshHnn5EIQh286xfJriyrK2hHbLJ
-qz0YuF6G3DXPeWGgXvj0Hipc0f8UDZkKkk/eGEI6vEkytyvoepoZI2XbAf/ZMy5n
-KwuhEn4hhkFMwWaSWp/h0QdMCaxk4BVSOqmNVaLSB7+FjsIj4CasFotYiyJ2gpRB
-Nf8QaS4bz0Tn1eBbC8ksj+e3ZWeX2b5wVMjql9jTt2X1ICs8KKe3vEBkjqT2AUi2
-52TtKzm73aWrz/GPy/Q2LCor3Fh9FGVSBOBBDXGy6MJpNHJnYVH9EENFGOh85ol1
-2pADOBB5vAU/kLB5LHPj2kue/FMiHaNnrSYIGrMlBSX2jj9EYa1uuUH+pd4MBj1F
-5uH8ORiaQ6ht2+WHklxic1Rj5yTYQwVlH70CBOn+qVEdo63yQwzAMJKFIwlGUQEX
-jiljgc86q4cZtUTFrcwMidbk+8Q6+JbDVg7HV/+pnC+wnv197kwe
------END CERTIFICATE-----

cert/tls.key

------BEGIN RSA PRIVATE KEY-----
-MIIJKQIBAAKCAgEA3xlUJs2b/aI2NLoy4OIQ+dn/yMb/O99iKDRyZKpH8rSOmS+o
-F9unmSAzL65XA/v6nY0OLI/dASDjkqkBpIdTGzogR5f8UiB6osuEY7V71XZdzWLr
-PjnJq6ZLAaoKmwG80W5+Wd6V8PygOx52mkr1w7IWKz+1ZLI5izbppon7XVGVRaAT
-RvNZDiJ6CeJpcJ5H723lkf5RvJWatZLCYIYDbRfTiKsyQ/SlRcv5BVfHg/LJSH9Q
-LGRhPMARldl9wyZCwZZDHxheI4a+26aa8MY3u9st/l0/Oo6VCTGpMiEhiGF2LVjp
-UWq/+BP4SFEvJfq/DuinI139W/5aZZ7/HwRPlmYU6pXTRLyIg7jd+19fJwR7X37q
-w0o8t06FhjmrCzaYCUjoReqDmHaNmZN/ddvG7jZWBu+jNh0YavsyQyCIVmv6yqSc
-jPiD9uivxqTwjJidIBRfuUrz3aERQ7cQgf0qhqjIzflzHbFKhILocBWq7zyNl9hr
-vUGT/WZcw0t/OtM72SPaplmTgVbbQRxf2VHzyptGIvtydlXK8thxOMpXo4e+Sl8d
-1gdQcC4oisN9F29oNs8P5yFQP//xYuv8C607nCj1DzrId5avG/NVfKB/fbDKEFgN
-2WhHInTzPLEcjF4fErcUAEuWW0buX/6FHCG3iTtrqyD92KTVDfN1J56rrcsCAwEA
-AQKCAgEAk8q8s4PrvYby79UVlWJNKqceykwBkxE1fjrYORWQ2hiAirxGV5+8lDT/
-k6ujm1EWwb5K0HxxRKkb+PEa1HqNNHE6JxNpJKK9exDlYAQ+x7dFBqVr/2nazmo4
-MB8MLYlmIztWWoSYwe8o2mEg4q+bxYs5Imdu7AkhE7dJ63hm23gLMfeMLalRqopu
-XBPwE5nXP6aGuUNHtG1K8tQJDlZY+LEbAeOfReNQhT9NdRukYSW579vfKblJrSvz
-ulg89sVm3cWEK5pB6rj9wJbK94voKftVqbbuBwWjd1a9pibKhwVBe2L2FWhpSZc5
-F/coC7njTaYT6tr91y5VhhJhIZQCf/vv4Zl5XhFHs5VTZNbM/OfqyFQLYXVJO48K
-F7tmazAEQQBQwVZqH9C9NQdzPHWmc38Okhtc1wzaqn/rg9+1sgAMD8hWCtQJUe97
-b9ymh5A0Z4QXKpyFT0b+pXcD1jRha07UtkX+/zLJ9HpAXcUmzkG+j5CXNpnxsIq5
-fJFeq3hBj9w6n4h+50M4W0Fse5YoEUsc3B0fz8BlQBb+YJLFLNH34MH8p1l0ZDYJ
-yae0psxlBijg4OPZ+WCBa+jtFW4LiWgEcxwgz8w+hEOAQr2a1Dc7w8jd+Y4IK8Um
-lTVs5dbp4mOmPMlRv/GM7kDudFqbMg3YFwXg3QbquVqLZzEzjVkCggEBAPJKZbCW
-YfLejkS/fkRyV3VIb54mKwQHoMWub88tPgGuXzjsJyd5QTQ58PpUjXrLHmn8lS2+
-viE8GJylKwN1yMlZw40+kZhpHUpCWx/2ZKjAqvqA9OOKo2fv6Hd/wOAnU4CtioC1
-pri7lKFYXoP8DtQVwHYvIzCRqDnhc4mwJDqzTC9xduI+svxzl4xH82fx0jrPiFY+
-/wOdXjyfIPjyhHC4jPTWbairwXS9dBjSl128aIRT580/yXE/SYAugg05jKtg5zQA
-So13MTezXRHXdO0di3tEMHGREEkFpeVnnPQvCCedK0DV36iNwiWc8pwdfLMVneTt
-DKwZedCx+o/7ev0CggEBAOu48DGEJJJzHxVR5mY1K2AlZyYtpTOWehK1zX74JvM3
-YxN4nd+Zx5n9uSPmmKzqF3TU+44RVtdJK6ejoFE8dMDTNWaSLW/ZDmN1nT0njvOn
-IWJn59ynOChWWKZgXZ/9UqGR7Pt6OxSkkex9c/fYBsMX/xusdXQigeogl0iOYVFW
-gXIiiLRLHpHJsK/uNxIizj0hTYYn7uD7PRENwFRcCYf8J1eUFbd6DuCVWeQCKWgf
-Nd2tSWoi0Vylj4uUX8Iw0tjLNMD5CREJEk4GSv4EDSmvUdv1LiBKJCL2lEcgoPeC
-oOD2iCc5KqgnmQraRilFFk8RVXA9PWZGY3C0b6TVmmcCggEANZO2AOKALlCAbTtb
-FI+kP08RP4t5H58AMjZsiweaGo0QiWnPDq+Fd6MIYpKn5mtcAlvUMRVovbioSJtN
-c6psB/pNf8JCN82mqHEb7WlywM46AMLbZCWYFLe8VBBv+iE4GdBGPEfu4hK4vyTn
-YZAvRz64HGo4Adlztbjg76V/nWtggW05uLXcpm55KJAQhv+2WULjBw9PHOGDoSwf
-Am2+U567rLht70prsQDj10laJ2QuSHS1YXGlfeFcw3eFUp9TN+JpvdoCol2lCIgl
-IHjgZj6ORWfCvpoxW7RgBuZukqCD0R60HdYtavxN3jtiepsapA83pxO0JapMgZWZ
-rpURkQKCAQBOcEv9Liu9T/GX9pjkiezVIZ0hZy8B66DTeQvYpFrRtCyT3h8quNFi
-vLtO5v0HDR6hEf5jWAG9wet07U37ulJfl+i9KQdVoLTZA9o+71ryWTsSs+DD3CEj
-yxfUxVxiULmeaiChzhq608h7GYPthUU6xlFttAWhj5oLfqzYyAg6OL76a+Nxm02g
-1ayl3m8U6eAXF23kpoUm+HNpqVnGuJmzVoUA75YKZ+NreEdhSBbfPwN9sJwtZUil
-u7H4kHcM95Ix8eysCjKqKIqezBlITbDTnjNvLjcbJ5C+0a6lvIXT1vQR5/eGlc9M
-BWE360pNkV/LD8mOf9Jepi2Q43oDL9EhAoIBAQDTWImfy0K9gGzA2rPy169mWYQK
-OlcnD3+hQq6x51Zn1e/texFeVlhHn4rrnRdCFOAp47uFkJ2m72GCVD74EwQucK9y
-AD5jorqgVHqCKZdkHjb2V60Mzm6g3rtL9WJXFVLvNBb/QGB2vgHVOO0zqiqGZj4e
-Ex7l2m//5SE4DLtn70J9CgG1HtXCS8dWrGPL1pzDnk8VXtnoXzb0LChLUFEgZRmh
-cV6AFHEK2H8wBHviNyehsRQiDkl2AiWOcJNvkzW68ck2nJjRWyPYK1JL3NCKpB3Q
-OohrP0fHcWAXMW97wFXZhRfnQfDxxIOlj3McYT0AlanXd0F4NGc2Nvmphx04
------END RSA PRIVATE KEY-----

conf/clair.yaml

-clair:
-  database:
-    type: pgsql
-    options:
-      source: "{{ template "harbor.database.clair" . }}"
-      # Number of elements kept in the cache
-      # Values unlikely to change (e.g. namespaces) are cached in order to save prevent needless roundtrips to the database.
-      cachesize: 16384
-  api:
-    # API server port
-    port: 6060
-    healthport: 6061
-    # Deadline before an API request will respond with a 503
-    timeout: 300s
-  updater:
-    interval: {{ .Values.clair.updatersInterval }}h

conf/notary-server.json

-{
-  "server": {
-    "http_addr": ":4443"
-  },
-  "trust_service": {
-    "type": "remote",
-    "hostname": "{{ template "harbor.notary-signer" . }}",
-    "port": "7899",
-    "tls_ca_file": "/etc/ssl/notary/ca.crt",
-    "key_algorithm": "ecdsa"
-  },
-  "logging": {
-    "level": "{{ .Values.logLevel }}"
-  },
-  "storage": {
-    "backend": "postgres",
-    "db_url": "{{ template "harbor.database.notaryServer" . }}"
-  },
-  "auth": {
-    "type": "token",
-    "options": {
-      "realm": "{{ .Values.externalURL }}.{{ $.Values.global.host }}/service/token",
-      "service": "harbor-notary",
-      "issuer": "harbor-token-issuer",
-      "rootcertbundle": "/root.crt"
-    }
-  }
-}
\ No newline at end of file

