56e598f66c
Harbor's jobservice and registry Deployments have RWO PVCs (Hetzner
Cloud Volumes). The default RollingUpdate strategy deadlocks: the new
pod cannot attach the volume while the old pod still holds it on a
different node. This has left the harbor Argo CD Application in a
Degraded state since 2026-08-07.
The goharbor chart exposes a top-level updateStrategy specifically for
this case ("Set it as Recreate when RWM for volumes isn't supported").
Refs DEV-458.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
115 lines
2.7 KiB
YAML
115 lines
2.7 KiB
YAML
harbor:
|
|
expose:
|
|
type: ingress
|
|
tls:
|
|
enabled: true
|
|
certSource: secret
|
|
secret:
|
|
secretName: harbor-tls
|
|
ingress:
|
|
hosts:
|
|
core: harbor.basicstack.de
|
|
className: traefik
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: letsencrypt-prod
|
|
traefik.ingress.kubernetes.io/router.entrypoints: websecure
|
|
traefik.ingress.kubernetes.io/router.tls: "true"
|
|
|
|
externalURL: https://harbor.basicstack.de
|
|
|
|
# Hetzner Cloud Volumes are ReadWriteOnce; RollingUpdate deadlocks on
|
|
# jobservice/registry rollouts because the new pod cannot attach the PVC
|
|
# while the old pod still holds it on another node (DEV-458).
|
|
updateStrategy:
|
|
type: Recreate
|
|
|
|
persistence:
|
|
enabled: true
|
|
resourcePolicy: keep
|
|
persistentVolumeClaim:
|
|
registry:
|
|
storageClass: hcloud-volumes-encrypted
|
|
size: 50Gi
|
|
database:
|
|
storageClass: hcloud-volumes-encrypted
|
|
size: 10Gi
|
|
redis:
|
|
storageClass: hcloud-volumes-encrypted
|
|
size: 5Gi
|
|
trivy:
|
|
storageClass: hcloud-volumes-encrypted
|
|
size: 5Gi
|
|
jobservice:
|
|
jobLog:
|
|
storageClass: hcloud-volumes-encrypted
|
|
size: 5Gi
|
|
|
|
# Use internal PostgreSQL and Redis
|
|
database:
|
|
type: internal
|
|
internal:
|
|
existingSecret: harbor-secrets
|
|
# Fix PostgreSQL data directory permissions
|
|
# The init container needs to set correct ownership for PostgreSQL
|
|
initContainer:
|
|
migrator: {}
|
|
permissions:
|
|
image:
|
|
registry: docker.io
|
|
repository: library/busybox
|
|
tag: latest
|
|
# Set proper security context for PostgreSQL
|
|
securityContext:
|
|
runAsUser: 999
|
|
fsGroup: 999
|
|
fsGroupChangePolicy: "OnRootMismatch"
|
|
|
|
redis:
|
|
type: internal
|
|
|
|
# Harbor admin credentials
|
|
existingSecretAdminPassword: harbor-secrets
|
|
existingSecretAdminPasswordKey: harborAdminPassword
|
|
|
|
# OIDC authentication via Pocket ID
|
|
# Note: Harbor requires database_auth to be configured first, then OIDC can be added via UI
|
|
# See: https://goharbor.io/docs/2.12.0/administration/configure-authentication/oidc-auth/
|
|
|
|
# Resource limits
|
|
core:
|
|
resources:
|
|
requests:
|
|
memory: 256Mi
|
|
cpu: 100m
|
|
limits:
|
|
memory: 1Gi
|
|
cpu: 1000m
|
|
|
|
portal:
|
|
resources:
|
|
requests:
|
|
memory: 128Mi
|
|
cpu: 100m
|
|
limits:
|
|
memory: 256Mi
|
|
cpu: 500m
|
|
|
|
registry:
|
|
registry:
|
|
resources:
|
|
requests:
|
|
memory: 256Mi
|
|
cpu: 100m
|
|
limits:
|
|
memory: 1Gi
|
|
cpu: 1000m
|
|
|
|
trivy:
|
|
enabled: true
|
|
resources:
|
|
requests:
|
|
memory: 512Mi
|
|
cpu: 200m
|
|
limits:
|
|
memory: 2Gi
|
|
cpu: 1000m
|