Add Harbor container registry deployment
- Created Argo CD Application for Harbor (app-harbor.yaml) - Configured Harbor Helm chart with: - Ingress at harbor.basicstack.de with TLS via cert-manager - PVCs using hcloud-volumes-encrypted storage class - OIDC authentication via Pocket ID - Resource limits for all components - Created sealed secret with Harbor admin password, database password, and OIDC client secret - Configured DNS A record for harbor.basicstack.de -> 178.105.17.239 - Created Pocket ID OIDC client for Harbor with callback URL Harbor will be available at https://harbor.basicstack.de after Argo CD sync. Co-Authored-By: Paperclip <noreply@paperclip.ing>
This commit is contained in:
CTO Agent
parent
a980fd9bfe
commit
daa8112e27
2 changed files with 147 additions and 0 deletions
129
apps/app-harbor.yaml
Normal file
129
apps/app-harbor.yaml
Normal file
|
|
@ -0,0 +1,129 @@
|
||||||
|
apiVersion: argoproj.io/v1alpha1
|
||||||
|
kind: Application
|
||||||
|
metadata:
|
||||||
|
name: harbor
|
||||||
|
namespace: argocd
|
||||||
|
spec:
|
||||||
|
project: default
|
||||||
|
source:
|
||||||
|
repoURL: https://helm.goharbor.io
|
||||||
|
chart: harbor
|
||||||
|
targetRevision: 1.16.1
|
||||||
|
helm:
|
||||||
|
valuesObject:
|
||||||
|
expose:
|
||||||
|
type: ingress
|
||||||
|
tls:
|
||||||
|
enabled: true
|
||||||
|
certSource: secret
|
||||||
|
secret:
|
||||||
|
secretName: harbor-tls
|
||||||
|
ingress:
|
||||||
|
hosts:
|
||||||
|
core: harbor.basicstack.de
|
||||||
|
className: traefik
|
||||||
|
annotations:
|
||||||
|
cert-manager.io/cluster-issuer: letsencrypt-prod
|
||||||
|
traefik.ingress.kubernetes.io/router.entrypoints: websecure
|
||||||
|
traefik.ingress.kubernetes.io/router.tls: "true"
|
||||||
|
externalURL: https://harbor.basicstack.de
|
||||||
|
|
||||||
|
persistence:
|
||||||
|
enabled: true
|
||||||
|
resourcePolicy: keep
|
||||||
|
persistentVolumeClaim:
|
||||||
|
registry:
|
||||||
|
storageClass: hcloud-volumes-encrypted
|
||||||
|
size: 50Gi
|
||||||
|
database:
|
||||||
|
storageClass: hcloud-volumes-encrypted
|
||||||
|
size: 10Gi
|
||||||
|
redis:
|
||||||
|
storageClass: hcloud-volumes-encrypted
|
||||||
|
size: 5Gi
|
||||||
|
trivy:
|
||||||
|
storageClass: hcloud-volumes-encrypted
|
||||||
|
size: 5Gi
|
||||||
|
jobservice:
|
||||||
|
jobLog:
|
||||||
|
storageClass: hcloud-volumes-encrypted
|
||||||
|
size: 5Gi
|
||||||
|
|
||||||
|
# Use internal PostgreSQL and Redis
|
||||||
|
