ec3e9624b3
- velero/schedules/: cluster-all @ 03:00 (30d TTL, manifests only), per-namespace <ns>-manifests @ 03:15+n min (30 in-scope namespaces, 30d TTL, no fs backup), and per-namespace <ns>-data @ 03:45+n min for the whitelist (pocket-id, vaultwarden, vikunja, passbolt; 14d TTL, defaultVolumesToFsBackup=true). - All schedules exclude velero, kube-system, kube-node-lease, kube-public so the Kopia password Secret never lands in S3. - apps/app-velero-schedules.yaml: sibling Argo app syncing that directory into namespace velero with prune+selfHeal. - opencloud, harbor(registry+trivy): pod-template annotation backup.velero.io/backup-volumes-excludes as a safety net so blob- heavy PVCs are never fs-backed-up even under a manual defaultVolumes run. nextcloud/monitoring workloads are not Argo-tracked yet — they were patched live in the same commit but need a follow-up to source- control them. Co-Authored-By: Paperclip <noreply@paperclip.ing>
121 lines
3 KiB
YAML
121 lines
3 KiB
YAML
harbor:
|
|
expose:
|
|
type: ingress
|
|
tls:
|
|
enabled: true
|
|
certSource: secret
|
|
secret:
|
|
secretName: harbor-tls
|
|
ingress:
|
|
hosts:
|
|
core: harbor.basicstack.de
|
|
className: traefik
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: letsencrypt-prod
|
|
traefik.ingress.kubernetes.io/router.entrypoints: websecure
|
|
traefik.ingress.kubernetes.io/router.tls: "true"
|
|
|
|
externalURL: https://harbor.basicstack.de
|
|
|
|
# Hetzner Cloud Volumes are ReadWriteOnce; RollingUpdate deadlocks on
|
|
# jobservice/registry rollouts because the new pod cannot attach the PVC
|
|
# while the old pod still holds it on another node (DEV-458).
|
|
updateStrategy:
|
|
type: Recreate
|
|
|
|
persistence:
|
|
enabled: true
|
|
resourcePolicy: keep
|
|
persistentVolumeClaim:
|
|
registry:
|
|
storageClass: hcloud-volumes-encrypted
|
|
size: 50Gi
|
|
database:
|
|
storageClass: hcloud-volumes-encrypted
|
|
size: 10Gi
|
|
redis:
|
|
storageClass: hcloud-volumes-encrypted
|
|
size: 5Gi
|
|
trivy:
|
|
storageClass: hcloud-volumes-encrypted
|
|
size: 5Gi
|
|
jobservice:
|
|
jobLog:
|
|
storageClass: hcloud-volumes-encrypted
|
|
size: 5Gi
|
|
|
|
# Use internal PostgreSQL and Redis
|
|
database:
|
|
type: internal
|
|
internal:
|
|
existingSecret: harbor-secrets
|
|
# Fix PostgreSQL data directory permissions
|
|
# The init container needs to set correct ownership for PostgreSQL
|
|
initContainer:
|
|
migrator: {}
|
|
permissions:
|
|
image:
|
|
registry: docker.io
|
|
repository: library/busybox
|
|
tag: latest
|
|
# Set proper security context for PostgreSQL
|
|
securityContext:
|
|
runAsUser: 999
|
|
fsGroup: 999
|
|
fsGroupChangePolicy: "OnRootMismatch"
|
|
|
|
redis:
|
|
type: internal
|
|
|
|
# Harbor admin credentials
|
|
existingSecretAdminPassword: harbor-secrets
|
|
existingSecretAdminPasswordKey: harborAdminPassword
|
|
|
|
# OIDC authentication via Pocket ID
|
|
# Note: Harbor requires database_auth to be configured first, then OIDC can be added via UI
|
|
# See: https://goharbor.io/docs/2.12.0/administration/configure-authentication/oidc-auth/
|
|
|
|
# Resource limits
|
|
core:
|
|
resources:
|
|
requests:
|
|
memory: 256Mi
|
|
cpu: 100m
|
|
limits:
|
|
memory: 1Gi
|
|
cpu: 1000m
|
|
|
|
portal:
|
|
resources:
|
|
requests:
|
|
memory: 128Mi
|
|
cpu: 100m
|
|
limits:
|
|
memory: 256Mi
|
|
cpu: 500m
|
|
|
|
registry:
|
|
# Skip Kopia fs-backup of the registry blob PVC (DEV-573 safety net).
|
|
podAnnotations:
|
|
backup.velero.io/backup-volumes-excludes: registry-data
|
|
registry:
|
|
resources:
|
|
requests:
|
|
memory: 256Mi
|
|
cpu: 100m
|
|
limits:
|
|
memory: 1Gi
|
|
cpu: 1000m
|
|
|
|
trivy:
|
|
enabled: true
|
|
# Skip Kopia fs-backup of the trivy scan cache PVC (DEV-573 safety net).
|
|
podAnnotations:
|
|
backup.velero.io/backup-volumes-excludes: data
|
|
resources:
|
|
requests:
|
|
memory: 512Mi
|
|
cpu: 200m
|
|
limits:
|
|
memory: 2Gi
|
|
cpu: 1000m
|