conf/notary-signer.json

-{
-  "server": {
-    "grpc_addr": ":7899",
-    "tls_cert_file": "/etc/ssl/notary/tls.crt",
-    "tls_key_file": "/etc/ssl/notary/tls.key"
-  },
-  "logging": {
-    "level": "{{ .Values.logLevel }}"
-  },
-  "storage": {
-    "backend": "postgres",
-    "db_url": "{{ template "harbor.database.notarySigner" . }}",
-    "default_alias": "defaultalias"
-  }
-}
\ No newline at end of file

docs/High Availability.md

----
-title: Harbor High Availability Guide
----
-
-## Goal
-
-Deploy Harbor on K8S via helm to make it highly available, that is, if one of node that has Harbor's container running becomes un accessible. Users does not experience interrupt of service of Harbor.
-
-## Prerequisites
-
-- Kubernetes cluster 1.10+
-- Helm 2.10.0+
-- High available ingress controller (Harbor does not manage the external endpoint)
-- High available PostgreSQL database (Harbor does not handle the deployment of HA of database)
-- High available Redis (Harbor does not handle the deployment of HA of Redis)
-- PVC that can be shared across nodes or external object storage
-
-## Architecture
-
-Most of Harbor's components are stateless now.  So we can simply increase the replica of the pods to make sure the components are distributed to multiple worker nodes, and leverage the "Service" mechanism of K8S to ensure the connectivity across pods.
-
-As for storage layer, it is expected that the user provide high available PostgreSQL, Redis cluster for application data and PVCs or object storage for storing images and charts.
-
-![HA](img/ha.png)
-
-## Usage
-
-### Download Chart
-
-Download Harbor helm chart:
-
-```bash
-helm repo add harbor https://helm.goharbor.io
-helm fetch harbor/harbor --untar
-```
-
-### Configuration
-
-Configure the followings items in `values.yaml`, you can also set them as parameters via `--set` flag during running `helm install`:
-
-- **Ingress rule**
-   Configure the `expose.ingress.hosts.core` and `expose.ingress.hosts.notary`.
-- **External URL**
-   Configure the `externalURL`.
-- **External PostgreSQL**
-   Set the `database.type` to `external` and fill the information in `database.external` section.
-
-   Four empty databases should be created manually for `Harbor core`, `Clair`, `Notary server` and `Notary signer` and configure them in the section. Harbor will create tables automatically when starting up.
-- **External Redis**
-   Set the `redis.type` to `external` and fill the information in `redis.external` section.
-
-   As the Redis client used by Harbor's upstream projects doesn't support `Sentinel`, Harbor can only work with a single entry point Redis. You can refer to this [guide](https://community.pivotal.io/s/article/How-to-setup-HAProxy-and-Redis-Sentinel-for-automatic-failover-between-Redis-Master-and-Slave-servers) to setup a HAProxy before the Redis to expose a single entry point.
-- **Storage**
-   By default, a default `StorageClass` is needed in the K8S cluster to provision volumes to store images, charts and job logs.
-
-   If you want to specify the `StorageClass`, set `persistence.persistentVolumeClaim.registry.storageClass`, `persistence.persistentVolumeClaim.chartmuseum.storageClass` and `persistence.persistentVolumeClaim.jobservice.storageClass`.
-
-   If you use `StorageClass`, for both default or specified one, set `persistence.persistentVolumeClaim.registry.accessMode`, `persistence.persistentVolumeClaim.chartmuseum.accessMode` and `persistence.persistentVolumeClaim.jobservice.accessMode` as `ReadWriteMany`, and make sure that the persistent volumes must can be shared cross different nodes.
-
-   You can also use the existing PVCs to store data, set `persistence.persistentVolumeClaim.registry.existingClaim`, `persistence.persistentVolumeClaim.chartmuseum.existingClaim` and `persistence.persistentVolumeClaim.jobservice.existingClaim`.
-
-   If you have no PVCs that can be shared across nodes, you can use external object storage to store images and charts and store the job logs in database. Set the `persistence.imageChartStorage.type` to the value you want to use and fill the corresponding section and set `jobservice.jobLogger` to `database`.
-
-- **Replica**
-   Set `portal.replicas`, `core.replicas`, `jobservice.replicas`, `registry.replicas`, `chartmuseum.replicas`, `clair.replicas`, `notary.server.replicas` and `notary.signer.replicas` to `n`(`n`>=2).
-
-### Installation
-
-Install the Harbor helm chart with a release name `my-release`:  
-
-helm 2:
-```bash
-helm install --name my-release .
-```
-helm 3:
-```
-helm install my-release .
-```

docs/Upgrade.md

----
-title: Upgrade Guide
----
-
-This guide is used to upgrade Harbor deployed by chart since version 0.3.0.
-
-## Notes
-
-- As the database schema may change between different versions of Harbor, there is a progress to migrate the schema during the upgrade and the downtime cannot be avoid
-- The database schema cannot be downgraded automatically, so the `helm rollback` is not supported
-
-## Upgrade
-
-### 1. Backup database
-
-Backup the database used by Harbor in case the upgrade process fails.
-
-### 2. Download new chart
-
-Download the latest version of Harbor chart.
-
-### 3. Configure new chart
-
-Configure the new chart to make sure that the configuration items have the same values with the old one.
-
-> Note: if TLS is enabled and the certificate is generated by chart automatically, a new certificate will be generated and overwrite the old one during the upgrade, this may cause some issues if you have distributed the certificate. You can follow the below steps to configure the new chart to use the old certificate:
-
-1) Get the secret name which certificate is stored in:
-
-    ```bash
-    kubectl get secret
-    ```
-
-    Find the secret whose name ends with `-harbor-ingress` (expose service via `Ingress`) or `-harbor-nginx`(expose service via `ClusterIP` or `NodePort`)
-
-2) Export the secret as yaml file:
-
-
-    ```bash
-    kubectl get secret <secret-name-from-step-1> -o yaml > secret.yaml
-    ```
-
-
-
-3) Rename the secret by setting `metadata.name` in `secret.yaml`
-
-4) Create a new secret:
-
-    ```bash
-    kubectl create -f secret.yaml
-    ```
-
-5) Configure the chart to use the new secret by setting `expose.tls.secretName` as the value you set in step **3**
-
-### 4. Upgrade
-
-Run upgrade command:
-
-```bash
-helm upgrade release-name --force .
-```
-
-> The `--force` is necessary if upgrade from version 0.3.0 due to issue [#30](https://github.com/goharbor/harbor-helm/issues/30).
-
-## Known issues
-
-- The job logs will be lost if you upgrade from version 0.3.0 as the logs are store in a `emptyDir` in 0.3.0.

docs/_index.md

----
-title: Managing Harbor with Helm
-weight: 50
----
-
-This documentation focuses on deploying and managing Harbor via [Helm](https://helm.sh). For general documentation for Harbor, please see the [Harbor docs](https://goharbor.io/docs).
\ No newline at end of file

raws/values-aliyun.yaml

-expose:
-  type: ingress
-  tls:
-    enabled: false
-  ingress:
-    hosts:
-      core: hub.wodcloud.local
-      notary: notary.wodcloud.local
-    annotations:
-      ingress.kubernetes.io/proxy-body-size: '0'
-
-externalURL: https://hub.wodcloud.local
-
-persistence:
-  enabled: true
-  persistentVolumeClaim:
-    registry:
-      existingClaim: ''
-      storageClass: 'hostpath'
-      subPath: ''
-      accessMode: ReadWriteOnce
-      size: 5Gi
-    chartmuseum:
-      existingClaim: ''
-      storageClass: 'hostpath'
-      subPath: ''
-      accessMode: ReadWriteOnce
-      size: 5Gi
-    jobservice:
-      existingClaim: ''
-      storageClass: 'hostpath'
-      subPath: ''
-      accessMode: ReadWriteOnce
-      size: 1Gi
-    database:
-      existingClaim: ''
-      storageClass: 'hostpath'
-      subPath: ''
-      accessMode: ReadWriteOnce
-      size: 1Gi
-    redis:
-      existingClaim: ''
-      storageClass: 'hostpath'
-      subPath: ''
-      accessMode: ReadWriteOnce
-      size: 1Gi
-    trivy:
-      existingClaim: ''
-      storageClass: 'hostpath'
-      subPath: ''
-      accessMode: ReadWriteOnce
-      size: 5Gi
-  imageChartStorage:
-    # s3 , filesystem
-    type: filesystem
-    s3:
-      accesskey: AKIAIOSFODNN7EXAMPLE
-      secretkey: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
-      region: us-east-1
-      regionendpoint: http://minio.wodcloud.local
-      bucket: registry
-      encrypt: false
-      v4auth: true
-      chunksize: '5242880'
-      rootdirectory: /
-
-imagePullPolicy: IfNotPresent
-
-logLevel: info
-harborAdminPassword: 'spaceIN511'
-secretKey: 'IpTIscRIgmerlare'
-
-portal:
-  image:
-    repository: registry.cn-qingdao.aliyuncs.com/wod/harbor-portal
-    tag: v2.1.6
-
-core:
-  image:
-    repository: registry.cn-qingdao.aliyuncs.com/wod/harbor-core
-    tag: v2.1.6
-
-jobservice:
-  image:
-    repository: registry.cn-qingdao.aliyuncs.com/wod/harbor-jobservice
-    tag: v2.1.6
-
-registry:
-  registry:
-    image:
-      repository: registry.cn-qingdao.aliyuncs.com/wod/registry
-      tag: v2.7.1
-    resources:
-      limits:
-        memory: 4Gi
-      requests:
-        memory: 256Mi
-  controller:
-    image:
-      repository: registry.cn-qingdao.aliyuncs.com/wod/harbor-registryctl
-      tag: v2.1.6
-
-chartmuseum:
-  image:
-    repository: registry.cn-qingdao.aliyuncs.com/wod/chartmuseum
-    tag: v2.1.6
-  nodeSelector: {}
-  # nodeSelector:
-  #   harbor: enabled
-  storageSpec:
-    type: hostPath
-    emptyDir: {}
-    hostPath:
-      root: /data
-
-clair:
-  clair:
-    image:
-      repository: registry.cn-qingdao.aliyuncs.com/wod/clair
-      tag: v2.1.6
-  adapter:
-    image:
-      repository: registry.cn-qingdao.aliyuncs.com/wod/harbor-scanner-clair
-      tag: v2.1.6
-
-trivy:
-  image:
-    repository: registry.cn-qingdao.aliyuncs.com/wod/harbor-scanner-trivy
-    tag: v2.1.6
-
-notary:
-  server:
-    image:
-      repository: registry.cn-qingdao.aliyuncs.com/wod/notary-server
-      tag: v2.1.6
-  signer:
-    image:
-      repository: registry.cn-qingdao.aliyuncs.com/wod/notary-signer
-      tag: v2.1.6
-
-database:
-  type: internal
-  internal:
-    image:
-      repository: registry.cn-qingdao.aliyuncs.com/wod/harbor-db
-      tag: v2.1.6
-    password: 'spaceIN511'
-    resources:
-      limits:
-        memory: 4Gi
-      requests:
-        memory: 256Mi
-
-redis:
-  type: internal
-  internal:
-    image:
-      repository: registry.cn-qingdao.aliyuncs.com/wod/redis
-      tag: 6.2.6

