• k8s上部署Harbor通过Nginx-Ingress域名访问

    目录

    1、k8s集群环境，通过kubesphere安装部署。

    1.1 集群基本信息

     1.2 集群节点信息

     2、安装Harbor

    2.1、使用Helm添加Harbor仓库

     2.2 、通过openssl生成证书

    2.3、 创建secret

     2.4、 创建nfs存储目录

     2.5、 创建pv

     2.6、创建pvc

    2.7、values.yaml配置文件

    2.8、部署执行命令

    2.9、编辑ingress文件，类型vim操作

     2.9.1、部署nginx-ingress-controller

    2.9.2、查看配置Ingress的配置结果

    3、访问

    3.1、window配置hosts

     3.2、访问地址

    1、k8s集群环境，通过kubesphere安装部署。

    1.1 集群基本信息

     1.2 集群节点信息

     2、安装Harbor

    2.1、使用Helm添加Harbor仓库

    1. helm repo add harbor https://helm.goharbor.io
    2. helm pull harbor/harbor

    运行上面命令，得到文件harbor-1.10.2.tgz，将文件解压，并重命名为harbor。

     2.2 、通过openssl生成证书

    harbor目录下存在cert，执行cp -r cert bak，对默认的cert文件进行备份。

    1. cd cert
    2.  
    3. openssl genrsa -des3 -passout pass:over4chars -out tls.pass.key 2048
    4. ...
    5. openssl rsa -passin pass:over4chars -in tls.pass.key -out tls.key
    6. # Writing RSA key
    7.  
    8. rm -rf tls.pass.key
    9.  
    10. openssl req -new -key tls.key -out tls.csr
    11. ...
    12. If you enter '.', the field will be left blank.
    13. -----
    14. Country Name (2 letter code) [XX]:CN
    15. State or Province Name (full name) []:Beijing
    16. Locality Name (eg, city) [Default City]:Beijing
    17. Organization Name (eg, company) [Default Company Ltd]:liebe
    18. Organizational Unit Name (eg, section) []:liebe
    19. Common Name (eg, your name or your server's hostname) []:harbon.liebe.com.cn
    20. Email Address []:你的邮箱地址
    22. Please enter the following 'extra' attributes
    23. to be sent with your certificate request
    24. A challenge password []:talent
    25. An optional company name []:liebe
    27. 生成 SSL 证书
    28. 自签名 SSL 证书是从私钥和文件生成的。tls.keytls.csr
    29. openssl x509 -req -sha256 -days 365 -in tls.csr -signkey tls.key -out tls.crt

    2.3、 创建secret

               执行命令

    kubectl create secret tls harbor.liebe.com.cn --key tls.key --cert tls.crt -n pig-dev

             查看创建结果

    kubectl get secret -n pig-dev

     2.4、 创建nfs存储目录

    1.   mkdir -p /home/data/nfs-share/harbor/registry
    2.   mkdir -p /home/data/nfs-share/harbor/chartmuseum
    3.   mkdir -p /home/data/nfs-share/harbor/jobservice
    4.   mkdir -p /home/data/nfs-share/harbor/database
    5.   mkdir -p /home/data/nfs-share/harbor/redis
    6.   mkdir -p /home/data/nfs-share/harbor/trivy  
    7.   mkdir -p /home/data/nfs-share/harbor/jobservicedata
    8.   mkdir -p /home/data/nfs-share/harbor/jobservicelog
    9.   chmod 777 /home/data/nfs-share/harbor/*

     2.5、 创建pv

    1. #第1个
    2. apiVersion: v1
    3. kind: PersistentVolume
    4. metadata:
    5.   name: harbor-registry
    6.   namespace: pig-dev
    7.   labels:
    8.     app: harbor-registry
    9. spec:
    10.   capacity:
    11.     storage: 150Gi
    12.   accessModes:
    13.     - ReadWriteOnce
    14.   persistentVolumeReclaimPolicy: Retain
    15.   storageClassName: "managed-nfs-storage"
    16.   mountOptions:
    17.     - hard
    18.   nfs:
    19.     path: /home/data/nfs-share/harbor/registry
    20.     server: 10.10.10.89
    21. ---
    22. #第2个
    23. apiVersion: v1
    24. kind: PersistentVolume
    25. metadata:
    26.   name: harbor-chartmuseum
    27.   namespace: pig-dev
    28.   labels:
    29.     app: harbor-chartmuseum
    30. spec:
    31.   capacity:
    32.     storage: 10G
    33.   accessModes:
    34.     - ReadWriteOnce
    35.   persistentVolumeReclaimPolicy: Retain
    36.   storageClassName: "managed-nfs-storage"
    37.   mountOptions:
    38.     - hard
    39.   nfs:
    40.     path: /home/data/nfs-share/harbor/chartmuseum
    41.     server: 10.10.10.89
    42. ---
    43. #第3个
    44. apiVersion: v1
    45. kind: PersistentVolume
    46. metadata:
    47.   name: harbor-jobservicelog
    48.   namespace: pig-dev
    49.   labels:
    50.     app: harbor-jobservicelog
    51. spec:
    52.   capacity:
    53.     storage: 10G
    54.   accessModes:
    55.     - ReadWriteOnce
    56.   persistentVolumeReclaimPolicy: Retain
    57.   storageClassName: "managed-nfs-storage"
    58.   mountOptions:
    59.     - hard
    60.   nfs:
    61.     path: /home/data/nfs-share/harbor/jobservicelog
    62.     server: 10.10.10.89
    63. ---
    64. apiVersion: v1
    65. kind: PersistentVolume
    66. metadata:
    67.   name: harbor-jobservicedata
    68.   namespace: pig-dev
    69.   labels:
    70.     app: harbor-jobservicedata
    71. spec:
    72.   capacity:
    73.     storage: 10G
    74.   accessModes:
    75.     - ReadWriteOnce
    76.   persistentVolumeReclaimPolicy: Retain
    77.   storageClassName: "managed-nfs-storage"
    78.   mountOptions:
    79.     - hard
    80.   nfs:
    81.     path: /home/data/nfs-share/harbor/jobservicedata
    82.     server: 10.10.10.89
    83. ---
    84. #第4个
    85. apiVersion: v1
    86. kind: PersistentVolume
    87. metadata:
    88.   name: harbor-database
    89.   namespace: pig-dev
    90.   labels:
    91.     app: harbor-database
    92. spec:
    93.   capacity:
    94.     storage: 10G
    95.   accessModes:
    96.     - ReadWriteOnce
    97.   persistentVolumeReclaimPolicy: Retain
    98.   storageClassName: "managed-nfs-storage"
    99.   mountOptions:
    100.     - hard
    101.   nfs:
    102.     path: /home/data/nfs-share/harbor/database
    103.     server: 10.10.10.89
    104. ---
    105. #第5个
    106. apiVersion: v1
    107. kind: PersistentVolume
    108. metadata:
    109.   name: harbor-redis
    110.   namespace: pig-dev
    111.   labels:
    112.     app: harbor-redis
    113. spec:
    114.   capacity:
    115.     storage: 10G
    116.   accessModes:
    117.     - ReadWriteOnce
    118.   persistentVolumeReclaimPolicy: Retain
    119.   storageClassName: "managed-nfs-storage"
    120.   mountOptions:
    121.     - hard
    122.   nfs:
    123.     path: /home/data/nfs-share/harbor/redis
    124.     server: 10.10.10.89
    125. ---
    126. #第6个
    127. apiVersion: v1
    128. kind: PersistentVolume
    129. metadata:
    130.   name: harbor-trivy
    131.   namespace: pig-dev
    132.   labels:
    133.     app: harbor-trivy
    134. spec:
    135.   capacity:
    136.     storage: 10G
    137.   accessModes:
    138.     - ReadWriteOnce
    139.   persistentVolumeReclaimPolicy: Retain
    140.   storageClassName: "managed-nfs-storage"
    141.   mountOptions:
    142.     - hard
    143.   nfs:
    144.     path: /home/data/nfs-share/harbor/trivy
    145.     server: 10.10.10.89

