daa8112e27
- Created Argo CD Application for Harbor (app-harbor.yaml) - Configured Harbor Helm chart with: - Ingress at harbor.basicstack.de with TLS via cert-manager - PVCs using hcloud-volumes-encrypted storage class - OIDC authentication via Pocket ID - Resource limits for all components - Created sealed secret with Harbor admin password, database password, and OIDC client secret - Configured DNS A record for harbor.basicstack.de -> 178.105.17.239 - Created Pocket ID OIDC client for Harbor with callback URL Harbor will be available at https://harbor.basicstack.de after Argo CD sync. Co-Authored-By: Paperclip <noreply@paperclip.ing>
129 lines
3.2 KiB
YAML
129 lines
3.2 KiB
YAML
apiVersion: argoproj.io/v1alpha1
|
|
kind: Application
|
|
metadata:
|
|
name: harbor
|
|
namespace: argocd
|
|
spec:
|
|
project: default
|
|
source:
|
|
repoURL: https://helm.goharbor.io
|
|
chart: harbor
|
|
targetRevision: 1.16.1
|
|
helm:
|
|
valuesObject:
|
|
expose:
|
|
type: ingress
|
|
tls:
|
|
enabled: true
|
|
certSource: secret
|
|
secret:
|
|
secretName: harbor-tls
|
|
ingress:
|
|
hosts:
|
|
core: harbor.basicstack.de
|
|
className: traefik
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: letsencrypt-prod
|
|
traefik.ingress.kubernetes.io/router.entrypoints: websecure
|
|
traefik.ingress.kubernetes.io/router.tls: "true"
|
|
externalURL: https://harbor.basicstack.de
|
|
|
|
persistence:
|
|
enabled: true
|
|
resourcePolicy: keep
|
|
persistentVolumeClaim:
|
|
registry:
|
|
storageClass: hcloud-volumes-encrypted
|
|
size: 50Gi
|
|
database:
|
|
storageClass: hcloud-volumes-encrypted
|
|
size: 10Gi
|
|
redis:
|
|
storageClass: hcloud-volumes-encrypted
|
|
size: 5Gi
|
|
trivy:
|
|
storageClass: hcloud-volumes-encrypted
|
|
size: 5Gi
|
|
jobservice:
|
|
jobLog:
|
|
storageClass: hcloud-volumes-encrypted
|
|
size: 5Gi
|
|
|
|
# Use internal PostgreSQL and Redis
|
|
database:
|
|
type: internal
|
|
internal:
|
|
existingSecret: harbor-secrets
|
|
|
|
redis:
|
|
type: internal
|
|
|
|
# Harbor admin credentials
|
|
existingSecretAdminPassword: harbor-secrets
|
|
existingSecretAdminPasswordKey: harborAdminPassword
|
|
|
|
# Enable OIDC authentication
|
|
authMode: oidc_auth
|
|
oidc:
|
|
name: PocketID
|
|
endpoint: https://auth.basicstack.de
|
|
clientId: harbor
|
|
clientSecret: "" # Will be loaded from secret
|
|
groupsClaim: groups
|
|
adminGroup: admins
|
|
scope: openid,profile,email,groups
|
|
autoOnboard: true
|
|
userClaim: email
|
|
verifyCert: true
|
|
existingSecretOIDC: harbor-secrets
|
|
existingSecretOIDCKey: oidc.clientSecret
|
|
|
|
# Resource limits
|
|
core:
|
|
resources:
|
|
requests:
|
|
memory: 256Mi
|
|
cpu: 100m
|
|
limits:
|
|
memory: 1Gi
|
|
cpu: 1000m
|
|
|
|
portal:
|
|
resources:
|
|
requests:
|
|
memory: 128Mi
|
|
cpu: 100m
|
|
limits:
|
|
memory: 256Mi
|
|
cpu: 500m
|
|
|
|
registry:
|
|
registry:
|
|
resources:
|
|
requests:
|
|
memory: 256Mi
|
|
cpu: 100m
|
|
limits:
|
|
memory: 1Gi
|
|
cpu: 1000m
|
|
|
|
trivy:
|
|
enabled: true
|
|
resources:
|
|
requests:
|
|
memory: 512Mi
|
|
cpu: 200m
|
|
limits:
|
|
memory: 2Gi
|
|
cpu: 1000m
|
|
|
|
destination:
|
|
server: https://kubernetes.default.svc
|
|
namespace: harbor
|
|
|
|
syncPolicy:
|
|
syncOptions:
|
|
- CreateNamespace=true
|
|
automated:
|
|
prune: false
|
|
selfHeal: true
|