raws/values-arm.yaml

-expose:
-  type: ingress
-  tls:
-    enabled: false
-  ingress:
-    hosts:
-      core: hub.wodcloud.local
-      notary: notary.wodcloud.local
-    annotations:
-      ingress.kubernetes.io/proxy-body-size: '0'
-
-externalURL: https://hub.wodcloud.local
-
-persistence:
-  enabled: true
-  persistentVolumeClaim:
-    registry:
-      existingClaim: ''
-      storageClass: 'hostpath'
-      subPath: ''
-      accessMode: ReadWriteOnce
-      size: 5Gi
-    chartmuseum:
-      existingClaim: ''
-      storageClass: 'hostpath'
-      subPath: ''
-      accessMode: ReadWriteOnce
-      size: 5Gi
-    jobservice:
-      existingClaim: ''
-      storageClass: 'hostpath'
-      subPath: ''
-      accessMode: ReadWriteOnce
-      size: 1Gi
-    database:
-      existingClaim: ''
-      storageClass: 'hostpath'
-      subPath: ''
-      accessMode: ReadWriteOnce
-      size: 1Gi
-    redis:
-      existingClaim: ''
-      storageClass: 'hostpath'
-      subPath: ''
-      accessMode: ReadWriteOnce
-      size: 1Gi
-    trivy:
-      existingClaim: ''
-      storageClass: 'hostpath'
-      subPath: ''
-      accessMode: ReadWriteOnce
-      size: 5Gi
-  imageChartStorage:
-    # s3 , filesystem
-    type: filesystem
-    s3:
-      accesskey: AKIAIOSFODNN7EXAMPLE
-      secretkey: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
-      region: us-east-1
-      regionendpoint: http://minio.wodcloud.local
-      bucket: registry
-      encrypt: false
-      v4auth: true
-      chunksize: '5242880'
-      rootdirectory: /
-
-imagePullPolicy: IfNotPresent
-
-logLevel: info
-harborAdminPassword: 'spaceIN511'
-secretKey: 'IpTIscRIgmerlare'
-
-portal:
-  image:
-    repository: registry.cn-qingdao.aliyuncs.com/wod/harbor-portal
-    tag: v2.1.6-arm64
-
-core:
-  image:
-    repository: registry.cn-qingdao.aliyuncs.com/wod/harbor-core
-    tag: v2.1.6-arm64
-
-jobservice:
-  image:
-    repository: registry.cn-qingdao.aliyuncs.com/wod/harbor-jobservice
-    tag: v2.1.6-arm64
-
-registry:
-  registry:
-    image:
-      repository: registry.cn-qingdao.aliyuncs.com/wod/registry
-      tag: v2.7.1-arm64
-    resources:
-      limits:
-        memory: 4Gi
-      requests:
-        memory: 256Mi
-  controller:
-    image:
-      repository: registry.cn-qingdao.aliyuncs.com/wod/harbor-registryctl
-      tag: v2.1.6-arm64
-
-chartmuseum:
-  image:
-    repository: registry.cn-qingdao.aliyuncs.com/wod/chartmuseum
-    tag: v2.1.6-arm64
-  nodeSelector: {}
-  # nodeSelector:
-  #   harbor: enabled
-  storageSpec:
-    type: hostPath
-    emptyDir: {}
-    hostPath:
-      root: /data
-
-clair:
-  clair:
-    image:
-      repository: registry.cn-qingdao.aliyuncs.com/wod/clair
-      tag: v2.1.6-arm64
-  adapter:
-    image:
-      repository: registry.cn-qingdao.aliyuncs.com/wod/harbor-scanner-clair
-      tag: v2.1.6-arm64
-
-trivy:
-  image:
-    repository: registry.cn-qingdao.aliyuncs.com/wod/harbor-scanner-trivy
-    tag: v2.1.6-arm64
-
-notary:
-  server:
-    image:
-      repository: registry.cn-qingdao.aliyuncs.com/wod/notary-server
-      tag: v2.1.6-arm64
-  signer:
-    image:
-      repository: registry.cn-qingdao.aliyuncs.com/wod/notary-signer
-      tag: v2.1.6-arm64
-
-database:
-  type: internal
-  internal:
-    image:
-      repository: registry.cn-qingdao.aliyuncs.com/wod/harbor-db
-      tag: v2.1.6-arm64
-    password: 'spaceIN511'
-    resources:
-      limits:
-        memory: 4Gi
-      requests:
-        memory: 256Mi
-
-redis:
-  type: internal
-  internal:
-    image:
-      repository: registry.cn-qingdao.aliyuncs.com/wod/redis
-      tag: 6.2.6-arm64

raws/values-pg.yaml

-expose:
-  type: ingress
-  tls:
-    enabled: false
-  ingress:
-    hosts:
-      core: hub.test.wodcloud.com
-      notary: notary.test.wodcloud.com
-    annotations:
-      ingress.kubernetes.io/proxy-body-size: '0'
-
-externalURL: https://hub.test.wodcloud.com
-
-persistence:
-  enabled: true
-  imageChartStorage:
-    # s3 , filesystem
-    type: filesystem
-    filesystem:
-      rootdirectory: /data
-    #s3:
-    # accesskey: AKIAIOSFODNN7EXAMPLE
-    # secretkey: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
-    # region: us-east-1
-    # regionendpoint: https://minio.sxwh.local
-    # bucket: registry
-    # encrypt: false
-    # v4auth: true
-    # chunksize: '5242880'
-    # rootdirectory: /
-
-imagePullPolicy: IfNotPresent
-
-logLevel: info
-harborAdminPassword: 'spaceIN511'
-secretKey: 'IpTIscRIgmerlare'
-
-portal:
-  image:
-    repository: registry.cn-qingdao.aliyuncs.com/wod/harbor-portal
-    tag: v1.8.2
-  replicas: 1
-
-core:
-  image:
-    repository: registry.cn-qingdao.aliyuncs.com/wod/harbor-core
-    tag: v1.8.2
-  replicas: 1
-
-jobservice:
-  image:
-    repository: registry.cn-qingdao.aliyuncs.com/wod/harbor-jobservice
-    tag: v1.8.2
-  replicas: 1
-  maxJobWorkers: 10
-  jobLogger: file
-
-registry:
-  registry:
-    image:
-      repository: registry.cn-qingdao.aliyuncs.com/wod/registry
-      tag: v2.7.1
-    resources:
-      limits:
-        memory: 4Gi
-      requests:
-        memory: 256Mi
-  nodeSelector:
-    harbor: enabled
-  storageSpec:
-    # type: emptyDir , hostPath , volumeClaimTemplate
-    type: hostPath
-    emptyDir: {}
-    hostPath:
-      root: /data
-    volumeClaimTemplate:
-      spec:
-        storageClassName: rook-ceph-block
-        accessModes: ['ReadWriteOnce']
-        resources:
-          requests:
-            storage: 100Gi
-      selector: {}
-
-  controller:
-    image:
-      repository: registry.cn-qingdao.aliyuncs.com/wod/harbor-registryctl
-      tag: v1.8.2
-  replicas: 1
-
-chartmuseum:
-  enabled: true
-  image:
-    repository: registry.cn-qingdao.aliyuncs.com/wod/chartmuseum-photon
-    tag: v0.9.0-v1.8.2
-  replicas: 1
-  nodeSelector:
-    harbor: enabled
-  storageSpec:
-    type: hostPath
-    emptyDir: {}
-    hostPath:
-      root: /data
-
-clair:
-  enabled: true
-  image:
-    repository: registry.cn-qingdao.aliyuncs.com/wod/clair-photon
-    tag: v2.0.8-v1.8.2
-  replicas: 1
-
-notary:
-  enabled: true
-  server:
-    image:
-      repository: registry.cn-qingdao.aliyuncs.com/wod/notary-server-photon
-      tag: v0.6.1-v1.8.2
-    replicas: 1
-  signer:
-    image:
-      repository: registry.cn-qingdao.aliyuncs.com/wod/notary-signer-photon
-      tag: v0.6.1-v1.8.2
-    replicas: 1
-
-database:
-  type: internal
-  internal:
-    image:
-      repository: registry.cn-qingdao.aliyuncs.com/wod/harbor-db
-      tag: v1.8.2
-    password: 'spaceIN511'
-    resources:
-      limits:
-        memory: 4Gi
-      requests:
-        memory: 256Mi
-    nodeSelector:
-      harbor: enabled
-    storageSpec:
-      type: hostPath
-      emptyDir: {}
-      hostPath:
-        root: /data
-      volumeClaimTemplate:
-        spec:
-          storageClassName: rook-ceph-block
-          accessModes: ['ReadWriteOnce']
-          resources:
-            requests:
-              storage: 20Gi
-        selector: {}
-
-redis:
-  type: internal
-  internal:
-    image:
-      repository: registry.cn-qingdao.aliyuncs.com/wod/redis
-      tag: 4.0.14-alpine

