devbox
酷酷是懒虫
这个屌丝很懒，什么也没留下！
关注作者
热门标签
热门文章
当前位置:   article > 正文

k8s上部署Harbor通过Nginx-Ingress域名访问_harbor ingress

作者：酷酷是懒虫 | 2024-08-14 01:39:18

赞

踩

harbor ingress

目录

1、k8s集群环境，通过kubesphere安装部署。

1.1 集群基本信息

 1.2 集群节点信息

 2、安装Harbor

2.1、使用Helm添加Harbor仓库

 2.2 、通过openssl生成证书

2.3、 创建secret

 2.4、 创建nfs存储目录

 2.5、 创建pv

 2.6、创建pvc

2.7、values.yaml配置文件

2.8、部署执行命令

2.9、编辑ingress文件，类型vim操作

 2.9.1、部署nginx-ingress-controller

2.9.2、查看配置Ingress的配置结果

3、访问

3.1、window配置hosts

 3.2、访问地址

1、k8s集群环境，通过kubesphere安装部署。

1.1 集群基本信息

 1.2 集群节点信息

 2、安装Harbor

2.1、使用Helm添加Harbor仓库

  1. helm repo add harbor https://helm.goharbor.io
  2. helm pull harbor/harbor

运行上面命令，得到文件harbor-1.10.2.tgz，将文件解压，并重命名为harbor。

 2.2 、通过openssl生成证书

harbor目录下存在cert，执行cp -r cert bak，对默认的cert文件进行备份。

  1. cd cert
  2.  
  3. openssl genrsa -des3 -passout pass:over4chars -out tls.pass.key 2048
  4. ...
  5. openssl rsa -passin pass:over4chars -in tls.pass.key -out tls.key
  6. # Writing RSA key
  7.  
  8. rm -rf tls.pass.key
  9.  
  10. openssl req -new -key tls.key -out tls.csr
  11. ...
  12. If you enter '.', the field will be left blank.
  13. -----
  14. Country Name (2 letter code) [XX]:CN
  15. State or Province Name (full name) []:Beijing
  16. Locality Name (eg, city) [Default City]:Beijing
  17. Organization Name (eg, company) [Default Company Ltd]:liebe
  18. Organizational Unit Name (eg, section) []:liebe
  19. Common Name (eg, your name or your server's hostname) []:harbon.liebe.com.cn
  20. Email Address []:你的邮箱地址
  22. Please enter the following 'extra' attributes
  23. to be sent with your certificate request
  24. A challenge password []:talent
  25. An optional company name []:liebe
  27. 生成 SSL 证书
  28. 自签名 SSL 证书是从私钥和文件生成的。tls.keytls.csr
  29. openssl x509 -req -sha256 -days 365 -in tls.csr -signkey tls.key -out tls.crt

2.3、 创建secret

           执行命令

kubectl create secret tls harbor.liebe.com.cn --key tls.key --cert tls.crt -n pig-dev

         查看创建结果

kubectl get secret -n pig-dev

 2.4、 创建nfs存储目录

  1.   mkdir -p /home/data/nfs-share/harbor/registry
  2.   mkdir -p /home/data/nfs-share/harbor/chartmuseum
  3.   mkdir -p /home/data/nfs-share/harbor/jobservice
  4.   mkdir -p /home/data/nfs-share/harbor/database
  5.   mkdir -p /home/data/nfs-share/harbor/redis
  6.   mkdir -p /home/data/nfs-share/harbor/trivy  
  7.   mkdir -p /home/data/nfs-share/harbor/jobservicedata
  8.   mkdir -p /home/data/nfs-share/harbor/jobservicelog
  9.   chmod 777 /home/data/nfs-share/harbor/*

 2.5、 创建pv

  1. #第1个
  2. apiVersion: v1
  3. kind: PersistentVolume
  4. metadata:
  5.   name: harbor-registry
  6.   namespace: pig-dev
  7.   labels:
  8.     app: harbor-registry
  9. spec:
  10.   capacity:
  11.     storage: 150Gi
  12.   accessModes:
  13.     - ReadWriteOnce
  14.   persistentVolumeReclaimPolicy: Retain
  15.   storageClassName: "managed-nfs-storage"
  16.   mountOptions:
  17.     - hard
  18.   nfs:
  19.     path: /home/data/nfs-share/harbor/registry
  20.     server: 10.10.10.89
  21. ---
  22. #第2个
  23. apiVersion: v1
  24. kind: PersistentVolume
  25. metadata:
  26.   name: harbor-chartmuseum
  27.   namespace: pig-dev
  28.   labels:
  29.     app: harbor-chartmuseum
  30. spec:
  31.   capacity:
  32.     storage: 10G
  33.   accessModes:
  34.     - ReadWriteOnce
  35.   persistentVolumeReclaimPolicy: Retain
  36.   storageClassName: "managed-nfs-storage"
  37.   mountOptions:
  38.     - hard
  39.   nfs:
  40.     path: /home/data/nfs-share/harbor/chartmuseum
  41.     server: 10.10.10.89
  42. ---
  43. #第3个
  44. apiVersion: v1
  45. kind: PersistentVolume
  46. metadata:
  47.   name: harbor-jobservicelog
  48.   namespace: pig-dev
  49.   labels:
  50.     app: harbor-jobservicelog
  51. spec:
  52.   capacity:
  53.     storage: 10G
  54.   accessModes:
  55.     - ReadWriteOnce
  56.   persistentVolumeReclaimPolicy: Retain
  57.   storageClassName: "managed-nfs-storage"
  58.   mountOptions:
  59.     - hard
  60.   nfs:
  61.     path: /home/data/nfs-share/harbor/jobservicelog
  62.     server: 10.10.10.89
  63. ---
  64. apiVersion: v1
  65. kind: PersistentVolume
  66. metadata:
  67.   name: harbor-jobservicedata
  68.   namespace: pig-dev
  69.   labels:
  70.     app: harbor-jobservicedata
  71. spec:
  72.   capacity:
  73.     storage: 10G
  74.   accessModes:
  75.     - ReadWriteOnce
  76.   persistentVolumeReclaimPolicy: Retain
  77.   storageClassName: "managed-nfs-storage"
  78.   mountOptions:
  79.     - hard
  80.   nfs:
  81.     path: /home/data/nfs-share/harbor/jobservicedata
  82.     server: 10.10.10.89
  83. ---
  84. #第4个
  85. apiVersion: v1
  86. kind: PersistentVolume
  87. metadata:
  88.   name: harbor-database
  89.   namespace: pig-dev
  90.   labels:
  91.     app: harbor-database
  92. spec:
  93.   capacity:
  94.     storage: 10G
  95.   accessModes:
  96.     - ReadWriteOnce
  97.   persistentVolumeReclaimPolicy: Retain
  98.   storageClassName: "managed-nfs-storage"
  99.   mountOptions:
  100.     - hard
  101.   nfs:
  102.     path: /home/data/nfs-share/harbor/database
  103.     server: 10.10.10.89
  104. ---
  105. #第5个
  106. apiVersion: v1
  107. kind: PersistentVolume
  108. metadata:
  109.   name: harbor-redis
  110.   namespace: pig-dev
  111.   labels:
  112.     app: harbor-redis
  113. spec:
  114.   capacity:
  115.     storage: 10G
  116.   accessModes:
  117.     - ReadWriteOnce
  118.   persistentVolumeReclaimPolicy: Retain
  119.   storageClassName: "managed-nfs-storage"
  120.   mountOptions:
  121.     - hard
  122.   nfs:
  123.     path: /home/data/nfs-share/harbor/redis
  124.     server: 10.10.10.89
  125. ---
  126. #第6个
  127. apiVersion: v1
  128. kind: PersistentVolume
  129. metadata:
  130.   name: harbor-trivy
  131.   namespace: pig-dev
  132.   labels:
  133.     app: harbor-trivy
  134. spec:
  135.   capacity:
  136.     storage: 10G
  137.   accessModes:
  138.     - ReadWriteOnce
  139.   persistentVolumeReclaimPolicy: Retain
  140.   storageClassName: "managed-nfs-storage"
  141.   mountOptions:
  142.     - hard
  143.   nfs:
  144.     path: /home/data/nfs-share/harbor/trivy
  145.     server: 10.10.10.89

