60dc1ac0a0
Move Helm chart configuration from inline values in app-harbor.yaml to separate files in apps/harbor/ subdirectory, following the same pattern as forgejo and other apps. Changes: - Create apps/harbor/Chart.yaml defining dependency on Harbor Helm chart - Create apps/harbor/values.yaml with all Helm values configuration - Update app-harbor.yaml to use git path source instead of direct Helm chart - Add apps/harbor/README.md documenting OIDC setup procedure OIDC authentication must be configured via Harbor UI after deployment, as the Helm chart does not support OIDC configuration at deployment time. The README provides step-by-step instructions for Pocket ID integration. Co-Authored-By: Paperclip <noreply@paperclip.ing>
95 lines
2 KiB
YAML
95 lines
2 KiB
YAML
harbor:
|
|
expose:
|
|
type: ingress
|
|
tls:
|
|
enabled: true
|
|
certSource: secret
|
|
secret:
|
|
secretName: harbor-tls
|
|
ingress:
|
|
hosts:
|
|
core: harbor.basicstack.de
|
|
className: traefik
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: letsencrypt-prod
|
|
traefik.ingress.kubernetes.io/router.entrypoints: websecure
|
|
traefik.ingress.kubernetes.io/router.tls: "true"
|
|
|
|
externalURL: https://harbor.basicstack.de
|
|
|
|
persistence:
|
|
enabled: true
|
|
resourcePolicy: keep
|
|
persistentVolumeClaim:
|
|
registry:
|
|
storageClass: hcloud-volumes-encrypted
|
|
size: 50Gi
|
|
database:
|
|
storageClass: hcloud-volumes-encrypted
|
|
size: 10Gi
|
|
redis:
|
|
storageClass: hcloud-volumes-encrypted
|
|
size: 5Gi
|
|
trivy:
|
|
storageClass: hcloud-volumes-encrypted
|
|
size: 5Gi
|
|
jobservice:
|
|
jobLog:
|
|
storageClass: hcloud-volumes-encrypted
|
|
size: 5Gi
|
|
|
|
# Use internal PostgreSQL and Redis
|
|
database:
|
|
type: internal
|
|
internal:
|
|
existingSecret: harbor-secrets
|
|
|
|
redis:
|
|
type: internal
|
|
|
|
# Harbor admin credentials
|
|
existingSecretAdminPassword: harbor-secrets
|
|
existingSecretAdminPasswordKey: harborAdminPassword
|
|
|
|
# OIDC authentication via Pocket ID
|
|
# Note: Harbor requires database_auth to be configured first, then OIDC can be added via UI
|
|
# See: https://goharbor.io/docs/2.12.0/administration/configure-authentication/oidc-auth/
|
|
|
|
# Resource limits
|
|
core:
|
|
resources:
|
|
requests:
|
|
memory: 256Mi
|
|
cpu: 100m
|
|
limits:
|
|
memory: 1Gi
|
|
cpu: 1000m
|
|
|
|
portal:
|
|
resources:
|
|
requests:
|
|
memory: 128Mi
|
|
cpu: 100m
|
|
limits:
|
|
memory: 256Mi
|
|
cpu: 500m
|
|
|
|
registry:
|
|
registry:
|
|
resources:
|
|
requests:
|
|
memory: 256Mi
|
|
cpu: 100m
|
|
limits:
|
|
memory: 1Gi
|
|
cpu: 1000m
|
|
|
|
trivy:
|
|
enabled: true
|
|
resources:
|
|
requests:
|
|
memory: 512Mi
|
|
cpu: 200m
|
|
limits:
|
|
memory: 2Gi
|
|
cpu: 1000m
|