raws/values-ppc64le.yaml

-expose:
-  type: ingress
-  tls:
-    enabled: false
-  ingress:
-    hosts:
-      core: hub.wodcloud.local
-      notary: notary.wodcloud.local
-    annotations:
-      ingress.kubernetes.io/proxy-body-size: '0'
-
-externalURL: https://hub.wodcloud.local
-
-persistence:
-  enabled: true
-  persistentVolumeClaim:
-    registry:
-      existingClaim: ''
-      storageClass: 'hostpath'
-      subPath: ''
-      accessMode: ReadWriteOnce
-      size: 5Gi
-    chartmuseum:
-      existingClaim: ''
-      storageClass: 'hostpath'
-      subPath: ''
-      accessMode: ReadWriteOnce
-      size: 5Gi
-    jobservice:
-      existingClaim: ''
-      storageClass: 'hostpath'
-      subPath: ''
-      accessMode: ReadWriteOnce
-      size: 1Gi
-    database:
-      existingClaim: ''
-      storageClass: 'hostpath'
-      subPath: ''
-      accessMode: ReadWriteOnce
-      size: 1Gi
-    redis:
-      existingClaim: ''
-      storageClass: 'hostpath'
-      subPath: ''
-      accessMode: ReadWriteOnce
-      size: 1Gi
-    trivy:
-      existingClaim: ''
-      storageClass: 'hostpath'
-      subPath: ''
-      accessMode: ReadWriteOnce
-      size: 5Gi
-  imageChartStorage:
-    # s3 , filesystem
-    type: filesystem
-    s3:
-      accesskey: AKIAIOSFODNN7EXAMPLE
-      secretkey: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
-      region: us-east-1
-      regionendpoint: http://minio.wodcloud.local
-      bucket: registry
-      encrypt: false
-      v4auth: true
-      chunksize: '5242880'
-      rootdirectory: /
-
-imagePullPolicy: IfNotPresent
-
-logLevel: info
-harborAdminPassword: 'spaceIN511'
-secretKey: 'IpTIscRIgmerlare'
-
-portal:
-  image:
-    repository: registry.cn-qingdao.aliyuncs.com/wod/harbor-portal
-    tag: v2.1.6-ppc64le
-
-core:
-  image:
-    repository: registry.cn-qingdao.aliyuncs.com/wod/harbor-core
-    tag: v2.1.6-ppc64le
-
-jobservice:
-  image:
-    repository: registry.cn-qingdao.aliyuncs.com/wod/harbor-jobservice
-    tag: v2.1.6-ppc64le
-
-registry:
-  registry:
-    image:
-      repository: registry.cn-qingdao.aliyuncs.com/wod/registry
-      tag: v2.7.1-ppc64le
-    resources:
-      limits:
-        memory: 4Gi
-      requests:
-        memory: 256Mi
-  controller:
-    image:
-      repository: registry.cn-qingdao.aliyuncs.com/wod/harbor-registryctl
-      tag: v2.1.6-ppc64le
-
-chartmuseum:
-  image:
-    repository: registry.cn-qingdao.aliyuncs.com/wod/chartmuseum
-    tag: v2.1.1-ppc64le
-  nodeSelector: {}
-  # nodeSelector:
-  #   harbor: enabled
-  storageSpec:
-    type: hostPath
-    emptyDir: {}
-    hostPath:
-      root: /data
-
-clair:
-  clair:
-    image:
-      repository: registry.cn-qingdao.aliyuncs.com/wod/clair
-      tag: v2.1.1-ppc64le
-  adapter:
-    image:
-      repository: registry.cn-qingdao.aliyuncs.com/wod/harbor-scanner-clair
-      tag: v2.1.1-ppc64le
-
-trivy:
-  image:
-    repository: registry.cn-qingdao.aliyuncs.com/wod/harbor-scanner-trivy
-    tag: v2.1.1-ppc64le
-
-notary:
-  server:
-    image:
-      repository: registry.cn-qingdao.aliyuncs.com/wod/notary-server
-      tag: v2.1.1-ppc64le
-  signer:
-    image:
-      repository: registry.cn-qingdao.aliyuncs.com/wod/notary-signer
-      tag: v2.1.1-ppc64le
-
-database:
-  type: internal
-  internal:
-    image:
-      repository: registry.cn-qingdao.aliyuncs.com/wod/harbor-db
-      tag: v2.1.6-ppc64le
-    password: 'spaceIN511'
-    resources:
-      limits:
-        memory: 4Gi
-      requests:
-        memory: 256Mi
-
-redis:
-  type: internal
-  internal:
-    image:
-      repository: registry.cn-qingdao.aliyuncs.com/wod/redis
-      tag: 6.2.6-ppc64le

raws/values-stolon.yaml

-expose:
-  type: ingress
-  tls:
-    enabled: false
-  ingress:
-    hosts:
-      core: hub.test.wodcloud.com
-      notary: notary.test.wodcloud.com
-    annotations:
-      ingress.kubernetes.io/proxy-body-size: '0'
-
-externalURL: https://hub.test.wodcloud.com
-
-persistence:
-  enabled: true
-  imageChartStorage:
-    # s3 , filesystem
-    type: filesystem
-    filesystem:
-      rootdirectory: /data
-    #s3:
-    # accesskey: AKIAIOSFODNN7EXAMPLE
-    # secretkey: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
-    # region: us-east-1
-    # regionendpoint: https://minio.sxwh.local
-    # bucket: registry
-    # encrypt: false
-    # v4auth: true
-    # chunksize: '5242880'
-    # rootdirectory: /
-
-imagePullPolicy: IfNotPresent
-
-logLevel: info
-harborAdminPassword: 'spaceIN511'
-secretKey: 'IpTIscRIgmerlare'
-
-portal:
-  image:
-    repository: registry.cn-qingdao.aliyuncs.com/wod/harbor-portal
-    tag: v1.8.2
-  replicas: 1
-
-core:
-  image:
-    repository: registry.cn-qingdao.aliyuncs.com/wod/harbor-core
-    tag: v1.8.2
-  replicas: 1
-
-jobservice:
-  image:
-    repository: registry.cn-qingdao.aliyuncs.com/wod/harbor-jobservice
-    tag: v1.8.2
-  replicas: 1
-  maxJobWorkers: 10
-  jobLogger: file
-
-registry:
-  registry:
-    image:
-      repository: registry.cn-qingdao.aliyuncs.com/wod/registry
-      tag: v2.7.1
-    resources:
-      limits:
-        memory: 4Gi
-      requests:
-        memory: 256Mi
-  nodeSelector:
-    harbor: enabled
-  storageSpec:
-    # type: emptyDir , hostPath , volumeClaimTemplate
-    type: hostPath
-    emptyDir: {}
-    hostPath:
-      root: /data
-    volumeClaimTemplate:
-      spec:
-        storageClassName: rook-ceph-block
-        accessModes: ['ReadWriteOnce']
-        resources:
-          requests:
-            storage: 100Gi
-      selector: {}
-
-  controller:
-    image:
-      repository: registry.cn-qingdao.aliyuncs.com/wod/harbor-registryctl
-      tag: v1.8.2
-  replicas: 1
-
-chartmuseum:
-  enabled: true
-  image:
-    repository: registry.cn-qingdao.aliyuncs.com/wod/chartmuseum-photon
-    tag: v0.9.0-v1.8.2
-  replicas: 1
-  nodeSelector:
-    harbor: enabled
-  storageSpec:
-    type: hostPath
-    emptyDir: {}
-    hostPath:
-      root: /data
-
-clair:
-  enabled: true
-  image:
-    repository: registry.cn-qingdao.aliyuncs.com/wod/clair-photon
-    tag: v2.0.8-v1.8.2
-  replicas: 1
-
-notary:
-  enabled: true
-  server:
-    image:
-      repository: registry.cn-qingdao.aliyuncs.com/wod/notary-server-photon
-      tag: v0.6.1-v1.8.2
-    replicas: 1
-  signer:
-    image:
-      repository: registry.cn-qingdao.aliyuncs.com/wod/notary-signer-photon
-      tag: v0.6.1-v1.8.2
-    replicas: 1
-
-database:
-  type: external
-  external:
-    host: 'stolon-proxy.devops'
-    port: '5432'
-    username: 'postgres'
-    password: 'spaceIN511'
-    coreDatabase: 'hub_registry'
-    clairDatabase: 'hub_clair'
-    notaryServerDatabase: 'hub_notary_server'
-    notarySignerDatabase: 'hub_notary_signer'
-    sslmode: 'disable'
-
-redis:
-  type: internal
-  internal:
-    image:
-      repository: registry.cn-qingdao.aliyuncs.com/wod/redis
-      tag: 4.0.14-alpine

templates/NOTES.txt

-Please wait for several minutes for Harbor deployment to complete.
-Then you should be able to visit the Harbor portal at {{ $.Values.global.host }}
-For more details, please visit https://github.com/goharbor/harbor
+Please wait for several minutes for Harbor deployment to complete.
+Then you should be able to visit the Harbor portal at {{ .Values.externalURL }}
+For more details, please visit https://github.com/goharbor/harbor

