feat(platform): add Harbor container registry (the-seas) deployment
- Add Harbor v2.15.1 (chart 1.19.1) deployment to wave 7 - Service name: the-seas (EPCOT: The Seas with Nemo & Friends) - Architecture: Embedded PostgreSQL, embedded Redis, single instance - Storage: NFS via nfs-emporium StorageClass (130Gi total) - Expose via Gateway API with dual DNS names - Primary: the-seas.local.mk-labs.cloud - Alternate: harbor.local.mk-labs.cloud - ExternalSecret for 1Password integration (6 secrets) - All image tags pinned to 2.15.1 - Resource requests/limits configured for homelab - Multi-source ArgoCD application pattern - TLS certificates via cert-manager (Let's Encrypt) - Metrics and Trivy scanning enabled Components: - Portal, Core, Registry, JobService (1 replica each) - Embedded PostgreSQL and Redis - NGINX reverse proxy - Trivy vulnerability scanner - Prometheus metrics exporter Refs: /mnt/mk-labs-pka/tony-stark-inbox/harbor-phase1-deployment.md
This commit is contained in:
Hermes Agent service account
273
cluster/platform/the-seas/values.yaml
Normal file
273
cluster/platform/the-seas/values.yaml
Normal file
@@ -0,0 +1,273 @@
|
||||
# ------------------------------------------------------------------------------
|
||||
# Harbor Helm Chart Values
|
||||
# Service: the-seas (The Seas with Nemo & Friends)
|
||||
# Architecture: Embedded PostgreSQL, embedded Redis, single instance
|
||||
# ------------------------------------------------------------------------------
|
||||
|
||||
# External URL for Harbor - primary DNS name
|
||||
externalURL: https://the-seas.local.mk-labs.cloud
|
||||
|
||||
# Expose Harbor via ClusterIP (Gateway API handles ingress)
|
||||
expose:
|
||||
type: clusterIP
|
||||
tls:
|
||||
enabled: true
|
||||
# TLS termination handled by Gateway, not ingress
|
||||
certSource: none
|
||||
clusterIP:
|
||||
name: the-seas
|
||||
ports:
|
||||
httpPort: 80
|
||||
httpsPort: 443
|
||||
|
||||
# Admin credentials from ExternalSecret
|
||||
harborAdminPassword: ""
|
||||
existingSecretAdminPassword: "the-seas-credentials"
|
||||
existingSecretAdminPasswordKey: "HARBOR_ADMIN_PASSWORD"
|
||||
|
||||
# Disable internal TLS (Gateway terminates TLS)
|
||||
internalTLS:
|
||||
enabled: false
|
||||
|
||||
# Embedded PostgreSQL configuration
|
||||
database:
|
||||
type: internal
|
||||
internal:
|
||||
image:
|
||||
repository: docker.io/goharbor/harbor-db
|
||||
tag: "2.15.1"
|
||||
# Password from ExternalSecret
|
||||
password: ""
|
||||
existingSecret: "the-seas-credentials"
|
||||
resources:
|
||||
requests:
|
||||
memory: 1Gi
|
||||
cpu: 500m
|
||||
limits:
|
||||
memory: 2Gi
|
||||
cpu: 2000m
|
||||
shmSizeLimit: 512Mi
|
||||
maxIdleConns: 100
|
||||
maxOpenConns: 900
|
||||
podAnnotations: {}
|
||||
podLabels: {}
|
||||
|
||||
# Embedded Redis configuration
|
||||
redis:
|
||||
type: internal
|
||||
internal:
|
||||
image:
|
||||
repository: docker.io/goharbor/redis-photon
|
||||
tag: "2.15.1"
|
||||
# Password from ExternalSecret
|
||||
jobservicePassword: ""
|
||||
existingSecret: "the-seas-credentials"
|
||||
resources:
|
||||
requests:
|
||||
memory: 256Mi
|
||||
cpu: 250m
|
||||
limits:
|
||||
memory: 512Mi
|
||||
cpu: 500m
|
||||
podAnnotations: {}
|
||||
podLabels: {}
|
||||
|
||||
# Storage configuration - use nfs-emporium StorageClass
|
||||
persistence:
|
||||
enabled: true
|
||||
resourcePolicy: "keep"
|
||||
persistentVolumeClaim:
|
||||
registry:
|
||||
storageClass: nfs-emporium
|
||||
accessMode: ReadWriteOnce
|
||||
size: 100Gi
|
||||
jobservice:
|
||||
jobLog:
|
||||
storageClass: nfs-emporium
|
||||
accessMode: ReadWriteOnce
|
||||
size: 5Gi
|
||||
database:
|
||||
storageClass: nfs-emporium
|
||||
accessMode: ReadWriteOnce
|
||||
size: 10Gi
|
||||
redis:
|
||||
storageClass: nfs-emporium
|
||||
accessMode: ReadWriteOnce
|
||||
size: 5Gi
|
||||
trivy:
|
||||
storageClass: nfs-emporium
|
||||
accessMode: ReadWriteOnce
|
||||
size: 10Gi
|
||||
|
||||
# Image chart storage - use local filesystem (on PVC)
|