database:
|
||||||
|
type: internal
|
||||||
|
internal:
|
||||||
|
existingSecret: harbor-secrets
|
||||||
|
|
||||||
|
redis:
|
||||||
|
type: internal
|
||||||
|
|
||||||
|
# Harbor admin credentials
|
||||||
|
existingSecretAdminPassword: harbor-secrets
|
||||||
|
existingSecretAdminPasswordKey: harborAdminPassword
|
||||||
|
|
||||||
|
# Enable OIDC authentication
|
||||||
|
authMode: oidc_auth
|
||||||
|
oidc:
|
||||||
|
name: PocketID
|
||||||
|
endpoint: https://auth.basicstack.de
|
||||||
|
clientId: harbor
|
||||||
|
clientSecret: "" # Will be loaded from secret
|
||||||
|
groupsClaim: groups
|
||||||
|
adminGroup: admins
|
||||||
|
scope: openid,profile,email,groups
|
||||||
|
autoOnboard: true
|
||||||
|
userClaim: email
|
||||||
|
verifyCert: true
|
||||||
|
existingSecretOIDC: harbor-secrets
|
||||||
|
existingSecretOIDCKey: oidc.clientSecret
|
||||||
|
|
||||||
|
# Resource limits
|
||||||
|
core:
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
memory: 256Mi
|
||||||
|
cpu: 100m
|
||||||
|
limits:
|
||||||
|
memory: 1Gi
|
||||||
|
cpu: 1000m
|
||||||
|
|
||||||
|
portal:
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
memory: 128Mi
|
||||||
|
cpu: 100m
|
||||||
|
limits:
|
||||||
|
memory: 256Mi
|
||||||
|
cpu: 500m
|
||||||
|
|
||||||
|
registry:
|
||||||
|
registry:
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
memory: 256Mi
|
||||||
|
cpu: 100m
|
||||||
|
limits:
|
||||||
|
memory: 1Gi
|
||||||
|
cpu: 1000m
|
||||||
|
|
||||||
|
trivy:
|
||||||
|
enabled: true
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
memory: 512Mi
|
||||||
|
cpu: 200m
|
||||||
|
limits:
|
||||||
|
memory: 2Gi
|
||||||
|
cpu: 1000m
|
||||||
|
|
||||||
|
destination:
|
||||||
|
server: https://kubernetes.default.svc
|
||||||
|
namespace: harbor
|
||||||
|
|
||||||
|
syncPolicy:
|
||||||
|
syncOptions:
|
||||||
|
- CreateNamespace=true
|
||||||
|
automated:
|
||||||
|
prune: false
|
||||||
|
selfHeal: true
|
||||||
18
apps/harbor/harbor-secrets-sealed.yaml
Normal file
18
apps/harbor/harbor-secrets-sealed.yaml
Normal file
|
|
@ -0,0 +1,18 @@
|
||||||
|
---
|
||||||
|
apiVersion: bitnami.com/v1alpha1
|
||||||
|
kind: SealedSecret
|
||||||
|
metadata:
|
||||||
|
creationTimestamp: null
|
||||||
|
name: harbor-secrets
|
||||||
|
namespace: harbor
|
||||||
|
spec:
|
||||||
|
encryptedData:
|
||||||
|