templates/chartmuseum/chartmuseum-cm.yaml

-{{- if .Values.chartmuseum.enabled }}
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: "{{ template "harbor.chartmuseum" . }}"
-  labels:
-{{ include "harbor.labels" . | indent 4 }}
-data:
-  PORT: "{{ template "harbor.chartmuseum.containerPort" . }}"
-{{- if .Values.internalTLS.enabled }}
-  TLS_CERT: "/etc/harbor/ssl/chartmuseum/tls.crt"
-  TLS_KEY: "/etc/harbor/ssl/chartmuseum/tls.key"
-{{- end }}
-  {{- if eq "redis" (include "harbor.redis.scheme" .) }}
-  CACHE: "redis"
-  {{- else }}
-  CACHE: "redis_sentinel"
-  CACHE_REDIS_MASTERNAME: "{{ template "harbor.redis.masterSet" . }}"
-  {{- end }}
-  CACHE_REDIS_ADDR: "{{ template "harbor.redis.addr" . }}"
-  CACHE_REDIS_DB: "{{ template "harbor.redis.dbForChartmuseum" . }}"
-  BASIC_AUTH_USER: "chart_controller"
-{{- if .Values.chartmuseum.absoluteUrl }}
-  CHART_URL: {{ .Values.externalURL }}.{{ $.Values.global.host }}/chartrepo
-{{- end }}
-  DEPTH: "1"
-{{- if eq .Values.logLevel "debug" }}
-  DEBUG: "true"
-{{- else }}
-  DEBUG: "false"
-{{- end }}
-  LOG_JSON: "true"
-  DISABLE_METRICS: "false"
-  DISABLE_API: "false"
-  DISABLE_STATEFILES: "false"
-  ALLOW_OVERWRITE: "true"
-  AUTH_ANONYMOUS_GET: "false"
-  CONTEXT_PATH: ""
-  INDEX_LIMIT: "0"
-  MAX_STORAGE_OBJECTS: "0"
-  MAX_UPLOAD_SIZE: "20971520"
-  CHART_POST_FORM_FIELD_NAME: "chart"
-  PROV_POST_FORM_FIELD_NAME: "prov"
-{{- $storage := .Values.persistence.imageChartStorage }}
-{{- $storageType := $storage.type }}
-{{- if eq $storageType "filesystem" }}
-  STORAGE: "local"
-  STORAGE_LOCAL_ROOTDIR: "/chart_storage"
-{{- else if eq $storageType "azure" }}
-  STORAGE: "microsoft"
-  STORAGE_MICROSOFT_CONTAINER: {{ $storage.azure.container }}
-  AZURE_STORAGE_ACCOUNT: {{ $storage.azure.accountname }}
-  AZURE_BASE_URL: {{ $storage.azure.realm }}
-  STORAGE_MICROSOFT_PREFIX: "/azure/harbor/charts"
-{{- else if eq $storageType "gcs" }}
-  STORAGE: "google"
-  STORAGE_GOOGLE_BUCKET: {{ $storage.gcs.bucket }}
-  GOOGLE_APPLICATION_CREDENTIALS: /etc/chartmuseum/gcs-key.json
-  {{- if $storage.gcs.rootdirectory }}
-  STORAGE_GOOGLE_PREFIX: {{ $storage.gcs.rootdirectory }}
-  {{- end }}
-{{- else if eq $storageType "s3" }}
-  STORAGE: "amazon"
-  STORAGE_AMAZON_BUCKET: {{ $storage.s3.bucket }}
-  {{- if $storage.s3.rootdirectory }}
-  STORAGE_AMAZON_PREFIX: {{ $storage.s3.rootdirectory }}
-  {{- end }}
-  STORAGE_AMAZON_REGION: {{ $storage.s3.region }}
-  {{- if $storage.s3.regionendpoint }}
-  STORAGE_AMAZON_ENDPOINT: {{ $storage.s3.regionendpoint }}
-  {{- end }}
-  {{- if $storage.s3.accesskey }}
-  AWS_ACCESS_KEY_ID: {{ $storage.s3.accesskey }}
-  {{- end }}
-  {{- if $storage.s3.keyid }}
-  STORAGE_AMAZON_SSE: aws:kms
-  {{- end }}
-{{- else if eq $storageType "swift" }}
-  STORAGE: "openstack"
-  STORAGE_OPENSTACK_CONTAINER: {{ $storage.swift.container }}
-  {{- if $storage.swift.prefix }}
-  STORAGE_OPENSTACK_PREFIX: {{ $storage.swift.prefix }}
-  {{- end }}
-  {{- if $storage.swift.region }}
-  STORAGE_OPENSTACK_REGION: {{ $storage.swift.region }}
-  {{- end }}
-  OS_AUTH_URL: {{ $storage.swift.authurl }}
-  OS_USERNAME: {{ $storage.swift.username }}
-  {{- if $storage.swift.tenantid }}
-  OS_PROJECT_ID: {{ $storage.swift.tenantid }}
-  {{- end }}
-  {{- if $storage.swift.tenant }}
-  OS_PROJECT_NAME: {{ $storage.swift.tenant }}
-  {{- end }}
-  {{- if $storage.swift.domainid }}
-  OS_DOMAIN_ID: {{ $storage.swift.domainid }}
-  {{- end }}
-  {{- if $storage.swift.domain }}
-  OS_DOMAIN_NAME: {{ $storage.swift.domain }}
-  {{- end }}
-{{- else if eq $storageType "oss" }}
-  STORAGE: "alibaba"
-  STORAGE_ALIBABA_BUCKET: {{ $storage.oss.bucket }}
-  {{- if $storage.oss.rootdirectory }}
-  STORAGE_ALIBABA_PREFIX: {{ $storage.oss.rootdirectory }}
-  {{- end }}
-  {{- if $storage.oss.endpoint }}
-  STORAGE_ALIBABA_ENDPOINT: {{ $storage.oss.endpoint }}
-  {{- end }}
-  ALIBABA_CLOUD_ACCESS_KEY_ID: {{ $storage.oss.accesskeyid }}
-{{- end }}
-  STORAGE_TIMESTAMP_TOLERANCE: 1s
-{{- end }}

templates/chartmuseum/chartmuseum-dpl.yaml

-{{- if .Values.chartmuseum.enabled }}
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: "{{ template "harbor.chartmuseum" . }}"
-  labels:
-{{ include "harbor.labels" . | indent 4 }}
-    component: chartmuseum
-spec:
-  replicas: {{ .Values.chartmuseum.replicas }}
-  strategy:
-    type: {{ .Values.updateStrategy.type }}
-    {{- if eq .Values.updateStrategy.type "Recreate" }}
-    rollingUpdate: null
-    {{- end }}
-  selector:
-    matchLabels:
-{{ include "harbor.matchLabels" . | indent 6 }}
-      component: chartmuseum
-  template:
-    metadata:
-      labels:
-{{ include "harbor.labels" . | indent 8 }}
-        component: chartmuseum
-      annotations:
-        checksum/configmap: {{ include (print $.Template.BasePath "/chartmuseum/chartmuseum-cm.yaml") . | sha256sum }}
-        checksum/secret: {{ include (print $.Template.BasePath "/chartmuseum/chartmuseum-secret.yaml") . | sha256sum }}
-        checksum/secret-core: {{ include (print $.Template.BasePath "/core/core-secret.yaml") . | sha256sum }}
-{{- if and .Values.internalTLS.enabled (eq .Values.internalTLS.certSource "auto") }}
-        checksum/tls: {{ include (print $.Template.BasePath "/internal/auto-tls.yaml") . | sha256sum }}
-{{- else if and .Values.internalTLS.enabled (eq .Values.internalTLS.certSource "manual") }}
-        checksum/tls: {{ include (print $.Template.BasePath "/chartmuseum/chartmuseum-tls.yaml") . | sha256sum }}
-{{- end }}
-{{- if .Values.chartmuseum.podAnnotations }}
-{{ toYaml .Values.chartmuseum.podAnnotations | indent 8 }}
-{{- end }}
-    spec:
-{{- with .Values.global.imagePullSecrets }}
-      imagePullSecrets:
-        {{- toYaml . | nindent 8 }}
-{{- end }}
-      securityContext:
-        fsGroup: 10000
-{{- if .Values.chartmuseum.serviceAccountName }}
-      serviceAccountName: {{ .Values.chartmuseum.serviceAccountName }}
-{{- end -}}
-      {{- with .Values.imagePullSecrets }}
-      imagePullSecrets:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      containers:
-      - name: chartmuseum
-{{- if contains "/" .Values.chartmuseum.image.repository }}
-        image: "{{ .Values.chartmuseum.image.repository }}"
-{{- else }}
-        image: "{{ .Values.chartmuseum.image.hub | default .Values.global.hub }}/{{ .Values.chartmuseum.image.repository }}:{{ .Values.chartmuseum.image.tag | default .Values.global.tag }}{{ template ".beagle.imageArch" . }}"
-{{- end }}
-        imagePullPolicy: "{{ .Values.imagePullPolicy | default .Values.global.imagePullPolicy }}"
-        livenessProbe:
-          httpGet:
-            path: /health
-            scheme: {{ include "harbor.component.scheme" . | upper }}
-            port: {{ template "harbor.chartmuseum.containerPort" . }}
-          initialDelaySeconds: 300
-          periodSeconds: 10
-        readinessProbe:
-          httpGet:
-            path: /health
-            scheme: {{ include "harbor.component.scheme" . | upper }}
-            port: {{ template "harbor.chartmuseum.containerPort" . }}
-          initialDelaySeconds: 1
-          periodSeconds: 10
-{{- if .Values.chartmuseum.resources }}
-        resources:
-{{ toYaml .Values.chartmuseum.resources | indent 10 }}
-{{- end }}
-        envFrom:
-        - configMapRef:
-            name: "{{ template "harbor.chartmuseum" . }}"
-        - secretRef:
-            name: "{{ template "harbor.chartmuseum" . }}"
-        env:
-          {{- if has "chartmuseum" .Values.proxy.components }}
-          - name: HTTP_PROXY
-            value: "{{ .Values.proxy.httpProxy }}"
-          - name: HTTPS_PROXY
-            value: "{{ .Values.proxy.httpsProxy }}"
-          - name: NO_PROXY
-            value: "{{ template "harbor.noProxy" . }}"
-          {{- end }}
-          {{- if .Values.internalTLS.enabled }}
-          - name: INTERNAL_TLS_ENABLED
-            value: "true"
-          - name: INTERNAL_TLS_KEY_PATH
-            value: /etc/harbor/ssl/chartmuseum/tls.key
-          - name: INTERNAL_TLS_CERT_PATH
-            value: /etc/harbor/ssl/chartmuseum/tls.crt
-          - name: INTERNAL_TLS_TRUST_CA_PATH
-            value: /etc/harbor/ssl/chartmuseum/ca.crt
-          {{- end }}
-          - name: BASIC_AUTH_PASS
-            valueFrom:
-              secretKeyRef:
-                name: {{ template "harbor.core" . }}
-                key: secret
-          - # Needed to make AWS' client connect correctly (see https://github.com/helm/chartmuseum/issues/280)
-            name: AWS_SDK_LOAD_CONFIG
-            value: "1"
-        ports:
-        - containerPort: {{ template "harbor.chartmuseum.containerPort" . }}
-        volumeMounts:
-        - name: chartmuseum-data
-          mountPath: /chart_storage
-          subPath: {{ .Values.persistence.persistentVolumeClaim.chartmuseum.subPath }}
-        {{- if .Values.internalTLS.enabled }}
-        - name: chart-internal-certs
-          mountPath: /etc/harbor/ssl/chartmuseum
-        {{- end }}
-        {{- if and .Values.persistence.enabled (eq .Values.persistence.imageChartStorage.type "gcs") }}
-        - name: gcs-key
-          mountPath: /etc/chartmuseum/gcs-key.json
-          subPath: gcs-key.json
-        {{- end }}
-        {{- if .Values.persistence.imageChartStorage.caBundleSecretName }}
-        - name: storage-service-ca
-          mountPath: /harbor_cust_cert/custom-ca-bundle.crt
-          subPath: ca.crt
-        {{- end }}
-        {{- if .Values.caBundleSecretName }}
-{{ include "harbor.caBundleVolumeMount" . | indent 8 }}
-        {{- end }}
-      volumes:
-      - name: chartmuseum-data
-      {{- if and .Values.persistence.enabled (eq .Values.persistence.imageChartStorage.type "filesystem") }}
-        persistentVolumeClaim:
-          claimName: {{ .Values.persistence.persistentVolumeClaim.chartmuseum.existingClaim | default (include "harbor.chartmuseum" .) }}
-      {{- else }}
-        emptyDir: {}
-      {{- end }}
-      {{- if .Values.internalTLS.enabled }}
-      - name: chart-internal-certs
-        secret:
-          secretName: {{ template "harbor.internalTLS.chartmuseum.secretName" . }}
-      {{- end }}
-      {{- if and .Values.persistence.enabled (eq .Values.persistence.imageChartStorage.type "gcs") }}
-      - name: gcs-key
-        secret:
-          secretName: {{ template "harbor.registry" . }}
-          items:
-            - key: GCS_KEY_DATA
-              path: gcs-key.json
-      {{- end }}
-      {{- if .Values.persistence.imageChartStorage.caBundleSecretName }}
-      - name: storage-service-ca
-        secret:
-          secretName: {{ .Values.persistence.imageChartStorage.caBundleSecretName }}
-      {{- end }}
-      {{- if .Values.caBundleSecretName }}
-{{ include "harbor.caBundleVolume" . | indent 6 }}
-      {{- end }}
-      {{- with .Values.chartmuseum.nodeSelector }}
-      nodeSelector:
-{{ toYaml . | indent 8 }}
-      {{- end }}
-      {{- with .Values.chartmuseum.affinity }}
-      affinity:
-{{ toYaml . | indent 8 }}
-      {{- end }}
-      {{- with .Values.chartmuseum.tolerations }}
-      tolerations:
-{{ toYaml . | indent 8 }}
-      {{- end }}
-{{- end }}