     2.6、创建pvc

    1. #第1个
    2. kind: PersistentVolumeClaim
    3. apiVersion: v1
    4. metadata:
    5.   name: harbor-registry
    6.   namespace: pig-dev
    7. spec:
    8.   accessModes:
    9.     - ReadWriteOnce
    10.   storageClassName: "managed-nfs-storage"
    11.   resources:
    12.     requests:
    13.       storage: 150Gi
    14. ---
    15. #第2个
    16. kind: PersistentVolumeClaim
    17. apiVersion: v1
    18. metadata:
    19.   name: harbor-chartmuseum
    20.   namespace: pig-dev
    21. spec:
    22.   accessModes:
    23.     - ReadWriteOnce
    24.   storageClassName: "managed-nfs-storage"
    25.   resources:
    26.     requests:
    27.       storage: 10Gi
    28. ---
    29. #第3个
    30. kind: PersistentVolumeClaim
    31. apiVersion: v1
    32. metadata:
    33.   name: harbor-jobservicelog
    34.   namespace: pig-dev
    35. spec:
    36.   accessModes:
    37.     - ReadWriteOnce
    38.   storageClassName: "managed-nfs-storage"
    39.   resources:
    40.     requests:
    41.       storage: 5Gi
    42. ---
    43. kind: PersistentVolumeClaim
    44. apiVersion: v1
    45. metadata:
    46.   name: harbor-jobservicedata
    47.   namespace: pig-dev
    48. spec:
    49.   accessModes:
    50.     - ReadWriteOnce
    51.   storageClassName: "managed-nfs-storage"
    52.   resources:
    53.     requests:
    54.       storage: 5Gi
    55. ---
    56. #第4个
    57. kind: PersistentVolumeClaim
    58. apiVersion: v1
    59. metadata:
    60.   name: harbor-database
    61.   namespace: pig-dev
    62. spec:
    63.   accessModes:
    64.     - ReadWriteOnce
    65.   storageClassName: "managed-nfs-storage"
    66.   resources:
    67.     requests:
    68.       storage: 10Gi
    69. ---
    70. #第5个
    71. kind: PersistentVolumeClaim
    72. apiVersion: v1
    73. metadata:
    74.   name: harbor-redis
    75.   namespace: pig-dev
    76. spec:
    77.   accessModes:
    78.     - ReadWriteOnce
    79.   storageClassName: "managed-nfs-storage"
    80.   resources:
    81.     requests:
    82.       storage: 10Gi
    83. ---
    84. #第6个
    85. kind: PersistentVolumeClaim
    86. apiVersion: v1
    87. metadata:
    88.   name: harbor-trivy
    89.   namespace: pig-dev
    90. spec:
    91.   accessModes:
    92.     - ReadWriteOnce
    93.   storageClassName: "managed-nfs-storage"
    94.   resources:
    95.     requests:
    96.       storage: 10Gi