 2.6、创建pvc

  1. #第1个
  2. kind: PersistentVolumeClaim
  3. apiVersion: v1
  4. metadata:
  5.   name: harbor-registry
  6.   namespace: pig-dev
  7. spec:
  8.   accessModes:
  9.     - ReadWriteOnce
  10.   storageClassName: "managed-nfs-storage"
  11.   resources:
  12.     requests:
  13.       storage: 150Gi
  14. ---
  15. #第2个
  16. kind: PersistentVolumeClaim
  17. apiVersion: v1
  18. metadata:
  19.   name: harbor-chartmuseum
  20.   namespace: pig-dev
  21. spec:
  22.   accessModes:
  23.     - ReadWriteOnce
  24.   storageClassName: "managed-nfs-storage"
  25.   resources:
  26.     requests:
  27.       storage: 10Gi
  28. ---
  29. #第3个
  30. kind: PersistentVolumeClaim
  31. apiVersion: v1
  32. metadata:
  33.   name: harbor-jobservicelog
  34.   namespace: pig-dev
  35. spec:
  36.   accessModes:
  37.     - ReadWriteOnce
  38.   storageClassName: "managed-nfs-storage"
  39.   resources:
  40.     requests:
  41.       storage: 5Gi
  42. ---
  43. kind: PersistentVolumeClaim
  44. apiVersion: v1
  45. metadata:
  46.   name: harbor-jobservicedata
  47.   namespace: pig-dev
  48. spec:
  49.   accessModes:
  50.     - ReadWriteOnce
  51.   storageClassName: "managed-nfs-storage"
  52.   resources:
  53.     requests:
  54.       storage: 5Gi
  55. ---
  56. #第4个
  57. kind: PersistentVolumeClaim
  58. apiVersion: v1
  59. metadata:
  60.   name: harbor-database
  61.   namespace: pig-dev
  62. spec:
  63.   accessModes:
  64.     - ReadWriteOnce
  65.   storageClassName: "managed-nfs-storage"
  66.   resources:
  67.     requests:
  68.       storage: 10Gi
  69. ---
  70. #第5个
  71. kind: PersistentVolumeClaim
  72. apiVersion: v1
  73. metadata:
  74.   name: harbor-redis
  75.   namespace: pig-dev
  76. spec:
  77.   accessModes:
  78.     - ReadWriteOnce
  79.   storageClassName: "managed-nfs-storage"
  80.   resources:
  81.     requests:
  82.       storage: 10Gi
  83. ---
  84. #第6个
  85. kind: PersistentVolumeClaim
  86. apiVersion: v1
  87. metadata:
  88.   name: harbor-trivy
  89.   namespace: pig-dev
  90. spec:
  91.   accessModes:
  92.     - ReadWriteOnce
  93.   storageClassName: "managed-nfs-storage"
  94.   resources:
  95.     requests:
  96.       storage: 10Gi

