fix(harbor): correct naming convention and use staging certs
- Rename application/namespace: the-seas -> harbor - Move directory: cluster/platform/the-seas -> cluster/platform/harbor - Update all resource references (ExternalSecret, HTTPRoutes, Certificates) - Switch to letsencrypt-staging issuer (avoid ACME rate limits during testing) - Thematic name 'the-seas' remains in DNS hostnames and comments
This commit is contained in:
Hermes Agent service account
273
cluster/platform/harbor/values.yaml
Normal file
273
cluster/platform/harbor/values.yaml
Normal file
@@ -0,0 +1,273 @@
|
||||
# ------------------------------------------------------------------------------
|
||||
# Harbor Helm Chart Values
|
||||
# Service: the-seas (The Seas with Nemo & Friends)
|
||||
# Architecture: Embedded PostgreSQL, embedded Redis, single instance
|
||||
# ------------------------------------------------------------------------------
|
||||
|
||||
# External URL for Harbor - primary DNS name
|
||||
externalURL: https://the-seas.local.mk-labs.cloud
|
||||
|
||||
# Expose Harbor via ClusterIP (Gateway API handles ingress)
|
||||
expose:
|
||||
type: clusterIP
|
||||
tls:
|
||||
enabled: true
|
||||
# TLS termination handled by Gateway, not ingress
|
||||
certSource: none
|
||||
clusterIP:
|
||||
name: the-seas
|
||||
ports:
|
||||
httpPort: 80
|
||||
httpsPort: 443
|
||||
|
||||
# Admin credentials from ExternalSecret
|
||||
harborAdminPassword: ""
|
||||
existingSecretAdminPassword: "harbor-credentials"
|
||||
existingSecretAdminPasswordKey: "HARBOR_ADMIN_PASSWORD"
|
||||
|
||||
# Disable internal TLS (Gateway terminates TLS)
|
||||
internalTLS:
|
||||
enabled: false
|
||||
|
||||
# Embedded PostgreSQL configuration
|
||||
database:
|
||||
type: internal
|
||||
internal:
|
||||
image:
|
||||
repository: docker.io/goharbor/harbor-db
|
||||
tag: "v2.15.1"
|
||||
# Password from ExternalSecret
|
||||
password: ""
|
||||
existingSecret: "harbor-credentials"
|
||||
resources:
|
||||
requests:
|
||||
memory: 1Gi
|
||||
cpu: 500m
|
||||
limits:
|
||||
memory: 2Gi
|
||||
cpu: 2000m
|
||||
shmSizeLimit: 512Mi
|
||||
maxIdleConns: 100
|
||||
maxOpenConns: 900
|
||||
podAnnotations: {}
|
||||
podLabels: {}
|
||||
|
||||
# Embedded Redis configuration
|
||||
redis:
|
||||
type: internal
|
||||
internal:
|
||||
image:
|
||||
repository: docker.io/goharbor/redis-photon
|
||||
tag: "v2.15.1"
|
||||
# Password from ExternalSecret
|
||||
jobservicePassword: ""
|
||||
existingSecret: "harbor-credentials"
|
||||
resources:
|
||||
requests:
|
||||
memory: 256Mi
|
||||
cpu: 250m
|
||||
limits:
|
||||
memory: 512Mi
|
||||
cpu: 500m
|
||||
podAnnotations: {}
|
||||
podLabels: {}
|
||||
|
||||
# Storage configuration - use nfs-emporium StorageClass
|
||||
persistence:
|
||||
enabled: true
|
||||
resourcePolicy: "keep"
|
||||
persistentVolumeClaim:
|
||||
registry:
|
||||
storageClass: nfs-emporium
|
||||
accessMode: ReadWriteOnce
|
||||
size: 100Gi
|
||||
jobservice:
|
||||
jobLog:
|
||||
storageClass: nfs-emporium
|
||||
accessMode: ReadWriteOnce
|
||||
size: 5Gi
|
||||
database:
|
||||
storageClass: nfs-emporium
|
||||
accessMode: ReadWriteOnce
|
||||
size: 10Gi
|
||||
redis:
|
||||
storageClass: nfs-emporium
|
||||
accessMode: ReadWriteOnce
|
||||
size: 5Gi
|
||||
trivy:
|
||||
storageClass: nfs-emporium
|
||||
accessMode: ReadWriteOnce
|
||||
size: 10Gi
|
||||
|
||||
# Image chart storage - use local filesystem (on PVC)
|
||||
imageChartStorage:
|
||||
disableredirect: false
|
||||
type: filesystem
|
||||
filesystem:
|
||||
rootdirectory: /storage
|
||||
|
||||
# Portal (UI) configuration - single replica
|
||||
portal:
|
||||
image:
|
||||
repository: docker.io/goharbor/harbor-portal