    2.7、values.yaml配置文件

    1. expose:
    2.   # Set how to expose the service. Set the type as "ingress", "clusterIP", "nodePort" or "loadBalancer"
    3.   # and fill the information in the corresponding section
    4.   type: ingress
    5.   tls:
    6.     # Enable TLS or not.
    7.     # Delete the "ssl-redirect" annotations in "expose.ingress.annotations" when TLS is disabled and "expose.type" is "ingress"
    8.     # Note: if the "expose.type" is "ingress" and TLS is disabled,
    9.     # the port must be included in the command when pulling/pushing images.
    10.     # Refer to https://github.com/goharbor/harbor/issues/5291 for details.
    11.     enabled: true
    12.     # The source of the tls certificate. Set as "auto", "secret"
    13.     # or "none" and fill the information in the corresponding section
    14.     # 1) auto: generate the tls certificate automatically
    15.     # 2) secret: read the tls certificate from the specified secret.
    16.     # The tls certificate can be generated manually or by cert manager
    17.     # 3) none: configure no tls certificate for the ingress. If the default
    18.     # tls certificate is configured in the ingress controller, choose this option
    19.     certSource: "secret"
    20.     auto:
    21.       # The common name used to generate the certificate, it's necessary
    22.       # when the type isn't "ingress"
    23.       commonName: ""
    24.     secret:
    25.       # The name of secret which contains keys named:
    26.       # "tls.crt" - the certificate
    27.       # "tls.key" - the private key
    28.       secretName: "harbor.liebe.com.cn"
    29.       # The name of secret which contains keys named:
    30.       # "tls.crt" - the certificate
    31.       # "tls.key" - the private key
    32.       # Only needed when the "expose.type" is "ingress".
    33.       notarySecretName: "harbor.liebe.com.cn"
    34.   ingress:
    35.     hosts:
    36.       core: harbor.liebe.com.cn
    37.       notary: notary-harbor.liebe.com.cn
    38.     # set to the type of ingress controller if it has specific requirements.
    39.     # leave as `default` for most ingress controllers.
    40.     # set to `gce` if using the GCE ingress controller
    41.     # set to `ncp` if using the NCP (NSX-T Container Plugin) ingress controller
    42.     # set to `alb` if using the ALB ingress controller
    43.     controller: default
    44.     ## Allow .Capabilities.KubeVersion.Version to be overridden while creating ingress
    45.     kubeVersionOverride: ""
    46.     className: ""
    47.     annotations:
    48.       # note different ingress controllers may require a different ssl-redirect annotation
    49.       # for Envoy, use ingress.kubernetes.io/force-ssl-redirect: "true" and remove the nginx lines below
    50.       ingress.kubernetes.io/ssl-redirect: "true"
    51.       ingress.kubernetes.io/proxy-body-size: "1024m"
    52.       #### 如果是 traefik ingress，则按下面配置：
    53. #      kubernetes.io/ingress.class: "traefik"
    54. #      traefik.ingress.kubernetes.io/router.tls: 'true'
    55. #      traefik.ingress.kubernetes.io/router.entrypoints: websecure
    56.       #### 如果是 nginx ingress，则按下面配置：
    57.       nginx.ingress.kubernetes.io/ssl-redirect: "true"
    58.       nginx.ingress.kubernetes.io/proxy-body-size: "1024m"
    59.       nginx.org/client-max-body-size: "1024m"
    60.     notary:
    61.       # notary ingress-specific annotations
    62.       annotations: {}
    63.       # notary ingress-specific labels
    64.       labels: {}
    65.     harbor:
    66.       # harbor ingress-specific annotations
    67.       annotations: {}
    68.       # harbor ingress-specific labels
    69.       labels: {}
    70.   clusterIP:
    71.     # The name of ClusterIP service
    72.     name: harbor
    73.     # Annotations on the ClusterIP service
    74.     annotations: {}
    75.     ports:
    76.       # The service port Harbor listens on when serving HTTP
    77.       httpPort: 80
    78.       # The service port Harbor listens on when serving HTTPS
    79.       httpsPort: 443
    80.       # The service port Notary listens on. Only needed when notary.enabled
    81.       # is set to true
    82.       notaryPort: 4443
    83.   nodePort:
    84.     # The name of NodePort service
    85.     name: harbor
    86.     ports:
    87.       http:
    88.         # The service port Harbor listens on when serving HTTP
    89.         port: 80
    90.         # The node port Harbor listens on when serving HTTP
    91.         nodePort: 30102
    92.       https:
    93.         # The service port Harbor listens on when serving HTTPS
    94.         port: 443
    95.         # The node port Harbor listens on when serving HTTPS
    96.         nodePort: 30103
    97.       # Only needed when notary.enabled is set to true
    98.       notary:
    99.         # The service port Notary listens on
    100.         port: 4443
    101.         # The node port Notary listens on
    102.         nodePort: 30104
    103.   loadBalancer:
    104.     # The name of LoadBalancer service
    105.     name: harbor
    106.     # Set the IP if the LoadBalancer supports assigning IP
    107.     IP: ""
    108.     ports:
    109.       # The service port Harbor listens on when serving HTTP
    110.       httpPort: 80
    111.       # The service port Harbor listens on when serving HTTPS
    112.       httpsPort: 443
    113.       # The service port Notary listens on. Only needed when notary.enabled
    114.       # is set to true
    115.       notaryPort: 4443
    116.     annotations: {}
    117.     sourceRanges: []
    118.  
    119. # The external URL for Harbor core service. It is used to
    120. # 1) populate the docker/helm commands showed on portal
    121. # 2) populate the token service URL returned to docker/notary client
    122. #
    123. # Format: protocol://domain[:port]. Usually:
    124. # 1) if "expose.type" is "ingress", the "domain" should be
    125. # the value of "expose.ingress.hosts.core"
    126. # 2) if "expose.type" is "clusterIP", the "domain" should be
    127. # the value of "expose.clusterIP.name"
    128. # 3) if "expose.type" is "nodePort", the "domain" should be
    129. # the IP address of k8s node
    130. #
    131. # If Harbor is deployed behind the proxy, set it as the URL of proxy
    132. externalURL: https://harbor.liebe.com.cn
    133.  
    134. # The internal TLS used for harbor components secure communicating. In order to enable https
    135. # in each components tls cert files need to provided in advance.
    136. internalTLS:
    137.   # If internal TLS enabled