2.7、values.yaml配置文件

  1. expose:
  2.   # Set how to expose the service. Set the type as "ingress", "clusterIP", "nodePort" or "loadBalancer"
  3.   # and fill the information in the corresponding section
  4.   type: ingress
  5.   tls:
  6.     # Enable TLS or not.
  7.     # Delete the "ssl-redirect" annotations in "expose.ingress.annotations" when TLS is disabled and "expose.type" is "ingress"
  8.     # Note: if the "expose.type" is "ingress" and TLS is disabled,
  9.     # the port must be included in the command when pulling/pushing images.
  10.     # Refer to https://github.com/goharbor/harbor/issues/5291 for details.
  11.     enabled: true
  12.     # The source of the tls certificate. Set as "auto", "secret"
  13.     # or "none" and fill the information in the corresponding section
  14.     # 1) auto: generate the tls certificate automatically
  15.     # 2) secret: read the tls certificate from the specified secret.
  16.     # The tls certificate can be generated manually or by cert manager
  17.     # 3) none: configure no tls certificate for the ingress. If the default
  18.     # tls certificate is configured in the ingress controller, choose this option
  19.     certSource: "secret"
  20.     auto:
  21.       # The common name used to generate the certificate, it's necessary
  22.       # when the type isn't "ingress"
  23.       commonName: ""
  24.     secret:
  25.       # The name of secret which contains keys named:
  26.       # "tls.crt" - the certificate
  27.       # "tls.key" - the private key
  28.       secretName: "harbor.liebe.com.cn"
  29.       # The name of secret which contains keys named:
  30.       # "tls.crt" - the certificate
  31.       # "tls.key" - the private key
  32.       # Only needed when the "expose.type" is "ingress".
  33.       notarySecretName: "harbor.liebe.com.cn"
  34.   ingress:
  35.     hosts:
  36.       core: harbor.liebe.com.cn
  37.       notary: notary-harbor.liebe.com.cn
  38.     # set to the type of ingress controller if it has specific requirements.
  39.     # leave as `default` for most ingress controllers.
  40.     # set to `gce` if using the GCE ingress controller
  41.     # set to `ncp` if using the NCP (NSX-T Container Plugin) ingress controller
  42.     # set to `alb` if using the ALB ingress controller
  43.     controller: default
  44.     ## Allow .Capabilities.KubeVersion.Version to be overridden while creating ingress
  45.     kubeVersionOverride: ""
  46.     className: ""
  47.     annotations:
  48.       # note different ingress controllers may require a different ssl-redirect annotation
  49.       # for Envoy, use ingress.kubernetes.io/force-ssl-redirect: "true" and remove the nginx lines below
  50.       ingress.kubernetes.io/ssl-redirect: "true"
  51.       ingress.kubernetes.io/proxy-body-size: "1024m"
  52.       #### 如果是 traefik ingress，则按下面配置：
  53. #      kubernetes.io/ingress.class: "traefik"
  54. #      traefik.ingress.kubernetes.io/router.tls: 'true'
  55. #      traefik.ingress.kubernetes.io/router.entrypoints: websecure
  56.       #### 如果是 nginx ingress，则按下面配置：
  57.       nginx.ingress.kubernetes.io/ssl-redirect: "true"
  58.       nginx.ingress.kubernetes.io/proxy-body-size: "1024m"
  59.       nginx.org/client-max-body-size: "1024m"
  60.     notary:
  61.       # notary ingress-specific annotations
  62.       annotations: {}
  63.       # notary ingress-specific labels
  64.       labels: {}
  65.     harbor:
  66.       # harbor ingress-specific annotations
  67.       annotations: {}
  68.       # harbor ingress-specific labels
  69.       labels: {}
  70.   clusterIP:
  71.     # The name of ClusterIP service
  72.     name: harbor
  73.     # Annotations on the ClusterIP service
  74.     annotations: {}
  75.     ports:
  76.       # The service port Harbor listens on when serving HTTP
  77.       httpPort: 80
  78.       # The service port Harbor listens on when serving HTTPS
  79.       httpsPort: 443
  80.       # The service port Notary listens on. Only needed when notary.enabled
  81.       # is set to true
  82.       notaryPort: 4443
  83.   nodePort:
  84.     # The name of NodePort service
  85.     name: harbor
  86.     ports:
  87.       http:
  88.         # The service port Harbor listens on when serving HTTP
  89.         port: 80
  90.         # The node port Harbor listens on when serving HTTP
  91.         nodePort: 30102
  92.       https:
  93.         # The service port Harbor listens on when serving HTTPS
  94.         port: 443
  95.         # The node port Harbor listens on when serving HTTPS
  96.         nodePort: 30103
  97.       # Only needed when notary.enabled is set to true
  98.       notary:
  99.         # The service port Notary listens on
  100.         port: 4443
  101.         # The node port Notary listens on
  102.         nodePort: 30104
  103.   loadBalancer:
  104.     # The name of LoadBalancer service
  105.     name: harbor
  106.     # Set the IP if the LoadBalancer supports assigning IP
  107.     IP: ""
  108.     ports:
  109.       # The service port Harbor listens on when serving HTTP
  110.       httpPort: 80
  111.       # The service port Harbor listens on when serving HTTPS
  112.       httpsPort: 443
  113.       # The service port Notary listens on. Only needed when notary.enabled
  114.       # is set to true
  115.       notaryPort: 4443
  116.     annotations: {}
  117.     sourceRanges: []
  118.  
  119. # The external URL for Harbor core service. It is used to
  120. # 1) populate the docker/helm commands showed on portal
  121. # 2) populate the token service URL returned to docker/notary client
  122. #
  123. # Format: protocol://domain[:port]. Usually:
  124. # 1) if "expose.type" is "ingress", the "domain" should be
  125. # the value of "expose.ingress.hosts.core"
  126. # 2) if "expose.type" is "clusterIP", the "domain" should be
  127. # the value of "expose.clusterIP.name"
  128. # 3) if "expose.type" is "nodePort", the "domain" should be
  129. # the IP address of k8s node
  130. #
  131. # If Harbor is deployed behind the proxy, set it as the URL of proxy
  132. externalURL: https://harbor.liebe.com.cn
  133.  
  134. # The internal TLS used for harbor components secure communicating. In order to enable https
  135. # in each components tls cert files need to provided in advance.
  136. internalTLS:
  137.   # If internal TLS enabled
  138.   enabled: true
  139.   # There are three ways to provide tls
  140.   # 1) "auto" will generate cert automatically
  141.   # 2) "manual" need provide cert file manually in following value
  142.   # 3) "secret" internal certificates from secret
  143.   certSource: "auto"
  144.   # The content of trust ca, only available when `certSource` is "manual"
  145.   trustCa: ""
  146.   # core related cert configuration
  147.   core:
  148.     # secret name for core's tls certs
  149.     secretName: ""
  150.     # Content of core's TLS cert file, only available when `certSource` is "manual"
  151.     crt: ""
  152.     # Content of core's TLS key file, only available when `certSource` is "manual"
  153.     key: ""
  154.   # jobservice related cert configuration
  155.   jobservice:
  156.     # secret name for jobservice's tls certs
  157.     secretName: ""
  158.     # Content of jobservice's TLS key file, only available when `certSource` is "manual"
  159.     crt: ""
  160.     # Content of jobservice's TLS key file, only available when `certSource` is "manual"
  161.     key: ""
  162.   # registry related cert configuration
  163.   registry:
  164.     # secret name for registry's tls certs
  165.     secretName: ""
  166.     # Content of registry's TLS key file, only available when `certSource` is "manual"
  167.     crt: ""
  168.     # Content of registry's TLS key file, only available when `certSource` is "manual"
  169.     key: ""
  170.   # portal related cert configuration
  171.   portal:
  172.     # secret name for portal's tls certs
  173.     secretName: ""
  174.     # Content of portal's TLS key file, only available when `certSource` is "manual"
  175.     crt: ""
  176.     # Content of portal's TLS key file, only available when `certSource` is "manual"
  177.     key: ""
  178.   # chartmuseum related cert configuration
  179.   chartmuseum:
  180.     # secret name for chartmuseum's tls certs
  181.     secretName: ""
  182.     # Content of chartmuseum's TLS key file, only available when `certSource` is "manual"
  183.     crt: ""
  184.     # Content of chartmuseum's TLS key file, only available when `certSource` is "manual"
  185.     key: ""
  186.   # trivy related cert configuration
  187.   trivy:
  188.     # secret name for trivy's tls certs
  189.     secretName: ""
  190.     # Content of trivy's TLS key file, only available when `certSource` is "manual"
  191.     crt: ""
  192.     # Content of trivy's TLS key file, only available when `certSource` is "manual"
  193.     key: ""
  194.  
  195. ipFamily:
  196.   # ipv6Enabled set to true if ipv6 is enabled in cluster, currently it affected the nginx related component
  197.   ipv6:
  198.     enabled: true
  199.   # ipv4Enabled set to true if ipv4 is enabled in cluster, currently it affected the nginx related component
  200.   ipv4:
  201.     enabled: true
  202.  
  203. # The persistence is enabled by default and a default StorageClass
  204. # is needed in the k8s cluster to provision volumes dynamically.
  205. # Specify another StorageClass in the "storageClass" or set "existingClaim"
  206. # if you already have existing persistent volumes to use
  207. #
  208. # For storing images and charts, you can also use "azure", "gcs", "s3",
  209. # "swift" or "oss". Set it in the "imageChartStorage" section
  210. persistence:
  211.   enabled: true
  212.   # Setting it to "keep" to avoid removing PVCs during a helm delete
  213.   # operation. Leaving it empty will delete PVCs after the chart deleted
  214.   # (this does not apply for PVCs that are created for internal database
  215.   # and redis components, i.e. they are never deleted automatically)
  216.   resourcePolicy: "keep"
  217.   persistentVolumeClaim:
  218.     registry:
