fix(harbor): correct naming convention and use staging certs

- Rename application/namespace: the-seas -> harbor
- Move directory: cluster/platform/the-seas -> cluster/platform/harbor
- Update all resource references (ExternalSecret, HTTPRoutes, Certificates)
- Switch to letsencrypt-staging issuer (avoid ACME rate limits during testing)
- Thematic name 'the-seas' remains in DNS hostnames and comments

cluster/platform/harbor/application.yaml

@@ -1,12 +1,13 @@
 # ------------------------------------------------------------------------------
-# Platform: the-seas (Harbor Container Registry)
+# Platform: harbor (Container Registry)
+# Theme: the-seas (EPCOT: The Seas with Nemo & Friends)
 # Wave 7 — depends on Gateway API (wave 4), cert-manager (wave 3), ESO (wave 1)
 # Multi-source: Helm chart from upstream + values + manifests from repo
 # ------------------------------------------------------------------------------
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: the-seas
+  name: harbor
   namespace: argocd
   annotations:
     argocd.argoproj.io/sync-wave: "7"
@@ -19,17 +20,17 @@ spec:
       targetRevision: 1.19.1
       helm:
         valueFiles:
-          - $values/cluster/platform/the-seas/values.yaml
+          - $values/cluster/platform/harbor/values.yaml
     # Source 2: Repo — values ref + ExternalSecret + HTTPRoutes + Certificates
     - repoURL: https://gitea.mk-labs.cloud/rblundon/homelab.git
       targetRevision: main
-      path: cluster/platform/the-seas
+      path: cluster/platform/harbor
       ref: values
       directory:
         exclude: "application.yaml"
   destination:
     server: https://kubernetes.default.svc
-    namespace: the-seas
+    namespace: harbor
   syncPolicy:
     automated:
       prune: true

cluster/platform/harbor/certificate-alt.yaml

@@ -1,16 +1,16 @@
 # ------------------------------------------------------------------------------
-# Certificate — Harbor Alternate TLS Certificate
+# Certificate — Harbor Alternate TLS Certificate (staging until stable)
 # Alternate DNS: harbor.local.mk-labs.cloud
 # ------------------------------------------------------------------------------
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
-  name: harbor-tls
-  namespace: the-seas
+  name: harbor-alt-tls
+  namespace: harbor
 spec:
-  secretName: harbor-tls
+  secretName: harbor-alt-tls
   issuerRef:
-    name: letsencrypt-prod
+    name: letsencrypt-staging
     kind: ClusterIssuer
   dnsNames:
     - harbor.local.mk-labs.cloud

cluster/platform/harbor/certificate.yaml

@@ -1,16 +1,16 @@
 # ------------------------------------------------------------------------------
-# Certificate — The Seas TLS Certificate
+# Certificate — Harbor TLS Certificate (staging until stable)
 # Primary DNS: the-seas.local.mk-labs.cloud
 # ------------------------------------------------------------------------------
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
-  name: the-seas-tls
-  namespace: the-seas
+  name: harbor-tls
+  namespace: harbor
 spec:
-  secretName: the-seas-tls
+  secretName: harbor-tls
   issuerRef:
-    name: letsencrypt-prod
+    name: letsencrypt-staging
     kind: ClusterIssuer
   dnsNames:
     - the-seas.local.mk-labs.cloud

cluster/platform/harbor/externalsecret.yaml

@@ -10,15 +10,15 @@
 apiVersion: external-secrets.io/v1beta1
 kind: ExternalSecret
 metadata:
-  name: the-seas-credentials
-  namespace: the-seas
+  name: harbor-credentials
+  namespace: harbor
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
     name: onepassword-connect
   refreshInterval: "1h"
   target:
-    name: the-seas-credentials
+    name: harbor-credentials
     creationPolicy: Owner
   data:
     - secretKey: HARBOR_ADMIN_PASSWORD

cluster/platform/harbor/httproute-alt.yaml

@@ -1,12 +1,13 @@
 # ------------------------------------------------------------------------------
+# ------------------------------------------------------------------------------
 # HTTPRoute — Harbor (Alternate) via Cilium Gateway  
-# Alternate DNS: harbor.local.mk-labs.cloud
+# Alternate DNS: harbor.local.mk-labs.cloud (functional name)
 # ------------------------------------------------------------------------------
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
   name: harbor-alt
-  namespace: the-seas
+  namespace: harbor
   annotations:
     external-dns.alpha.kubernetes.io/hostname: harbor.local.mk-labs.cloud
     external-dns.alpha.kubernetes.io/target: "10.1.71.90"

cluster/platform/harbor/httproute.yaml

@@ -1,12 +1,12 @@
 # ------------------------------------------------------------------------------
-# HTTPRoute — The Seas (Primary) via Cilium Gateway
-# Primary DNS: the-seas.local.mk-labs.cloud
+# HTTPRoute — Harbor (Primary) via Cilium Gateway
+# Primary DNS: the-seas.local.mk-labs.cloud (EPCOT theme)
 # ------------------------------------------------------------------------------
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
-  name: the-seas
-  namespace: the-seas
+  name: harbor-the-seas
+  namespace: harbor
   annotations:
     external-dns.alpha.kubernetes.io/hostname: the-seas.local.mk-labs.cloud
     external-dns.alpha.kubernetes.io/target: "10.1.71.90"
@@ -27,6 +27,6 @@ spec:
       backendRefs:
         - group: ""
           kind: Service
-          name: the-seas
+          name: harbor
           port: 80
           weight: 1

cluster/platform/harbor/values.yaml

@@ -22,7 +22,7 @@ expose:
 
 # Admin credentials from ExternalSecret
 harborAdminPassword: ""
-existingSecretAdminPassword: "the-seas-credentials"
+existingSecretAdminPassword: "harbor-credentials"
 existingSecretAdminPasswordKey: "HARBOR_ADMIN_PASSWORD"
 
 # Disable internal TLS (Gateway terminates TLS)
@@ -38,7 +38,7 @@ database:
       tag: "v2.15.1"
     # Password from ExternalSecret
     password: ""
-    existingSecret: "the-seas-credentials"
+    existingSecret: "harbor-credentials"
     resources:
       requests:
         memory: 1Gi
@@ -61,7 +61,7 @@ redis:
       tag: "v2.15.1"
     # Password from ExternalSecret
     jobservicePassword: ""
-    existingSecret: "the-seas-credentials"
+    existingSecret: "harbor-credentials"
     resources:
       requests:
         memory: 256Mi
@@ -130,7 +130,7 @@ core:
   replicas: 1
   # Core secret from ExternalSecret
   secret: ""
-  existingSecret: "the-seas-credentials"
+  existingSecret: "harbor-credentials"
   secretName: "CORE_SECRET"
   # Enable HTTP/2 for better performance
   configureUserSettings: |-
@@ -153,7 +153,7 @@ jobservice:
   replicas: 1
   # Job service secret from ExternalSecret
   secret: ""
-  existingSecret: "the-seas-credentials"
+  existingSecret: "harbor-credentials"
   existingSecretKey: "JOBSERVICE_SECRET"
   resources:
     requests:
@@ -175,7 +175,7 @@ registry:
   credentials:
     username: "harbor_registry_user"
     password: ""
-    existingSecret: "the-seas-credentials"
+    existingSecret: "harbor-credentials"
   resources:
     requests:
       memory: 1Gi