    138.   enabled: true
    139.   # There are three ways to provide tls
    140.   # 1) "auto" will generate cert automatically
    141.   # 2) "manual" need provide cert file manually in following value
    142.   # 3) "secret" internal certificates from secret
    143.   certSource: "auto"
    144.   # The content of trust ca, only available when `certSource` is "manual"
    145.   trustCa: ""
    146.   # core related cert configuration
    147.   core:
    148.     # secret name for core's tls certs
    149.     secretName: ""
    150.     # Content of core's TLS cert file, only available when `certSource` is "manual"
    151.     crt: ""
    152.     # Content of core's TLS key file, only available when `certSource` is "manual"
    153.     key: ""
    154.   # jobservice related cert configuration
    155.   jobservice:
    156.     # secret name for jobservice's tls certs
    157.     secretName: ""
    158.     # Content of jobservice's TLS key file, only available when `certSource` is "manual"
    159.     crt: ""
    160.     # Content of jobservice's TLS key file, only available when `certSource` is "manual"
    161.     key: ""
    162.   # registry related cert configuration
    163.   registry:
    164.     # secret name for registry's tls certs
    165.     secretName: ""
    166.     # Content of registry's TLS key file, only available when `certSource` is "manual"
    167.     crt: ""
    168.     # Content of registry's TLS key file, only available when `certSource` is "manual"
    169.     key: ""
    170.   # portal related cert configuration
    171.   portal:
    172.     # secret name for portal's tls certs
    173.     secretName: ""
    174.     # Content of portal's TLS key file, only available when `certSource` is "manual"
    175.     crt: ""
    176.     # Content of portal's TLS key file, only available when `certSource` is "manual"
    177.     key: ""
    178.   # chartmuseum related cert configuration
    179.   chartmuseum:
    180.     # secret name for chartmuseum's tls certs
    181.     secretName: ""
    182.     # Content of chartmuseum's TLS key file, only available when `certSource` is "manual"
    183.     crt: ""
    184.     # Content of chartmuseum's TLS key file, only available when `certSource` is "manual"
    185.     key: ""
    186.   # trivy related cert configuration
    187.   trivy:
    188.     # secret name for trivy's tls certs
    189.     secretName: ""
    190.     # Content of trivy's TLS key file, only available when `certSource` is "manual"
    191.     crt: ""
    192.     # Content of trivy's TLS key file, only available when `certSource` is "manual"
    193.     key: ""
    194.  
    195. ipFamily:
    196.   # ipv6Enabled set to true if ipv6 is enabled in cluster, currently it affected the nginx related component
    197.   ipv6:
    198.     enabled: true
    199.   # ipv4Enabled set to true if ipv4 is enabled in cluster, currently it affected the nginx related component
    200.   ipv4:
    201.     enabled: true
    202.  
    203. # The persistence is enabled by default and a default StorageClass
    204. # is needed in the k8s cluster to provision volumes dynamically.
    205. # Specify another StorageClass in the "storageClass" or set "existingClaim"
    206. # if you already have existing persistent volumes to use
    207. #
    208. # For storing images and charts, you can also use "azure", "gcs", "s3",
    209. # "swift" or "oss". Set it in the "imageChartStorage" section
    210. persistence:
    211.   enabled: true
    212.   # Setting it to "keep" to avoid removing PVCs during a helm delete
    213.   # operation. Leaving it empty will delete PVCs after the chart deleted
    214.   # (this does not apply for PVCs that are created for internal database
    215.   # and redis components, i.e. they are never deleted automatically)
    216.   resourcePolicy: "keep"
    217.   persistentVolumeClaim:
    218.     registry:
    219.       # Use the existing PVC which must be created manually before bound,
    220.       # and specify the "subPath" if the PVC is shared with other components
    221.       existingClaim: "harbor-registry"
    222.       # Specify the "storageClass" used to provision the volume. Or the default
    223.       # StorageClass will be used (the default).
    224.       # Set it to "-" to disable dynamic provisioning
    225.       storageClass: "managed-nfs-storage"
    226.       subPath: ""
    227.       accessMode: ReadWriteOnce
    228.       size: 150Gi
    229.       annotations: {}
    230.     chartmuseum:
    231.       existingClaim: "harbor-chartmuseum"
    232.       storageClass: "managed-nfs-storage"
    233.       subPath: ""
    234.       accessMode: ReadWriteOnce
    235.       size: 10Gi
    236.       annotations: {}
    237.     jobservice:
    238.       jobLog:
    239.         existingClaim: "harbor-jobservicelog"
    240.         storageClass: "managed-nfs-storage"
    241.         subPath: ""
    242.         accessMode: ReadWriteOnce
    243.         size: 5Gi
    244.         annotations: {}
    245.       scanDataExports:
    246.         existingClaim: "harbor-jobservicedata"
    247.         storageClass: "managed-nfs-storage"
    248.         subPath: ""
    249.         accessMode: ReadWriteOnce
    250.         size: 5Gi
    251.         annotations: {}
    252.     # If external database is used, the following settings for database will
    253.     # be ignored
    254.     database:
    255.       existingClaim: "harbor-database"
    256.       storageClass: "managed-nfs-storage"
    257.       subPath: ""
    258.       accessMode: ReadWriteOnce
    259.       size: 10Gi
    260.       annotations: {}
    261.     # If external Redis is used, the following settings for Redis will
    262.     # be ignored
    263.     redis:
    264.       existingClaim: "harbor-redis"
    265.       storageClass: "managed-nfs-storage"
    266.       subPath: ""
    267.       accessMode: ReadWriteOnce
    268.       size: 10Gi
    269.       annotations: {}
    270.     trivy:
    271.       existingClaim: "harbor-trivy"
    272.       storageClass: "managed-nfs-storage"
    273.       subPath: ""
    274.       accessMode: ReadWriteOnce
    275.       size: 10Gi
    276.       annotations: {}
    277.   # Define which storage backend is used for registry and chartmuseum to store
    278.   # images and charts. Refer to
    279.   # https://github.com/docker/distribution/blob/master/docs/configuration.md#storage
    280.   # for the detail.
    281.   imageChartStorage:
    282.     # Specify whether to disable `redirect` for images and chart storage, for