templates/chartmuseum/chartmuseum-pvc.yaml

-{{- if .Values.chartmuseum.enabled }}
-{{- $persistence := .Values.persistence -}}
-{{- if $persistence.enabled }}
-{{- $chartmuseum := $persistence.persistentVolumeClaim.chartmuseum -}}
-{{- if and (not $chartmuseum.existingClaim) (eq $persistence.imageChartStorage.type "filesystem") }}
-kind: PersistentVolumeClaim
-apiVersion: v1
-metadata:
-  name: {{ template "harbor.chartmuseum" . }}
-  {{- if eq $persistence.resourcePolicy "keep" }}
-  annotations:
-    helm.sh/resource-policy: keep
-  {{- end }}
-  labels:
-{{ include "harbor.labels" . | indent 4 }}
-    component: chartmuseum
-spec:
-  accessModes: 
-    - {{ $chartmuseum.accessMode }}
-  resources:
-    requests:
-      storage: {{ $chartmuseum.size }}
-  {{- if $chartmuseum.storageClass }}
-    {{- if eq "-" $chartmuseum.storageClass }}
-  storageClassName: ""
-    {{- else }}
-  storageClassName: {{ $chartmuseum.storageClass }}
-    {{- end }}
-  {{- end }}
-{{- end }}
-{{- end }}
-{{- end }}
\ No newline at end of file

templates/chartmuseum/chartmuseum-secret.yaml

-{{- if .Values.chartmuseum.enabled }}
-apiVersion: v1
-kind: Secret
-metadata:
-  name: "{{ template "harbor.chartmuseum" . }}"
-  labels:
-{{ include "harbor.labels" . | indent 4 }}
-type: Opaque
-data:
-  CACHE_REDIS_PASSWORD: {{ include "harbor.redis.password" . | b64enc | quote }}
-{{- $storage := .Values.persistence.imageChartStorage }}
-{{- $storageType := $storage.type }}
-{{- if eq $storageType "azure" }}
-  AZURE_STORAGE_ACCESS_KEY: {{ $storage.azure.accountkey | b64enc | quote }}
-{{- else if eq $storageType "gcs" }}
-  # TODO support the keyfile of gcs
-{{- else if eq $storageType "s3" }}
-  {{- if $storage.s3.secretkey }}
-  AWS_SECRET_ACCESS_KEY: {{ $storage.s3.secretkey | b64enc | quote }}
-  {{- end }}
-{{- else if eq $storageType "swift" }}
-  OS_PASSWORD: {{ $storage.swift.password | b64enc | quote }}
-{{- else if eq $storageType "oss" }}
-  ALIBABA_CLOUD_ACCESS_KEY_SECRET: {{ $storage.oss.accesskeysecret | b64enc | quote }}
-{{- end }}
-{{- end }}
\ No newline at end of file

templates/chartmuseum/chartmuseum-svc.yaml

-{{- if .Values.chartmuseum.enabled }}
-apiVersion: v1
-kind: Service
-metadata:
-  name: "{{ template "harbor.chartmuseum" . }}"
-  labels:
-{{ include "harbor.labels" . | indent 4 }}
-spec:
-  ports:
-    - port: {{ template "harbor.chartmuseum.servicePort" . }}
-      targetPort: {{ template "harbor.chartmuseum.containerPort" . }}
-  selector:
-{{ include "harbor.matchLabels" . | indent 4 }}
-    component: chartmuseum
-{{- end }}
\ No newline at end of file

templates/chartmuseum/chartmuseum-tls.yaml

-{{- if and .Values.chartmuseum.enabled .Values.internalTLS.enabled }}
-{{- if eq .Values.internalTLS.certSource "manual" }}
-apiVersion: v1
-kind: Secret
-metadata:
-  name: "{{ template "harbor.internalTLS.chartmuseum.secretName" . }}"
-  labels:
-{{ include "harbor.labels" . | indent 4 }}
-type: kubernetes.io/tls
-data:
-  tls.ca: {{ (required "The \"internalTLS.trustCa\" is required!" .Values.internalTLS.trustCa) | b64enc | quote }}
-  tls.crt: {{ (required "The \"internalTLS.chartmuseum.crt\" is required!" .Values.internalTLS.chartmuseum.crt) | b64enc | quote }}
-  tls.key: {{ (required "The \"internalTLS.chartmuseum.key\" is required!" .Values.internalTLS.chartmuseum.key) | b64enc | quote }}
-{{- end }}
-{{- end }}

templates/clair/clair-dpl.yaml

-{{ if .Values.clair.enabled }}
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: {{ template "harbor.clair" . }}
-  labels:
-{{ include "harbor.labels" . | indent 4 }}
-    component: clair
-spec:
-  replicas: {{ .Values.clair.replicas }}
-  selector:
-    matchLabels:
-{{ include "harbor.matchLabels" . | indent 6 }}
-      component: clair
-  template:
-    metadata:
-      labels:
-{{ include "harbor.labels" . | indent 8 }}
-        component: clair
-      annotations:
-        checksum/secret: {{ include (print $.Template.BasePath "/clair/clair-secret.yaml") . | sha256sum }}
-{{- if and .Values.internalTLS.enabled (eq .Values.internalTLS.certSource "auto") }}
-        checksum/tls: {{ include (print $.Template.BasePath "/internal/auto-tls.yaml") . | sha256sum }}
-{{- else if and .Values.internalTLS.enabled (eq .Values.internalTLS.certSource "manual") }}
-        checksum/tls: {{ include (print $.Template.BasePath "/clair/clair-tls.yaml") . | sha256sum }}
-{{- end }}
-{{- if .Values.clair.podAnnotations }}
-{{ toYaml .Values.clair.podAnnotations | indent 8 }}
-{{- end }}
-    spec:
-{{- with .Values.global.imagePullSecrets }}
-      imagePullSecrets:
-        {{- toYaml . | nindent 8 }}
-{{- end }}
-      securityContext:
-        fsGroup: 10000
-{{- if .Values.clair.serviceAccountName }}
-      serviceAccountName: {{ .Values.clair.serviceAccountName }}
-{{- end -}}
-      {{- with .Values.imagePullSecrets }}
-      imagePullSecrets:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      containers:
-      - name: clair
-{{- if contains "/" .Values.clair.clair.image.repository }}
-        image: "{{ .Values.clair.clair.image.repository }}"
-{{- else }}
-        image: "{{ .Values.clair.clair.image.hub | default .Values.global.hub }}/{{ .Values.clair.clair.image.repository }}:{{ .Values.clair.clair.image.tag | default .Values.global.tag }}{{ template ".beagle.imageArch" . }}"
-{{- end }}
-        imagePullPolicy: "{{ .Values.global.imagePullPolicy }}"
-        livenessProbe:
-          httpGet:
-            path: /health
-            port: 6061
-          initialDelaySeconds: 300
-          periodSeconds: 10
-        readinessProbe:
-          httpGet:
-            path: /health
-            port: 6061
-          initialDelaySeconds: 30
-          periodSeconds: 10
-        args: ["-log-level", "{{ .Values.logLevel }}"]
-        env:
-        {{- if has "clair" .Values.proxy.components }}
-        - name: HTTP_PROXY
-          value: "{{ .Values.proxy.httpProxy }}"
-        - name: HTTPS_PROXY
-          value: "{{ .Values.proxy.httpsProxy }}"
-        - name: NO_PROXY
-          value: "{{ template "harbor.noProxy" . }}"
-        {{- end }}
-{{- if .Values.clair.clair.resources }}
-        resources:
-{{ toYaml .Values.clair.clair.resources | indent 10 }}
-{{- end }}
-        ports:
-        - containerPort: 6060
-        volumeMounts:
-        - name: config
-          mountPath: /etc/clair/config.yaml
-          subPath: config.yaml
-        {{- if .Values.internalTLS.enabled }}
-        - name: clair-internal-certs
-          mountPath: /etc/harbor/ssl/clair
-        {{- end }}
-        {{- if .Values.caBundleSecretName }}
-{{ include "harbor.caBundleVolumeMount" . | indent 8 }}
-        {{- end }}
-      - name: adapter
-{{- if contains "/" .Values.clair.adapter.image.repository }}
-        image: "{{ .Values.clair.adapter.image.repository }}"
-{{- else }}
-        image: "{{ .Values.clair.adapter.image.hub | default .Values.global.hub }}/{{ .Values.clair.adapter.image.repository }}:{{ .Values.clair.adapter.image.tag | default .Values.global.tag }}{{ template ".beagle.imageArch" . }}"
-{{- end }}
-        imagePullPolicy: "{{ .Values.global.imagePullPolicy }}"
-        livenessProbe:
-          httpGet:
-            path: /probe/healthy
-            scheme: {{ include "harbor.component.scheme" . | upper }}
-            port: {{ template "harbor.clairAdapter.containerPort" . }}
-          initialDelaySeconds: 300
-          periodSeconds: 10
-        readinessProbe:
-          httpGet:
-            path: /probe/ready
-            scheme: {{ include "harbor.component.scheme" . | upper }}
-            port: {{ template "harbor.clairAdapter.containerPort" . }}
-          initialDelaySeconds: 30
-          periodSeconds: 10
-        env:
-        - name: SCANNER_CLAIR_URL
-          # To avoid a pod cannot reach itself via service IP when the clusters disable hairpin
-          value: "http://127.0.0.1:6060"
-        - name: SCANNER_STORE_REDIS_URL
-          valueFrom:
-              secretKeyRef:
-                name: {{ template "harbor.clair" . }}
-                key: redis
-        - name: SCANNER_CLAIR_DATABASE_URL
-          valueFrom:
-              secretKeyRef:
-                name: {{ template "harbor.clair" . }}
-                key: database
-        {{- if .Values.internalTLS.enabled }}
-        - name: INTERNAL_TLS_ENABLED
-          value: "true"
-        - name: SCANNER_API_SERVER_ADDR
-          value: ":8443"
-        - name: SCANNER_API_SERVER_TLS_KEY
-          value: /etc/harbor/ssl/clair/tls.key
-        - name: SCANNER_API_SERVER_TLS_CERTIFICATE
-          value: /etc/harbor/ssl/clair/tls.crt
-        {{- end }}
-        - name: SCANNER_LOG_LEVEL
-          value: "{{ .Values.logLevel }}"
-{{- if .Values.clair.adapter.resources }}
-        resources:
-{{ toYaml .Values.clair.adapter.resources | indent 10 }}
-{{- end }}
-        ports:
-        - containerPort: {{ template "harbor.clairAdapter.containerPort" . }}
-        {{- if or .Values.internalTLS.enabled .Values.caBundleSecretName }}
-        volumeMounts:
-        {{- if .Values.internalTLS.enabled }}
-        - name: clair-internal-certs
-          mountPath: /etc/harbor/ssl/clair
-        {{- end }}
-        {{- if .Values.caBundleSecretName }}
-{{ include "harbor.caBundleVolumeMount" . | indent 8 }}
-        {{- end }}
-        {{- end }}
-      volumes:
-      - name: config
-        secret:
-          secretName: "{{ template "harbor.clair" . }}"
-      {{- if .Values.internalTLS.enabled }}
-      - name: clair-internal-certs
-        secret:
-          secretName: {{ template "harbor.internalTLS.clair.secretName" . }}
-      {{- end }}
-      {{- if .Values.caBundleSecretName }}
-{{ include "harbor.caBundleVolume" . | indent 6 }}
-      {{- end }}
-    {{- with .Values.clair.nodeSelector }}
-      nodeSelector:
-{{ toYaml . | indent 8 }}
-    {{- end }}
-    {{- with .Values.clair.affinity }}
-      affinity:
-{{ toYaml . | indent 8 }}
-    {{- end }}
-    {{- with .Values.clair.tolerations }}
-      tolerations:
-{{ toYaml . | indent 8 }}
-    {{- end }}
-{{ end }}