  219.       # Use the existing PVC which must be created manually before bound,
  220.       # and specify the "subPath" if the PVC is shared with other components
  221.       existingClaim: "harbor-registry"
  222.       # Specify the "storageClass" used to provision the volume. Or the default
  223.       # StorageClass will be used (the default).
  224.       # Set it to "-" to disable dynamic provisioning
  225.       storageClass: "managed-nfs-storage"
  226.       subPath: ""
  227.       accessMode: ReadWriteOnce
  228.       size: 150Gi
  229.       annotations: {}
  230.     chartmuseum:
  231.       existingClaim: "harbor-chartmuseum"
  232.       storageClass: "managed-nfs-storage"
  233.       subPath: ""
  234.       accessMode: ReadWriteOnce
  235.       size: 10Gi
  236.       annotations: {}
  237.     jobservice:
  238.       jobLog:
  239.         existingClaim: "harbor-jobservicelog"
  240.         storageClass: "managed-nfs-storage"
  241.         subPath: ""
  242.         accessMode: ReadWriteOnce
  243.         size: 5Gi
  244.         annotations: {}
  245.       scanDataExports:
  246.         existingClaim: "harbor-jobservicedata"
  247.         storageClass: "managed-nfs-storage"
  248.         subPath: ""
  249.         accessMode: ReadWriteOnce
  250.         size: 5Gi
  251.         annotations: {}
  252.     # If external database is used, the following settings for database will
  253.     # be ignored
  254.     database:
  255.       existingClaim: "harbor-database"
  256.       storageClass: "managed-nfs-storage"
  257.       subPath: ""
  258.       accessMode: ReadWriteOnce
  259.       size: 10Gi
  260.       annotations: {}
  261.     # If external Redis is used, the following settings for Redis will
  262.     # be ignored
  263.     redis:
  264.       existingClaim: "harbor-redis"
  265.       storageClass: "managed-nfs-storage"
  266.       subPath: ""
  267.       accessMode: ReadWriteOnce
  268.       size: 10Gi
  269.       annotations: {}
  270.     trivy:
  271.       existingClaim: "harbor-trivy"
  272.       storageClass: "managed-nfs-storage"
  273.       subPath: ""
  274.       accessMode: ReadWriteOnce
  275.       size: 10Gi
  276.       annotations: {}
  277.   # Define which storage backend is used for registry and chartmuseum to store
  278.   # images and charts. Refer to
  279.   # https://github.com/docker/distribution/blob/master/docs/configuration.md#storage
  280.   # for the detail.
  281.   imageChartStorage:
  282.     # Specify whether to disable `redirect` for images and chart storage, for
  283.     # backends which not supported it (such as using minio for `s3` storage type), please disable
  284.     # it. To disable redirects, simply set `disableredirect` to `true` instead.
  285.     # Refer to
  286.     # https://github.com/docker/distribution/blob/master/docs/configuration.md#redirect
  287.     # for the detail.
  288.     disableredirect: false
  289.     # Specify the "caBundleSecretName" if the storage service uses a self-signed certificate.
  290.     # The secret must contain keys named "ca.crt" which will be injected into the trust store
  291.     # of registry's and chartmuseum's containers.
  292.     # caBundleSecretName:
  293.  
  294.     # Specify the type of storage: "filesystem", "azure", "gcs", "s3", "swift",
  295.     # "oss" and fill the information needed in the corresponding section. The type
  296.     # must be "filesystem" if you want to use persistent volumes for registry
  297.     # and chartmuseum
  298.     type: filesystem
  299.     filesystem:
  300.       rootdirectory: /storage
  301.       #maxthreads: 100
  302.     azure:
  303.       accountname: accountname
  304.       accountkey: base64encodedaccountkey
  305.       container: containername
  306.       #realm: core.windows.net
  307.       # To use existing secret, the key must be AZURE_STORAGE_ACCESS_KEY
  308.       existingSecret: ""
  309.     gcs:
  310.       bucket: bucketname
  311.       # The base64 encoded json file which contains the key
  312.       encodedkey: base64-encoded-json-key-file
  313.       #rootdirectory: /gcs/object/name/prefix
  314.       #chunksize: "5242880"
  315.       # To use existing secret, the key must be gcs-key.json
  316.       existingSecret: ""
  317.       useWorkloadIdentity: false
  318.     s3:
  319.       # Set an existing secret for S3 accesskey and secretkey
  320.       # keys in the secret should be AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY for chartmuseum
  321.       # keys in the secret should be REGISTRY_STORAGE_S3_ACCESSKEY and REGISTRY_STORAGE_S3_SECRETKEY for registry
  322.       #existingSecret: ""
  323.       region: us-west-1
  324.       bucket: bucketname
  325.       #accesskey: awsaccesskey
  326.       #secretkey: awssecretkey
  327.       #regionendpoint: http://myobjects.local
  328.       #encrypt: false
  329.       #keyid: mykeyid
  330.       #secure: true
  331.       #skipverify: false
  332.       #v4auth: true
  333.       #chunksize: "5242880"
  334.       #rootdirectory: /s3/object/name/prefix
  335.       #storageclass: STANDARD
  336.       #multipartcopychunksize: "33554432"
  337.       #multipartcopymaxconcurrency: 100
  338.       #multipartcopythresholdsize: "33554432"
  339.     swift:
  340.       authurl: https://storage.myprovider.com/v3/auth
  341.       username: username
  342.       password: password
  343.       container: containername
  344.       #region: fr
  345.       #tenant: tenantname
  346.       #tenantid: tenantid
  347.       #domain: domainname
  348.       #domainid: domainid
  349.       #trustid: trustid
  350.       #insecureskipverify: false
  351.       #chunksize: 5M
  352.       #prefix:
  353.       #secretkey: secretkey
  354.       #accesskey: accesskey
  355.       #authversion: 3
  356.       #endpointtype: public
  357.       #tempurlcontainerkey: false
  358.       #tempurlmethods:
  359.     oss:
  360.       accesskeyid: accesskeyid
  361.       accesskeysecret: accesskeysecret
  362.       region: regionname
  363.       bucket: bucketname
  364.       #endpoint: endpoint
  365.       #internal: false
  366.       #encrypt: false
  367.       #secure: true
  368.       #chunksize: 10M
  369.       #rootdirectory: rootdirectory
  370.  
  371. imagePullPolicy: IfNotPresent
  372.  
  373. # Use this set to assign a list of default pullSecrets
  374. imagePullSecrets:
  375. #  - name: docker-registry-secret
  376. #  - name: internal-registry-secret
  377.  
  378. # The update strategy for deployments with persistent volumes(jobservice, registry
  379. # and chartmuseum): "RollingUpdate" or "Recreate"
  380. # Set it as "Recreate" when "RWM" for volumes isn't supported
  381. updateStrategy:
  382.   type: RollingUpdate
  383.  
  384. # debug, info, warning, error or fatal
  385. logLevel: info
  386.  
  387. # The initial password of Harbor admin. Change it from portal after launching Harbor
  388. harborAdminPassword: "Harbor12345"
  389.  
  390. # The name of the secret which contains key named "ca.crt". Setting this enables the
  391. # download link on portal to download the CA certificate when the certificate isn't
  392. # generated automatically
  393. caSecretName: ""
  394.  
  395. # The secret key used for encryption. Must be a string of 16 chars.
  396. secretKey: "not-a-secure-key"
  397. # If using existingSecretSecretKey, the key must be sercretKey
  398. existingSecretSecretKey: ""
  399.  
  400. # The proxy settings for updating trivy vulnerabilities from the Internet and replicating
  401. # artifacts from/to the registries that cannot be reached directly
  402. proxy:
  403.   httpProxy:
  404.   httpsProxy:
  405.   noProxy: 127.0.0.1,localhost,.local,.internal
  406.   components:
  407.     - core
  408.     - jobservice
  409.     - trivy
  410.  
  411. # Run the migration job via helm hook
  412. enableMigrateHelmHook: false
  413.  
  414. # The custom ca bundle secret, the secret must contain key named "ca.crt"
  415. # which will be injected into the trust store for chartmuseum, core, jobservice, registry, trivy components
  416. # caBundleSecretName: ""
  417.  
  418. ## UAA Authentication Options
  419. # If you're using UAA for authentication behind a self-signed
  420. # certificate you will need to provide the CA Cert.
  421. # Set uaaSecretName below to provide a pre-created secret that
  422. # contains a base64 encoded CA Certificate named `ca.crt`.
  423. # uaaSecretName:
  424.  
  425. # If service exposed via "ingress", the Nginx will not be used
  426. nginx:
  427.   image:
  428.     repository: goharbor/nginx-photon
  429.     tag: v2.6.2
  430.   # set the service account to be used, default if left empty
  431.   serviceAccountName: ""
  432.   # mount the service account token
  433.   automountServiceAccountToken: false
  434.   replicas: 1
  435.   revisionHistoryLimit: 10
  436.   # resources:
  437.   #  requests:
  438.   #    memory: 256Mi
  439.   #    cpu: 100m
  440.   nodeSelector: {}
  441.   tolerations: []
  442.   affinity: {}
  443.   ## Additional deployment annotations
  444.   podAnnotations: {}
  445.   ## The priority class to run the pod as
  446.   priorityClassName:
  447.  
  448. portal:
  449.   image:
  450.     repository: goharbor/harbor-portal
  451.     tag: v2.6.2
  452.   # set the service account to be used, default if left empty
  453.   serviceAccountName: ""
  454.   # mount the service account token
  455.   automountServiceAccountToken: false
  456.   replicas: 1
  457.   revisionHistoryLimit: 10
  458.   # resources:
  459.   #  requests:
  460.   #    memory: 256Mi
  461.   #    cpu: 100m
  462.   nodeSelector: {}
  463.   tolerations: []
  464.   affinity: {}
  465.   ## Additional deployment annotations
  466.   podAnnotations: {}
  467.   ## The priority class to run the pod as
  468.   priorityClassName:
  469.  
  470. core:
  471.   image:
  472.     repository: goharbor/harbor-core
  473.     tag: v2.6.2
  474.   # set the service account to be used, default if left empty
  475.   serviceAccountName: ""
  476.   # mount the service account token
  477.   automountServiceAccountToken: false
  478.   replicas: 1