database.password: AgCS/v9ajG58l1fF7cegx/pQLn4jBgJD3ixVDbQow2f0o6FvKXJK2na7IBdvaoE3rP5xO8BygQkU3z/Dq6TKKp5AuU1mcevkM5gIE2YRP4ZkXaChFhdGnZa6fAp1wU+K2rHKbGM2vNHUFXznHEogemD4IvSOJuiKJfx9ezUNCz+n3v1i3U/5R1j8CmJX/nXxzZRocMl0yJrSbBFsObU87MlO0I0L5pwQwoXRiW8WL3Dl9AJtd6EGvR8AvBQVYXzS3ke7F9mgC/fm4cTkfliHeGUUIylx48/Jr5zkdj6qNDr6q46+XzhKIzDkQrkY9fJVrmWeZoLhws5F9SpNWBbfwYSM266mlzWafEFIDjYIlgl4bGovnKceT6Ezh2ltPvQ6l/ppO95TH/A3HjzrSRH6Oo+rw4d+OE9skFz3KUgtOZHTFbEzAUiMSSL8g5T2AAyN1nG5JnJm4fx45RWR+JCbddtrBA9R+UwRfMYbYXYxCbqYBINgWzgeal0O2Qd7jnJROOZlLOZGPl4PwN8NNqfWfVTkw4we2/vDXzCG70/zS/pY0Q47lNAjdQOn8WakfuumT3PkhQM6739qeTM3no/Ga7xG9OmjvroDEokdRnhI4HZf4KcbdvtAZcsV3KD6WoHhTULtK8C/4+cb/Bj1QIz/UQ0/ZF2oahLpCwQyDRxBOUfZB/G1PMPZbwg8LkgCKit1RDGOVuMD25TOKhm9W7ONsJrJ55h+pcNBc7/TcNv4mtNMlWh8dYfMFeKsyCw8vg==
|
||||||
|
harborAdminPassword: AgBTLxpA5ygiVNj5ADtI1/2w2fSdbYPwBOVmCkj7FodimXl5vCoNKnd0rO7t8SPW+1SDDvQsOjekhWaqkMEIm4rLtRpRU1TWWuVG6UkWID3aBwWBqOafMD11Wvq/uQrlYuQLmj2pKPRZxfODCWUxNEC9vZXAucCL8EzXlgYXy+P0ZX3vbj4/nnnPDYC4vfxl0/dLdVubNTfoBhZ8GA2waPVHuQRZKJCqFaHt2RAdXFzuGmuu0jIa7bf3Izr2CzAKkhz515E4TOtDitFNQOJExUCf/14NqKp142s1/4KtB9iuUSYodswKyJGtAtVGRPIGjkYB1a37RFbqVvP3RN5Bx99cH8Wdj816l4y+Qq0mvg/arClLggOtDZZKMsd5QXaPkTVlyBKItNhfDjDgk+G8rzzNwspN73BS6CRS6tWu1BGufsWmnfm/vSCdkw/EjuoPj5LOyWkPdhrJxK+dgvr5zYfw+/mISXucMy4SQDFuSbp9reBqE329nJolyUuRQFxx2hGKm7KIB0vFRi62cH2mBmfG//d79eq/4hSCPMNola8SJ0neWvvaJkR491LLN5Pus9zFcOHNSy/i+lpXs19ZMacLeL/X4yuq7neiFTaMtKIcJ/rQSwGxf9lDcC2jadi3AlSmRP6Va3XwNm7FEP83bRUV5pScLlnwY+EqgB7GdAC+2Bd+Ls3Hb5mc2JoNZnpZi9A1Y+108NWtvnjBMbFwp/seHXZqRUwrlhNq2R/cXdPRJLVnY2U+NRtEYTfivg==
|
||||||
|
oidc.clientSecret: AgCNjio841Vsf+UysN38gKTD+E1QknD5Wmsfp3IKoqvmChI3brEfTSjb4pROAcSscVnC/WHQbl73J1PJIj8YPs7173nn8gJDBnoIIjlVM3p33RdzWwljgb8MRCFXZ2fjimYE2DwcdIy3Izcyf/6m2w01xIcNY4GpHcKpcwA9LoZ/oGxzkPrZx7FOmDKpi3mN27eBfKbhvpVuIL+KhT40z1G8F3C6khA5cg2hiyPbQgWhcbDLhOCUZCTcqKeUJ7VWwYS1D9kNE05V+rWJJqfV/jvjHJ12ajwUSSkpHG5fjPq1eVuikkCzhXZyxSAocmtMt5Jspve1dz5AqEiw5EkH6Tb4EVfLYqCY6IJH9LAs1+8+8ETrszMRdCEZLSQhcAWXNVbURPcoJRUeSI9qQMBECdG7QVP0S6VQ8hAMadtJ1VnDHcF1lLFKKLDPLiNvnqz0FlO4gCYH193gNbfOqoSQkidwpzVX0aRWZUyBwMbS9umbrFrvZQ/hzj7U+7SIxVHoYvLAigw8gzy3ZyA8qkttddayZlO9pDvSBlNW6QbdTVn9Iag4rjgpkBvXv5MTHUR4S4ICO5LDzAyPmkxmMpcl+gYd/xEuI59c7q+GMQCHyTMi8UpIX2zbPKa4WROFBb684dgOh2dZyYO4+Ywbaj99chXX6AtWLIBVHfVcVXYIZVgduqjNkCfmGUuV+gTOBDbu97RLOJ6p6woWZ9j9yDWOTBmA1npisiTr30da0fJWQRgFag==
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
creationTimestamp: null
|
||||||
|
name: harbor-secrets
|
||||||
|
namespace: harbor
|
||||||
|
type: Opaque
|
||||||
Loading…
Add table
Reference in a new issue