diff --git a/Chart.yaml b/Chart.yaml index 41bb684d7d12cec9f173e1e5e339f5084a9ecd10..288b7b1f81fe8549bc8c3b2dcf80139744fcbf08 100644 --- a/Chart.yaml +++ b/Chart.yaml @@ -1,6 +1,6 @@ name: harbor -version: dev -appVersion: dev +version: 1.0.0 +appVersion: 1.7.0 description: An open source trusted cloud native registry that stores, signs, and scans content keywords: - docker diff --git a/Deploy.md b/Deploy.md index 3152e408891fe4957613a6845c4302ab4a826ddc..63fd771999f01515da84de1fc3d649cc7df5e958 100644 --- a/Deploy.md +++ b/Deploy.md @@ -35,6 +35,11 @@ docker pull goharbor/harbor-core:v1.7.5 && \ docker tag goharbor/harbor-core:v1.7.5 registry-vpc.cn-qingdao.aliyuncs.com/wod/harbor-core:v1.7.5 && \ docker push registry-vpc.cn-qingdao.aliyuncs.com/wod/harbor-core:v1.7.5 +# goharbor/harbor-adminserver +docker pull goharbor/harbor-adminserver:v1.7.5 && \ +docker tag goharbor/harbor-adminserver:v1.7.5 registry-vpc.cn-qingdao.aliyuncs.com/wod/harbor-adminserver:v1.7.5 && \ +docker push registry-vpc.cn-qingdao.aliyuncs.com/wod/harbor-adminserver:v1.7.5 + # goharbor/harbor-jobservice docker pull goharbor/harbor-jobservice:v1.7.5 && \ docker tag goharbor/harbor-jobservice:v1.7.5 registry-vpc.cn-qingdao.aliyuncs.com/wod/harbor-jobservice:v1.7.5 && \ diff --git a/docs/High Availability.md b/docs/High Availability.md index 6bd48f13833bb2a032a713d1dc6252d92e3ba97b..e6516738774ffe6780b200f24a36c227092c7f7b 100644 --- a/docs/High Availability.md +++ b/docs/High Availability.md @@ -53,7 +53,7 @@ Configure the followings items in `values.yaml`, you can also set them as parame If you have no PVCs that can be shared across nodes, you can use external object storage to store images and charts and store the job logs in database. Set the `persistence.imageChartStorage.type` to the value you want to use and fill the corresponding section and set `jobservice.jobLogger` to `database`. - **Replica** - Set `portal.replicas`, `core.replicas`, `jobservice.replicas`, `registry.replicas`, `chartmuseum.replicas`, `clair.replicas`, `notary.server.replicas` and `notary.signer.replicas` to `n`(`n`>=2). + Set `portal.replicas`, `adminserver.replicas`, `core.replicas`, `jobservice.replicas`, `registry.replicas`, `chartmuseum.replicas`, `clair.replicas`, `notary.server.replicas` and `notary.signer.replicas` to `n`(`n`>=2). ### Installation Install the Harbor helm chart with a release name `my-release`: diff --git a/readme.md b/readme.md index 95173f38048a362eb975c05dbd7e100c10016159..62e53e2a6856527e07c764cedb4a1f7b73f91c4e 100644 --- a/readme.md +++ b/readme.md @@ -1,89 +1,60 @@ # Helm Chart for Harbor -**Notes:** The master branch is in heavy development, please use the codes on other branch instead. A high available solution for Harbor based on chart can be find [here](docs/High%20Availability.md). And refer to the [guide](docs/Upgrade.md) to upgrade the existing deployment. +**Notes:** The master branch is in heavy development, please use the codes on other branch instead. A high available solution for Harbor based on chart can be find [here](docs/High%20Availability.md). And refer to the [guide](docs/Upgrade.md) to upgrade the existing deployment. ## Introduction - This [Helm](https://github.com/kubernetes/helm) chart installs [Harbor](https://github.com/goharbor/harbor) in a Kubernetes cluster. Welcome to [contribute](CONTRIBUTING.md) to Helm Chart for Harbor. ## Prerequisites - - Kubernetes cluster 1.10+ - Helm 2.8.0+ ## Installation - ### Download the chart - Download Harbor helm chart code. - ```bash git clone https://github.com/goharbor/harbor-helm ``` - Checkout the branch. - ```bash cd harbor-helm git checkout branch_name ``` - ### Configure the chart - -The following items can be configured in `values.yaml` or set via `--set` flag during installation. +The following items can be configured in `values.yaml` or set via `--set` flag during installation. #### Configure the way how to expose Harbor service: - - **Ingress**: The ingress controller must be installed in the Kubernetes cluster. - **Notes:** if the TLS is disabled, the port must be included in the command when pulling/pushing images. Refer to issue [#5291](https://github.com/goharbor/harbor/issues/5291) for the detail. -- **ClusterIP**: Exposes the service on a cluster-internal IP. Choosing this value makes the service only reachable from within the cluster. -- **NodePort**: Exposes the service on each Node’s IP at a static port (the NodePort). You’ll be able to contact the NodePort service, from outside the cluster, by requesting `NodeIP:NodePort`. -- **LoadBalancer**: Exposes the service externally using a cloud provider’s load balancer. +**Notes:** if the TLS is disabled, the port must be included in the command when pulling/pushing images. Refer to issue [#5291](https://github.com/goharbor/harbor/issues/5291) for the detail. +- **ClusterIP**: Exposes the service on a cluster-internal IP. Choosing this value makes the service only reachable from within the cluster. +- **NodePort**: Exposes the service on each Node’s IP at a static port (the NodePort). You’ll be able to contact the NodePort service, from outside the cluster, by requesting `NodeIP:NodePort`. #### Configure the external URL +The external URL for Harbor core service is used to: +1) populate the docker/helm commands showed on portal +2) populate the token service URL returned to docker/notary client -The external URL for Harbor core service is used to: - -1. populate the docker/helm commands showed on portal -2. populate the token service URL returned to docker/notary client - -Format: `protocol://domain[:port]`. Usually: +Format: `protocol://domain[:port]`. Usually: +- if expose the service via `Ingress`, the `domain` should be the value of `expose.ingress.hosts.core` +- if expose the service via `ClusterIP`, the `domain` should be the value of `expose.clusterIP.name` +- if expose the service via `NodePort`, the `domain` should be the IP address of one Kubernetes node -- if expose the service via `Ingress`, the `domain` should be the value of `expose.ingress.hosts.core` -- if expose the service via `ClusterIP`, the `domain` should be the value of `expose.clusterIP.name` -- if expose the service via `NodePort`, the `domain` should be the IP address of one Kubernetes node -- if expose the service via `LoadBalancer`, set the `domain` as your own domain name and add a CNAME record to map the domain name to the one you got from the cloud provider - -If Harbor is deployed behind the proxy, set it as the URL of proxy. +If Harbor is deployed behind the proxy, set it as the URL of proxy. #### Configure the way how to persistent data: - - **Disable**: The data does not survive the termination of a pod. - **Persistent Volume Claim(default)**: A default `StorageClass` is needed in the Kubernetes cluster to dynamic provision the volumes. Specify another StorageClass in the `storageClass` or set `existingClaim` if you have already existing persistent volumes to use. -- **External Storage(only for images and charts)**: For images and charts, the external storages are supported: `azure`, `gcs`, `s3` `swift` and `oss`. - -#### Configure the secrets - -- **Secret keys**: Secret keys are used for secure communication between components. Fill `core.secret`, `jobservice.secret` and `registry.secret` to configure. -- **Certificates**: - - *notary*: Used for authentication during communications. Fill `notary.secretName` to configure. Notary server certificate must be issued with notary service name as subject alternative name. - - *core*: Used for token encryption/decryption. Fill `core.secretName` to configure. - -Secrets and certificates must be setup to avoid changes on every Helm upgrade (see: [#107](https://github.com/goharbor/harbor-helm/issues/107)). - +- **External Storage(only for images and charts)**: For images and charts, the external storages are supported: `azure`, `gcs`, `s3` `swift` and `oss`. #### Configure the other items listed in [configuration](#configuration) section. ### Install the chart - Install the Harbor helm chart with a release name `my-release`: - ```bash helm install --name my-release . ``` ## Uninstallation - To uninstall/delete the `my-release` deployment: ```bash @@ -91,194 +62,190 @@ helm delete --purge my-release ``` ## Configuration - The following table lists the configurable parameters of the Harbor chart and the default values. -| Parameter | Description | Default | -| --------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------- | -| **Expose** | -| `expose.type` | The way how to expose the service: `ingress`, `clusterIP`, `nodePort` or `loadBalancer` | `ingress` | -| `expose.tls.enabled` | Enable the tls or not | `true` | -| `expose.tls.secretName` | Fill the name of secret if you want to use your own TLS certificate. The secret must contain keys named: -`tls.crt` - the certificate, `tls.key` - the private key, `ca.crt` - the certificate of CA.These files will be generated automatically if the `secretName` is not set || -| `expose.tls.commonName` | The common name used to generate the certificate, it's necessary when the `expose.type` is `clusterIP` or `nodePort` and `expose.tls.secretName` is null | | -| `expose.ingress.host` | The host of Harbor service in ingress rule | `harbor.local` | -| `expose.ingress.controller` | The ingress controller type. Currently supports `default` and `gce` | `default` | -| `expose.ingress.annotations` | The annotations used in ingress | | -| `expose.ingress.rewriteAnnotation` | The name of the `rewrite-target` annotation| `nginx.ingress.kubernetes.io/rewrite-target` | -| `expose.clusterIP.name` | The name of ClusterIP service | `harbor` | -| `expose.clusterIP.ports.http` | The service port Harbor listens on when serving with HTTP | `80` | -| `expose.clusterIP.ports.https` | The service port Harbor listens on when serving with HTTPS | `443` | -| `expose.nodePort.name` | The name of NodePort service | `harbor` | -| `expose.nodePort.ports.http.port` | The service port Harbor listens on when serving with HTTP | `80` | -| `expose.nodePort.ports.http.nodePort` | The node port Harbor listens on when serving with HTTP | `30002` | -| `expose.nodePort.ports.https.port` | The service port Harbor listens on when serving with HTTPS | `443` | -| `expose.nodePort.ports.https.nodePort` | The node port Harbor listens on when serving with HTTPS | `30003` | -| `expose.loadBalancer.name` | The name of service |`harbor`| -| `expose.loadBalancer.ports.http` | The service port Harbor listens on when serving with HTTP |`80`| -| `expose.loadBalancer.ports.https` | The service port Harbor listens on when serving with HTTP |`30002`| -| **Persistence** | -| `persistence.enabled` | Enable the data persistence or not | `true` | -| `persistence.resourcePolicy` | Setting it to `keep` to avoid removing PVCs during a helm delete operation. Leaving it empty will delete PVCs after the chart deleted | `keep` | -| `persistence.persistentVolumeClaim.registry.existingClaim` | Use the existing PVC which must be created manually before bound, and specify the `subPath` if the PVC is shared with other components | | -| `persistence.persistentVolumeClaim.registry.storageClass` | Specify the `storageClass` used to provision the volume. Or the default StorageClass will be used(the default). Set it to `-` to disable dynamic provisioning | | -| `persistence.persistentVolumeClaim.registry.subPath` | The sub path used in the volume | | -| `persistence.persistentVolumeClaim.registry.accessMode` | The access mode of the volume | `ReadWriteOnce` | -| `persistence.persistentVolumeClaim.registry.size` | The size of the volume | `5Gi` | -| `persistence.persistentVolumeClaim.chartmuseum.existingClaim` | Use the existing PVC which must be created manually before bound, and specify the `subPath` if the PVC is shared with other components | | -| `persistence.persistentVolumeClaim.chartmuseum.storageClass` | Specify the `storageClass` used to provision the volume. Or the default StorageClass will be used(the default). Set it to `-` to disable dynamic provisioning | | -| `persistence.persistentVolumeClaim.chartmuseum.subPath` | The sub path used in the volume | | -| `persistence.persistentVolumeClaim.chartmuseum.accessMode` | The access mode of the volume | `ReadWriteOnce` | -| `persistence.persistentVolumeClaim.chartmuseum.size` | The size of the volume | `5Gi` | -| `persistence.persistentVolumeClaim.jobservice.existingClaim` | Use the existing PVC which must be