    283.     # backends which not supported it (such as using minio for `s3` storage type), please disable
    284.     # it. To disable redirects, simply set `disableredirect` to `true` instead.
    285.     # Refer to
    286.     # https://github.com/docker/distribution/blob/master/docs/configuration.md#redirect
    287.     # for the detail.
    288.     disableredirect: false
    289.     # Specify the "caBundleSecretName" if the storage service uses a self-signed certificate.
    290.     # The secret must contain keys named "ca.crt" which will be injected into the trust store
    291.     # of registry's and chartmuseum's containers.
    292.     # caBundleSecretName:
    293.  
    294.     # Specify the type of storage: "filesystem", "azure", "gcs", "s3", "swift",
    295.     # "oss" and fill the information needed in the corresponding section. The type
    296.     # must be "filesystem" if you want to use persistent volumes for registry
    297.     # and chartmuseum
    298.     type: filesystem
    299.     filesystem:
    300.       rootdirectory: /storage
    301.       #maxthreads: 100
    302.     azure:
    303.       accountname: accountname
    304.       accountkey: base64encodedaccountkey
    305.       container: containername
    306.       #realm: core.windows.net
    307.       # To use existing secret, the key must be AZURE_STORAGE_ACCESS_KEY
    308.       existingSecret: ""
    309.     gcs:
    310.       bucket: bucketname
    311.       # The base64 encoded json file which contains the key
    312.       encodedkey: base64-encoded-json-key-file
    313.       #rootdirectory: /gcs/object/name/prefix
    314.       #chunksize: "5242880"
    315.       # To use existing secret, the key must be gcs-key.json
    316.       existingSecret: ""
    317.       useWorkloadIdentity: false
    318.     s3:
    319.       # Set an existing secret for S3 accesskey and secretkey
    320.       # keys in the secret should be AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY for chartmuseum
    321.       # keys in the secret should be REGISTRY_STORAGE_S3_ACCESSKEY and REGISTRY_STORAGE_S3_SECRETKEY for registry
    322.       #existingSecret: ""
    323.       region: us-west-1
    324.       bucket: bucketname
    325.       #accesskey: awsaccesskey
    326.       #secretkey: awssecretkey
    327.       #regionendpoint: http://myobjects.local
    328.       #encrypt: false
    329.       #keyid: mykeyid
    330.       #secure: true
    331.       #skipverify: false
    332.       #v4auth: true
    333.       #chunksize: "5242880"
    334.       #rootdirectory: /s3/object/name/prefix
    335.       #storageclass: STANDARD
    336.       #multipartcopychunksize: "33554432"
    337.       #multipartcopymaxconcurrency: 100
    338.       #multipartcopythresholdsize: "33554432"
    339.     swift:
    340.       authurl: https://storage.myprovider.com/v3/auth
    341.       username: username
    342.       password: password
    343.       container: containername
    344.       #region: fr
    345.       #tenant: tenantname
    346.       #tenantid: tenantid
    347.       #domain: domainname
    348.       #domainid: domainid
    349.       #trustid: trustid
    350.       #insecureskipverify: false
    351.       #chunksize: 5M
    352.       #prefix:
    353.       #secretkey: secretkey
    354.       #accesskey: accesskey
    355.       #authversion: 3
    356.       #endpointtype: public
    357.       #tempurlcontainerkey: false
    358.       #tempurlmethods:
    359.     oss:
    360.       accesskeyid: accesskeyid
    361.       accesskeysecret: accesskeysecret
    362.       region: regionname
    363.       bucket: bucketname
    364.       #endpoint: endpoint
    365.       #internal: false
    366.       #encrypt: false
    367.       #secure: true
    368.       #chunksize: 10M
    369.       #rootdirectory: rootdirectory
    370.  
    371. imagePullPolicy: IfNotPresent
    372.  
    373. # Use this set to assign a list of default pullSecrets
    374. imagePullSecrets:
    375. #  - name: docker-registry-secret
    376. #  - name: internal-registry-secret
    377.  
    378. # The update strategy for deployments with persistent volumes(jobservice, registry
    379. # and chartmuseum): "RollingUpdate" or "Recreate"
    380. # Set it as "Recreate" when "RWM" for volumes isn't supported
    381. updateStrategy:
    382.   type: RollingUpdate
    383.  
    384. # debug, info, warning, error or fatal
    385. logLevel: info
    386.  
    387. # The initial password of Harbor admin. Change it from portal after launching Harbor
    388. harborAdminPassword: "Harbor12345"
    389.  
    390. # The name of the secret which contains key named "ca.crt". Setting this enables the
    391. # download link on portal to download the CA certificate when the certificate isn't
    392. # generated automatically
    393. caSecretName: ""
    394.  
    395. # The secret key used for encryption. Must be a string of 16 chars.
    396. secretKey: "not-a-secure-key"
    397. # If using existingSecretSecretKey, the key must be sercretKey
    398. existingSecretSecretKey: ""
    399.  
    400. # The proxy settings for updating trivy vulnerabilities from the Internet and replicating
    401. # artifacts from/to the registries that cannot be reached directly
    402. proxy:
    403.   httpProxy:
    404.   httpsProxy:
    405.   noProxy: 127.0.0.1,localhost,.local,.internal
    406.   components:
    407.     - core
    408.     - jobservice
    409.     - trivy
    410.  
    411. # Run the migration job via helm hook
    412. enableMigrateHelmHook: false
    413.  
    414. # The custom ca bundle secret, the secret must contain key named "ca.crt"
    415. # which will be injected into the trust store for chartmuseum, core, jobservice, registry, trivy components
    416. # caBundleSecretName: ""
    417.  
    418. ## UAA Authentication Options
    419. # If you're using UAA for authentication behind a self-signed
    420. # certificate you will need to provide the CA Cert.
    421. # Set uaaSecretName below to provide a pre-created secret that
    422. # contains a base64 encoded CA Certificate named `ca.crt`.
    423. # uaaSecretName:
    424.  
    425. # If service exposed via "ingress", the Nginx will not be used
    426. nginx:
    427.   image:
    428.     repository: goharbor/nginx-photon
    429.     tag: v2.6.2
    430.   # set the service account to be used, default if left empty
    431.   serviceAccountName: ""
    432.   # mount the service account token
    433.   automountServiceAccountToken: false
    434.   replicas: 1
    435.   revisionHistoryLimit: 10
    436.   # resources:
    437.   #  requests:
    438.   #    memory: 256Mi
