homelab/cluster/platform/harbor/values.yaml

# ------------------------------------------------------------------------------
# Harbor Helm Chart Values
# Service: the-seas (The Seas with Nemo & Friends)
# Architecture: Embedded PostgreSQL, embedded Redis, single instance
# ------------------------------------------------------------------------------

# External URL for Harbor - primary DNS name
externalURL: https://the-seas.local.mk-labs.cloud

# Expose Harbor via ClusterIP (Gateway API handles ingress)
expose:
  type: clusterIP
  tls:
    enabled: true
    # TLS termination handled by Gateway, not ingress
    certSource: none
  clusterIP:
    name: the-seas
    ports:
      httpPort: 80
      httpsPort: 443

# Admin credentials from ExternalSecret
harborAdminPassword: ""
existingSecretAdminPassword: "harbor-credentials"
existingSecretAdminPasswordKey: "HARBOR_ADMIN_PASSWORD"

# Disable internal TLS (Gateway terminates TLS)
internalTLS:
  enabled: false

# Embedded PostgreSQL configuration
database:
  type: internal
  internal:
    image:
      repository: docker.io/goharbor/harbor-db
      tag: "v2.15.1"
    # Password from ExternalSecret
    password: ""
    existingSecret: "harbor-credentials"
    existingSecretKey: "DATABASE_PASSWORD"
    resources:
      requests:
        memory: 1Gi
        cpu: 500m
      limits:
        memory: 2Gi
        cpu: 2000m
    shmSizeLimit: 512Mi
  maxIdleConns: 100
  maxOpenConns: 900
  podAnnotations: {}
  podLabels: {}

# Embedded Redis configuration
redis:
  type: internal
  internal:
    image:
      repository: docker.io/goharbor/redis-photon
      tag: "v2.15.1"
    # Password from ExternalSecret
    jobservicePassword: ""
    existingSecret: "harbor-credentials"
    existingSecretKey: "REDIS_PASSWORD"
    resources:
      requests:
        memory: 256Mi
        cpu: 250m
      limits:
        memory: 512Mi
        cpu: 500m
  podAnnotations: {}
  podLabels: {}

# Storage configuration - use nfs-emporium StorageClass
persistence:
  enabled: true
  resourcePolicy: "keep"
  persistentVolumeClaim:
    registry:
      storageClass: nfs-emporium
      accessMode: ReadWriteOnce
      size: 100Gi
    jobservice:
      jobLog:
        storageClass: nfs-emporium
        accessMode: ReadWriteOnce
        size: 5Gi
    database:
      storageClass: nfs-emporium
      accessMode: ReadWriteOnce
      size: 10Gi
    redis:
      storageClass: nfs-emporium
      accessMode: ReadWriteOnce
      size: 5Gi
    trivy:
      storageClass: nfs-emporium
      accessMode: ReadWriteOnce
      size: 10Gi

# Image chart storage - use local filesystem (on PVC)
  imageChartStorage:
    disableredirect: false
    type: filesystem
    filesystem:
      rootdirectory: /storage

# Portal (UI) configuration - single replica
portal:
  image:
    repository: docker.io/goharbor/harbor-portal
    tag: "v2.15.1"
  replicas: 1
  resources:
    requests:
      memory: 256Mi
      cpu: 250m
    limits:
      memory: 512Mi
      cpu: 500m
  podAnnotations: {}
  podLabels: {}

# Core service configuration - single replica
core:
  image:
    repository: docker.io/goharbor/harbor-core
    tag: "v2.15.1"
  replicas: 1
  # Core secret from ExternalSecret
  secret: ""
  existingSecret: "harbor-credentials"
  # Enable HTTP/2 for better performance
  configureUserSettings: |-
    http2_push_preload on;
  resources:
    requests:
      memory: 512Mi
      cpu: 500m
    limits:
      memory: 1Gi
      cpu: 1000m
  podAnnotations: {}
  podLabels: {}

# Job service configuration - single replica
jobservice:
  image:
    repository: docker.io/goharbor/harbor-jobservice
    tag: "v2.15.1"
  replicas: 1
  # Job service secret from ExternalSecret
  secret: ""
  existingSecret: "harbor-credentials"
  existingSecretKey: "JOBSERVICE_SECRET"
  resources:
    requests:
      memory: 512Mi
      cpu: 500m
    limits:
      memory: 1Gi
      cpu: 1000m
  podAnnotations: {}
  podLabels: {}

# Registry configuration - single replica
registry:
  image:
    repository: docker.io/goharbor/registry-photon
    tag: "v2.15.1"
  replicas: 1
  # Registry credentials from ExternalSecret
  credentials:
    username: "harbor_registry_user"
    password: ""
    existingSecret: "harbor-credentials"
  resources:
    requests:
      memory: 1Gi
      cpu: 500m
    limits:
      memory: 2Gi
      cpu: 1000m
  podAnnotations: {}
  podLabels: {}

# Registry controller
registryctl:
  image:
    repository: docker.io/goharbor/harbor-registryctl
    tag: "v2.15.1"
  resources:
    requests:
      memory: 256Mi
      cpu: 250m
    limits:
      memory: 512Mi
      cpu: 500m

# Trivy vulnerability scanner
trivy:
  enabled: true
  image:
    repository: docker.io/goharbor/trivy-adapter-photon
    tag: "v2.15.1"
  resources:
    requests:
      memory: 512Mi
      cpu: 500m
    limits:
      memory: 1Gi
      cpu: 1000m
  podAnnotations: {}
  podLabels: {}

# Exporter for metrics
exporter:
  image:
    repository: docker.io/goharbor/harbor-exporter
    tag: "v2.15.1"
  replicas: 1
  resources:
    requests:
      memory: 256Mi
      cpu: 250m
    limits:
      memory: 512Mi
      cpu: 500m
  podAnnotations: {}
  podLabels: {}

# Metrics configuration
metrics:
  enabled: true
  core:
    path: /metrics
    port: 8001
  registry:
    path: /metrics
    port: 8001
  jobservice:
    path: /metrics
    port: 8001
  exporter:
    path: /metrics
    port: 8001

# Cache configuration (for performance)
cache:
  enabled: true
  expireHours: 24

# Update strategy
updateStrategy:
  type: RollingUpdate

# NGINX (proxy in front of Harbor)
nginx:
  image:
    repository: docker.io/goharbor/nginx-photon
    tag: "v2.15.1"
  replicas: 1
  resources:
    requests:
      memory: 256Mi
      cpu: 250m
    limits:
      memory: 512Mi
      cpu: 500m
  podAnnotations: {}
  podLabels: {}