||||
imageChartStorage:
|
||||
disableredirect: false
|
||||
type: filesystem
|
||||
filesystem:
|
||||
rootdirectory: /storage
|
||||
|
||||
# Portal (UI) configuration - single replica
|
||||
portal:
|
||||
image:
|
||||
repository: docker.io/goharbor/harbor-portal
|
||||
tag: "2.15.1"
|
||||
replicas: 1
|
||||
resources:
|
||||
requests:
|
||||
memory: 256Mi
|
||||
cpu: 250m
|
||||
limits:
|
||||
memory: 512Mi
|
||||
cpu: 500m
|
||||
podAnnotations: {}
|
||||
podLabels: {}
|
||||
|
||||
# Core service configuration - single replica
|
||||
core:
|
||||
image:
|
||||
repository: docker.io/goharbor/harbor-core
|
||||
tag: "2.15.1"
|
||||
replicas: 1
|
||||
# Core secret from ExternalSecret
|
||||
secret: ""
|
||||
existingSecret: "the-seas-credentials"
|
||||
secretName: "CORE_SECRET"
|
||||
# Enable HTTP/2 for better performance
|
||||
configureUserSettings: |-
|
||||
http2_push_preload on;
|
||||
resources:
|
||||
requests:
|
||||
memory: 512Mi
|
||||
cpu: 500m
|
||||
limits:
|
||||
memory: 1Gi
|
||||
cpu: 1000m
|
||||
podAnnotations: {}
|
||||
podLabels: {}
|
||||
|
||||
# Job service configuration - single replica
|
||||
jobservice:
|
||||
image:
|
||||
repository: docker.io/goharbor/harbor-jobservice
|
||||
tag: "2.15.1"
|
||||
replicas: 1
|
||||
# Job service secret from ExternalSecret
|
||||
secret: ""
|
||||
existingSecret: "the-seas-credentials"
|
||||
existingSecretKey: "JOBSERVICE_SECRET"
|
||||
resources:
|
||||
requests:
|
||||
memory: 512Mi
|
||||
cpu: 500m
|
||||
limits:
|
||||
memory: 1Gi
|
||||
cpu: 1000m
|
||||
podAnnotations: {}
|
||||
podLabels: {}
|
||||
|
||||
# Registry configuration - single replica
|
||||
registry:
|
||||
image:
|
||||
repository: docker.io/goharbor/registry-photon
|
||||
tag: "2.15.1"
|
||||
replicas: 1
|
||||
# Registry credentials from ExternalSecret
|
||||
credentials:
|
||||
username: "harbor_registry_user"
|
||||
password: ""
|
||||
existingSecret: "the-seas-credentials"
|
||||
resources:
|
||||
requests:
|
||||
memory: 1Gi
|
||||
cpu: 500m
|
||||
limits:
|
||||
memory: 2Gi
|
||||
cpu: 1000m
|
||||
podAnnotations: {}
|
||||
podLabels: {}
|
||||
|
||||
# Registry controller
|
||||
registryctl:
|
||||
image:
|
||||
repository: docker.io/goharbor/harbor-registryctl
|
||||
tag: "2.15.1"
|
||||
resources:
|
||||
requests:
|
||||
memory: 256Mi
|
||||
cpu: 250m
|
||||
limits:
|
||||
memory: 512Mi
|
||||
cpu: 500m
|
||||
|
||||
# Trivy vulnerability scanner
|
||||
trivy:
|
||||
enabled: true
|
||||
image:
|
||||
repository: docker.io/goharbor/trivy-adapter-photon
|
||||
tag: "2.15.1"
|
||||
resources:
|
||||
requests:
|
||||
memory: 512Mi
|
||||
cpu: 500m
|
||||
limits:
|
||||
memory: 1Gi
|
||||
cpu: 1000m
|
||||
podAnnotations: {}
|
||||
podLabels: {}
|
||||
|
||||
# Exporter for metrics
|
||||
exporter:
|
||||
image:
|
||||
repository: docker.io/goharbor/harbor-exporter
|
||||
tag: "2.15.1"
|
||||
replicas: 1
|
||||
resources:
|
||||
requests:
|
||||
memory: 256Mi
|
||||
cpu: 250m
|
||||
limits:
|
||||
memory: 512Mi
|
||||
cpu: 500m
|
||||
podAnnotations: {}
|
||||
podLabels: {}
|
||||
|
||||
# Metrics configuration
|
||||
metrics:
|
||||
enabled: true
|
||||
core:
|
||||
path: /metrics
|
||||
port: 8001
|
||||
registry:
|
||||
path: /metrics
|
||||
port: 8001
|
||||
jobservice:
|
||||
path: /metrics
|
||||
port: 8001
|
||||
exporter:
|
||||
path: /metrics
|
||||
port: 8001
|
||||
|
||||
# Cache configuration (for performance)
|
||||
cache:
|
||||
enabled: true
|
||||
expireHours: 24
|
||||
|
||||
# Update strategy
|
||||
updateStrategy:
|
||||
type: RollingUpdate
|
||||
|
||||
# NGINX (proxy in front of Harbor)
|
||||
nginx:
|
||||
image:
|
||||
repository: docker.io/goharbor/nginx-photon
|
||||
tag: "2.15.1"
|
||||
replicas: 1
|
||||
resources:
|
||||
requests:
|
||||
memory: 256Mi
|
||||
cpu: 250m
|
||||
limits:
|
||||
memory: 512Mi
|
||||
cpu: 500m
|
||||
podAnnotations: {}
|
||||
podLabels: {}
|
||||
Reference in New Issue
Block a user