|
||||
tag: "v2.15.1"
|
||||
replicas: 1
|
||||
resources:
|
||||
requests:
|
||||
memory: 256Mi
|
||||
cpu: 250m
|
||||
limits:
|
||||
memory: 512Mi
|
||||
cpu: 500m
|
||||
podAnnotations: {}
|
||||
podLabels: {}
|
||||
|
||||
# Core service configuration - single replica
|
||||
core:
|
||||
image:
|
||||
repository: docker.io/goharbor/harbor-core
|
||||
tag: "v2.15.1"
|
||||
replicas: 1
|
||||
# Core secret from ExternalSecret
|
||||
secret: ""
|
||||
existingSecret: "harbor-credentials"
|
||||
secretName: "CORE_SECRET"
|
||||
# Enable HTTP/2 for better performance
|
||||
configureUserSettings: |-
|
||||
http2_push_preload on;
|
||||
resources:
|
||||
requests:
|
||||
memory: 512Mi
|
||||
cpu: 500m
|
||||
limits:
|
||||
memory: 1Gi
|
||||
cpu: 1000m
|
||||
podAnnotations: {}
|
||||
podLabels: {}
|
||||
|
||||
# Job service configuration - single replica
|
||||
jobservice:
|
||||
image:
|
||||
repository: docker.io/goharbor/harbor-jobservice
|
||||
tag: "v2.15.1"
|
||||
replicas: 1
|
||||
# Job service secret from ExternalSecret
|
||||
secret: ""
|
||||
existingSecret: "harbor-credentials"
|
||||
existingSecretKey: "JOBSERVICE_SECRET"
|
||||
resources:
|
||||
requests:
|
||||
memory: 512Mi
|
||||
cpu: 500m
|
||||
limits:
|
||||
memory: 1Gi
|
||||
cpu: 1000m
|
||||
podAnnotations: {}
|
||||
podLabels: {}
|
||||
|
||||
# Registry configuration - single replica
|
||||
registry:
|
||||
image:
|
||||
repository: docker.io/goharbor/registry-photon
|
||||
tag: "v2.15.1"
|
||||
replicas: 1
|
||||
# Registry credentials from ExternalSecret
|
||||
credentials:
|
||||
username: "harbor_registry_user"
|
||||
password: ""
|
||||
existingSecret: "harbor-credentials"
|
||||
resources:
|
||||
requests:
|
||||
memory: 1Gi
|
||||
cpu: 500m
|
||||
limits:
|
||||
memory: 2Gi
|
||||
cpu: 1000m
|
||||
podAnnotations: {}
|
||||
podLabels: {}
|
||||
|
||||
# Registry controller
|
||||
registryctl:
|
||||
image:
|
||||
repository: docker.io/goharbor/harbor-registryctl
|
||||
tag: "v2.15.1"
|
||||
resources:
|
||||
requests:
|
||||
memory: 256Mi
|
||||
cpu: 250m
|
||||
limits:
|
||||
memory: 512Mi
|
||||
cpu: 500m
|
||||
|
||||
# Trivy vulnerability scanner
|
||||
trivy:
|
||||
enabled: true
|
||||
image:
|
||||
repository: docker.io/goharbor/trivy-adapter-photon
|
||||
tag: "v2.15.1"
|
||||
resources:
|
||||
requests:
|
||||
memory: 512Mi
|
||||
cpu: 500m
|
||||
limits:
|
||||
memory: 1Gi
|
||||
cpu: 1000m
|
||||
podAnnotations: {}
|
||||
podLabels: {}
|
||||
|
||||
# Exporter for metrics
|
||||
exporter:
|
||||
image:
|
||||
repository: docker.io/goharbor/harbor-exporter
|
||||
tag: "v2.15.1"
|
||||
replicas: 1
|
||||
resources:
|
||||
requests:
|
||||
memory: 256Mi
|
||||
cpu: 250m
|
||||
limits:
|
||||
memory: 512Mi
|
||||
cpu: 500m
|
||||
podAnnotations: {}
|
||||
podLabels: {}
|
||||
|
||||
# Metrics configuration
|
||||
metrics:
|
||||
enabled: true
|
||||
core:
|
||||
path: /metrics
|
||||
port: 8001
|
||||
registry:
|
||||
path: /metrics
|
||||
port: 8001
|
||||
jobservice:
|
||||
path: /metrics
|
||||
port: 8001
|
||||
exporter:
|
||||
path: /metrics
|
||||
port: 8001
|
||||
|
||||
# Cache configuration (for performance)
|
||||
cache:
|
||||
enabled: true
|
||||
expireHours: 24
|
||||
|
||||
# Update strategy
|
||||
updateStrategy:
|
||||
type: RollingUpdate
|
||||
|
||||
# NGINX (proxy in front of Harbor)
|
||||
nginx:
|
||||
image:
|
||||
repository: docker.io/goharbor/nginx-photon
|
||||
tag: "v2.15.1"
|
||||
replicas: 1
|
||||
resources:
|
||||
requests:
|
||||
memory: 256Mi
|
||||
cpu: 250m
|
||||
limits:
|
||||
memory: 512Mi
|
||||
cpu: 500m
|
||||
podAnnotations: {}
|
||||
podLabels: {}
|
||||
Reference in New Issue
Block a user