  479.   revisionHistoryLimit: 10
  480.   ## Startup probe values
  481.   startupProbe:
  482.     enabled: true
  483.     initialDelaySeconds: 10
  484.   # resources:
  485.   #  requests:
  486.   #    memory: 256Mi
  487.   #    cpu: 100m
  488.   nodeSelector: {}
  489.   tolerations: []
  490.   affinity: {}
  491.   ## Additional deployment annotations
  492.   podAnnotations: {}
  493.   # Secret is used when core server communicates with other components.
  494.   # If a secret key is not specified, Helm will generate one.
  495.   # Must be a string of 16 chars.
  496.   secret: ""
  497.   # Fill the name of a kubernetes secret if you want to use your own
  498.   # TLS certificate and private key for token encryption/decryption.
  499.   # The secret must contain keys named:
  500.   # "tls.crt" - the certificate
  501.   # "tls.key" - the private key
  502.   # The default key pair will be used if it isn't set
  503.   secretName: ""
  504.   # The XSRF key. Will be generated automatically if it isn't specified
  505.   xsrfKey: ""
  506.   ## The priority class to run the pod as
  507.   priorityClassName:
  508.   # The time duration for async update artifact pull_time and repository
  509.   # pull_count, the unit is second. Will be 10 seconds if it isn't set.
  510.   # eg. artifactPullAsyncFlushDuration: 10
  511.   artifactPullAsyncFlushDuration:
  512.   gdpr:
  513.     deleteUser: false
  514.  
  515. jobservice:
  516.   image:
  517.     repository: goharbor/harbor-jobservice
  518.     tag: v2.6.2
  519.   replicas: 1
  520.   revisionHistoryLimit: 10
  521.   # set the service account to be used, default if left empty
  522.   serviceAccountName: ""
  523.   # mount the service account token
  524.   automountServiceAccountToken: false
  525.   maxJobWorkers: 10
  526.   # The logger for jobs: "file", "database" or "stdout"
  527.   jobLoggers:
  528.     - file
  529.     # - database
  530.     # - stdout
  531.   # The jobLogger sweeper duration (ignored if `jobLogger` is `stdout`)
  532.   loggerSweeperDuration: 14 #days
  533.  
  534.   # resources:
  535.   #   requests:
  536.   #     memory: 256Mi
  537.   #     cpu: 100m
  538.   nodeSelector: {}
  539.   tolerations: []
  540.   affinity: {}
  541.   ## Additional deployment annotations
  542.   podAnnotations: {}
  543.   # Secret is used when job service communicates with other components.
  544.   # If a secret key is not specified, Helm will generate one.
  545.   # Must be a string of 16 chars.
  546.   secret: ""
  547.   ## The priority class to run the pod as
  548.   priorityClassName:
  549.  
  550. registry:
  551.   # set the service account to be used, default if left empty
  552.   serviceAccountName: ""
  553.   # mount the service account token
  554.   automountServiceAccountToken: false
  555.   registry:
  556.     image:
  557.       repository: goharbor/registry-photon
  558.       tag: v2.6.2
  559.     # resources:
  560.     #  requests:
  561.     #    memory: 256Mi
  562.     #    cpu: 100m
  563.   controller:
  564.     image:
  565.       repository: goharbor/harbor-registryctl
  566.       tag: v2.6.2
  567.  
  568.     # resources:
  569.     #  requests:
  570.     #    memory: 256Mi
  571.     #    cpu: 100m
  572.   replicas: 1
  573.   revisionHistoryLimit: 10
  574.   nodeSelector: {}
  575.   tolerations: []
  576.   affinity: {}
  577.   ## Additional deployment annotations
  578.   podAnnotations: {}
  579.   ## The priority class to run the pod as
  580.   priorityClassName:
  581.   # Secret is used to secure the upload state from client
  582.   # and registry storage backend.
  583.   # See: https://github.com/docker/distribution/blob/master/docs/configuration.md#http
  584.   # If a secret key is not specified, Helm will generate one.
  585.   # Must be a string of 16 chars.
  586.   secret: ""
  587.   # If true, the registry returns relative URLs in Location headers. The client is responsible for resolving the correct URL.
  588.   relativeurls: false
  589.   credentials:
  590.     username: "harbor_registry_user"
  591.     password: "harbor_registry_password"
  592.     # If using existingSecret, the key must be REGISTRY_PASSWD and REGISTRY_HTPASSWD
  593.     existingSecret: ""
  594.     # Login and password in htpasswd string format. Excludes `registry.credentials.username`  and `registry.credentials.password`. May come in handy when integrating with tools like argocd or flux. This allows the same line to be generated each time the template is rendered, instead of the `htpasswd` function from helm, which generates different lines each time because of the salt.
  595.     # htpasswdString: $apr1$XLefHzeG$Xl4.s00sMSCCcMyJljSZb0 # example string
  596.   middleware:
  597.     enabled: false
  598.     type: cloudFront
  599.     cloudFront:
  600.       baseurl: example.cloudfront.net
  601.       keypairid: KEYPAIRID
  602.       duration: 3000s
  603.       ipfilteredby: none
  604.       # The secret key that should be present is CLOUDFRONT_KEY_DATA, which should be the encoded private key
  605.       # that allows access to CloudFront
  606.       privateKeySecret: "my-secret"
  607.   # enable purge _upload directories
  608.   upload_purging:
  609.     enabled: true
  610.     # remove files in _upload directories which exist for a period of time, default is one week.
  611.     age: 168h
  612.     # the interval of the purge operations
  613.     interval: 24h
  614.     dryrun: false
  615.  
  616. chartmuseum:
  617.   enabled: true
  618.   # set the service account to be used, default if left empty
  619.   serviceAccountName: ""
  620.   # mount the service account token
  621.   automountServiceAccountToken: false
  622.   # Harbor defaults ChartMuseum to returning relative urls, if you want using absolute url you should enable it by change the following value to 'true'
  623.   absoluteUrl: false
  624.   image:
  625.     repository: goharbor/chartmuseum-photon
  626.     tag: v2.6.2
  627.   replicas: 1
  628.   revisionHistoryLimit: 10
  629.   # resources:
  630.   #  requests:
  631.   #    memory: 256Mi
  632.   #    cpu: 100m
  633.   nodeSelector: {}
  634.   tolerations: []
  635.   affinity: {}
  636.   ## Additional deployment annotations
  637.   podAnnotations: {}
  638.   ## The priority class to run the pod as
  639.   priorityClassName:
  640.   ## limit the number of parallel indexers
  641.   indexLimit: 0
  642.  
  643. trivy:
  644.   # enabled the flag to enable Trivy scanner
  645.   enabled: true
  646.   image:
  647.     # repository the repository for Trivy adapter image
  648.     repository: goharbor/trivy-adapter-photon
  649.     # tag the tag for Trivy adapter image
  650.     tag: v2.6.2
  651.   # set the service account to be used, default if left empty
  652.   serviceAccountName: ""
  653.   # mount the service account token
  654.   automountServiceAccountToken: false
  655.   # replicas the number of Pod replicas
  656.   replicas: 1
  657.   # debugMode the flag to enable Trivy debug mode with more verbose scanning log
  658.   debugMode: false
  659.   # vulnType a comma-separated list of vulnerability types. Possible values are `os` and `library`.
  660.   vulnType: "os,library"
  661.   # severity a comma-separated list of severities to be checked
  662.   severity: "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL"
  663.   # ignoreUnfixed the flag to display only fixed vulnerabilities
  664.   ignoreUnfixed: false
  665.   # insecure the flag to skip verifying registry certificate
  666.   insecure: false
  667.   # gitHubToken the GitHub access token to download Trivy DB
  668.   #
  669.   # Trivy DB contains vulnerability information from NVD, Red Hat, and many other upstream vulnerability databases.
  670.   # It is downloaded by Trivy from the GitHub release page https://github.com/aquasecurity/trivy-db/releases and cached
  671.   # in the local file system (`/home/scanner/.cache/trivy/db/trivy.db`). In addition, the database contains the update
  672.   # timestamp so Trivy can detect whether it should download a newer version from the Internet or use the cached one.
  673.   # Currently, the database is updated every 12 hours and published as a new release to GitHub.
  674.   #
  675.   # Anonymous downloads from GitHub are subject to the limit of 60 requests per hour. Normally such rate limit is enough
  676.   # for production operations. If, for any reason, it's not enough, you could increase the rate limit to 5000
  677.   # requests per hour by specifying the GitHub access token. For more details on GitHub rate limiting please consult
  678.   # https://developer.github.com/v3/#rate-limiting
  679.   #
  680.   # You can create a GitHub token by following the instructions in
  681.   # https://help.github.com/en/github/authenticating-to-github/creating-a-personal-access-token-for-the-command-line
  682.   gitHubToken: ""
  683.   # skipUpdate the flag to disable Trivy DB downloads from GitHub
  684.   #
  685.   # You might want to set the value of this flag to `true` in test or CI/CD environments to avoid GitHub rate limiting issues.
  686.   # If the value is set to `true` you have to manually download the `trivy.db` file and mount it in the
  687.   # `/home/scanner/.cache/trivy/db/trivy.db` path.
  688.   skipUpdate: false
  689.   # The offlineScan option prevents Trivy from sending API requests to identify dependencies.
  690.   #
  691.   # Scanning JAR files and pom.xml may require Internet access for better detection, but this option tries to avoid it.
  692.   # For example, the offline mode will not try to resolve transitive dependencies in pom.xml when the dependency doesn't
  693.   # exist in the local repositories. It means a number of detected vulnerabilities might be fewer in offline mode.
  694.   # It would work if all the dependencies are in local.
  695.   # This option doesn’t affect DB download. You need to specify skipUpdate as well as offlineScan in an air-gapped environment.
  696.   offlineScan: false
  697.   # Comma-separated list of what security issues to detect. Possible values are `vuln`, `config` and `secret`. Defaults to `vuln`.