    439.   #    cpu: 100m
    440.   nodeSelector: {}
    441.   tolerations: []
    442.   affinity: {}
    443.   ## Additional deployment annotations
    444.   podAnnotations: {}
    445.   ## The priority class to run the pod as
    446.   priorityClassName:
    447.  
    448. portal:
    449.   image:
    450.     repository: goharbor/harbor-portal
    451.     tag: v2.6.2
    452.   # set the service account to be used, default if left empty
    453.   serviceAccountName: ""
    454.   # mount the service account token
    455.   automountServiceAccountToken: false
    456.   replicas: 1
    457.   revisionHistoryLimit: 10
    458.   # resources:
    459.   #  requests:
    460.   #    memory: 256Mi
    461.   #    cpu: 100m
    462.   nodeSelector: {}
    463.   tolerations: []
    464.   affinity: {}
    465.   ## Additional deployment annotations
    466.   podAnnotations: {}
    467.   ## The priority class to run the pod as
    468.   priorityClassName:
    469.  
    470. core:
    471.   image:
    472.     repository: goharbor/harbor-core
    473.     tag: v2.6.2
    474.   # set the service account to be used, default if left empty
    475.   serviceAccountName: ""
    476.   # mount the service account token
    477.   automountServiceAccountToken: false
    478.   replicas: 1
    479.   revisionHistoryLimit: 10
    480.   ## Startup probe values
    481.   startupProbe:
    482.     enabled: true
    483.     initialDelaySeconds: 10
    484.   # resources:
    485.   #  requests:
    486.   #    memory: 256Mi
    487.   #    cpu: 100m
    488.   nodeSelector: {}
    489.   tolerations: []
    490.   affinity: {}
    491.   ## Additional deployment annotations
    492.   podAnnotations: {}
    493.   # Secret is used when core server communicates with other components.
    494.   # If a secret key is not specified, Helm will generate one.
    495.   # Must be a string of 16 chars.
    496.   secret: ""
    497.   # Fill the name of a kubernetes secret if you want to use your own
    498.   # TLS certificate and private key for token encryption/decryption.
    499.   # The secret must contain keys named:
    500.   # "tls.crt" - the certificate
    501.   # "tls.key" - the private key
    502.   # The default key pair will be used if it isn't set
    503.   secretName: ""
    504.   # The XSRF key. Will be generated automatically if it isn't specified
    505.   xsrfKey: ""
    506.   ## The priority class to run the pod as
    507.   priorityClassName:
    508.   # The time duration for async update artifact pull_time and repository
    509.   # pull_count, the unit is second. Will be 10 seconds if it isn't set.
    510.   # eg. artifactPullAsyncFlushDuration: 10
    511.   artifactPullAsyncFlushDuration:
    512.   gdpr:
    513.     deleteUser: false
    514.  
    515. jobservice:
    516.   image:
    517.     repository: goharbor/harbor-jobservice
    518.     tag: v2.6.2
    519.   replicas: 1
    520.   revisionHistoryLimit: 10
    521.   # set the service account to be used, default if left empty
    522.   serviceAccountName: ""
    523.   # mount the service account token
    524.   automountServiceAccountToken: false
    525.   maxJobWorkers: 10
    526.   # The logger for jobs: "file", "database" or "stdout"
    527.   jobLoggers:
    528.     - file
    529.     # - database
    530.     # - stdout
    531.   # The jobLogger sweeper duration (ignored if `jobLogger` is `stdout`)
    532.   loggerSweeperDuration: 14 #days
    533.  
    534.   # resources:
    535.   #   requests:
    536.   #     memory: 256Mi
    537.   #     cpu: 100m
    538.   nodeSelector: {}
    539.   tolerations: []
    540.   affinity: {}
    541.   ## Additional deployment annotations
    542.   podAnnotations: {}
    543.   # Secret is used when job service communicates with other components.
    544.   # If a secret key is not specified, Helm will generate one.
    545.   # Must be a string of 16 chars.
    546.   secret: ""
    547.   ## The priority class to run the pod as
    548.   priorityClassName:
    549.  
    550. registry:
    551.   # set the service account to be used, default if left empty
    552.   serviceAccountName: ""
    553.   # mount the service account token
    554.   automountServiceAccountToken: false
    555.   registry:
    556.     image:
    557.       repository: goharbor/registry-photon
    558.       tag: v2.6.2
    559.     # resources:
    560.     #  requests:
    561.     #    memory: 256Mi
    562.     #    cpu: 100m
    563.   controller:
    564.     image:
    565.       repository: goharbor/harbor-registryctl
    566.       tag: v2.6.2
    567.  
    568.     # resources:
    569.     #  requests:
    570.     #    memory: 256Mi
    571.     #    cpu: 100m
    572.   replicas: 1
    573.   revisionHistoryLimit: 10
    574.   nodeSelector: {}
    575.   tolerations: []
    576.   affinity: {}
    577.   ## Additional deployment annotations
    578.   podAnnotations: {}
    579.   ## The priority class to run the pod as
    580.   priorityClassName:
    581.   # Secret is used to secure the upload state from client
    582.   # and registry storage backend.
    583.   # See: https://github.com/docker/distribution/blob/master/docs/configuration.md#http
    584.   # If a secret key is not specified, Helm will generate one.
    585.   # Must be a string of 16 chars.
    586.   secret: ""
    587.   # If true, the registry returns relative URLs in Location headers. The client is responsible for resolving the correct URL.
    588.   relativeurls: false
    589.   credentials:
    590.     username: "harbor_registry_user"
    591.     password: "harbor_registry_password"
    592.     # If using existingSecret, the key must be REGISTRY_PASSWD and REGISTRY_HTPASSWD
    593.     existingSecret: ""
    594.     # Login and password in htpasswd string format. Excludes `registry.credentials.username`  and `registry.credentials.password`. May come in handy when integrating with tools like argocd or flux. This allows the same line to be generated each time the template is rendered, instead of the `htpasswd` function from helm, which generates different lines each time because of the salt.
    595.     # htpasswdString: $apr1$XLefHzeG$Xl4.s00sMSCCcMyJljSZb0 # example string
    596.   middleware:
    597.     enabled: false
    598.     type: cloudFront
    599.     cloudFront:
    600.       baseurl: example.cloudfront.net
    601.       keypairid: KEYPAIRID
    602.       duration: 3000s
    603.       ipfilteredby: none
    604.       # The secret key that should be present is CLOUDFRONT_KEY_DATA, which should be the encoded private key
    605.       # that allows access to CloudFront