templates/clair/clair-secret.yaml

-{{- if .Values.clair.enabled }}
-apiVersion: v1
-kind: Secret
-metadata:
-  name: {{ template "harbor.clair" . }}
-  labels:
-{{ include "harbor.labels" . | indent 4 }}
-type: Opaque
-data:
-  config.yaml: {{ tpl (.Files.Get "conf/clair.yaml") . | b64enc }}
-  redis: {{ include "harbor.redis.urlForClair" . | b64enc }}
-  database: {{ include "harbor.database.clair" . | b64enc }}
-{{- end }} 
\ No newline at end of file

templates/clair/clair-tls.yaml

-{{- if and .Values.clair.enabled .Values.internalTLS.enabled }}
-{{- if eq .Values.internalTLS.certSource "manual" }}
-apiVersion: v1
-kind: Secret
-metadata:
-  name: "{{ template "harbor.internalTLS.clair.secretName" . }}"
-  labels:
-{{ include "harbor.labels" . | indent 4 }}
-type: kubernetes.io/tls
-data:
-  ca.crt: {{ (required "The \"internalTLS.trustCa\" is required!" .Values.internalTLS.trustCa) | b64enc | quote }}
-  tls.crt: {{ (required "The \"internalTLS.clair.crt\" is required!" .Values.internalTLS.clair.crt) | b64enc | quote }}
-  tls.key: {{ (required "The \"internalTLS.clair.key\" is required!" .Values.internalTLS.clair.key) | b64enc | quote }}
-{{- end }}
-{{- end }}
\ No newline at end of file

templates/core/core-cm.yaml

-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: {{ template "harbor.core" . }}
-  labels:
-{{ include "harbor.labels" . | indent 4 }}
-data:
-  app.conf: |+
-    appname = Harbor
-    runmode = prod
-    enablegzip = true
-
-    [prod]
-    httpport = {{ ternary "8443" "8080" .Values.internalTLS.enabled }}
-  PORT: "{{ ternary "8443" "8080" .Values.internalTLS.enabled }}"
-  DATABASE_TYPE: "postgresql"
-  POSTGRESQL_HOST: "{{ template "harbor.database.host" . }}"
-  POSTGRESQL_PORT: "{{ template "harbor.database.port" . }}"
-  POSTGRESQL_USERNAME: "{{ template "harbor.database.username" . }}"
-  POSTGRESQL_DATABASE: "{{ template "harbor.database.coreDatabase" . }}"
-  POSTGRESQL_SSLMODE: "{{ template "harbor.database.sslmode" . }}"
-  POSTGRESQL_MAX_IDLE_CONNS: "{{ .Values.database.maxIdleConns }}"
-  POSTGRESQL_MAX_OPEN_CONNS: "{{ .Values.database.maxOpenConns }}"
-  EXT_ENDPOINT: "{{ .Values.externalURL }}.{{ $.Values.global.host }}"
-  CORE_URL: "{{ template "harbor.coreURL" . }}"
-  JOBSERVICE_URL: "{{ template "harbor.jobserviceURL" . }}"
-  REGISTRY_URL: "{{ template "harbor.registryURL" . }}"
-  TOKEN_SERVICE_URL: "{{ template "harbor.tokenServiceURL" . }}"
-  WITH_NOTARY: "{{ .Values.notary.enabled }}"
-  NOTARY_URL: "http://{{ template "harbor.notary-server" . }}:4443"
-  CORE_LOCAL_URL: "{{ ternary "https://127.0.0.1:8443" "http://127.0.0.1:8080" .Values.internalTLS.enabled }}"
-  WITH_CLAIR: "{{ .Values.clair.enabled }}"
-  CLAIR_ADAPTER_URL: "{{ template "harbor.clairAdapterURL" . }}"
-  WITH_TRIVY: {{ .Values.trivy.enabled | quote }}
-  TRIVY_ADAPTER_URL: "{{ template "harbor.trivyAdapterURL" . }}"
-  REGISTRY_STORAGE_PROVIDER_NAME: "{{ .Values.persistence.imageChartStorage.type }}"
-  WITH_CHARTMUSEUM: "{{ .Values.chartmuseum.enabled }}"
-  CHART_REPOSITORY_URL: "{{ template "harbor.component.scheme" . }}://{{ template "harbor.chartmuseum" . }}"
-  LOG_LEVEL: "{{ .Values.logLevel }}"
-  CONFIG_PATH: "/etc/core/app.conf"
-  CHART_CACHE_DRIVER: "redis"
-  _REDIS_URL_CORE: "{{ template "harbor.redis.urlForCore" . }}"
-  _REDIS_URL_REG: "{{ template "harbor.redis.urlForRegistry" . }}"
-  PORTAL_URL: "{{ template "harbor.portalURL" . }}"
-  REGISTRY_CONTROLLER_URL: "{{ template "harbor.registryControllerURL" . }}"
-  REGISTRY_CREDENTIAL_USERNAME: "{{ .Values.registry.credentials.username }}"
-  {{- if .Values.uaaSecretName }}
-  UAA_CA_ROOT: "/etc/core/auth-ca/auth-ca.crt"
-  {{- end }}
-  {{- if has "core" .Values.proxy.components }}
-  HTTP_PROXY: "{{ .Values.proxy.httpProxy }}"
-  HTTPS_PROXY: "{{ .Values.proxy.httpsProxy }}"
-  NO_PROXY: "{{ template "harbor.noProxy" . }}"
-  {{- end }}
-  PERMITTED_REGISTRY_TYPES_FOR_PROXY_CACHE: "docker-hub,harbor"
-  {{- if hasKey .Values.core "gcTimeWindowHours" }}
-  #make the GC time window configurable for testing
-  GC_TIME_WINDOW_HOURS: "{{ .Values.core.gcTimeWindowHours }}"
-  {{- end }}
\ No newline at end of file
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ template "harbor.core" . }}
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+{{ include "harbor.labels" . | indent 4 }}
+data:
+  app.conf: |+
+    appname = Harbor
+    runmode = prod
+    enablegzip = true
+
+    [prod]
+    httpport = {{ ternary "8443" "8080" .Values.internalTLS.enabled }}
+  PORT: "{{ ternary "8443" "8080" .Values.internalTLS.enabled }}"
+  DATABASE_TYPE: "postgresql"
+  POSTGRESQL_HOST: "{{ template "harbor.database.host" . }}"
+  POSTGRESQL_PORT: "{{ template "harbor.database.port" . }}"
+  POSTGRESQL_USERNAME: "{{ template "harbor.database.username" . }}"
+  POSTGRESQL_DATABASE: "{{ template "harbor.database.coreDatabase" . }}"
+  POSTGRESQL_SSLMODE: "{{ template "harbor.database.sslmode" . }}"
+  POSTGRESQL_MAX_IDLE_CONNS: "{{ .Values.database.maxIdleConns }}"
+  POSTGRESQL_MAX_OPEN_CONNS: "{{ .Values.database.maxOpenConns }}"
+  EXT_ENDPOINT: "{{ .Values.externalURL }}"
+  CORE_URL: "{{ template "harbor.coreURL" . }}"
+  JOBSERVICE_URL: "{{ template "harbor.jobserviceURL" . }}"
+  REGISTRY_URL: "{{ template "harbor.registryURL" . }}"
+  TOKEN_SERVICE_URL: "{{ template "harbor.tokenServiceURL" . }}"
+  CORE_LOCAL_URL: "{{ ternary "https://127.0.0.1:8443" "http://127.0.0.1:8080" .Values.internalTLS.enabled }}"
+  WITH_TRIVY: {{ .Values.trivy.enabled | quote }}
+  TRIVY_ADAPTER_URL: "{{ template "harbor.trivyAdapterURL" . }}"
+  REGISTRY_STORAGE_PROVIDER_NAME: "{{ .Values.persistence.imageChartStorage.type }}"
+  LOG_LEVEL: "{{ .Values.logLevel }}"
+  CONFIG_PATH: "/etc/core/app.conf"
+  CHART_CACHE_DRIVER: "redis"
+  _REDIS_URL_CORE: "{{ template "harbor.redis.urlForCore" . }}"
+  _REDIS_URL_REG: "{{ template "harbor.redis.urlForRegistry" . }}"
+  {{- if or (and (eq .Values.redis.type "internal") .Values.redis.internal.harborDatabaseIndex) (and (eq .Values.redis.type "external") .Values.redis.external.harborDatabaseIndex) }}
+  _REDIS_URL_HARBOR: "{{ template "harbor.redis.urlForHarbor" . }}"
+  {{- end }}
+  {{- if or (and (eq .Values.redis.type "internal") .Values.redis.internal.cacheLayerDatabaseIndex) (and (eq .Values.redis.type "external") .Values.redis.external.cacheLayerDatabaseIndex) }}
+  _REDIS_URL_CACHE_LAYER: "{{ template "harbor.redis.urlForCache" . }}"
+  {{- end }}  
+  PORTAL_URL: "{{ template "harbor.portalURL" . }}"
+  REGISTRY_CONTROLLER_URL: "{{ template "harbor.registryControllerURL" . }}"
+  REGISTRY_CREDENTIAL_USERNAME: "{{ .Values.registry.credentials.username }}"
+  {{- if .Values.uaaSecretName }}
+  UAA_CA_ROOT: "/etc/core/auth-ca/auth-ca.crt"
+  {{- end }}
+  {{- if has "core" .Values.proxy.components }}
+  HTTP_PROXY: "{{ .Values.proxy.httpProxy }}"
+  HTTPS_PROXY: "{{ .Values.proxy.httpsProxy }}"
+  NO_PROXY: "{{ template "harbor.noProxy" . }}"
+  {{- end }}
+  PERMITTED_REGISTRY_TYPES_FOR_PROXY_CACHE: "docker-hub,harbor,azure-acr,aws-ecr,google-gcr,quay,docker-registry,github-ghcr,jfrog-artifactory"
+  {{- if .Values.metrics.enabled}}
+  METRIC_ENABLE: "true"
+  METRIC_PATH: "{{ .Values.metrics.core.path }}"
+  METRIC_PORT: "{{ .Values.metrics.core.port }}"
+  METRIC_NAMESPACE: harbor
+  METRIC_SUBSYSTEM: core
+  {{- end }}
+
+  {{- if hasKey .Values.core "gcTimeWindowHours" }}
+  #make the GC time window configurable for testing
+  GC_TIME_WINDOW_HOURS: "{{ .Values.core.gcTimeWindowHours }}"
+  {{- end }}
+  {{- template "harbor.traceEnvsForCore" . }}
+
+  {{- if .Values.core.artifactPullAsyncFlushDuration }}
+  ARTIFACT_PULL_ASYNC_FLUSH_DURATION: {{ .Values.core.artifactPullAsyncFlushDuration | quote }}
+  {{- end }}
+
+  {{- if .Values.core.gdpr}}
+  {{- if .Values.core.gdpr.deleteUser}}
+  GDPR_DELETE_USER: "true"
+  {{- end }}
+  {{- if .Values.core.gdpr.auditLogsCompliant}}
+  GDPR_AUDIT_LOGS: "true"
+  {{- end }}
+  {{- end }}
+
+  {{- if .Values.cache.enabled }}
+  CACHE_ENABLED: "true"
+  CACHE_EXPIRE_HOURS: "{{ .Values.cache.expireHours }}"
+  {{- end }}
+  
+  {{- if .Values.core.quotaUpdateProvider }}
+  QUOTA_UPDATE_PROVIDER: "{{ .Values.core.quotaUpdateProvider }}"
+  {{- end }}