  698.   securityCheck: "vuln"
  699.   # The duration to wait for scan completion
  700.   timeout: 5m0s
  701.   resources:
  702.     requests:
  703.       cpu: 200m
  704.       memory: 512Mi
  705.     limits:
  706.       cpu: 1
  707.       memory: 1Gi
  708.   nodeSelector: {}
  709.   tolerations: []
  710.   affinity: {}
  711.   ## Additional deployment annotations
  712.   podAnnotations: {}
  713.   ## The priority class to run the pod as
  714.   priorityClassName:
  715.  
  716. notary:
  717.   enabled: true
  718.   server:
  719.     # set the service account to be used, default if left empty
  720.     serviceAccountName: ""
  721.     # mount the service account token
  722.     automountServiceAccountToken: false
  723.     image:
  724.       repository: goharbor/notary-server-photon
  725.       tag: v2.6.2
  726.     replicas: 1
  727.     # resources:
  728.     #  requests:
  729.     #    memory: 256Mi
  730.     #    cpu: 100m
  731.     nodeSelector: {}
  732.     tolerations: []
  733.     affinity: {}
  734.     ## Additional deployment annotations
  735.     podAnnotations: {}
  736.     ## The priority class to run the pod as
  737.     priorityClassName:
  738.   signer:
  739.     # set the service account to be used, default if left empty
  740.     serviceAccountName: ""
  741.     # mount the service account token
  742.     automountServiceAccountToken: false
  743.     image:
  744.       repository: goharbor/notary-signer-photon
  745.       tag: v2.6.2
  746.     replicas: 1
  747.     # resources:
  748.     #  requests:
  749.     #    memory: 256Mi
  750.     #    cpu: 100m
  751.     nodeSelector: {}
  752.     tolerations: []
  753.     affinity: {}
  754.     ## Additional deployment annotations
  755.     podAnnotations: {}
  756.     ## The priority class to run the pod as
  757.     priorityClassName:
  758.   # Fill the name of a kubernetes secret if you want to use your own
  759.   # TLS certificate authority, certificate and private key for notary
  760.   # communications.
  761.   # The secret must contain keys named ca.crt, tls.crt and tls.key that
  762.   # contain the CA, certificate and private key.
  763.   # They will be generated if not set.
  764.   secretName: ""
  765.  
  766. database:
  767.   # if external database is used, set "type" to "external"
  768.   # and fill the connection informations in "external" section
  769.   type: internal
  770.   internal:
  771.     # set the service account to be used, default if left empty
  772.     serviceAccountName: ""
  773.     # mount the service account token
  774.     automountServiceAccountToken: false
  775.     image:
  776.       repository: goharbor/harbor-db
  777.       tag: v2.6.2
  778.     # The initial superuser password for internal database
  779.     password: "changeit"
  780.     # The size limit for Shared memory, pgSQL use it for shared_buffer
  781.     # More details see:
  782.     # https://github.com/goharbor/harbor/issues/15034
  783.     shmSizeLimit: 512Mi
  784.     # resources:
  785.     #  requests:
  786.     #    memory: 256Mi
  787.     #    cpu: 100m
  788.     nodeSelector: {}
  789.     tolerations: []
  790.     affinity: {}
  791.     ## The priority class to run the pod as
  792.     priorityClassName:
  793.     initContainer:
  794.       migrator: {}
  795.       # resources:
  796.       #  requests:
  797.       #    memory: 128Mi
  798.       #    cpu: 100m
  799.       permissions: {}
  800.       # resources:
  801.       #  requests:
  802.       #    memory: 128Mi
  803.       #    cpu: 100m
  804.   external:
  805.     host: "postgresql"
  806.     port: "5432"
  807.     username: "gitlab"
  808.     password: "passw0rd"
  809.     coreDatabase: "registry"
  810.     notaryServerDatabase: "notary_server"
  811.     notarySignerDatabase: "notary_signer"
  812.     # if using existing secret, the key must be "password"
  813.     existingSecret: ""
  814.     # "disable" - No SSL
  815.     # "require" - Always SSL (skip verification)
  816.     # "verify-ca" - Always SSL (verify that the certificate presented by the
  817.     # server was signed by a trusted CA)
  818.     # "verify-full" - Always SSL (verify that the certification presented by the
  819.     # server was signed by a trusted CA and the server host name matches the one
  820.     # in the certificate)
  821.     sslmode: "disable"
  822.   # The maximum number of connections in the idle connection pool per pod (core+exporter).
  823.   # If it <=0, no idle connections are retained.
  824.   maxIdleConns: 100
  825.   # The maximum number of open connections to the database per pod (core+exporter).
  826.   # If it <= 0, then there is no limit on the number of open connections.
  827.   # Note: the default number of connections is 1024 for postgre of harbor.
  828.   maxOpenConns: 900
  829.   ## Additional deployment annotations
  830.   podAnnotations: {}
  831.  
  832. redis:
  833.   # if external Redis is used, set "type" to "external"
  834.   # and fill the connection informations in "external" section
  835.   type: internal
  836.   internal:
  837.     # set the service account to be used, default if left empty
  838.     serviceAccountName: ""
  839.     # mount the service account token
  840.     automountServiceAccountToken: false
  841.     image:
  842.       repository: goharbor/redis-photon
  843.       tag: v2.6.2
  844.     # resources:
  845.     #  requests:
  846.     #    memory: 256Mi
  847.     #    cpu: 100m
  848.     nodeSelector: {}
  849.     tolerations: []
  850.     affinity: {}
  851.     ## The priority class to run the pod as
  852.     priorityClassName:
  853.   external:
  854.     # support redis, redis+sentinel
  855.     # addr for redis: <host_redis>:<port_redis>
  856.     # addr for redis+sentinel: <host_sentinel1>:<port_sentinel1>,<host_sentinel2>:<port_sentinel2>,<host_sentinel3>:<port_sentinel3>
  857.     addr: "192.168.0.2:6379"
  858.     # The name of the set of Redis instances to monitor, it must be set to support redis+sentinel
  859.     sentinelMasterSet: ""
  860.     # The "coreDatabaseIndex" must be "0" as the library Harbor
  861.     # used doesn't support configuring it
  862.     coreDatabaseIndex: "0"
  863.     jobserviceDatabaseIndex: "1"
  864.     registryDatabaseIndex: "2"
  865.     chartmuseumDatabaseIndex: "3"
  866.     trivyAdapterIndex: "5"
  867.     password: ""
  868.     # If using existingSecret, the key must be REDIS_PASSWORD
  869.     existingSecret: ""
  870.   ## Additional deployment annotations
  871.   podAnnotations: {}
  872.  
  873. exporter:
  874.   replicas: 1
  875.   revisionHistoryLimit: 10
  876.   # resources:
  877.   #  requests:
  878.   #    memory: 256Mi
  879.   #    cpu: 100m
  880.   podAnnotations: {}
  881.   serviceAccountName: ""
  882.   # mount the service account token
  883.   automountServiceAccountToken: false
  884.   image:
  885.     repository: goharbor/harbor-exporter
  886.     tag: v2.6.2
  887.   nodeSelector: {}
  888.   tolerations: []
  889.   affinity: {}
  890.   cacheDuration: 23
  891.   cacheCleanInterval: 14400
  892.   ## The priority class to run the pod as
  893.   priorityClassName:
  894.  
  895. metrics:
  896.   enabled: false
  897.   core:
  898.     path: /metrics
  899.     port: 8001
  900.   registry:
  901.     path: /metrics
  902.     port: 8001
  903.   jobservice:
  904.     path: /metrics
  905.     port: 8001
  906.   exporter:
  907.     path: /metrics
  908.     port: 8001
  909.   ## Create prometheus serviceMonitor to scrape harbor metrics.
  910.   ## This requires the monitoring.coreos.com/v1 CRD. Please see
  911.   ## https://github.com/prometheus-operator/prometheus-operator/blob/master/Documentation/user-guides/getting-started.md
  912.   ##
  913.   serviceMonitor:
  914.     enabled: false
  915.     additionalLabels: {}
  916.     # Scrape interval. If not set, the Prometheus default scrape interval is used.
  917.     interval: ""
  918.     # Metric relabel configs to apply to samples before ingestion.
  919.     metricRelabelings:
  920.       []
  921.       # - action: keep
  922.       #   regex: 'kube_(daemonset|deployment|pod|namespace|node|statefulset).+'
  923.       #   sourceLabels: [__name__]
  924.     # Relabel configs to apply to samples before ingestion.
  925.     relabelings:
  926.       []
  927.       # - sourceLabels: [__meta_kubernetes_pod_node_name]
  928.       #   separator: ;
  929.       #   regex: ^(.*)$
  930.       #   targetLabel: nodename
  931.       #   replacement: $1
  932.       #   action: replace
  933.  
  934. trace:
  935.   enabled: false
  936.   # trace provider: jaeger or otel
  937.   # jaeger should be 1.26+
  938.   provider: jaeger
  939.   # set sample_rate to 1 if you wanna sampling 100% of trace data; set 0.5 if you wanna sampling 50% of trace data, and so forth
  940.   sample_rate: 1
  941.   # namespace used to differentiate different harbor services
  942.   # namespace:
  943.   # attributes is a key value dict contains user defined attributes used to initialize trace provider
  944.   # attributes:
  945.   #   application: harbor
  946.   jaeger:
  947.     # jaeger supports two modes:
  948.     #   collector mode(uncomment endpoint and uncomment username, password if needed)
  949.     #   agent mode(uncomment agent_host and agent_port)
  950.     endpoint: http://hostname:14268/api/traces
  951.     # username:
  952.     # password:
  953.     # agent_host: hostname
  954.     # export trace data by jaeger.thrift in compact mode
  955.     # agent_port: 6831
  956.   otel:
  957.     endpoint: hostname:4318
  958.     url_path: /v1/traces
  959.     compression: false
  960.     insecure: true
  961.     timeout: 10s
  962.  
  963. # cache layer configurations
  964. # if this feature enabled, harbor will cache the resource
  965. # `project/project_metadata/repository/artifact/manifest` in the redis
  966. # which help to improve the performance of high concurrent pulling manifest.
  967. cache:
  968.   # default is not enabled.
  969.   enabled: false
  970.   # default keep cache for one day.
  971.   expireHours: 24

