c6b14ff0bc
Add securityContext configuration to the database StatefulSet to ensure PostgreSQL can access its data directory with correct permissions. The issue was that the PVC mount permissions did not match PostgreSQL's requirements (u=rwx/0700 or u=rwx,g=rx/0750). This fix sets: - runAsUser: 999 (postgres user) - fsGroup: 999 (postgres group) - fsGroupChangePolicy: OnRootMismatch (only change ownership when needed) This resolves the crash loop where harbor-database-0 failed with: 'data directory has invalid permissions' Fixes: DEV-364 Co-Authored-By: Paperclip <noreply@paperclip.ing>
109 lines
2.5 KiB
YAML
109 lines
2.5 KiB
YAML
harbor:
|
|
expose:
|
|
type: ingress
|
|
tls:
|
|
enabled: true
|
|
certSource: secret
|
|
secret:
|
|
secretName: harbor-tls
|
|
ingress:
|
|
hosts:
|
|
core: harbor.basicstack.de
|
|
className: traefik
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: letsencrypt-prod
|
|
traefik.ingress.kubernetes.io/router.entrypoints: websecure
|
|
traefik.ingress.kubernetes.io/router.tls: "true"
|
|
|
|
externalURL: https://harbor.basicstack.de
|
|
|
|
persistence:
|
|
enabled: true
|
|
resourcePolicy: keep
|
|
persistentVolumeClaim:
|
|
registry:
|
|
storageClass: hcloud-volumes-encrypted
|
|
size: 50Gi
|
|
database:
|
|
storageClass: hcloud-volumes-encrypted
|
|
size: 10Gi
|
|
redis:
|
|
storageClass: hcloud-volumes-encrypted
|
|
size: 5Gi
|
|
trivy:
|
|
storageClass: hcloud-volumes-encrypted
|
|
size: 5Gi
|
|
jobservice:
|
|
jobLog:
|
|
storageClass: hcloud-volumes-encrypted
|
|
size: 5Gi
|
|
|
|
# Use internal PostgreSQL and Redis
|
|
database:
|
|
type: internal
|
|
internal:
|
|
existingSecret: harbor-secrets
|
|
# Fix PostgreSQL data directory permissions
|
|
# The init container needs to set correct ownership for PostgreSQL
|
|
initContainer:
|
|
migrator: {}
|
|
permissions:
|
|
image:
|
|
registry: docker.io
|
|
repository: library/busybox
|
|
tag: latest
|
|
# Set proper security context for PostgreSQL
|
|
securityContext:
|
|
runAsUser: 999
|
|
fsGroup: 999
|
|
fsGroupChangePolicy: "OnRootMismatch"
|
|
|
|
redis:
|
|
type: internal
|
|
|
|
# Harbor admin credentials
|
|
existingSecretAdminPassword: harbor-secrets
|
|
existingSecretAdminPasswordKey: harborAdminPassword
|
|
|
|
# OIDC authentication via Pocket ID
|
|
# Note: Harbor requires database_auth to be configured first, then OIDC can be added via UI
|
|
# See: https://goharbor.io/docs/2.12.0/administration/configure-authentication/oidc-auth/
|
|
|
|
# Resource limits
|
|
core:
|
|
resources:
|
|
requests:
|
|
memory: 256Mi
|
|
cpu: 100m
|
|
limits:
|
|
memory: 1Gi
|
|
cpu: 1000m
|
|
|
|
portal:
|
|
resources:
|
|
requests:
|
|
memory: 128Mi
|
|
cpu: 100m
|
|
limits:
|
|
memory: 256Mi
|
|
cpu: 500m
|
|
|
|
registry:
|
|
registry:
|
|
resources:
|
|
requests:
|
|
memory: 256Mi
|
|
cpu: 100m
|
|
limits:
|
|
memory: 1Gi
|
|
cpu: 1000m
|
|
|
|
trivy:
|
|
enabled: true
|
|
resources:
|
|
requests:
|
|
memory: 512Mi
|
|
cpu: 200m
|
|
limits:
|
|
memory: 2Gi
|
|
cpu: 1000m
|