templates/core/core-pre-upgrade-job.yaml

+{{- if .Values.enableMigrateHelmHook }}
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: migration-job
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+{{ include "harbor.labels" . | indent 4 }}
+    component: migrator
+  annotations:
+    # This is what defines this resource as a hook. Without this line, the
+    # job is considered part of the release.
+    "helm.sh/hook": pre-upgrade
+    "helm.sh/hook-weight": "-5"
+spec:
+  template:
+    metadata:
+      labels:
+{{ include "harbor.matchLabels" . | indent 8 }}
+        component: migrator
+    spec:
+      restartPolicy: Never
+      securityContext:
+        runAsUser: 10000
+        fsGroup: 10000
+{{- if .Values.core.serviceAccountName }}
+      serviceAccountName: {{ .Values.core.serviceAccountName }}
+{{- end -}}
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      terminationGracePeriodSeconds: 120
+      containers:
+      - name: core-job
+        image: {{ .Values.core.image.repository }}:{{ .Values.core.image.tag }}
+        imagePullPolicy: {{ .Values.imagePullPolicy }}
+        command: ["/harbor/harbor_core", "-mode=migrate"]
+        envFrom:
+        - configMapRef:
+            name: "{{ template "harbor.core" . }}"
+        - secretRef:
+            name: "{{ template "harbor.core" . }}"
+        {{- if .Values.database.external.existingSecret }}
+        env:
+          - name: POSTGRESQL_PASSWORD
+            valueFrom:
+              secretKeyRef:
+                name: {{ .Values.database.external.existingSecret }}
+                key: password
+        {{- end }}
+        {{- if not (empty .Values.containerSecurityContext) }}
+        securityContext: {{ .Values.containerSecurityContext | toYaml | nindent 10 }}
+        {{- end }}               
+        volumeMounts:
+        - name: config
+          mountPath: /etc/core/app.conf
+          subPath: app.conf
+      volumes:
+      - name: config
+        configMap:
+          name: {{ template "harbor.core" . }}
+          items:
+            - key: app.conf
+              path: app.conf
+    {{- with .Values.core.nodeSelector }}
+      nodeSelector:
+{{ toYaml . | indent 8 }}
+    {{- end }}
+    {{- with .Values.core.affinity }}
+      affinity:
+{{ toYaml . | indent 8 }}
+    {{- end }}
+    {{- with .Values.core.tolerations }}
+      tolerations:
+{{ toYaml . | indent 8 }}
+    {{- end }}
+{{- end }}

templates/core/core-secret.yaml

-apiVersion: v1
-kind: Secret
-metadata:
-  name: {{ template "harbor.core" . }}
-  labels:
-{{ include "harbor.labels" . | indent 4 }}
-type: Opaque
-data:
-  secretKey: {{ .Values.secretKey | b64enc | quote }}
-  secret: {{ .Values.core.secret | default (randAlphaNum 16) | b64enc | quote }}
-{{- if not .Values.core.secretName }}
-  tls.crt: {{ .Files.Get "cert/tls.crt" | b64enc }}
-  tls.key: {{ .Files.Get "cert/tls.key" | b64enc }}
-{{- end }}
-  HARBOR_ADMIN_PASSWORD: {{ .Values.harborAdminPassword | b64enc | quote }}
-  POSTGRESQL_PASSWORD: {{ template "harbor.database.encryptedPassword" . }}
-  REGISTRY_CREDENTIAL_PASSWORD: {{ .Values.registry.credentials.password | b64enc | quote }}
-  CSRF_KEY: {{ .Values.core.xsrfKey | default (randAlphaNum 32) | b64enc | quote }}
+{{- $existingSecret := lookup "v1" "Secret" .Release.Namespace (include "harbor.core" .) }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ template "harbor.core" . }}
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+{{ include "harbor.labels" . | indent 4 }}
+type: Opaque
+data:
+  {{- if not .Values.existingSecretSecretKey }}
+  secretKey: {{ .Values.secretKey | b64enc | quote }}
+  {{- end }}
+  {{- if not .Values.core.existingSecret }}
+  secret: {{ .Values.core.secret | default (include "harbor.secretKeyHelper" (dict "key" "secret" "data" $existingSecret.data)) | default (randAlphaNum 16) | b64enc | quote }}
+  {{- end }}
+  {{- if not .Values.core.secretName }}
+  {{- $ca := genCA "harbor-token-ca" 365 }}
+  tls.key: {{ .Values.core.tokenKey | default $ca.Key | b64enc | quote }}
+  tls.crt: {{ .Values.core.tokenCert | default $ca.Cert | b64enc | quote }}
+  {{- end }}
+  {{- if not .Values.existingSecretAdminPassword }}
+  HARBOR_ADMIN_PASSWORD: {{ .Values.harborAdminPassword | b64enc | quote }}
+  {{- end }}
+  {{- if not .Values.database.external.existingSecret }}
+  POSTGRESQL_PASSWORD: {{ template "harbor.database.encryptedPassword" . }}
+  {{- end }}
+  {{- if not .Values.registry.credentials.existingSecret }}
+  REGISTRY_CREDENTIAL_PASSWORD: {{ .Values.registry.credentials.password | b64enc | quote }}
+  {{- end }}
+  {{- if not .Values.core.existingXsrfSecret }}
+  CSRF_KEY: {{ .Values.core.xsrfKey | default (include "harbor.secretKeyHelper" (dict "key" "CSRF_KEY" "data" $existingSecret.data)) | default (randAlphaNum 32) | b64enc | quote }}
+  {{- end }}
+{{- if .Values.core.configureUserSettings }}
+  CONFIG_OVERWRITE_JSON: {{ .Values.core.configureUserSettings | b64enc | quote }}
+{{- end }}
+  {{- template "harbor.traceJaegerPassword" . }}

templates/database/database-secret.yaml

-{{- if eq .Values.database.type "internal" -}}
-apiVersion: v1
-kind: Secret
-metadata:
-  name: "{{ template "harbor.database" . }}"
-  labels:
-{{ include "harbor.labels" . | indent 4 }}
-type: Opaque
-data:
-  POSTGRES_PASSWORD: {{ template "harbor.database.encryptedPassword" . }}
-{{- end -}}
+{{- if eq .Values.database.type "internal" -}}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: "{{ template "harbor.database" . }}"
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+{{ include "harbor.labels" . | indent 4 }}
+type: Opaque
+data:
+  POSTGRES_PASSWORD: {{ template "harbor.database.encryptedPassword" . }}
+{{- end -}}

test/test.go

-package test