2.8、部署执行命令

  1.  kubectl apply -f harbor-pv.yaml  
  2.  kubectl apply -f harbor-pvc.yaml 
  3.  helm install harbor ./ -f values.yaml -n pig-dev
  4.  kubectl get pv,pvc -A

删除的命令

  1. helm list -A
  2.  
  3. helm uninstall harbor -n pig-dev
  4. kubectl delete -f harbor-pvc.yaml
  5. kubectl delete -f harbor-pv.yaml

2.9、编辑ingress文件，类型vim操作

  1. kubectl edit ingress -n pig-dev harbor-ingress
  2. kubectl edit ingress -n pig-dev harbor-ingress-notary

增减内容：ingressClassName: nginx

两个文件都要增加ingressClassName: nginx

 2.9.1、部署nginx-ingress-controller

  1. apiVersion: v1
  2. kind: Namespace
  3. metadata:
  4.   labels:
  5.     app.kubernetes.io/instance: ingress-nginx
  6.     app.kubernetes.io/name: ingress-nginx
  7.   name: ingress-nginx
  8. ---
  9. apiVersion: v1
  10. automountServiceAccountToken: true
  11. kind: ServiceAccount
  12. metadata:
  13.   labels:
  14.     app.kubernetes.io/component: controller
  15.     app.kubernetes.io/instance: ingress-nginx
  16.     app.kubernetes.io/name: ingress-nginx
  17.     app.kubernetes.io/part-of: ingress-nginx
  18.     app.kubernetes.io/version: 1.2.1
  19.   name: ingress-nginx
  20.   namespace: pig-dev
  21. ---
  22. apiVersion: v1
  23. kind: ServiceAccount
  24. metadata:
  25.   labels:
  26.     app.kubernetes.io/component: admission-webhook
  27.     app.kubernetes.io/instance: ingress-nginx
  28.     app.kubernetes.io/name: ingress-nginx
  29.     app.kubernetes.io/part-of: ingress-nginx
  30.     app.kubernetes.io/version: 1.2.1
  31.   name: ingress-nginx-admission
  32.   namespace: pig-dev
  33. ---
  34. apiVersion: rbac.authorization.k8s.io/v1
  35. kind: Role
  36. metadata:
  37.   labels:
  38.     app.kubernetes.io/component: controller
  39.     app.kubernetes.io/instance: ingress-nginx
  40.     app.kubernetes.io/name: ingress-nginx
  41.     app.kubernetes.io/part-of: ingress-nginx
  42.     app.kubernetes.io/version: 1.2.1
  43.   name: ingress-nginx
  44.   namespace: pig-dev
  45. rules:
  46. - apiGroups:
  47.   - ""
  48.   resources:
  49.   - namespaces
  50.   verbs:
  51.   - get
  52. - apiGroups:
  53.   - ""
  54.   resources:
  55.   - configmaps
  56.   - pods
  57.   - secrets
  58.   - endpoints
  59.   verbs:
  60.   - get
  61.   - list
  62.   - watch
  63. - apiGroups:
  64.   - ""
  65.   resources:
  66.   - services
  67.   verbs:
  68.   - get
  69.   - list
  70.   - watch
  71. - apiGroups:
  72.   - networking.k8s.io
  73.   resources:
  74.   - ingresses
  75.   verbs:
  76.   - get
  77.   - list
  78.   - watch
  79. - apiGroups:
  80.   - networking.k8s.io
  81.   resources:
  82.   - ingresses/status
  83.   verbs:
  84.   - update
  85. - apiGroups:
  86.   - networking.k8s.io
  87.   resources:
  88.   - ingressclasses
  89.   verbs:
  90.   - get
  91.   - list
  92.   - watch
  93. - apiGroups:
  94.   - ""
  95.   resourceNames:
  96.   - ingress-controller-leader
  97.   resources:
  98.   - configmaps
  99.   verbs:
  100.   - get
  101.   - update
  102. - apiGroups:
  103.   - ""
  104.   resources:
  105.   - configmaps
  106.   verbs:
  107.   - create
  108. - apiGroups:
  109.   - ""
  110.   resources:
  111.   - events
  112.   verbs:
  113.   - create
  114.   - patch
  115. ---
  116. apiVersion: rbac.authorization.k8s.io/v1
  117. kind: Role
  118. metadata:
  119.   labels:
  120.     app.kubernetes.io/component: admission-webhook
  121.     app.kubernetes.io/instance: ingress-nginx
  122.     app.kubernetes.io/name: ingress-nginx
  123.     app.kubernetes.io/part-of: ingress-nginx
  124.     app.kubernetes.io/version: 1.2.1
  125.   name: ingress-nginx-admission
  126.   namespace: pig-dev
  127. rules:
  128. - apiGroups:
  129.   - ""
  130.   resources:
  131.   - secrets
  132.   verbs:
  133.   - get
  134.   - create
  135. ---
  136. apiVersion: rbac.authorization.k8s.io/v1
  137. kind: ClusterRole
  138. metadata:
  139.   labels:
  140.     app.kubernetes.io/instance: ingress-nginx
  141.     app.kubernetes.io/name: ingress-nginx
  142.     app.kubernetes.io/part-of: ingress-nginx
  143.     app.kubernetes.io/version: 1.2.1
  144.   name: ingress-nginx
  145. rules:
  146. - apiGroups:
  147.   - ""
  148.   resources:
  149.   - configmaps
  150.   - endpoints
  151.   - nodes
  152.   - pods
  153.   - secrets
  154.   - namespaces
  155.   verbs:
  156.   - list
  157.   - watch
  158. - apiGroups:
  159.   - ""
  160.   resources:
  161.   - nodes
  162.   verbs:
  163.   - get
  164. - apiGroups:
  165.   - ""
  166.   resources:
  167.   - services
  168.   verbs:
  169.   - get
  170.   - list
  171.   - watch
  172. - apiGroups:
  173.   - networking.k8s.io
  174.   resources:
  175.   - ingresses
  176.   verbs:
  177.   - get
  178.   - list
  179.   - watch
  180. - apiGroups:
  181.   - ""
  182.   resources:
  183.   - events
  184.   verbs:
  185.   - create
  186.   - patch
  187. - apiGroups:
  188.   - networking.k8s.io
  189.   resources:
  190.   - ingresses/status
  191.   verbs:
  192.   - update
  193. - apiGroups:
  194.   - networking.k8s.io
  195.   resources:
  196.   - ingressclasses
  197.   verbs:
  198.   - get
  199.   - list
  200.   - watch
  201. ---
  202. apiVersion: rbac.authorization.k8s.io/v1
  203. kind: ClusterRole
  204. metadata:
  205.   labels:
  206.     app.kubernetes.io/component: admission-webhook
  207.     app.kubernetes.io/instance: ingress-nginx
  208.     app.kubernetes.io/name: ingress-nginx
  209.     app.kubernetes.io/part-of: ingress-nginx
  210.     app.kubernetes.io/version: 1.2.1
  211.   name: ingress-nginx-admission
  212. rules:
  213. - apiGroups:
  214.   - admissionregistration.k8s.io
  215.   resources:
  216.   - validatingwebhookconfigurations
  217.   verbs:
  218.   - get
  219.   - update
  220. ---
  221. apiVersion: rbac.authorization.k8s.io/v1
  222. kind: RoleBinding
  223. metadata:
  224.   labels:
  225.     app.kubernetes.io/component: controller
  226.     app.kubernetes.io/instance: ingress-nginx
  227.     app.kubernetes.io/name: ingress-nginx
  228.     app.kubernetes.io/part-of: ingress-nginx
  229.     app.kubernetes.io/version: 1.2.1
  230.   name: ingress-nginx
  231.   namespace: pig-dev
  232. roleRef:
  233.   apiGroup: rbac.authorization.k8s.io
  234.   kind: Role
  235.   name: ingress-nginx
  236. subjects:
  237. - kind: ServiceAccount
  238.   name: ingress-nginx
  239.   namespace: pig-dev
  240. ---
  241. apiVersion: rbac.authorization.k8s.io/v1
  242. kind: RoleBinding
  243. metadata:
  244.   labels:
  245.     app.kubernetes.io/component: admission-webhook
  246.     app.kubernetes.io/instance: ingress-nginx
  247.     app.kubernetes.io/name: ingress-nginx
  248.     app.kubernetes.io/part-of: ingress-nginx
  249.     app.kubernetes.io/version: 1.2.1
  250.   name: ingress-nginx-admission
  251.   namespace: pig-dev
  252. roleRef:
  253.   apiGroup: rbac.authorization.k8s.io
  254.   kind: Role
  255.   name: ingress-nginx-admission
  256. subjects:
  257. - kind: ServiceAccount
  258.   name: ingress-nginx-admission
  259.   namespace: pig-dev
  260. ---
  261. apiVersion: rbac.authorization.k8s.io/v1
  262. kind: ClusterRoleBinding
  263. metadata:
  264.   labels:
  265.     app.kubernetes.io/instance: ingress-nginx
  266.     app.kubernetes.io/name: ingress-nginx
  267.     app.kubernetes.io/part-of: ingress-nginx
  268.     app.kubernetes.io/version: 1.2.1
  269.   name: ingress-nginx
  270. roleRef:
  271.   apiGroup: rbac.authorization.k8s.io
  272.   kind: ClusterRole
  273.   name: ingress-nginx
  274. subjects:
  275. - kind: ServiceAccount
  276.   name: ingress-nginx
  277.   namespace: pig-dev
  278. ---
  279. apiVersion: rbac.authorization.k8s.io/v1
  280. kind: ClusterRoleBinding
  281. metadata:
  282.   labels:
  283.     app.kubernetes.io/component: admission-webhook
  284.     app.kubernetes.io/instance: ingress-nginx
  285.     app.kubernetes.io/name: ingress-nginx
  286.     app.kubernetes.io/part-of: ingress-nginx
  287.     app.kubernetes.io/version: 1.2.1
  288.   name: ingress-nginx-admission
  289. roleRef:
  290.   apiGroup: rbac.authorization.k8s.io
  291.   kind: ClusterRole
  292.   name: ingress-nginx-admission
  293. subjects:
  294. - kind: ServiceAccount
  295.   name: ingress-nginx-admission
  296.   namespace: pig-dev
  297. ---
  298. apiVersion: v1
  299. data:
  300.   allow-snippet-annotations: "true"
  301. kind: ConfigMap
  302. metadata:
  303.   labels:
  304.     app.kubernetes.io/component: controller
  305.     app.kubernetes.io/instance: ingress-nginx
  306.     app.kubernetes.io/name: ingress-nginx
  307.     app.kubernetes.io/part-of: ingress-nginx
  308.     app.kubernetes.io/version: 1.2.1
  309.   name: ingress-nginx-controller
  310.   namespace: pig-dev
  311. ---
  312. apiVersion: v1
  313. kind: Service
  314. metadata:
  315.   labels:
  316.     app.kubernetes.io/component: controller
  317.     app.kubernetes.io/instance: ingress-nginx
  318.     app.kubernetes.io/name: ingress-nginx
  319.     app.kubernetes.io/part-of: ingress-nginx
  320.     app.kubernetes.io/version: 1.2.1
  321.   name: ingress-nginx-controller
  322.   namespace: pig-dev
  323. spec:
  324.   externalTrafficPolicy: Local
  325.   ports:
  326.   - appProtocol: http
  327.     name: http
  328.     port: 80
  329.     protocol: TCP
  330.     targetPort: http
  331.   - appProtocol: https
  332.     name: https
  333.     port: 443
  334.     protocol: TCP
  335.     targetPort: https
  336.   selector:
  337.     app.kubernetes.io/component: controller
  338.     app.kubernetes.io/instance: ingress-nginx
  339.     app.kubernetes.io/name: ingress-nginx
  340.   type: LoadBalancer
  341. ---
  342. apiVersion: v1
  343. kind: Service
  344. metadata:
  345.   labels:
  346.     app.kubernetes.io/component: controller
  347.     app.kubernetes.io/instance: ingress-nginx
  348.     app.kubernetes.io/name: ingress-nginx
  349.     app.kubernetes.io/part-of: ingress-nginx