    606.       privateKeySecret: "my-secret"
    607.   # enable purge _upload directories
    608.   upload_purging:
    609.     enabled: true
    610.     # remove files in _upload directories which exist for a period of time, default is one week.
    611.     age: 168h
    612.     # the interval of the purge operations
    613.     interval: 24h
    614.     dryrun: false
    615.  
    616. chartmuseum:
    617.   enabled: true
    618.   # set the service account to be used, default if left empty
    619.   serviceAccountName: ""
    620.   # mount the service account token
    621.   automountServiceAccountToken: false
    622.   # Harbor defaults ChartMuseum to returning relative urls, if you want using absolute url you should enable it by change the following value to 'true'
    623.   absoluteUrl: false
    624.   image:
    625.     repository: goharbor/chartmuseum-photon
    626.     tag: v2.6.2
    627.   replicas: 1
    628.   revisionHistoryLimit: 10
    629.   # resources:
    630.   #  requests:
    631.   #    memory: 256Mi
    632.   #    cpu: 100m
    633.   nodeSelector: {}
    634.   tolerations: []
    635.   affinity: {}
    636.   ## Additional deployment annotations
    637.   podAnnotations: {}
    638.   ## The priority class to run the pod as
    639.   priorityClassName:
    640.   ## limit the number of parallel indexers
    641.   indexLimit: 0
    642.  
    643. trivy:
    644.   # enabled the flag to enable Trivy scanner
    645.   enabled: true
    646.   image:
    647.     # repository the repository for Trivy adapter image
    648.     repository: goharbor/trivy-adapter-photon
    649.     # tag the tag for Trivy adapter image
    650.     tag: v2.6.2
    651.   # set the service account to be used, default if left empty
    652.   serviceAccountName: ""
    653.   # mount the service account token
    654.   automountServiceAccountToken: false
    655.   # replicas the number of Pod replicas
    656.   replicas: 1
    657.   # debugMode the flag to enable Trivy debug mode with more verbose scanning log
    658.   debugMode: false
    659.   # vulnType a comma-separated list of vulnerability types. Possible values are `os` and `library`.
    660.   vulnType: "os,library"
    661.   # severity a comma-separated list of severities to be checked
    662.   severity: "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL"
    663.   # ignoreUnfixed the flag to display only fixed vulnerabilities
    664.   ignoreUnfixed: false
    665.   # insecure the flag to skip verifying registry certificate
    666.   insecure: false
    667.   # gitHubToken the GitHub access token to download Trivy DB
    668.   #
    669.   # Trivy DB contains vulnerability information from NVD, Red Hat, and many other upstream vulnerability databases.
    670.   # It is downloaded by Trivy from the GitHub release page https://github.com/aquasecurity/trivy-db/releases and cached
    671.   # in the local file system (`/home/scanner/.cache/trivy/db/trivy.db`). In addition, the database contains the update
    672.   # timestamp so Trivy can detect whether it should download a newer version from the Internet or use the cached one.
    673.   # Currently, the database is updated every 12 hours and published as a new release to GitHub.
    674.   #
    675.   # Anonymous downloads from GitHub are subject to the limit of 60 requests per hour. Normally such rate limit is enough
    676.   # for production operations. If, for any reason, it's not enough, you could increase the rate limit to 5000
    677.   # requests per hour by specifying the GitHub access token. For more details on GitHub rate limiting please consult
    678.   # https://developer.github.com/v3/#rate-limiting
    679.   #
    680.   # You can create a GitHub token by following the instructions in
    681.   # https://help.github.com/en/github/authenticating-to-github/creating-a-personal-access-token-for-the-command-line
    682.   gitHubToken: ""
    683.   # skipUpdate the flag to disable Trivy DB downloads from GitHub
    684.   #
    685.   # You might want to set the value of this flag to `true` in test or CI/CD environments to avoid GitHub rate limiting issues.
    686.   # If the value is set to `true` you have to manually download the `trivy.db` file and mount it in the
    687.   # `/home/scanner/.cache/trivy/db/trivy.db` path.
    688.   skipUpdate: false
    689.   # The offlineScan option prevents Trivy from sending API requests to identify dependencies.
    690.   #
    691.   # Scanning JAR files and pom.xml may require Internet access for better detection, but this option tries to avoid it.
    692.   # For example, the offline mode will not try to resolve transitive dependencies in pom.xml when the dependency doesn't
    693.   # exist in the local repositories. It means a number of detected vulnerabilities might be fewer in offline mode.
    694.   # It would work if all the dependencies are in local.
    695.   # This option doesn’t affect DB download. You need to specify skipUpdate as well as offlineScan in an air-gapped environment.
    696.   offlineScan: false
    697.   # Comma-separated list of what security issues to detect. Possible values are `vuln`, `config` and `secret`. Defaults to `vuln`.
    698.   securityCheck: "vuln"
    699.   # The duration to wait for scan completion
    700.   timeout: 5m0s
    701.   resources:
    702.     requests:
    703.       cpu: 200m
    704.       memory: 512Mi
    705.     limits:
    706.       cpu: 1
    707.       memory: 1Gi
    708.   nodeSelector: {}
    709.   tolerations: []
    710.   affinity: {}
    711.   ## Additional deployment annotations
    712.   podAnnotations: {}
    713.   ## The priority class to run the pod as
    714.   priorityClassName:
    715.  
    716. notary:
    717.   enabled: true
    718.   server:
    719.     # set the service account to be used, default if left empty
    720.     serviceAccountName: ""
    721.     # mount the service account token
    722.     automountServiceAccountToken: false
    723.     image:
    724.       repository: goharbor/notary-server-photon
    725.       tag: v2.6.2
    726.     replicas: 1
    727.     # resources:
    728.     #  requests:
    729.     #    memory: 256Mi
    730.     #    cpu: 100m
    731.     nodeSelector: {}
    732.     tolerations: []
    733.     affinity: {}
    734.     ## Additional deployment annotations
    735.     podAnnotations: {}
    736.     ## The priority class to run the pod as
    737.     priorityClassName:
    738.   signer:
    739.     # set the service account to be used, default if left empty
    740.     serviceAccountName: ""
