130 lines
3.2 KiB
YAML
130 lines
3.2 KiB
YAML
|
apiVersion: argoproj.io/v1alpha1
|
||
|
|
kind: Application
|
||
|
|
metadata:
|
||
|
|
name: harbor
|
||
|
|
namespace: argocd
|
||
|
|
spec:
|
||
|
|
project: default
|
||
|
|
source:
|
||
|
|
repoURL: https://helm.goharbor.io
|
||
|
|
chart: harbor
|
||
|
|
targetRevision: 1.16.1
|
||
|
|
helm:
|
||
|
|
valuesObject:
|
||
|
|
expose:
|
||
|
|
type: ingress
|
||
|
|
tls:
|
||
|
|
enabled: true
|
||
|
|
certSource: secret
|
||
|
|
secret:
|
||
|
|
secretName: harbor-tls
|
||
|
|
ingress:
|
||
|
|
hosts:
|
||
|
|
core: harbor.basicstack.de
|
||
|
|
className: traefik
|
||
|
|
annotations:
|
||
|
|
cert-manager.io/cluster-issuer: letsencrypt-prod
|
||
|
|
traefik.ingress.kubernetes.io/router.entrypoints: websecure
|
||
|
|
traefik.ingress.kubernetes.io/router.tls: "true"
|
||
|
|
externalURL: https://harbor.basicstack.de
|
||
|
|
|
||
|
|
persistence:
|
||
|
|
enabled: true
|
||
|
|
resourcePolicy: keep
|
||
|
|
persistentVolumeClaim:
|
||
|
|
registry:
|
||
|
|
storageClass: hcloud-volumes-encrypted
|
||
|
|
size: 50Gi
|
||
|
|
database:
|
||
|
|
storageClass: hcloud-volumes-encrypted
|
||
|
|
size: 10Gi
|
||
|
|
redis:
|
||
|
|
storageClass: hcloud-volumes-encrypted
|
||
|
|
size: 5Gi
|
||
|
|
trivy:
|
||
|
|
storageClass: hcloud-volumes-encrypted
|
||
|
|
size: 5Gi
|
||
|
|
jobservice:
|
||
|
|
jobLog:
|
||
|
|
storageClass: hcloud-volumes-encrypted
|
||
|
|
size: 5Gi
|
||
|
|
|
||
|
|
# Use internal PostgreSQL and Redis
|
||
|
|
database:
|
||
|
|
type: internal
|
||
|
|
internal:
|
||
|
|
existingSecret: harbor-secrets
|
||
|
|
|
||
|
|
redis:
|
||
|
|
type: internal
|
||
|
|
|
||
|
|
# Harbor admin credentials
|
||
|
|
existingSecretAdminPassword: harbor-secrets
|
||
|
|
existingSecretAdminPasswordKey: harborAdminPassword
|
||
|
|
|
||
|
|
# Enable OIDC authentication
|
||
|
|
authMode: oidc_auth
|
||
|
|
oidc:
|
||
|
|
name: PocketID
|
||
|
|
endpoint: https://auth.basicstack.de
|
||
|
|
clientId: harbor
|
||
|
|
clientSecret: "" # Will be loaded from secret
|
||
|
|
groupsClaim: groups
|
||
|
|
adminGroup: admins
|
||
|
|
scope: openid,profile,email,groups
|
||
|
|
autoOnboard: true
|
||
|
|
userClaim: email
|
||
|
|
verifyCert: true
|
||
|
|
existingSecretOIDC: harbor-secrets
|
||
|
|
existingSecretOIDCKey: oidc.clientSecret
|
||
|
|
|
||
|
|
# Resource limits
|
||
|
|
core:
|
||
|
|
resources:
|
||
|
|
requests:
|
||
|
|
memory: 256Mi
|
||
|
|
cpu: 100m
|
||
|
|
limits:
|
||
|
|
memory: 1Gi
|
||
|
|
cpu: 1000m
|
||
|
|
|
||
|
|
portal:
|
||
|
|
resources:
|
||
|
|
requests:
|
||
|
|
memory: 128Mi
|
||
|
|
cpu: 100m
|
||
|
|
limits:
|
||
|
|
memory: 256Mi
|
||
|
|
cpu: 500m
|
||
|
|
|
||
|
|
registry:
|
||
|
|
registry:
|
||
|
|
resources:
|
||
|
|
requests:
|
||
|
|
memory: 256Mi
|
||
|
|
cpu: 100m
|
||
|
|
limits:
|
||
|
|
memory: 1Gi
|
||
|
|
cpu: 1000m
|
||
|
|
|
||
|
|
trivy:
|
||
|
|
enabled: true
|
||
|
|
resources:
|
||
|
|
requests:
|
||
|
|
memory: 512Mi
|
||
|
|
cpu: 200m
|
||
|
|
limits:
|
||
|
|
memory: 2Gi
|
||
|
|
cpu: 1000m
|
||
|
|
|
||
|
|
destination:
|
||
|
|
server: https://kubernetes.default.svc
|
||
|
|
namespace: harbor
|
||
|
|
|
||
|
|
syncPolicy:
|
||
|
|
syncOptions:
|
||
|
|
- CreateNamespace=true
|
||
|
|
automated:
|
||
|
|
prune: false
|
||
|
|
selfHeal: true
|