  350.     app.kubernetes.io/version: 1.2.1
  351.   name: ingress-nginx-controller-admission
  352.   namespace: pig-dev
  353. spec:
  354.   ports:
  355.   - appProtocol: https
  356.     name: https-webhook
  357.     port: 443
  358.     targetPort: webhook
  359.   selector:
  360.     app.kubernetes.io/component: controller
  361.     app.kubernetes.io/instance: ingress-nginx
  362.     app.kubernetes.io/name: ingress-nginx
  363.   type: ClusterIP
  364. ---
  365. apiVersion: apps/v1
  366. #kind: Deployment
  367. kind: DaemonSet
  368. metadata:
  369.   labels:
  370.     app.kubernetes.io/component: controller
  371.     app.kubernetes.io/instance: ingress-nginx
  372.     app.kubernetes.io/name: ingress-nginx
  373.     app.kubernetes.io/part-of: ingress-nginx
  374.     app.kubernetes.io/version: 1.2.1
  375.   name: ingress-nginx-controller
  376.   namespace: pig-dev
  377. spec:
  378.   minReadySeconds: 0
  379.   revisionHistoryLimit: 10
  380.   selector:
  381.     matchLabels:
  382.       app.kubernetes.io/component: controller
  383.       app.kubernetes.io/instance: ingress-nginx
  384.       app.kubernetes.io/name: ingress-nginx
  385.   template:
  386.     metadata:
  387.       labels:
  388.         app.kubernetes.io/component: controller
  389.         app.kubernetes.io/instance: ingress-nginx
  390.         app.kubernetes.io/name: ingress-nginx
  391.     spec:
  392.       hostNetwork: true
  393.       containers:
  394.       - args:
  395.         - /nginx-ingress-controller
  396.         - --publish-service=$(POD_NAMESPACE)/ingress-nginx-controller
  397.         - --election-id=ingress-controller-leader
  398.         - --controller-class=k8s.io/ingress-nginx
  399.         - --ingress-class=nginx
  400.         - --configmap=$(POD_NAMESPACE)/ingress-nginx-controller
  401.         - --validating-webhook=:8443
  402.         - --validating-webhook-certificate=/usr/local/certificates/cert
  403.         - --validating-webhook-key=/usr/local/certificates/key
  404.         env:
  405.         - name: POD_NAME
  406.           valueFrom:
  407.             fieldRef:
  408.               fieldPath: metadata.name
  409.         - name: POD_NAMESPACE
  410.           valueFrom:
  411.             fieldRef:
  412.               fieldPath: metadata.namespace
  413.         - name: LD_PRELOAD
  414.           value: /usr/local/lib/libmimalloc.so
  415.         image: zhxl1989/ingress-nginx-controller:v1.2.1
  416.         imagePullPolicy: IfNotPresent
  417.         lifecycle:
  418.           preStop:
  419.             exec:
  420.               command:
  421.               - /wait-shutdown
  422.         livenessProbe:
  423.           failureThreshold: 5
  424.           httpGet:
  425.             path: /healthz
  426.             port: 10254
  427.             scheme: HTTP
  428.           initialDelaySeconds: 10
  429.           periodSeconds: 10
  430.           successThreshold: 1
  431.           timeoutSeconds: 1
  432.         name: controller
  433.         ports:
  434.         - containerPort: 80
  435.           name: http
  436.           protocol: TCP
  437.         - containerPort: 443
  438.           name: https
  439.           protocol: TCP
  440.         - containerPort: 8443
  441.           name: webhook
  442.           protocol: TCP
  443.         readinessProbe:
  444.           failureThreshold: 3
  445.           httpGet:
  446.             path: /healthz
  447.             port: 10254
  448.             scheme: HTTP
  449.           initialDelaySeconds: 10
  450.           periodSeconds: 10
  451.           successThreshold: 1
  452.           timeoutSeconds: 1
  453.         resources:
  454.           requests:
  455.             cpu: 100m
  456.             memory: 90Mi
  457.         securityContext:
  458.           allowPrivilegeEscalation: true
  459.           capabilities:
  460.             add:
  461.             - NET_BIND_SERVICE
  462.             drop:
  463.             - ALL
  464.           runAsUser: 101
  465.         volumeMounts:
  466.         - mountPath: /usr/local/certificates/
  467.           name: webhook-cert
  468.           readOnly: true
  469.       dnsPolicy: ClusterFirstWithHostNet
  470.       nodeSelector:
  471.         kubernetes.io/os: linux
  472.       serviceAccountName: ingress-nginx
  473.       terminationGracePeriodSeconds: 300
  474.       volumes:
  475.       - name: webhook-cert
  476.         secret:
  477.           secretName: ingress-nginx-admission
  478. ---
  479. apiVersion: batch/v1
  480. kind: Job
  481. metadata:
  482.   labels:
  483.     app.kubernetes.io/component: admission-webhook
  484.     app.kubernetes.io/instance: ingress-nginx
  485.     app.kubernetes.io/name: ingress-nginx
  486.     app.kubernetes.io/part-of: ingress-nginx
  487.     app.kubernetes.io/version: 1.2.1
  488.   name: ingress-nginx-admission-create
  489.   namespace: pig-dev
  490. spec:
  491.   template:
  492.     metadata:
  493.       labels:
  494.         app.kubernetes.io/component: admission-webhook
  495.         app.kubernetes.io/instance: ingress-nginx
  496.         app.kubernetes.io/name: ingress-nginx
  497.         app.kubernetes.io/part-of: ingress-nginx
  498.         app.kubernetes.io/version: 1.2.1
  499.       name: ingress-nginx-admission-create
  500.     spec:
  501.       containers:
  502.       - args:
  503.         - create
  504.         - --host=ingress-nginx-controller-admission,ingress-nginx-controller-admission.$(POD_NAMESPACE).svc
  505.         - --namespace=$(POD_NAMESPACE)
  506.         - --secret-name=ingress-nginx-admission
  507.         env:
  508.         - name: POD_NAMESPACE
  509.           valueFrom:
  510.             fieldRef:
  511.               fieldPath: metadata.namespace
  512.         image: zhxl1989/ingress-nginx-kube-webhook-certgen:v1.1.1
  513.         imagePullPolicy: IfNotPresent
  514.         name: create
  515.         securityContext:
  516.           allowPrivilegeEscalation: false
  517.       nodeSelector:
  518.         kubernetes.io/os: linux
  519.       restartPolicy: OnFailure
  520.       securityContext:
  521.         fsGroup: 2000
  522.         runAsNonRoot: true
  523.         runAsUser: 2000
  524.       serviceAccountName: ingress-nginx-admission
  525. ---
  526. apiVersion: batch/v1
  527. kind: Job
  528. metadata:
  529.   labels:
  530.     app.kubernetes.io/component: admission-webhook
  531.     app.kubernetes.io/instance: ingress-nginx
  532.     app.kubernetes.io/name: ingress-nginx
  533.     app.kubernetes.io/part-of: ingress-nginx
  534.     app.kubernetes.io/version: 1.2.1
  535.   name: ingress-nginx-admission-patch
  536.   namespace: pig-dev
  537. spec:
  538.   template:
  539.     metadata:
  540.       labels:
  541.         app.kubernetes.io/component: admission-webhook
  542.         app.kubernetes.io/instance: ingress-nginx
  543.         app.kubernetes.io/name: ingress-nginx
  544.         app.kubernetes.io/part-of: ingress-nginx
  545.         app.kubernetes.io/version: 1.2.1
  546.       name: ingress-nginx-admission-patch
  547.     spec:
  548.       containers:
  549.       - args:
  550.         - patch
  551.         - --webhook-name=ingress-nginx-admission
  552.         - --namespace=$(POD_NAMESPACE)
  553.         - --patch-mutating=false
  554.         - --secret-name=ingress-nginx-admission
  555.         - --patch-failure-policy=Fail
  556.         env:
  557.         - name: POD_NAMESPACE
  558.           valueFrom:
  559.             fieldRef:
  560.               fieldPath: metadata.namespace
  561.         image: zhxl1989/ingress-nginx-kube-webhook-certgen:v1.1.1
  562.         imagePullPolicy: IfNotPresent
  563.         name: patch
  564.         securityContext:
  565.           allowPrivilegeEscalation: false
  566.       nodeSelector:
  567.         kubernetes.io/os: linux
  568.       restartPolicy: OnFailure
  569.       securityContext:
  570.         fsGroup: 2000
  571.         runAsNonRoot: true
  572.         runAsUser: 2000
  573.       serviceAccountName: ingress-nginx-admission
  574. ---
  575. apiVersion: networking.k8s.io/v1
  576. kind: IngressClass
  577. metadata:
  578.   labels:
  579.     app.kubernetes.io/component: controller
  580.     app.kubernetes.io/instance: ingress-nginx
  581.     app.kubernetes.io/name: ingress-nginx
  582.     app.kubernetes.io/part-of: ingress-nginx
  583.     app.kubernetes.io/version: 1.2.1
  584.   name: nginx
  585. spec:
  586.   controller: k8s.io/ingress-nginx
  587. ---
  588. apiVersion: admissionregistration.k8s.io/v1
  589. kind: ValidatingWebhookConfiguration
  590. metadata:
  591.   labels:
  592.     app.kubernetes.io/component: admission-webhook
  593.     app.kubernetes.io/instance: ingress-nginx
  594.     app.kubernetes.io/name: ingress-nginx
  595.     app.kubernetes.io/part-of: ingress-nginx
  596.     app.kubernetes.io/version: 1.2.1
  597.   name: ingress-nginx-admission
  598. webhooks:
  599. - admissionReviewVersions:
  600.   - v1
  601.   clientConfig:
  602.     service:
  603.       name: ingress-nginx-controller-admission
  604.       namespace: pig-dev
  605.       path: /networking/v1/ingresses
  606.   failurePolicy: Fail
  607.   matchPolicy: Equivalent
  608.   name: validate.nginx.ingress.kubernetes.io
  609.   rules:
  610.   - apiGroups:
  611.     - networking.k8s.io
  612.     apiVersions:
  613.     - v1
  614.     operations:
  615.     - CREATE
  616.     - UPDATE
  617.     resources:
  618.     - ingresses
  619.   sideEffects: None

2.9.2、查看配置Ingress的配置结果

kubectl describe ingress/harbor-ingress -n pig-dev

3、访问

3.1、window配置hosts

 3.2、访问地址

https://harbor.liebe.com.cn/harbor/projects

用户名：admin

密码：Harbor12345

 

 

 

声明：本文内容由网友自发贡献，不代表【wpsshop博客】立场，版权归原作者所有，本站不承担相应法律责任。如您发现有侵权的内容，请联系我们。转载请注明出处：https://www.wpsshop.cn/w/酷酷是懒虫/article/detail/977371
推荐阅读
相关标签

Copyright © 2003-2013 www.wpsshop.cn 版权所有，并保留所有权利。

  

闽ICP备14008679号