created manually before bound, and specify the `subPath` if the PVC is shared with other components | | -| `persistence.persistentVolumeClaim.jobservice.storageClass` | Specify the `storageClass` used to provision the volume. Or the default StorageClass will be used(the default). Set it to `-` to disable dynamic provisioning | | -| `persistence.persistentVolumeClaim.jobservice.subPath` | The sub path used in the volume | | -| `persistence.persistentVolumeClaim.jobservice.accessMode` | The access mode of the volume | `ReadWriteOnce` | -| `persistence.persistentVolumeClaim.jobservice.size` | The size of the volume | `1Gi` | -| `persistence.persistentVolumeClaim.database.existingClaim` | Use the existing PVC which must be created manually before bound, and specify the `subPath` if the PVC is shared with other components. If external database is used, the setting will be ignored | | -| `persistence.persistentVolumeClaim.database.storageClass` | Specify the `storageClass` used to provision the volume. Or the default StorageClass will be used(the default). Set it to `-` to disable dynamic provisioning. If external database is used, the setting will be ignored | | -| `persistence.persistentVolumeClaim.database.subPath` | The sub path used in the volume. If external database is used, the setting will be ignored | | -| `persistence.persistentVolumeClaim.database.accessMode` | The access mode of the volume. If external database is used, the setting will be ignored | `ReadWriteOnce` | -| `persistence.persistentVolumeClaim.database.size` | The size of the volume. If external database is used, the setting will be ignored | `1Gi` | -| `persistence.persistentVolumeClaim.redis.existingClaim` | Use the existing PVC which must be created manually before bound, and specify the `subPath` if the PVC is shared with other components. If external Redis is used, the setting will be ignored | | -| `persistence.persistentVolumeClaim.redis.storageClass` | Specify the `storageClass` used to provision the volume. Or the default StorageClass will be used(the default). Set it to `-` to disable dynamic provisioning. If external Redis is used, the setting will be ignored | | -| `persistence.persistentVolumeClaim.redis.subPath` | The sub path used in the volume. If external Redis is used, the setting will be ignored | | -| `persistence.persistentVolumeClaim.redis.accessMode` | The access mode of the volume. If external Redis is used, the setting will be ignored | `ReadWriteOnce` | -| `persistence.persistentVolumeClaim.redis.size` | The size of the volume. If external Redis is used, the setting will be ignored | `1Gi` | -| `persistence.imageChartStorage.disableredirect` | The configuration for managing redirects from content backends. For backends which not supported it (such as using minio for `s3` storage type), please set it to `true` to disable redirects. Refer to the [guide](https://github.com/docker/distribution/blob/master/docs/configuration.md#redirect) for more information about the detail | `false` | -| `persistence.imageChartStorage.type` | The type of storage for images and charts: `filesystem`, `azure`, `gcs`, `s3`, `swift` or `oss`. The type must be `filesystem` if you want to use persistent volumes for registry and chartmuseum. Refer to the [guide](https://github.com/docker/distribution/blob/master/docs/configuration.md#storage) for more information about the detail | `filesystem` | -| **General** | -| `externalURL` | The external URL for Harbor service | `https://harbor.local` | -| `imagePullPolicy` | The image pull policy | `IfNotPresent` | -| `logLevel` | The log level | `debug` | -| `harborAdminPassword` | The initial password of Harbor admin. Change it from portal after launching Harbor | `Harbor12345` | -| `secretkey` | The key used for encryption. Must be a string of 16 chars | `not-a-secure-key` | -| **Nginx** (if expose the service via `ingress`, the Nginx will not be used) | -| `nginx.image.repository` | Image repository | `goharbor/nginx-photon` | -| `nginx.image.tag` | Image tag | `dev` | -| `nginx.replicas` | The replica count | `1` | -| `nginx.resources` | The [resources] to allocate for container | undefined | -| `nginx.nodeSelector` | Node labels for pod assignment | `{}` | -| `nginx.tolerations` | Tolerations for pod assignment | `[]` | -| `nginx.affinity` | Node/Pod affinities | `{}` | -| `nginx.podAnnotations` | Annotations to add to the nginx pod | `{}` | -| **Portal** | -| `portal.image.repository` | Repository for portal image | `goharbor/harbor-portal` | -| `portal.image.tag` | Tag for portal image | `dev` | -| `portal.replicas` | The replica count | `1` | -| `portal.resources` | The [resources] to allocate for container | undefined | -| `portal.nodeSelector` | Node labels for pod assignment | `{}` | -| `portal.tolerations` | Tolerations for pod assignment | `[]` | -| `portal.affinity` | Node/Pod affinities | `{}` | -| `portal.podAnnotations` | Annotations to add to the portal pod | `{}` | -| **Core** | -| `core.image.repository` | Repository for Harbor core image | `goharbor/harbor-core` | -| `core.image.tag` | Tag for Harbor core image | `dev` | -| `core.replicas` | The replica count | `1` | -| `core.resources` | The [resources] to allocate for container | undefined | -| `core.nodeSelector` | Node labels for pod assignment | `{}` | -| `core.tolerations` | Tolerations for pod assignment | `[]` | -| `core.affinity` | Node/Pod affinities | `{}` | -| `core.podAnnotations` | Annotations to add to the core pod | `{}` | -| `core.secret` | Secret is used when core server communicates with other components. If a secret key is not specified, Helm will generate one. Must be a string of 16 chars. | | -| `core.secret` | Fill the name of a kubernetes secret if you want to use your own TLS certificate and private key for token encryption/decryption. The secret must contain keys named `tls.tokenServiceRootCertBundle` and `tls.tokenServicePrivateKey` that contain the certificate and private key. They will be automatically generated if not set. | | -| **Jobservice** | -| `jobservice.image.repository` | Repository for jobservice image | `goharbor/harbor-jobservice` | -| `jobservice.image.tag` | Tag for jobservice image | `dev` | -| `jobservice.replicas` | The replica count | `1` | -| `jobservice.maxJobWorkers` | The max job workers | `10` | -| `jobservice.jobLogger` | The logger for jobs: `file`, `database` or `stdout` | `file` | -| `jobservice.resources` | The [resources] to allocate for container | undefined | -| `jobservice.nodeSelector` | Node labels for pod assignment | `{}` | -| `jobservice.tolerations` | Tolerations for pod assignment | `[]` | -| `jobservice.affinity` | Node/Pod affinities | `{}` | -| `jobservice.podAnnotations` | Annotations to add to the jobservice pod | `{}` | -| `jobservice.secret` | Secret is used when job service communicates with other components. If a secret key is not specified, Helm will generate one. Must be a string of 16 chars. | | -| **Registry** | -| `registry.registry.image.repository` | Repository for registry image | `goharbor/registry-photon` | -| `registry.registry.image.tag` | Tag for registry image | -| `registry.registry.resources` | The [resources] to allocate for container | undefined | | `dev` | -| `registry.controller.image.repository` | Repository for registry controller image | `goharbor/harbor-registryctl` | -| `registry.controller.image.tag` | Tag for registry controller image | -| `registry.controller.resources` | The [resources] to allocate for container | undefined | | `dev` | -| `registry.replicas` | The replica count | `1` | -| `registry.nodeSelector` | Node labels for pod assignment | `{}` | -| `registry.tolerations` | Tolerations for pod assignment | `[]` | -| `registry.affinity` | Node/Pod affinities | `{}` | -| `registry.podAnnotations` | Annotations to add to the registry pod | `{}` | -| `registry.secret` | Secret is used to secure the upload state from client and registry storage backend. See: https://github.com/docker/distribution/blob/master/docs/configuration.md#http. If a secret key is not specified, Helm will generate one. Must be a string of 16 chars. | | -| **Chartmuseum** | -| `chartmuseum.enabled` | Enable chartmusuem to store chart | `true` | -| `chartmuseum.image.repository` | Repository for chartmuseum image | `goharbor/chartmuseum-photon` | -| `chartmuseum.image.tag` | Tag for chartmuseum image | `dev` | -| `chartmuseum.replicas` | The replica count | `1` | -| `chartmuseum.resources` | The [resources] to allocate for container | undefined | -| `chartmuseum.nodeSelector` | Node labels for pod assignment | `{}` | -| `chartmuseum.tolerations` | Tolerations for pod assignment | `[]` | -| `chartmuseum.affinity` | Node/Pod affinities | `{}` | -| `chartmuseum.podAnnotations` | Annotations to add to the chart museum pod | `{}` | -| **Clair** | -| `clair.enabled` | Enable Clair | `true` | -| `clair.image.repository` | Repository for clair image | `goharbor/clair-photon` | -| `clair.image.tag` | Tag for clair image | `dev` | -| `clair.replicas` | The replica count | `1` | -| `clair.httpProxy` | The HTTP proxy used to update vulnerabilities database from internet | | -| `clair.httpsProxy` | The HTTPS proxy used to update vulnerabilities database from internet | | -| `clair.updatersInterval` | The interval of clair updaters, the unit is hour, set to 0 to disable the updaters | `12` | -| `clair.resources` | The [resources] to allocate for container | undefined | -| `clair.nodeSelector` | Node labels for pod assignment | `{}` | -| `clair.tolerations` | Tolerations for pod assignment | `[]` | -| `clair.affinity` | Node/Pod affinities | `{}` | -| `clair.podAnnotations` | Annotations to add to the clair pod | `{}` | -| **Notary** | -| `notary.enabled` | Enable Notary? | `true` | -| `notary.server.image.repository` | Repository for notary server image | `goharbor/notary-server-photon` | -| `notary.server.image.tag` | Tag for notary server image | `dev` | -| `notary.server.replicas` | The replica count | -| `notary.server.resources` | The [resources] to allocate for container | undefined | | `1` | -| `notary.signer.image.repository` | Repository for notary signer image | `goharbor/notary-signer-photon` | -| `notary.signer.image.tag` | Tag for notary signer image | `dev` | -| `notary.signer.replicas` | The replica count | -| `notary.signer.resources` | The [resources] to allocate for container | undefined | | `1` | -| `notary.nodeSelector` | Node labels for pod assignment | `{}` | -| `notary.tolerations` | Tolerations for pod assignment | `[]` | -| `notary.affinity` | Node/Pod affinities | `{}` | -| `notary.podAnnotations` | Annotations to add to the notary pod | `{}` | -| `notary.secretName` | Fill the name of a kubernetes secret if you want to use your own TLS certificate authority, certificate and private key for notary communications. The secret must contain keys named `tls.ca`, `tls.crt` and `tls.key` that contain the CA, certificate and private key. They will be generated if not set. | | -| **Database** | -| `database.type` | If external database is used, set it to `external` | `internal` | -| `database.internal.image.repository` | Repository for database image | `goharbor/harbor-db` | -| `database.internal.image.tag` | Tag for database image | `dev` | -| `database.internal.password` | The password for database | `changeit` | -| `database.internal.resources` | The [resources] to allocate for container | undefined | -| `database.internal.nodeSelector` | Node labels for pod assignment | `{}` | -| `database.internal.tolerations` | Tolerations for pod assignment | `[]` | -| `database.internal.affinity` | Node/Pod affinities | `{}` | -| `database.external.host` | The hostname of external database | `192.168.0.1` | -| `database.external.port` | The port of external database | `5432` | -| `database.external.username` | The username of external database | `user` | -| `database.external.password` | The password of external database | `password` | -| `database.external.coreDatabase` | The database used by core service | `registry` | -| `database.external.clairDatabase` | The database used by clair | `clair` | -| `database.external.notaryServerDatabase` | The database used by Notary server | `notary_server` | -| `database.external.notarySignerDatabase` | The database used by Notary signer | `notary_signer` | -| `database.external.sslmode` | Connection method of external database (require | prefer | disable) | `disable` | -| `database.podAnnotations` | Annotations to add to the database pod | `{}` | -| **Redis** | -| `redis.type` | If external redis is used, set it to `external` | `internal` | -| `redis.internal.image.repository` | Repository for redis image | `goharbor/redis-photon` | -| `redis.internal.image.tag` | Tag for redis image | `dev` | -| `redis.internal.resources` | The [resources] to allocate for container | undefined | -| `redis.internal.nodeSelector` | Node labels for pod assignment | `{}` | -| `redis.internal.tolerations` | Tolerations for pod assignment | `[]` | -| `redis.internal.affinity` | Node/Pod affinities | `{}` | -| `redis.external.host` | The hostname of external Redis | `192.168.0.2` | -| `redis.external.port` | The port of external Redis | `6379` | -| `redis.external.coreDatabaseIndex` | The database index for core | `0` | -| `redis.external.jobserviceDatabaseIndex` | The database index for jobservice | `1` | -| `redis.external.registryDatabaseIndex` | The database index for registry | `2` | -| `redis.external.chartmuseumDatabaseIndex` | The database index for chartmuseum | `3` | -| `redis.external.password` | The password of external Redis | | -| `redis.podAnnotations` | Annotations to add to the redis pod | `{}` | - -[resources]: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/ +| Parameter | Description | Default | +| ----------------------- | ---------------------------------- | ----------------------- | +| **Expose** | +|`expose.type`|The way how to expose the service: `ingress`, `clusterIP` or `nodePort`|`ingress`| +|`expose.tls.enabled`|Enable the tls or not|`true`| +|`expose.tls.secretName`|Fill the name of secret if you want to use your own TLS certificate and private key. The secret must contain keys named `tls.crt` and `tls.key` that contain the certificate and private key to use for TLS. The certificate and private key will be generated automatically if it is not set|| +|`expose.tls.notarySecretName`|By default, the Notary service will use the same cert and key as described above. Fill the name of secret if you want to use a separated one. Only needed when the `expose.type` is `ingress`.|| +|`expose.tls.commonName`|The common name used to generate the certificate, it's necessary when the `expose.type` is `clusterIP` or `nodePort` and `expose.tls.secretName` is null|| +| `expose.ingress.hosts.core` | The host of Harbor core service in ingress rule | `core.harbor.domain` | +| `expose.ingress.hosts.notary` | The host of Harbor Notary service in ingress rule | `notary.harbor.domain` | +| `expose.ingress.annotations` | The annotations used in ingress || +| `expose.clusterIP.name` | The name of ClusterIP service |`harbor`| +| `expose.clusterIP.ports.httpPort` | The service port Harbor listens on when serving with HTTP |`80`| +| `expose.clusterIP.ports.httpsPort` | The service port Harbor listens on when serving with HTTPS |`443`| +| `expose.clusterIP.ports.notaryPort` | The service port Notary listens on. Only needed when `notary.enabled` is set to `true` |`4443`| +| `expose.nodePort.name` | The name of NodePort service |`harbor`| +| `expose.nodePort.ports.http.port` | The service port Harbor listens on when serving with HTTP |`80`| +| `expose.nodePort.ports.http.nodePort` | The node port Harbor listens on when serving with HTTP |`30002`| +| `expose.nodePort.ports.https.port` | The service port Harbor listens on when serving with HTTPS |`443`| +| `expose.nodePort.ports.https.nodePort` | The node port Harbor listens on when serving with HTTPS |`30003`| +| `expose.nodePort.ports.notary.port` | The service port Notary listens on. Only needed when `notary.enabled` is set to `true` |`4443`| +| `expose.nodePort.ports.notary.nodePort` | The node port Notary listens on. Only needed when `notary.enabled` is set to `true` |`30004`| +| **Persistence** | +| `persistence.enabled` | Enable the data persistence or not | `true` | +| `persistence.resourcePolicy` | Setting it to `keep` to avoid removing PVCs during a helm delete operation. Leaving it empty will delete PVCs after the chart deleted | `keep` | +| `persistence.persistentVolumeClaim.registry.existingClaim` | Use the existing PVC which must be created manually before bound | | +|`persistence.persistentVolumeClaim.registry.storageClass` | Specify the `storageClass` used to provision the volume. Or the default StorageClass will be used(the default). Set it to `-` to disable dynamic provisioning | | +|`persistence.persistentVolumeClaim.registry.subPath` | The sub path used in the volume | | +|`persistence.persistentVolumeClaim.registry.accessMode` | The access mode of the volume | `ReadWriteOnce` | +|`persistence.persistentVolumeClaim.registry.size` | The size of the volume | `5Gi` | +|`persistence.persistentVolumeClaim.chartmuseum.existingClaim` | Use the existing PVC which must be created manually before bound | | +|`persistence.persistentVolumeClaim.chartmuseum.storageClass` | Specify the `storageClass` used to provision the volume. Or the default StorageClass will be used(the default). Set it to `-` to disable dynamic provisioning | | +|`persistence.persistentVolumeClaim.chartmuseum.subPath` | The sub path used in the volume | | +|`persistence.persistentVolumeClaim.chartmuseum.accessMode` | The access mode of the volume | `ReadWriteOnce` | +|`persistence.persistentVolumeClaim.chartmuseum.size` | The size of the volume | `5Gi` | +|`persistence.persistentVolumeClaim.jobservice.existingClaim` | Use the existing PVC which must be created manually before bound | | +|`persistence.persistentVolumeClaim.jobservice.storageClass` | Specify the `storageClass` used to provision the volume. Or the default StorageClass will be used(the default). Set it to `-` to disable dynamic provisioning | | +|`persistence.persistentVolumeClaim.jobservice.subPath` | The sub path used in the volume | | +|`persistence.persistentVolumeClaim.jobservice.accessMode` | The access mode of the volume | `ReadWriteOnce` | +|`persistence.persistentVolumeClaim.jobservice.size` | The size of the volume | `1Gi` | +|`persistence.persistentVolumeClaim.database.existingClaim` | Use the existing PVC which must be created manually before bound. If external database is used, the setting will be ignored | | +|`persistence.persistentVolumeClaim.database.storageClass` | Specify the `storageClass` used to provision the volume. Or the default StorageClass will be used(the default). Set it to `-` to disable dynamic provisioning. If external database is used, the setting will be ignored | | +|`persistence.persistentVolumeClaim.database.subPath` | The sub path used in the volume. If external database is used, the setting will be ignored | | +|`persistence.persistentVolumeClaim.database.accessMode` | The access mode of the volume. If external database is used, the setting will be ignored | `ReadWriteOnce` | +|`persistence.persistentVolumeClaim.database.size` | The size of the volume. If external database is used, the setting will be ignored | `1Gi` | +|`persistence.persistentVolumeClaim.redis.existingClaim` | Use the existing PVC which must be created manually before bound. If external Redis is used, the setting will be ignored | | +|`persistence.persistentVolumeClaim.redis.storageClass` | Specify the `storageClass` used to provision the volume. Or the default StorageClass will be used(the default). Set it to `-` to disable dynamic provisioning. If external Redis is used, the setting will be ignored | | +|`persistence.persistentVolumeClaim.redis.subPath` | The sub path used in the volume. If external Redis is used, the setting will be ignored | | +|`persistence.persistentVolumeClaim.redis.accessMode` | The access mode of the volume. If external Redis is used, the setting will be ignored | `ReadWriteOnce` | +|`persistence.persistentVolumeClaim.redis.size` | The size of the volume. If external Redis is used, the setting will be ignored | `1Gi` | +|`persistence.imageChartStorage.type` | The type of storage for images and charts: `filesystem`, `azure`, `gcs`, `s3`, `swift` or `oss`. The type must be `filesystem` if you want to use persistent volumes for registry and chartmuseum. Refer to the [guide](https://github.com/docker/distribution/blob/master/docs/configuration.md#storage) for more information about the detail | `filesystem` | +| | +| `externalURL` | The external URL for Harbor core service | `https://core.harbor.domain` | +| `imagePullPolicy` | The image pull policy | `IfNotPresent` | +| `logLevel` | The log level | `debug` | +| `harborAdminPassword` | The initial password of Harbor admin. Change it from portal after launching Harbor | `Harbor12345` | +| `secretkey` | The key used for encryption. Must be a string of 16 chars | `not-a-secure-key` | +| **Nginx**(if expose the service via `ingress`, the Nginx will not be used) | +| `nginx.image.repository` | Image repository | `goharbor/nginx-photon` | +| `nginx.image.tag` | Image tag | `dev` | +| `nginx.replicas` | The replica count | `1` | +| `nginx.resources` | [resources](https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/) to allocate for container | undefined | +| `nginx.nodeSelector` | Node labels for pod assignment | `{}` | +| `nginx.tolerations` | Tolerations for pod assignment | `[]` | +| `nginx.affinity` | Node/Pod affinities | `{}` | +| `nginx.podAnnotations` | Annotations to add to the nginx pod | `{}` | +| **Portal** | +| `portal.image.repository` | Repository for portal image | `goharbor/harbor-portal` | +| `portal.image.tag` | Tag for portal image | `dev` | +| `portal.replicas` | The replica count | `1` | +| `portal.resources` | [resources](https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/) to allocate for container | undefined | +| `portal.nodeSelector` | Node labels for pod assignment | `{}` | +| `portal.tolerations` | Tolerations for pod assignment | `[]` | +| `portal.affinity` | Node/Pod affinities | `{}` | +| `portal.podAnnotations` | Annotations to add to the portal pod | `{}` | +| **Core** | +| `core.image.repository` | Repository for Harbor core image | `goharbor/harbor-core` | +| `core.image.tag` | Tag for Harbor core image | `dev` | +| `core.replicas` | The replica count | `1` | +| `core.resources` | [resources](https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/) to allocate for container | undefined | +| `core.nodeSelector` | Node labels for pod assignment | `{}` | +| `core.tolerations` | Tolerations for pod assignment | `[]` | +| `core.affinity` | Node/Pod affinities | `{}` | +| `core.podAnnotations` | Annotations to add to the core pod | `{}` | +| **Adminserver** | +| `adminserver.image.repository` | Repository for adminserver image | `goharbor/harbor-adminserver` | +| `adminserver.image.tag` | Tag for adminserver image | `dev` | +| `adminserver.replicas` | The replica count | `1` | +| `adminserver.resources` | [resources](https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/) to allocate for container | undefined | +| `adminserver.nodeSelector` | Node labels for pod assignment | `{}` | +| `adminserver.tolerations` | Tolerations for pod assignment | `[]` | +| `adminserver.affinity` | Node/Pod affinities | `{}` | +| `adminserver.podAnnotations` | Annotations to add to the adminserver pod | `{}` | +| **Jobservice** | +| `jobservice.image.repository` | Repository for jobservice image | `goharbor/harbor-jobservice` | +| `jobservice.image.tag` | Tag for jobservice image | `dev` | +| `jobservice.replicas` | The replica count | `1` | +| `jobservice.maxJobWorkers` | The max job workers | `10` | +| `jobservice.jobLogger` | The logger for jobs: `file`, `database` or `stdout` | `file` | +| `jobservice.resources` | [resources](https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/) to allocate for container | undefined | +| `jobservice.nodeSelector` | Node labels for pod assignment | `{}` | +| `jobservice.tolerations` | Tolerations for pod assignment | `[]` | +| `jobservice.affinity` | Node/Pod affinities | `{}` | +| `jobservice.podAnnotations` | Annotations to add to the jobservice pod | `{}` | +| **Registry** | +| `registry.registry.image.repository` | Repository for registry image | `goharbor/registry-photon` | +| `registry.registry.image.tag` | Tag for registry image | `dev` | +| `registry.controller.image.repository` | Repository for registry controller image | `goharbor/harbor-registryctl` | +| `registry.controller.image.tag` | Tag for registry controller image | `dev` | +| `registry.replicas` | The replica count | `1` | +| `registry.resources` | [resources](https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/) to allocate for container | undefined | +| `registry.nodeSelector` | Node labels for pod assignment | `{}` | +| `registry.tolerations` | Tolerations for pod assignment | `[]` | +| `registry.affinity` | Node/Pod affinities | `{}` | +| `registry.podAnnotations` | Annotations to add to the registry pod | `{}` | +| **Chartmuseum** | +| `chartmuseum.enabled` | Enable chartmusuem to store chart | `true` | +| `chartmuseum.image.repository` | Repository for chartmuseum image | `goharbor/chartmuseum-photon` | +| `chartmuseum.image.tag` | Tag for chartmuseum image | `dev` | +| `chartmuseum.replicas` | The replica count | `1` | +| `chartmuseum.resources` | [resources](https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/) to allocate for container | undefined | +| `chartmuseum.nodeSelector` | Node labels for pod assignment | `{}` | +| `chartmuseum.tolerations` | Tolerations for pod assignment | `[]` | +| `chartmuseum.affinity` | Node/Pod affinities | `{}` | +| `chartmuseum.podAnnotations` | Annotations to add to the chart museum pod | `{}` | +| **Clair** | +| `clair.enabled` | Enable Clair | `true` | +| `clair.image.repository` | Repository for clair image | `goharbor/clair-photon` | +| `clair.image.tag` | Tag for clair image | `dev` +| `clair.replicas` | The replica count | `1` | +| `clair.httpProxy` | The HTTP proxy used to update vulnerabilities database from internet || +| `clair.httpsProxy` | The HTTPS proxy used to update vulnerabilities database from internet || +| `clair.updatersInterval` | The interval of clair updaters, the unit is hour, set to 0 to disable the updaters | `12` | +| `clair.resources` | [resources](https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/) to allocate for container | undefined +| `clair.nodeSelector` | Node labels for pod assignment | `{}` | +| `clair.tolerations` | Tolerations for pod assignment | `[]` | +| `clair.affinity` | Node/Pod affinities | `{}` | +| `clair.podAnnotations` | Annotations to add to the clair pod | `{}` | +| **Notary** | +| `notary.enabled` | Enable Notary? | `true` | +| `notary.server.image.repository` | Repository for notary server image | `goharbor/notary-server-photon` | +| `notary.server.image.tag` | Tag for notary server image | `dev` +| `notary.server.replicas` | The replica count | `1` | +| `notary.signer.image.repository` | Repository for notary signer image | `goharbor/notary-signer-photon` | +| `notary.signer.image.tag` | Tag for notary signer image | `dev` +| `notary.signer.replicas` | The replica count | `1` | +| `notary.nodeSelector` | Node labels for pod assignment | `{}` | +| `notary.tolerations` | Tolerations for pod assignment | `[]` | +| `notary.affinity` | Node/Pod affinities | `{}` | +| `notary.podAnnotations` | Annotations to add to the notary pod | `{}` | +| **Database** | +| `database.type` | If external database is used, set it to `external` | `internal` | +| `database.internal.image.repository` | Repository for database image | `goharbor/harbor-db` | +| `database.internal.image.tag` | Tag for database image | `dev` | +| `database.internal.password` | The password for database | `changeit` | +| `database.internal.resources` | [resources](https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/) to allocate for container | undefined | +| `database.internal.nodeSelector` | Node labels for pod assignment | `{}` | +| `database.internal.tolerations` | Tolerations for pod assignment | `[]` | +| `database.internal.affinity` | Node/Pod affinities | `{}` | +| `database.external.host` | The hostname of external database | `192.168.0.1` | +| `database.external.port` | The port of external database | `5432` | +| `database.external.username` | The username of external database | `user` | +| `database.external.password` | The password of external database | `password` | +| `database.external.coreDatabase` | The database used by core service | `registry` | +| `database.external.clairDatabase` | The database used by clair | `clair` | +| `database.external.notaryServerDatabase` | The database used by Notary server | `notary_server` | +| `database.external.notarySignerDatabase` | The database used by Notary signer | `notary_signer` | +| `database.external.sslmode` | Connection method of external database (require|prefer|disable) | `disable`| +| `database.podAnnotations` | Annotations to add to the database pod | `{}` | +| **Redis** | +| `redis.type` | If external redis is used, set it to `external` | `internal` | +| `redis.internal.image.repository` | Repository for redis image | `goharbor/redis-photon` | +| `redis.internal.image.tag` | Tag for redis image | `dev` | +| `redis.internal.resources` | [resources](https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/) to allocate for container | undefined | +| `redis.internal.nodeSelector` | Node labels for pod assignment | `{}` | +| `redis.internal.tolerations` | Tolerations for pod assignment | `[]` | +| `redis.internal.affinity` | Node/Pod affinities | `{}` | +| `redis.external.host` | The hostname of external Redis | `192.168.0.2` | +| `redis.external.port` | The port of external Redis | `6379` | +| `redis.external.coreDatabaseIndex` | The database index for core | `0` | +| `redis.external.jobserviceDatabaseIndex` | The database index for jobservice | `1` | +| `redis.external.registryDatabaseIndex` | The database index for registry | `2` | +| `redis.external.chartmuseumDatabaseIndex` | The database index for chartmuseum | `3` | +| `redis.external.password` | The password of external Redis | | +| `redis.podAnnotations` | Annotations to add to the redis pod | `{}` | diff --git a/templates/_helpers.tpl b/templates/_helpers.tpl index 80cf78a9c2e50e41b0bdf51fcee76227f24a2961..ee5e5bae18caa5a009dfe453eef7d7a7d1af9704 100644 --- a/templates/_helpers.tpl +++ b/templates/_helpers.tpl @@ -36,6 +36,22 @@ release: {{ .Release.Name }} {{- end -}} {{- end -}} +{{- define "harbor.autoGenCertForIngress" -}} + {{- if and (eq (include "harbor.autoGenCert" .) "true") (eq .Values.expose.type "ingress") -}} + {{- printf "true" -}} + {{- else -}} + {{- printf "false" -}} + {{- end -}} +{{- end -}} + +{{- define "harbor.autoGenCertForNginx" -}} + {{- if and (eq (include "harbor.autoGenCert" .) "true") (ne .Values.expose.type "ingress") -}} + {{- printf "true" -}} + {{- else -}} + {{- printf "false" -}} + {{- end -}} +{{- end -}} + {{- define "harbor.database.host" -}} {{- if eq .Values.database.type "internal" -}} {{- template "harbor.database" . }} @@ -216,6 +232,10 @@ host:port,pool_size,password {{- printf "%s-redis" (include "harbor.fullname" .) -}} {{- end -}} +{{- define "harbor.adminserver" -}} + {{- printf "%s-adminserver" (include "harbor.fullname" .) -}} +{{- end -}} + {{- define "harbor.jobservice" -}} {{- printf "%s-jobservice" (include "harbor.fullname" .) -}} {{- end -}} @@ -248,32 +268,6 @@ host:port,pool_size,password {{- printf "%s-nginx" (include "harbor.fullname" .) -}} {{- end -}} -{{- define "harbor.ingress.core" -}} - {{- printf "%s-ingress-core" (include "harbor.fullname" .) -}} -{{- end -}} - -{{- define "harbor.ingress.notary" -}} - {{- printf "%s-ingress-notary" (include "harbor.fullname" .) -}} -{{- end -}} - -{{- define "harbor.certificate" -}} - {{- printf "%s-certificate" (include "harbor.fullname" .) -}} -{{- end -}} - -{{- define "harbor.certificate-secret" -}} - {{- $tls := .Values.expose.tls -}} - {{- if $tls.secretName }} - {{- printf "%s" $tls.secretName -}} - {{- else }} - {{- printf "%s" (include "harbor.certificate" .) -}} - {{- end }} -{{- end -}} - -{{- define "harbor.common-name" -}} - {{- $expose := .Values.expose }} - {{- if and (eq $expose.type "ingress") $expose.ingress.host }} - {{- printf "%s" $expose.ingress.host -}} - {{- else }} - {{- printf "%s" $expose.tls.commonName -}} - {{- end }} +{{- define "harbor.ingress" -}} + {{- printf "%s-ingress" (include "harbor.fullname" .) -}} {{- end -}} \ No newline at end of file diff --git a/templates/adminserver/adminserver-cm.yaml b/templates/adminserver/adminserver-cm.yaml new file mode 100644 index 0000000000000000000000000000000000000000..ae40999da3449edc6d9975742d4393c085f7028c --- /dev/null +++ b/templates/adminserver/adminserver-cm.yaml @@ -0,0 +1,50 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: "{{ template "harbor.adminserver" . }}" + labels: +{{ include "harbor.labels" . | indent 4 }} + app: adminserver +data: + DATABASE_TYPE: "postgresql" + POSTGRESQL_HOST: "{{ template "harbor.database.host" . }}" + POSTGRESQL_PORT: "{{ template "harbor.database.port" . }}" + POSTGRESQL_USERNAME: "{{ template "harbor.database.username" . }}" + POSTGRESQL_DATABASE: "{{ template "harbor.database.coreDatabase" . }}" + POSTGRESQL_SSLMODE: "{{ template "harbor.database.sslmode" . }}" + EXT_ENDPOINT: "{{ .Values.externalURL }}" + CORE_URL: "http://{{ template "harbor.core" . }}" + JOBSERVICE_URL: "http://{{ template "harbor.fullname" . }}-jobservice" + REGISTRY_URL: "http://{{ template "harbor.registry" . }}:5000" + TOKEN_SERVICE_URL: "http://{{ template "harbor.core" . }}/service/token" + WITH_NOTARY: "{{ .Values.notary.enabled }}" + NOTARY_URL: "http://{{ template "harbor.notary-server" . }}:4443" + LOG_LEVEL: "{{ .Values.logLevel }}" + IMAGE_STORE_PATH: "/" # This is a temporary hack. + CFG_EXPIRATION: "5" + ADMIRAL_URL: "NA" + RESET: "false" + WITH_CLAIR: "{{ .Values.clair.enabled }}" + CLAIR_DB_HOST: "{{ template "harbor.database.host" . }}" + CLAIR_DB_PORT: "{{ template "harbor.database.port" . }}" + CLAIR_DB_USERNAME: "{{ template "harbor.database.username" . }}" + CLAIR_DB: "{{ template "harbor.database.clairDatabase" . }}" + CLAIR_URL: "http://{{ template "harbor.fullname" . }}-clair:6060" + CLAIR_DB_SSLMODE: "{{ template "harbor.database.sslmode" . }}" + UAA_ENDPOINT: "" + UAA_CLIENTID: "" + UAA_CLIENTSECRET: "" + UAA_VERIFY_CERT: "True" + REGISTRY_STORAGE_PROVIDER_NAME: "{{ .Values.persistence.imageChartStorage.type }}" + WITH_CHARTMUSEUM: "{{ .Values.chartmuseum.enabled }}" + CHART_REPOSITORY_URL: "http://{{ template "harbor.chartmuseum" . }}" + # The following properties have no default value in Harbor core if not + # set via env. They should be removed after the refactoring: + # AUTH_MODE, SELF_REGISTRATION, PROJECT_CREATION_RESTRICTION + AUTH_MODE: "db_auth" + SELF_REGISTRATION: "on" + PROJECT_CREATION_RESTRICTION: "everyone" + TOKEN_EXPIRATION: "30" + EMAIL_HOST: "smtp.mydomain.com" + EMAIL_FROM: "admin " + EMAIL_PORT: "25" \ No newline at end of file diff --git a/templates/adminserver/adminserver-dpl.yaml b/templates/adminserver/adminserver-dpl.yaml new file mode 100644 index 0000000000000000000000000000000000000000..f7429dee27cba1408d5855944eb766b4d9690a32 --- /dev/null +++ b/templates/adminserver/adminserver-dpl.yaml @@ -0,0 +1,97 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: "{{ template "harbor.adminserver" . }}" + labels: +{{ include "harbor.labels" . | indent 4 }} + app: adminserver +spec: + replicas: {{ .Values.adminserver.replicas }} + selector: + matchLabels: +{{ include "harbor.matchLabels" . | indent 6 }} + app: adminserver + template: + metadata: + labels: +{{ include "harbor.labels" . | indent 8 }} + app: adminserver + annotations: + checksum/configmap: {{ include (print $.Template.BasePath "/adminserver/adminserver-cm.yaml") . | sha256sum }} + checksum/secret: {{ include (print $.Template.BasePath "/adminserver/adminserver-secrets.yaml") . | sha256sum }} + checksum/secret-core: {{ include (print $.Template.BasePath "/core/core-secret.yaml") . | sha256sum }} + checksum/secret-jobservice: {{ include (print $.Template.BasePath "/jobservice/jobservice-secrets.yaml") . | sha256sum }} +{{- if .Values.adminserver.podAnnotations }} +{{ toYaml .Values.adminserver.podAnnotations | indent 8 }} +{{- end }} + spec: + containers: + - name: adminserver + image: "{{ .Values.adminserver.image.repository }}:{{ .Values.adminserver.image.tag }}" + imagePullPolicy: "{{ .Values.imagePullPolicy }}" + livenessProbe: + httpGet: + path: /api/ping + port: 8080 + initialDelaySeconds: 1 + periodSeconds: 10 + readinessProbe: + httpGet: + path: /api/ping + port: 8080 + initialDelaySeconds: 1 + periodSeconds: 10 + resources: +{{ toYaml .Values.adminserver.resources | indent 10 }} + envFrom: + - configMapRef: + name: "{{ template "harbor.adminserver" . }}" + - secretRef: + name: "{{ template "harbor.adminserver" . }}" + env: + - name: PORT + value: "8080" + - name: JSON_CFG_STORE_PATH + value: /etc/adminserver/config/config.json + - name: KEY_PATH + value: /etc/adminserver/key + - name: CORE_SECRET + valueFrom: + secretKeyRef: + name: "{{ template "harbor.core" . }}" + key: secret + - name: JOBSERVICE_SECRET + valueFrom: + secretKeyRef: + name: "{{ template "harbor.jobservice" . }}" + key: secret + ports: + - containerPort: 8080 + volumeMounts: + - name: adminserver-key + mountPath: /etc/adminserver/key + subPath: key + - name: etc-localtime + mountPath: /etc/localtime + volumes: + - name: etc-localtime + hostPath: + path: /etc/localtime + - name: adminserver-key + secret: + secretName: "{{ template "harbor.adminserver" . }}" + items: + - key: secretKey + path: key + {{- with .Values.adminserver.nodeSelector }} + nodeSelector: +{{ toYaml . | indent 8 }} + {{- end }} + {{- with .Values.adminserver.affinity }} + affinity: +{{ toYaml . | indent 8 }} + {{- end }} + {{- with .Values.adminserver.tolerations }} + tolerations: +{{ toYaml . | indent 8 }} + {{- end }} \ No newline at end of file diff --git a/templates/adminserver/adminserver-secrets.yaml b/templates/adminserver/adminserver-secrets.yaml new file mode 100644 index 0000000000000000000000000000000000000000..62bf3d260d6390f0999e6afea0cf38a0bf0107f5 --- /dev/null +++ b/templates/adminserver/adminserver-secrets.yaml @@ -0,0 +1,15 @@ +apiVersion: v1 +kind: Secret +metadata: + name: "{{ template "harbor.adminserver" . }}" + labels: +{{ include "harbor.labels" . | indent 4 }} + app: adminserver +type: Opaque +data: + secretKey: {{ .Values.secretKey | b64enc | quote }} + HARBOR_ADMIN_PASSWORD: {{ .Values.harborAdminPassword | b64enc | quote }} + POSTGRESQL_PASSWORD: {{ template "harbor.database.encryptedPassword" . }} +{{ if .Values.clair.enabled }} + CLAIR_DB_PASSWORD: {{ template "harbor.database.encryptedPassword" . }} +{{ end }} diff --git a/templates/adminserver/adminserver-svc.yaml b/templates/adminserver/adminserver-svc.yaml new file mode 100644 index 0000000000000000000000000000000000000000..f2f7249de9af121d35038df17bfd657bfe3fcaef --- /dev/null +++ b/templates/adminserver/adminserver-svc.yaml @@ -0,0 +1,11 @@ +apiVersion: v1 +kind: Service +metadata: + name: "{{ template "harbor.adminserver" . }}" +spec: + ports: + - port: 80 + targetPort: 8080 + selector: +{{ include "harbor.matchLabels" . | indent 4 }} + app: adminserver \ No newline at end of file diff --git a/templates/chartmuseum/chartmuseum-cm.yaml b/templates/chartmuseum/chartmuseum-cm.yaml index 272c515daa523a49f5287ff8e906f862a9540895..52482efd12975dec9dce93871af97bac87b7e174 100644 --- a/templates/chartmuseum/chartmuseum-cm.yaml +++ b/templates/chartmuseum/chartmuseum-cm.yaml @@ -22,7 +22,7 @@ data: DISABLE_API: "false" DISABLE_STATEFILES: "false" ALLOW_OVERWRITE: "true" - #CHART_URL: {{ .Values.externalURL }}/chartrepo + CHART_URL: AUTH_ANONYMOUS_GET: "false" TLS_CERT: TLS_KEY: @@ -45,7 +45,6 @@ data: {{- else if eq $storageType "gcs" }} STORAGE: "google" STORAGE_GOOGLE_BUCKET: {{ $storage.gcs.bucket }} - GOOGLE_APPLICATION_CREDENTIALS: /etc/chartmuseum/gcs-key.json {{- if $storage.gcs.rootdirectory }} STORAGE_GOOGLE_PREFIX: {{ $storage.gcs.rootdirectory }} {{- end }} diff --git a/templates/chartmuseum/chartmuseum-dpl.yaml b/templates/chartmuseum/chartmuseum-dpl.yaml index 801e72287290989a550bc4d3d774fb006203c560..a7cfb3be5adbb62bb9e52361ee11a6ae9939c21c 100644 --- a/templates/chartmuseum/chartmuseum-dpl.yaml +++ b/templates/chartmuseum/chartmuseum-dpl.yaml @@ -20,7 +20,6 @@ spec: annotations: checksum/configmap: {{ include (print $.Template.BasePath "/chartmuseum/chartmuseum-cm.yaml") . | sha256sum }} checksum/secret: {{ include (print $.Template.BasePath "/chartmuseum/chartmuseum-secret.yaml") . | sha256sum }} - checksum/secret-core: {{ include (print $.Template.BasePath "/core/core-secret.yaml") . | sha256sum }} {{- if .Values.chartmuseum.podAnnotations }} {{ toYaml .Values.chartmuseum.podAnnotations | indent 8 }} {{- end }} @@ -41,10 +40,8 @@ spec: port: 9999 initialDelaySeconds: 1 periodSeconds: 10 -{{- if .Values.chartmuseum.resources }} resources: {{ toYaml .Values.chartmuseum.resources | indent 10 }} -{{- end }} envFrom: - configMapRef: name: "{{ template "harbor.chartmuseum" . }}" @@ -62,7 +59,7 @@ spec: - name: chartmuseum-data mountPath: /chart_storage - name: etc-localtime - mountPath: /etc/localtime + mountPath: /etc/localtime volumes: - name: etc-localtime hostPath: diff --git a/templates/clair/clair-dpl.yaml b/templates/clair/clair-dpl.yaml index 7d5f134bf0575fcf7dcdbc5180de2aec6dab2b9b..c12492e88b18c7032c57e402028e6cae299cf98e 100644 --- a/templates/clair/clair-dpl.yaml +++ b/templates/clair/clair-dpl.yaml @@ -51,10 +51,8 @@ spec: {{- end }} - name: NO_PROXY value: "{{ template "harbor.registry" . }},{{ template "harbor.core" . }}" -{{- if .Values.clair.resources }} resources: {{ toYaml .Values.clair.resources | indent 10 }} -{{- end }} ports: - containerPort: 6060 volumeMounts: diff --git a/templates/clair/clair-svc.yaml b/templates/clair/clair-svc.yaml index ced23e032e6ae645f6ebeabafc78e5263fde6e91..9a2a805a824eec69ad74ae42f076773102b8ee8e 100644 --- a/templates/clair/clair-svc.yaml +++ b/templates/clair/clair-svc.yaml @@ -7,10 +7,7 @@ metadata: {{ include "harbor.labels" . | indent 4 }} spec: ports: - - name: clair - port: 6060 - - name: health - port: 6061 + - port: 6060 selector: {{ include "harbor.matchLabels" . | indent 4 }} app: clair diff --git a/templates/core/core-cm.yaml b/templates/core/core-cm.yaml index e7508bbfe05fbb460b3492a5880d76a2f1f723a2..f584502a2dd907ceab2e9730613d8b79c64715c4 100644 --- a/templates/core/core-cm.yaml +++ b/templates/core/core-cm.yaml @@ -7,41 +7,8 @@ metadata: data: app.conf: |+ appname = Harbor - runmode = dev + runmode = prod enablegzip = true - [dev] + [prod] httpport = 8080 - DATABASE_TYPE: "postgresql" - POSTGRESQL_HOST: "{{ template "harbor.database.host" . }}" - POSTGRESQL_PORT: "{{ template "harbor.database.port" . }}" - POSTGRESQL_USERNAME: "{{ template "harbor.database.username" . }}" - POSTGRESQL_DATABASE: "{{ template "harbor.database.coreDatabase" . }}" - POSTGRESQL_SSLMODE: "{{ template "harbor.database.sslmode" . }}" - EXT_ENDPOINT: "{{ .Values.externalURL }}" - CORE_URL: "http://{{ template "harbor.core" . }}" - JOBSERVICE_URL: "http://{{ template "harbor.fullname" . }}-jobservice" - REGISTRY_URL: "http://{{ template "harbor.registry" . }}:5000" - TOKEN_SERVICE_URL: "http://{{ template "harbor.core" . }}/service/token" - WITH_NOTARY: "{{ .Values.notary.enabled }}" - NOTARY_URL: "http://{{ template "harbor.notary-server" . }}:4443" - CFG_EXPIRATION: "5" - WITH_CLAIR: "{{ .Values.clair.enabled }}" - CLAIR_DB_HOST: "{{ template "harbor.database.host" . }}" - CLAIR_DB_PORT: "{{ template "harbor.database.port" . }}" - CLAIR_DB_USERNAME: "{{ template "harbor.database.username" . }}" - CLAIR_DB: "{{ template "harbor.database.clairDatabase" . }}" - CLAIR_DB_SSLMODE: "{{ template "harbor.database.sslmode" . }}" - CLAIR_URL: "http://{{ template "harbor.fullname" . }}-clair:6060" - REGISTRY_STORAGE_PROVIDER_NAME: "{{ .Values.persistence.imageChartStorage.type }}" - WITH_CHARTMUSEUM: "{{ .Values.chartmuseum.enabled }}" - CHART_REPOSITORY_URL: "http://{{ template "harbor.chartmuseum" . }}" - LOG_LEVEL: "{{ .Values.logLevel }}" - CONFIG_PATH: "/etc/core/app.conf" - SYNC_REGISTRY: "false" - CHART_CACHE_DRIVER: "redis" - _REDIS_URL: "{{ template "harbor.redisForCore" . }}" - _REDIS_URL_REG: "{{ template "harbor.redisForGC" . }}" - PORTAL_URL: "http://{{ template "harbor.portal" . }}" - REGISTRYCTL_URL: "http://{{ template "harbor.registry" . }}:8080" - CLAIR_HEALTH_CHECK_SERVER_URL: "http://{{ template "harbor.clair" . }}:6061" \ No newline at end of file diff --git a/templates/core/core-dpl.yaml b/templates/core/core-dpl.yaml index 18e3f6986fed285a9adbbdafca9fddabfc5914db..81e86f5f9bb65435d4c189258d773fd3126e7859 100644 --- a/templates/core/core-dpl.yaml +++ b/templates/core/core-dpl.yaml @@ -19,7 +19,6 @@ spec: annotations: checksum/configmap: {{ include (print $.Template.BasePath "/core/core-cm.yaml") . | sha256sum }} checksum/secret: {{ include (print $.Template.BasePath "/core/core-secret.yaml") . | sha256sum }} - checksum/secret-jobservice: {{ include (print $.Template.BasePath "/jobservice/jobservice-secrets.yaml") . | sha256sum }} {{- if .Values.core.podAnnotations }} {{ toYaml .Values.core.podAnnotations | indent 8 }} {{- end }} @@ -40,11 +39,6 @@ spec: port: 8080 initialDelaySeconds: 20 periodSeconds: 10 - envFrom: - - configMapRef: - name: "{{ template "harbor.core" . }}" - - secretRef: - name: "{{ template "harbor.core" . }}" env: - name: CORE_SECRET valueFrom: @@ -56,6 +50,20 @@ spec: secretKeyRef: name: "{{ template "harbor.jobservice" . }}" key: secret + - name: _REDIS_URL + value: {{ template "harbor.redisForCore" . }} + - name: _REDIS_URL_REG + value: {{ template "harbor.redisForGC" . }} + - name: LOG_LEVEL + value: {{ .Values.logLevel }} + - name: CONFIG_PATH + value: /etc/core/app.conf + - name: SYNC_REGISTRY + value: "false" + - name: ADMINSERVER_URL + value: "http://{{ template "harbor.adminserver" . }}" + - name: CHART_CACHE_DRIVER + value: "redis" ports: - containerPort: 8080 volumeMounts: @@ -69,18 +77,14 @@ spec: mountPath: /etc/core/private_key.pem subPath: tokenServicePrivateKey - name: etc-localtime - mountPath: /etc/localtime - {{- if .Values.expose.tls.enabled }} + mountPath: /etc/localtime + {{- if eq (include "harbor.autoGenCert" .) "true" }} - name: ca-download mountPath: /etc/core/ca/ca.crt subPath: ca.crt {{- end }} - name: psc mountPath: /etc/core/token -{{- if .Values.core.resources }} - resources: -{{ toYaml .Values.core.resources | indent 10 }} -{{- end }} volumes: - name: etc-localtime hostPath: @@ -96,15 +100,15 @@ spec: path: key - name: token-service-private-key secret: - {{- if .Values.core.secretName }} - secretName: {{ .Values.core.secretName }} - {{- else }} secretName: {{ template "harbor.core" . }} - {{- end }} - {{- if .Values.expose.tls.enabled }} + {{- if eq (include "harbor.autoGenCert" .) "true" }} - name: ca-download secret: - secretName: "{{ template "harbor.certificate-secret" . }}" + {{- if eq (include "harbor.autoGenCertForIngress" .) "true" }} + secretName: "{{ template "harbor.ingress" . }}" + {{- else }} + secretName: {{ template "harbor.nginx" . }} + {{- end }} items: - key: ca.crt path: ca.crt @@ -122,4 +126,4 @@ spec: {{- with .Values.core.tolerations }} tolerations: {{ toYaml . | indent 8 }} - {{- end }} \ No newline at end of file + {{- end }} diff --git a/templates/core/core-secret.yaml b/templates/core/core-secret.yaml index 860f43351da5964291bcddc178319611d8c660d3..d84c8f54733cd02a6f0383c80e094ee3d7ec44a2 100644 --- a/templates/core/core-secret.yaml +++ b/templates/core/core-secret.yaml @@ -8,13 +8,7 @@ metadata: type: Opaque data: secretKey: {{ .Values.secretKey | b64enc | quote }} - secret: {{ .Values.core.secret | default (randAlphaNum 16) | b64enc | quote }} -{{- if not .Values.core.secretName }} + secret: {{ randAlphaNum 16 | b64enc | quote }} tokenServiceRootCertBundle: {{ $cert.Cert | b64enc | quote }} tokenServicePrivateKey: {{ $cert.Key | b64enc | quote }} -{{- end }} - HARBOR_ADMIN_PASSWORD: {{ .Values.harborAdminPassword | b64enc | quote }} - POSTGRESQL_PASSWORD: {{ template "harbor.database.encryptedPassword" . }} -{{ if .Values.clair.enabled }} - CLAIR_DB_PASSWORD: {{ template "harbor.database.encryptedPassword" . }} -{{ end }} + \ No newline at end of file diff --git a/templates/core/core-svc.yaml b/templates/core/core-svc.yaml index c2aee808cb045800410f929bdd52ade0cd4edc4b..3bc43e25f6e92c0f85b54e3c45ed5a8bd1841a73 100644 --- a/templates/core/core-svc.yaml +++ b/templates/core/core-svc.yaml @@ -5,9 +5,6 @@ metadata: labels: {{ include "harbor.labels" . | indent 4 }} spec: -{{- if (eq .Values.expose.ingress.controller "gce") }} - type: NodePort -{{- end }} ports: - port: 80 targetPort: 8080 diff --git a/templates/database/database-ss.yaml b/templates/database/database-ss.yaml index f0020634c0a3e2e4d30f86fac5f6fde7fab50e40..12db5d6363010d1f87e0731ed79b9063debf645d 100644 --- a/templates/database/database-ss.yaml +++ b/templates/database/database-ss.yaml @@ -1,5 +1,4 @@ {{- if eq .Values.database.type "internal" -}} -{{- $database := .Values.persistence.persistentVolumeClaim.database -}} apiVersion: apps/v1 kind: StatefulSet metadata: @@ -28,7 +27,6 @@ spec: initContainers: - name: "remove-lost-found" image: {{ .Values.database.internal.image.repository }}:{{ .Values.database.internal.image.tag }} - imagePullPolicy: {{ .Values.imagePullPolicy }} command: ["rm", "-Rf", "/var/lib/postgresql/data/lost+found"] volumeMounts: - name: database-data @@ -49,10 +47,8 @@ spec: - /docker-healthcheck.sh initialDelaySeconds: 1 periodSeconds: 10 -{{- if .Values.database.internal.resources }} resources: {{ toYaml .Values.database.internal.resources | indent 10 }} -{{- end }} envFrom: - secretRef: name: "{{ template "harbor.database" . }}" @@ -60,7 +56,7 @@ spec: - name: database-data mountPath: /var/lib/postgresql/data - name: etc-localtime - mountPath: /etc/localtime + mountPath: /etc/localtime volumes: - name: etc-localtime hostPath: diff --git a/templates/ingress/ingress.yaml b/templates/ingress/ingress.yaml index d0e891d471eedb996b0726bcb04fc87d6c308cd8..8c358b2675f8d4fad77830b360d30961db0d2bf9 100644 --- a/templates/ingress/ingress.yaml +++ b/templates/ingress/ingress.yaml @@ -1,56 +1,39 @@ {{- if eq .Values.expose.type "ingress" }} {{- $ingress := .Values.expose.ingress -}} +{{- $tls := .Values.expose.tls -}} apiVersion: extensions/v1beta1 kind: Ingress metadata: - name: "{{ template "harbor.ingress.core" . }}" + name: "{{ template "harbor.ingress" . }}" labels: {{ include "harbor.labels" . | indent 4 }} annotations: {{ toYaml $ingress.annotations | indent 4 }} spec: - {{- if .Values.expose.tls.enabled }} + {{- if $tls.enabled }} tls: - - secretName: {{ template "harbor.certificate-secret" . }} - {{- if $ingress.host }} - hosts: - - {{ $ingress.host }} + - hosts: + - {{ $ingress.hosts.core }} + {{- if $tls.secretName }} + secretName: {{ $tls.secretName }} + {{- else }} + secretName: "{{ template "harbor.ingress" . }}" {{- end }} - {{- end }} -{{- if eq .Values.expose.ingress.controller "gce" }} - rules: - - http: - paths: - - path: /* - backend: - serviceName: {{ template "harbor.portal" . }} - servicePort: 80 - - path: /api/* - backend: - serviceName: {{ template "harbor.core" . }} - servicePort: 80 - - path: /service/* - backend: - serviceName: {{ template "harbor.core" . }} - servicePort: 80 - - path: /v2/* - backend: - serviceName: {{ template "harbor.core" . }} - servicePort: 80 - - path: /chartrepo/* - backend: - serviceName: {{ template "harbor.core" . }} - servicePort: 80 - - path: /c/* - backend: - serviceName: {{ template "harbor.core" . }} - servicePort: 80 - {{- if $ingress.host }} - host: {{ $ingress.host }} + {{- if .Values.notary.enabled }} + - hosts: + - {{ $ingress.hosts.notary }} + {{- if $tls.notarySecretName }} + secretName: {{ $tls.notarySecretName }} + {{- else if $tls.secretName }} + secretName: {{ $tls.secretName }} + {{- else }} + secretName: "{{ template "harbor.ingress" . }}" {{- end }} -{{- else }} + {{- end }} + {{- end }} rules: - - http: + - host: {{ $ingress.hosts.core }} + http: paths: - path: / backend: @@ -76,8 +59,13 @@ spec: backend: serviceName: {{ template "harbor.core" . }} servicePort: 80 - {{- if $ingress.host }} - host: {{ $ingress.host }} - {{- end }} -{{- end }} + {{- if .Values.notary.enabled }} + - host: {{ $ingress.hosts.notary }} + http: + paths: + - path: / + backend: + serviceName: {{ template "harbor.notary-server" . }} + servicePort: 4443 + {{- end }} {{- end }} \ No newline at end of file diff --git a/templates/ingress/secret.yaml b/templates/ingress/secret.yaml new file mode 100644 index 0000000000000000000000000000000000000000..0d89af99ac913ec6ec7a31b51cbf10200635456c --- /dev/null +++ b/templates/ingress/secret.yaml @@ -0,0 +1,15 @@ +{{- if eq (include "harbor.autoGenCertForIngress" .) "true" }} +{{- $ca := genCA "harbor-ca" 365 }} +{{- $cert := genSignedCert .Values.expose.ingress.hosts.core nil (list .Values.expose.ingress.hosts.core .Values.expose.ingress.hosts.notary) 365 $ca }} +apiVersion: v1 +kind: Secret +metadata: + name: "{{ template "harbor.ingress" . }}" + labels: +{{ include "harbor.labels" . | indent 4 }} +type: kubernetes.io/tls +data: + tls.crt: {{ $cert.Cert | b64enc | quote }} + tls.key: {{ $cert.Key | b64enc | quote }} + ca.crt: {{ $ca.Cert | b64enc | quote }} +{{- end }} \ No newline at end of file diff --git a/templates/jobservice/jobservice-cm.yaml b/templates/jobservice/jobservice-cm.yaml index 2faa9ccf3f277d716414f2e0ceeae25a26372184..ee1ad5227c36f401c8987e832e1b59a7778c9112 100644 --- a/templates/jobservice/jobservice-cm.yaml +++ b/templates/jobservice/jobservice-cm.yaml @@ -36,4 +36,5 @@ data: #Loggers for the job service loggers: - name: "STD_OUTPUT" - level: {{ .Values.logLevel | upper }} \ No newline at end of file + level: {{ .Values.logLevel | upper }} + admin_server: "http://{{ template "harbor.adminserver" . }}" diff --git a/templates/jobservice/jobservice-dpl.yaml b/templates/jobservice/jobservice-dpl.yaml index 8721d166656ccb137dc52f4aeed41554ba68e44e..9cc75f9cffd512e058fa005eb0c92a83dd9ca31e 100644 --- a/templates/jobservice/jobservice-dpl.yaml +++ b/templates/jobservice/jobservice-dpl.yaml @@ -19,7 +19,6 @@ spec: annotations: checksum/configmap: {{ include (print $.Template.BasePath "/jobservice/jobservice-cm.yaml") . | sha256sum }} checksum/secret: {{ include (print $.Template.BasePath "/jobservice/jobservice-secrets.yaml") . | sha256sum }} - checksum/secret-core: {{ include (print $.Template.BasePath "/core/core-secret.yaml") . | sha256sum }} {{- if .Values.jobservice.podAnnotations }} {{ toYaml .Values.jobservice.podAnnotations | indent 8 }} {{- end }} @@ -40,10 +39,8 @@ spec: port: 8080 initialDelaySeconds: 20 periodSeconds: 10 -{{- if .Values.jobservice.resources }} resources: {{ toYaml .Values.jobservice.resources | indent 10 }} -{{- end }} env: - name: CORE_SECRET valueFrom: @@ -55,8 +52,8 @@ spec: secretKeyRef: name: "{{ template "harbor.jobservice" . }}" key: secret - - name: CORE_URL - value: "http://{{ template "harbor.core" . }}" + - name: ADMINSERVER_URL + value: "http://{{ template "harbor.adminserver" . }}" - name: REGISTRY_CONTROLLER_URL value: "http://{{ template "harbor.registry" . }}:8080" - name: LOG_LEVEL @@ -70,7 +67,7 @@ spec: - name: job-logs mountPath: /var/log/jobs - name: etc-localtime - mountPath: /etc/localtime + mountPath: /etc/localtime volumes: - name: etc-localtime hostPath: @@ -79,7 +76,12 @@ spec: configMap: name: "{{ template "harbor.jobservice" . }}" - name: job-logs + {{- if and .Values.persistence.enabled (eq .Values.jobservice.jobLogger "file") }} + persistentVolumeClaim: + claimName: {{ .Values.persistence.persistentVolumeClaim.jobservice.existingClaim | default (include "harbor.jobservice" .) }} + {{- else }} emptyDir: {} + {{- end }} {{- with .Values.jobservice.nodeSelector }} nodeSelector: {{ toYaml . | indent 8 }} diff --git a/templates/jobservice/jobservice-secrets.yaml b/templates/jobservice/jobservice-secrets.yaml index e08f7ce58bbb3b7bfef3f9b61df9d867503f0d63..cbaad34d3a8cb568bf340c3a3770c5e4605b2eef 100644 --- a/templates/jobservice/jobservice-secrets.yaml +++ b/templates/jobservice/jobservice-secrets.yaml @@ -6,4 +6,4 @@ metadata: {{ include "harbor.labels" . | indent 4 }} type: Opaque data: - secret: {{ .Values.jobservice.secret | default (randAlphaNum 16) | b64enc | quote }} + secret: {{ randAlphaNum 16 | b64enc | quote }} \ No newline at end of file diff --git a/templates/nginx/configmap-http.yaml b/templates/nginx/configmap-http.yaml index 2cd02fa67a3747c0257e574ec9a983c2a0872c3b..f2eb3b59b5ed6d66c90bf7c4fd7591a32037eeb1 100644 --- a/templates/nginx/configmap-http.yaml +++ b/templates/nginx/configmap-http.yaml @@ -67,19 +67,6 @@ data: proxy_buffering off; proxy_request_buffering off; } - - location /chartrepo/ { - proxy_pass http://core/chartrepo/; - proxy_set_header Host $host; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - - # When setting up Harbor behind other proxy, such as an Nginx instance, remove the below line if the proxy already has similar settings. - proxy_set_header X-Forwarded-Proto $scheme; - - proxy_buffering off; - proxy_request_buffering off; - } location /c/ { proxy_pass http://core/c/; diff --git a/templates/nginx/configmap-https.yaml b/templates/nginx/configmap-https.yaml index e962eb24005ba15b90c623f2ea03c18d2c9ab5cc..bbdade0bf37aa188f38469059d4089ad2989d25a 100644 --- a/templates/nginx/configmap-https.yaml +++ b/templates/nginx/configmap-https.yaml @@ -42,6 +42,41 @@ data: access_log /dev/stdout timed_combined; + {{- if .Values.notary.enabled }} + server { + listen 4443 ssl; + server_tokens off; + # ssl + ssl_certificate /etc/nginx/cert/tls.crt; + ssl_certificate_key /etc/nginx/cert/tls.key; + + # recommendations from https://raymii.org/s/tutorials/strong_ssl_security_on_nginx.html + ssl_protocols tlsv1.1 tlsv1.2; + ssl_ciphers '!aNULL:kECDH+AESGCM:ECDH+AESGCM:RSA+AESGCM:kECDH+AES:ECDH+AES:RSA+AES:'; + ssl_prefer_server_ciphers on; + ssl_session_cache shared:ssl:10m; + + # disable any limits to avoid http 413 for large image uploads + client_max_body_size 0; + + # required to avoid http 411: see issue #1486 (https://github.com/docker/docker/issues/1486) + chunked_transfer_encoding on; + + location /v2/ { + proxy_pass http://notary-server/v2/; + proxy_set_header Host $http_host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + + # When setting up Harbor behind other proxy, such as an Nginx instance, remove the below line if the proxy already has similar settings. + proxy_set_header X-Forwarded-Proto $scheme; + + proxy_buffering off; + proxy_request_buffering off; + } + } + {{- end }} + server { listen 443 ssl; # server_name harbordomain.com; @@ -90,19 +125,6 @@ data: proxy_buffering off; proxy_request_buffering off; } - - location /chartrepo/ { - proxy_pass http://core/chartrepo/; - proxy_set_header Host $host; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - - # When setting up Harbor behind other proxy, such as an Nginx instance, remove the below line if the proxy already has similar settings. - proxy_set_header X-Forwarded-Proto $scheme; - - proxy_buffering off; - proxy_request_buffering off; - } location /c/ { proxy_pass http://core/c/; @@ -149,22 +171,6 @@ data: location /service/notifications { return 404; } - {{- if .Values.notary.enabled }} - location /notary/ { - proxy_pass http://notary-server; - proxy_set_header Host $http_host; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - - # When setting up Harbor behind other proxy, such as an Nginx instance, remove the below line if the proxy already has similar settings. - proxy_set_header X-Forwarded-Proto $scheme; - - proxy_buffering off; - proxy_request_buffering off; - - rewrite /notary/(.*) /$1 break; - } - {{- end }} } server { listen 80; @@ -172,4 +178,5 @@ data: return 301 https://$host$request_uri; } } -{{- end }} \ No newline at end of file +{{- end }} + \ No newline at end of file diff --git a/templates/nginx/deployment.yaml b/templates/nginx/deployment.yaml index d1705e81ba4965c974883885c57041edf2a60682..f4fbfc303c35a004f40883f1783f49d24ac10c21 100644 --- a/templates/nginx/deployment.yaml +++ b/templates/nginx/deployment.yaml @@ -23,8 +23,8 @@ spec: {{- else }} checksum/configmap: {{ include (print $.Template.BasePath "/nginx/configmap-https.yaml") . | sha256sum }} {{- end }} - {{- if eq (include "harbor.autoGenCert" .) "true" }} - checksum/secret: {{ include (print $.Template.BasePath "/common/certificate-secret.yaml") . | sha256sum }} + {{- if eq (include "harbor.autoGenCertForNginx" .) "true" }} + checksum/secret: {{ include (print $.Template.BasePath "/nginx/secret.yaml") . | sha256sum }} {{- end }} {{- if .Values.nginx.podAnnotations }} {{ toYaml .Values.nginx.podAnnotations | indent 8 }} @@ -46,13 +46,12 @@ spec: port: 80 initialDelaySeconds: 1 periodSeconds: 10 -{{- if .Values.nginx.resources }} resources: {{ toYaml .Values.nginx.resources | indent 10 }} -{{- end }} ports: - containerPort: 80 - containerPort: 443 + - containerPort: 4443 volumeMounts: - name: config mountPath: /etc/nginx/nginx.conf @@ -68,7 +67,11 @@ spec: {{- if .Values.expose.tls.enabled }} - name: certificate secret: - secretName: {{ template "harbor.certificate-secret" . }} + {{- if .Values.expose.tls.secretName }} + secretName: {{ .Values.expose.tls.secretName }} + {{- else }} + secretName: {{ template "harbor.nginx" . }} + {{- end }} {{- end }} {{- with .Values.nginx.nodeSelector }} nodeSelector: diff --git a/templates/nginx/secret.yaml b/templates/nginx/secret.yaml new file mode 100644 index 0000000000000000000000000000000000000000..2fbf0111215187491b8226b96b72666f3ffb53c5 --- /dev/null +++ b/templates/nginx/secret.yaml @@ -0,0 +1,23 @@ +{{- if eq (include "harbor.autoGenCertForNginx" .) "true" }} +{{- $ca := genCA "harbor-ca" 365 }} +{{- $cn := (required "The \"expose.tls.commonName\" is required!" .Values.expose.tls.commonName) }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ template "harbor.nginx" . }} + labels: +{{ include "harbor.labels" . | indent 4 }} +type: Opaque +data: + {{- if regexMatch `^((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$` $cn }} + {{- $cert := genSignedCert $cn (list $cn) nil 365 $ca }} + tls.crt: {{ $cert.Cert | b64enc | quote }} + tls.key: {{ $cert.Key | b64enc | quote }} + ca.crt: {{ $ca.Cert | b64enc | quote }} + {{- else }} + {{- $cert := genSignedCert $cn nil (list $cn) 365 $ca }} + tls.crt: {{ $cert.Cert | b64enc | quote }} + tls.key: {{ $cert.Key | b64enc | quote }} + ca.crt: {{ $ca.Cert | b64enc | quote }} + {{- end }} +{{- end }} \ No newline at end of file diff --git a/templates/nginx/service.yaml b/templates/nginx/service.yaml index 24fad89dc757f8507eed0f0596262e5117ec91b6..8dca83f053b811a858d54ddc17f7838ddc63b145 100644 --- a/templates/nginx/service.yaml +++ b/templates/nginx/service.yaml @@ -5,19 +5,25 @@ metadata: {{- if eq .Values.expose.type "clusterIP" }} {{- $clusterIP := .Values.expose.clusterIP }} name: {{ $clusterIP.name }} + labels: {{ include "harbor.labels" . | indent 4 }} spec: type: ClusterIP ports: - name: http - port: {{ $clusterIP.ports.http }} + port: {{ $clusterIP.ports.httpPort }} targetPort: 80 {{- if .Values.expose.tls.enabled }} - name: https - port: {{ $clusterIP.ports.https }} + port: {{ $clusterIP.ports.httpsPort }} targetPort: 443 {{- end }} + {{- if .Values.notary.enabled }} + - name: notary + port: {{ $clusterIP.ports.notaryPort }} + targetPort: 4443 + {{- end }} {{- else if eq .Values.expose.type "nodePort" }} {{- $nodePort := .Values.expose.nodePort }} name: {{ $nodePort.name }} @@ -40,21 +46,13 @@ spec: nodePort: {{ $nodePort.ports.https.nodePort }} {{- end }} {{- end }} -{{- else if eq .Values.expose.type "loadBalancer" }} -{{- $loadBalancer := .Values.expose.loadBalancer }} - name: {{ $loadBalancer.name }} - labels: -{{ include "harbor.labels" . | indent 4 }} -spec: - type: LoadBalancer - ports: - - name: http - port: {{ $loadBalancer.ports.http }} - targetPort: 80 - {{- if .Values.expose.tls.enabled }} - - name: https - port: {{ $loadBalancer.ports.https }} - targetPort: 443 + {{- if .Values.notary.enabled }} + - name: notary + port: {{ $nodePort.ports.notary.port }} + targetPort: 4443 + {{- if $nodePort.ports.notary.nodePort }} + nodePort: {{ $nodePort.ports.notary.nodePort }} + {{- end }} {{- end }} {{- end }} selector: diff --git a/templates/notary/notary-cm.yaml b/templates/notary/notary-cm.yaml index 0ced91d12544456105001dc85061d733adfc36c5..1d9004a54e17d0f89470aba0a4a75ce8fd7596cf 100644 --- a/templates/notary/notary-cm.yaml +++ b/templates/notary/notary-cm.yaml @@ -9,14 +9,12 @@ metadata: data: {{ $ca := genCA "harbor-notary-ca" 365 }} {{ $cert := genSignedCert (include "harbor.notary-signer" .) nil nil 365 $ca }} - {{- if not .Values.notary.secretName }} notary-signer-ca.crt: | -{{ $ca.Cert | indent 4 }} +{{ $ca.Cert | indent 4 }} notary-signer.crt: | {{ $cert.Cert | indent 4 }} notary-signer.key: | -{{ $cert.Key | indent 4 }} - {{- end }} +{{ $cert.Key | indent 4 }} server-config.postgres.json: | { "server": { @@ -26,11 +24,7 @@ data: "type": "remote", "hostname": "{{ template "harbor.notary-signer" . }}", "port": "7899", -{{- if not .Values.notary.secretName }} "tls_ca_file": "./notary-signer-ca.crt", -{{- else }} - "tls_ca_file": "/etc/ssl/notary/cert/notary-signer-ca.crt", -{{- end }} "key_algorithm": "ecdsa" }, "logging": { @@ -54,13 +48,8 @@ data: { "server": { "grpc_addr": ":7899", -{{- if not .Values.notary.secretName }} "tls_cert_file": "./notary-signer.crt", "tls_key_file": "./notary-signer.key" -{{- else }} - "tls_cert_file": "/etc/ssl/notary/cert/notary-signer.crt", - "tls_key_file": "/etc/ssl/notary/cert/notary-signer.key" -{{- end }} }, "logging": { "level": "{{ .Values.logLevel }}" diff --git a/templates/notary/notary-server.yaml b/templates/notary/notary-server.yaml index 6c3be0528af180f25c7e976310542265c1fd92e6..2e188e79b03767a6c4085ef74ec23e0de9330c33 100644 --- a/templates/notary/notary-server.yaml +++ b/templates/notary/notary-server.yaml @@ -19,7 +19,6 @@ spec: app: notary-server annotations: checksum/configmap: {{ include (print $.Template.BasePath "/notary/notary-cm.yaml") . | sha256sum }} - checksum/secret-core: {{ include (print $.Template.BasePath "/core/core-secret.yaml") . | sha256sum }} {{- if .Values.notary.podAnnotations }} {{ toYaml .Values.notary.podAnnotations | indent 8 }} {{- end }} @@ -28,10 +27,8 @@ spec: - name: notary-server image: {{ .Values.notary.server.image.repository }}:{{ .Values.notary.server.image.tag }} imagePullPolicy: {{ .Values.imagePullPolicy }} -{{- if .Values.notary.server.resources }} resources: {{ toYaml .Values.notary.server.resources | indent 10 }} -{{- end }} env: - name: MIGRATIONS_PATH value: migrations/server/postgresql @@ -41,15 +38,10 @@ spec: - name: notary-config mountPath: /etc/notary - name: etc-localtime - mountPath: /etc/localtime + mountPath: /etc/localtime - name: root-certificate mountPath: /root.crt subPath: tokenServiceRootCertBundle - {{- if .Values.notary.secretName }} - - name: notary-ca - mountPath: /etc/ssl/notary/cert/notary-signer-ca.crt - subPath: ca - {{- end }} volumes: - name: etc-localtime hostPath: @@ -59,16 +51,7 @@ spec: name: "{{ template "harbor.notary-server" . }}" - name: root-certificate secret: - {{- if .Values.core.secretName }} - secretName: {{ .Values.core.secretName }} - {{- else }} secretName: {{ template "harbor.core" . }} - {{- end }} - {{- if .Values.notary.secretName }} - - name: notary-ca - secret: - secretName: {{ .Values.notary.secretName }} - {{- end }} {{- with .Values.notary.nodeSelector }} nodeSelector: {{ toYaml . | indent 8 }} diff --git a/templates/notary/notary-signer.yaml b/templates/notary/notary-signer.yaml index ba3b11a46bad67721bee480178bbfb41dd16f391..ae4b5054f43dd4c28f73782f448a3ef7cdbd2067 100644 --- a/templates/notary/notary-signer.yaml +++ b/templates/notary/notary-signer.yaml @@ -24,10 +24,8 @@ spec: - name: notary-signer image: {{ .Values.notary.signer.image.repository }}:{{ .Values.notary.signer.image.tag }} imagePullPolicy: {{ .Values.imagePullPolicy }} -{{- if .Values.notary.signer.resources }} resources: {{ toYaml .Values.notary.signer.resources | indent 10 }} -{{- end }} env: - name: MIGRATIONS_PATH value: migrations/signer/postgresql @@ -39,18 +37,7 @@ spec: - name: notary-config mountPath: /etc/notary - name: etc-localtime - mountPath: /etc/localtime - {{- if .Values.notary.secretName }} - - name: notary-cert - mountPath: /etc/ssl/notary/cert/notary-signer-ca.crt - subPath: ca - - name: notary-cert - mountPath: /etc/ssl/notary/cert/notary-signer.crt - subPath: crt - - name: notary-cert - mountPath: /etc/ssl/notary/cert/notary-signer.key - subPath: key - {{- end }} + mountPath: /etc/localtime volumes: - name: etc-localtime hostPath: @@ -58,11 +45,6 @@ spec: - name: notary-config configMap: name: "{{ template "harbor.notary-server" . }}" - {{- if .Values.notary.secretName }} - - name: notary-cert - secret: - secretName: {{ .Values.notary.secretName }} - {{- end }} {{- with .Values.notary.nodeSelector }} nodeSelector: {{ toYaml . | indent 8 }} diff --git a/templates/notary/notary-svc.yaml b/templates/notary/notary-svc.yaml index c5ea13e90fed91a62d4f3b3469b534b28c75d773..7b2267ace0af4508e2644880021cfd244991bf03 100644 --- a/templates/notary/notary-svc.yaml +++ b/templates/notary/notary-svc.yaml @@ -6,9 +6,6 @@ metadata: labels: {{ include "harbor.labels" . | indent 4 }} spec: -{{- if (eq .Values.expose.ingress.controller "gce") }} - type: NodePort -{{- end }} ports: - port: 4443 selector: diff --git a/templates/portal/deployment.yaml b/templates/portal/deployment.yaml index 350f536d030dad5d57fc03bdad9345bf9f5f8020..06e175679b50c37b729e86cee749ada7b89f601b 100644 --- a/templates/portal/deployment.yaml +++ b/templates/portal/deployment.yaml @@ -49,7 +49,7 @@ spec: volumes: - name: etc-localtime hostPath: - path: /etc/localtime + path: /etc/localtime {{- with .Values.portal.nodeSelector }} nodeSelector: {{ toYaml . | indent 8 }} diff --git a/templates/portal/service.yaml b/templates/portal/service.yaml index 25bed608df39970efc7981dcc59ae5a56d243ac8..be3b843d4babce072554b8b11f9cfc24f7d2cca4 100644 --- a/templates/portal/service.yaml +++ b/templates/portal/service.yaml @@ -5,9 +5,6 @@ metadata: labels: {{ include "harbor.labels" . | indent 4 }} spec: -{{- if (eq .Values.expose.ingress.controller "gce") }} - type: NodePort -{{- end }} ports: - port: 80 targetPort: 80 diff --git a/templates/redis/statefulset.yaml b/templates/redis/statefulset.yaml index ab1ed6b4d0e30834f1155f92e3e7fe190236840a..df34459dd07702b703bbfe2ab946b1e7d80712af 100644 --- a/templates/redis/statefulset.yaml +++ b/templates/redis/statefulset.yaml @@ -37,19 +37,17 @@ spec: port: 6379 initialDelaySeconds: 1 periodSeconds: 10 -{{- if .Values.redis.internal.resources }} resources: {{ toYaml .Values.redis.internal.resources | indent 10 }} -{{- end }} volumeMounts: - name: data mountPath: /var/lib/redis - name: etc-localtime - mountPath: /etc/localtime + mountPath: /etc/localtime volumes: - name: etc-localtime hostPath: - path: /etc/localtime + path: /etc/localtime - name: data emptyDir: {} {{- with .Values.redis.internal.nodeSelector }} @@ -64,4 +62,4 @@ spec: tolerations: {{ toYaml . | indent 8 }} {{- end }} -{{- end -}} + {{- end -}} diff --git a/templates/registry/registry-cm.yaml b/templates/registry/registry-cm.yaml index 9793df7e0806140ef1838428922838daa8131b42..62bae629f53450896382bde40b35316df3e2ce67 100644 --- a/templates/registry/registry-cm.yaml +++ b/templates/registry/registry-cm.yaml @@ -21,10 +21,9 @@ data: enabled: false delete: enabled: true - redirect: - disable: false redis: addr: "{{ template "harbor.redis.host" . }}:{{ template "harbor.redis.port" . }}" + password: {{ template "harbor.redis.rawPassword" . }} db: {{ template "harbor.redis.registryDatabaseIndex" . }} http: addr: :5000 @@ -38,8 +37,6 @@ data: realm: "{{ .Values.externalURL }}/service/token" rootcertbundle: /etc/registry/root.crt service: harbor-registry - validation: - disabled: true notifications: endpoints: - name: harbor diff --git a/templates/registry/registry-dpl.yaml b/templates/registry/registry-dpl.yaml index 0a0cd506ae6a4cc8ec03b6a5cdbb440f3445cc5f..cb56033fa36b162b80278de334cf433cc6ea3c42 100644 --- a/templates/registry/registry-dpl.yaml +++ b/templates/registry/registry-dpl.yaml @@ -19,8 +19,6 @@ spec: annotations: checksum/configmap: {{ include (print $.Template.BasePath "/registry/registry-cm.yaml") . | sha256sum }} checksum/secret: {{ include (print $.Template.BasePath "/registry/registry-secret.yaml") . | sha256sum }} - checksum/secret-jobservice: {{ include (print $.Template.BasePath "/jobservice/jobservice-secrets.yaml") . | sha256sum }} - checksum/secret-core: {{ include (print $.Template.BasePath "/core/core-secret.yaml") . | sha256sum }} {{- if .Values.registry.podAnnotations }} {{ toYaml .Values.registry.podAnnotations | indent 8 }} {{- end }} @@ -41,10 +39,8 @@ spec: port: 5000 initialDelaySeconds: 1 periodSeconds: 10 -{{- if .Values.registry.registry.resources }} resources: -{{ toYaml .Values.registry.registry.resources | indent 10 }} -{{- end }} +{{ toYaml .Values.registry.resources | indent 10 }} args: ["serve", "/etc/registry/config.yml"] envFrom: - secretRef: @@ -62,7 +58,7 @@ spec: mountPath: /etc/registry/config.yml subPath: config.yml - name: etc-localtime - mountPath: /etc/localtime + mountPath: /etc/localtime - name: registryctl image: {{ .Values.registry.controller.image.repository }}:{{ .Values.registry.controller.image.tag }} imagePullPolicy: {{ .Values.imagePullPolicy }} @@ -78,10 +74,8 @@ spec: port: 8080 initialDelaySeconds: 1 periodSeconds: 10 -{{- if .Values.registry.controller.resources }} resources: -{{ toYaml .Values.registry.controller.resources | indent 10 }} -{{- end }} +{{ toYaml .Values.registry.resources | indent 10 }} args: ["serve", "/etc/registry/config.yml"] envFrom: - secretRef: @@ -95,7 +89,7 @@ spec: - name: JOBSERVICE_SECRET valueFrom: secretKeyRef: - name: {{ template "harbor.jobservice" . }} + name: "{{ template "harbor.fullname" . }}-jobservice" key: secret ports: - containerPort: 8080 @@ -113,14 +107,10 @@ spec: volumes: - name: etc-localtime hostPath: - path: /etc/localtime + path: /etc/localtime - name: registry-root-certificate secret: - {{- if .Values.core.secretName }} - secretName: {{ .Values.core.secretName }} - {{- else }} secretName: {{ template "harbor.core" . }} - {{- end }} - name: registry-config configMap: name: "{{ template "harbor.registry" . }}" @@ -130,7 +120,7 @@ spec: path: {{ .Values.registry.hostPath }} {{- else }} path: /data/{{ .Release.Namespace }}/{{ .Release.Name }}/registry - {{- end }} + {{- end }} {{- with .Values.registry.nodeSelector }} nodeSelector: {{ toYaml . | indent 8 }} diff --git a/templates/registry/registry-secret.yaml b/templates/registry/registry-secret.yaml index ca7e1df96094437f5345c4ad65e92e5a7ad3a532..6b8ce655eaa61e6fbac87b7a5ae09d810f42cf46 100644 --- a/templates/registry/registry-secret.yaml +++ b/templates/registry/registry-secret.yaml @@ -6,14 +6,11 @@ metadata: {{ include "harbor.labels" . | indent 4 }} type: Opaque data: - REGISTRY_HTTP_SECRET: {{ .Values.registry.secret | default (randAlphaNum 16) | b64enc | quote }} - REGISTRY_REDIS_PASSWORD: {{ (include "harbor.redis.rawPassword" .) | b64enc | quote }} + REGISTRY_HTTP_SECRET: {{ randAlphaNum 16 | b64enc | quote }} {{- $storage := .Values.persistence.imageChartStorage }} {{- $type := $storage.type }} {{- if eq $type "azure" }} REGISTRY_STORAGE_AZURE_ACCOUNTKEY: {{ $storage.azure.accountkey | b64enc | quote }} - {{- else if eq $type "gcs" }} - GCS_KEY_DATA: {{ $storage.gcs.encodedkey | quote }} {{- else if eq $type "s3" }} {{- if $storage.s3.accesskey }} REGISTRY_STORAGE_S3_ACCESSKEY: {{ $storage.s3.accesskey | b64enc | quote }} @@ -31,4 +28,4 @@ data: {{- end }} {{- else if eq $type "oss" }} REGISTRY_STORAGE_OSS_ACCESSKEYSECRET: {{ $storage.oss.accesskeysecret | b64enc | quote }} - {{- end }} + {{- end }} \ No newline at end of file diff --git a/values-aliyun.yaml b/values-aliyun.yaml index d8265bfb9ff1815745b8121bcf9caaa07568f994..6179acec81028f5fe0ff830039694f863bf35d5d 100644 --- a/values-aliyun.yaml +++ b/values-aliyun.yaml @@ -3,11 +3,11 @@ expose: tls: enabled: false ingress: - host: hub.wodcloud.local - controller: default + hosts: + core: hub.wodcloud.local + notary: notary.wodcloud.local annotations: ingress.kubernetes.io/ssl-redirect: "true" - rewriteAnnotation: traefik.ingress.kubernetes.io/rewrite-target externalURL: https://hub.wodcloud.local @@ -32,6 +32,12 @@ core: tag: v1.7.5 replicas: 1 +adminserver: + image: + repository: registry.cn-qingdao.aliyuncs.com/wod/harbor-adminserver + tag: v1.7.5 + replicas: 1 + jobservice: image: repository: registry.cn-qingdao.aliyuncs.com/wod/harbor-jobservice diff --git a/values.yaml b/values.yaml index d24bb938fdc1fa694a2228f106e3da4e6d698641..15570e1a67e5d77184940a26903cf5683c39ae4c 100644 --- a/values.yaml +++ b/values.yaml @@ -1,7 +1,7 @@ expose: # Set the way how to expose the service. Set the type as "ingress", - # "clusterIP", "nodePort" or "loadBalancer" and fill the information - # in the corresponding section + # "clusterIP" or "nodePort" and fill the information in the corresponding + # section type: ingress tls: # Enable the tls or not. Note: if the type is "ingress" and the tls @@ -9,38 +9,39 @@ expose: # images. Refer to https://github.com/goharbor/harbor/issues/5291 # for the detail. enabled: true - # Fill the name of secret if you want to use your own TLS certificate. - # The secret must contain keys named: - # "tls.crt" - the certificate - # "tls.key" - the private key - # "ca.crt" - the certificate of CA - # These files will be generated automatically if the "secretName" is not set + # Fill the name of secret if you want to use your own TLS certificate + # and private key. The secret must contain keys named tls.crt and + # tls.key that contain the certificate and private key to use for TLS + # The certificate and private key will be generated automatically if + # it is not set secretName: "" + # By default, the Notary service will use the same cert and key as + # described above. Fill the name of secret if you want to use a + # separated one. Only needed when the type is "ingress". + notarySecretName: "" # The commmon name used to generate the certificate, it's necessary - # when the type isn't "ingress" and "secretName" is null + # when the type is "clusterIP" or "nodePort" and "secretName" is null commonName: "" ingress: - host: harbor.local - # set to the type of ingress controller if it has specific requirements. - # leave as `default` for most ingress controllers. - # set to `gce` if using the GCE ingress controller - controller: default + hosts: + core: core.harbor.domain + notary: notary.harbor.domain annotations: ingress.kubernetes.io/ssl-redirect: "true" - ingress.kubernetes.io/proxy-body-size: "0" nginx.ingress.kubernetes.io/ssl-redirect: "true" + ingress.kubernetes.io/proxy-body-size: "0" nginx.ingress.kubernetes.io/proxy-body-size: "0" - # The annotation name for "rewrite-target", only needed when Notary - # service is enabled - rewriteAnnotation: nginx.ingress.kubernetes.io/rewrite-target clusterIP: # The name of ClusterIP service name: harbor ports: # The service port Harbor listens on when serving with HTTP - http: 80 + httpPort: 80 # The service port Harbor listens on when serving with HTTPS - https: 443 + httpsPort: 443 + # The service port Notary listens on. Only needed when notary.enabled + # is set to true + notaryPort: 4443 nodePort: # The name of NodePort service name: harbor @@ -55,29 +56,27 @@ expose: port: 443 # The node port Harbor listens on when serving with HTTPS nodePort: 30003 - loadBalancer: - # The name of LoadBalancer service - name: harbor - ports: - # The service port Harbor listens on when serving with HTTP - http: 80 - # The service port Harbor listens on when serving with HTTPS - https: 443 + # Only needed when notary.enabled is set to true + notary: + # The service port Notary listens on + port: 4443 + # The node port Notary listens on + nodePort: 30004 -# The external URL for Harbor service. It is used to +# The external URL for Harbor core service. It is used to # 1) populate the docker/helm commands showed on portal # 2) populate the token service URL returned to docker/notary client # # Format: protocol://domain[:port]. Usually: # 1) if "expose.type" is "ingress", the "domain" should be -# the value of "expose.ingress.host" +# the value of "expose.ingress.hosts.core" # 2) if "expose.type" is "clusterIP", the "domain" should be # the value of "expose.clusterIP.name" # 3) if "expose.type" is "nodePort", the "domain" should be # the IP address of k8s node # # If Harbor is deployed behind the proxy, set it as the URL of proxy -externalURL: https://harbor.local +externalURL: https://core.harbor.domain # The persistence is enabled by default and a default StorageClass # is needed in the k8s cluster to provision volumes dynamicly. @@ -93,8 +92,7 @@ persistence: resourcePolicy: "keep" persistentVolumeClaim: registry: - # Use the existing PVC which must be created manually before bound, - # and specify the "subPath" if the PVC is shared with other components + # Use the existing PVC which must be created manually before bound existingClaim: "" # Specify the "storageClass" used to provision the volume. Or the default # StorageClass will be used(the default). @@ -136,13 +134,6 @@ persistence: # https://github.com/docker/distribution/blob/master/docs/configuration.md#storage # for the detail. imageChartStorage: - # Specify whether to disable `redirect` for images and chart storage, for - # backends which not supported it (such as using minio for `s3` storage type), please disable - # it. To disable redirects, simply set `disableredirect` to `true` instead. - # Refer to - # https://github.com/docker/distribution/blob/master/docs/configuration.md#redirect - # for the detail. - disableredirect: false # Specify the type of storage: "filesystem", "azure", "gcs", "s3", "swift", # "oss" and fill the information needed in the corresponding section. The type # must be "filesystem" if you want to use persistent volumes for registry @@ -158,8 +149,8 @@ persistence: #realm: core.windows.net gcs: bucket: bucketname - # The base64 encoded json file which contains the key - encodedkey: base64-encoded-json-key-file + # TODO: support the keyfile of gcs + #keyfile: /path/to/keyfile #rootdirectory: /gcs/object/name/prefix #chunksize: "5242880" s3: @@ -219,7 +210,7 @@ secretKey: "not-a-secure-key" nginx: image: repository: goharbor/nginx-photon - tag: dev + tag: v1.7.0 replicas: 1 # resources: # requests: @@ -234,7 +225,7 @@ nginx: portal: image: repository: goharbor/harbor-portal - tag: dev + tag: v1.7.0 replicas: 1 # resources: # requests: @@ -249,7 +240,7 @@ portal: core: image: repository: goharbor/harbor-core - tag: dev + tag: v1.7.0 replicas: 1 # resources: # requests: @@ -260,22 +251,26 @@ core: affinity: {} ## Additional deployment annotations podAnnotations: {} - # Secret is used when core server communicates with other components. - # If a secret key is not specified, Helm will generate one. - # Must be a string of 16 chars. - secret: "" - # Fill the name of a kubernetes secret if you want to use your own - # TLS certificate and private key for token encryption/decryption. - # The secret must contain keys named tls.tokenServiceRootCertBundle and - # tls.tokenServicePrivateKey that contain the certificate and private key. - # They will be automatically generated if not set - secretName: "" +adminserver: + image: + repository: goharbor/harbor-adminserver + tag: v1.7.0 + replicas: 1 + # resources: + # requests: + # memory: 256Mi + # cpu: 100m + nodeSelector: {} + tolerations: [] + affinity: {} + ## Additional deployment annotations + podAnnotations: {} jobservice: image: repository: goharbor/harbor-jobservice - tag: dev + tag: v1.7.0 replicas: 1 maxJobWorkers: 10 # The logger for jobs: "file", "database" or "stdout" @@ -289,46 +284,32 @@ jobservice: affinity: {} ## Additional deployment annotations podAnnotations: {} - # Secret is used when job service communicates with other components. - # If a secret key is not specified, Helm will generate one. - # Must be a string of 16 chars. - secret: "" registry: registry: image: repository: goharbor/registry-photon - tag: dev - # resources: - # requests: - # memory: 256Mi - # cpu: 100m + tag: v2.6.2-v1.7.0 controller: image: repository: goharbor/harbor-registryctl - tag: dev - # resources: - # requests: - # memory: 256Mi - # cpu: 100m + tag: v1.7.0 replicas: 1 + # resources: + # requests: + # memory: 256Mi + # cpu: 100m nodeSelector: {} tolerations: [] affinity: {} ## Additional deployment annotations podAnnotations: {} - # Secret is used to secure the upload state from client - # and registry storage backend. - # See: https://github.com/docker/distribution/blob/master/docs/configuration.md#http - # If a secret key is not specified, Helm will generate one. - # Must be a string of 16 chars. - secret: "" chartmuseum: enabled: true image: repository: goharbor/chartmuseum-photon - tag: dev + tag: v0.7.1-v1.7.0 replicas: 1 # resources: # requests: @@ -344,7 +325,7 @@ clair: enabled: true image: repository: goharbor/clair-photon - tag: dev + tag: v2.0.7-v1.7.0 replicas: 1 # The http(s) proxy used to update vulnerabilities database from internet httpProxy: @@ -367,33 +348,18 @@ notary: server: image: repository: goharbor/notary-server-photon - tag: dev + tag: v0.6.1-v1.7.0 replicas: 1 - # resources: - # requests: - # memory: 256Mi - # cpu: 100m signer: image: repository: goharbor/notary-signer-photon - tag: dev + tag: v0.6.1-v1.7.0 replicas: 1 - # resources: - # requests: - # memory: 256Mi - # cpu: 100m nodeSelector: {} tolerations: [] affinity: {} ## Additional deployment annotations podAnnotations: {} - # Fill the name of a kubernetes secret if you want to use your own - # TLS certificate authority, certificate and private key for notary - # communications. - # The secret must contain keys named tls.ca, tls.crt and tls.key that - # contain the CA, certificate and private key. - # They will be generated if not set. - secretName: "" database: # if external database is used, set "type" to "external" @@ -402,7 +368,7 @@ database: internal: image: repository: goharbor/harbor-db - tag: dev + tag: v1.7.0 # The initial superuser password for internal database password: "changeit" # resources: @@ -432,7 +398,7 @@ redis: internal: image: repository: goharbor/redis-photon - tag: dev + tag: v1.7.0 # resources: # requests: # memory: 256Mi @@ -451,4 +417,4 @@ redis: chartmuseumDatabaseIndex: "3" password: "" ## Additional deployment annotations - podAnnotations: {} \ No newline at end of file + podAnnotations: {}