    741.     # mount the service account token
    742.     automountServiceAccountToken: false
    743.     image:
    744.       repository: goharbor/notary-signer-photon
    745.       tag: v2.6.2
    746.     replicas: 1
    747.     # resources:
    748.     #  requests:
    749.     #    memory: 256Mi
    750.     #    cpu: 100m
    751.     nodeSelector: {}
    752.     tolerations: []
    753.     affinity: {}
    754.     ## Additional deployment annotations
    755.     podAnnotations: {}
    756.     ## The priority class to run the pod as
    757.     priorityClassName:
    758.   # Fill the name of a kubernetes secret if you want to use your own
    759.   # TLS certificate authority, certificate and private key for notary
    760.   # communications.
    761.   # The secret must contain keys named ca.crt, tls.crt and tls.key that
    762.   # contain the CA, certificate and private key.
    763.   # They will be generated if not set.
    764.   secretName: ""
    765.  
    766. database:
    767.   # if external database is used, set "type" to "external"
    768.   # and fill the connection informations in "external" section
    769.   type: internal
    770.   internal:
    771.     # set the service account to be used, default if left empty
    772.     serviceAccountName: ""
    773.     # mount the service account token
    774.     automountServiceAccountToken: false
    775.     image:
    776.       repository: goharbor/harbor-db
    777.       tag: v2.6.2
    778.     # The initial superuser password for internal database
    779.     password: "changeit"
    780.     # The size limit for Shared memory, pgSQL use it for shared_buffer
    781.     # More details see:
    782.     # https://github.com/goharbor/harbor/issues/15034
    783.     shmSizeLimit: 512Mi
    784.     # resources:
    785.     #  requests:
    786.     #    memory: 256Mi
    787.     #    cpu: 100m
    788.     nodeSelector: {}
    789.     tolerations: []
    790.     affinity: {}
    791.     ## The priority class to run the pod as
    792.     priorityClassName:
    793.     initContainer:
    794.       migrator: {}
    795.       # resources:
    796.       #  requests:
    797.       #    memory: 128Mi
    798.       #    cpu: 100m
    799.       permissions: {}
    800.       # resources:
    801.       #  requests:
    802.       #    memory: 128Mi
    803.       #    cpu: 100m
    804.   external:
    805.     host: "postgresql"
    806.     port: "5432"
    807.     username: "gitlab"
    808.     password: "passw0rd"
    809.     coreDatabase: "registry"
    810.     notaryServerDatabase: "notary_server"
    811.     notarySignerDatabase: "notary_signer"
    812.     # if using existing secret, the key must be "password"
    813.     existingSecret: ""
    814.     # "disable" - No SSL
    815.     # "require" - Always SSL (skip verification)
    816.     # "verify-ca" - Always SSL (verify that the certificate presented by the
    817.     # server was signed by a trusted CA)
    818.     # "verify-full" - Always SSL (verify that the certification presented by the
    819.     # server was signed by a trusted CA and the server host name matches the one
    820.     # in the certificate)
    821.     sslmode: "disable"
    822.   # The maximum number of connections in the idle connection pool per pod (core+exporter).
    823.   # If it <=0, no idle connections are retained.
    824.   maxIdleConns: 100
    825.   # The maximum number of open connections to the database per pod (core+exporter).
    826.   # If it <= 0, then there is no limit on the number of open connections.
    827.   # Note: the default number of connections is 1024 for postgre of harbor.
    828.   maxOpenConns: 900
    829.   ## Additional deployment annotations
    830.   podAnnotations: {}
    831.  
    832. redis:
    833.   # if external Redis is used, set "type" to "external"
    834.   # and fill the connection informations in "external" section
    835.   type: internal
    836.   internal:
    837.     # set the service account to be used, default if left empty
    838.     serviceAccountName: ""
    839.     # mount the service account token
    840.     automountServiceAccountToken: false
    841.     image:
    842.       repository: goharbor/redis-photon
    843.       tag: v2.6.2
    844.     # resources:
    845.     #  requests:
    846.     #    memory: 256Mi
    847.     #    cpu: 100m
    848.     nodeSelector: {}
    849.     tolerations: []
    850.     affinity: {}
    851.     ## The priority class to run the pod as
    852.     priorityClassName:
    853.   external:
    854.     # support redis, redis+sentinel
    855.     # addr for redis: :
    856.     # addr for redis+sentinel: :,:,:
    857.     addr: "192.168.0.2:6379"
    858.     # The name of the set of Redis instances to monitor, it must be set to support redis+sentinel
    859.     sentinelMasterSet: ""
    860.     # The "coreDatabaseIndex" must be "0" as the library Harbor
    861.     # used doesn't support configuring it
    862.     coreDatabaseIndex: "0"
    863.     jobserviceDatabaseIndex: "1"
    864.     registryDatabaseIndex: "2"
    865.     chartmuseumDatabaseIndex: "3"
    866.     trivyAdapterIndex: "5"
    867.     password: ""
    868.     # If using existingSecret, the key must be REDIS_PASSWORD
    869.     existingSecret: ""
    870.   ## Additional deployment annotations
    871.   podAnnotations: {}
    872.  
    873. exporter:
    874.   replicas: 1
    875.   revisionHistoryLimit: 10
    876.   # resources:
    877.   #  requests:
    878.   #    memory: 256Mi
    879.   #    cpu: 100m
    880.   podAnnotations: {}
    881.   serviceAccountName: ""
    882.   # mount the service account token
    883.   automountServiceAccountToken: false
    884.   image:
    885.     repository: goharbor/harbor-exporter
    886.     tag: v2.6.2
    887.   nodeSelector: {}
    888.   tolerations: []
    889.   affinity: {}
    890.   cacheDuration: 23
    891.   cacheCleanInterval: 14400
    892.   ## The priority class to run the pod as
    893.   priorityClassName:
    894.  
    895. metrics:
    896.   enabled: false
    897.   core:
    898.     path: /metrics
    899.     port: 8001
    900.   registry:
    901.     path: /metrics
    902.     port: 8001
    903.   jobservice:
    904.     path: /metrics
    905.     port: 8001
    906.   exporter:
    907.     path: /metrics
    908.     port: 8001
    909.   ## Create prometheus serviceMonitor to scrape harbor metrics.
    910.   ## This requires the monitoring.coreos.com/v1 CRD. Please see
    911.   ## https://github.com/prometheus-operator/prometheus-operator/blob/master/Documentation/user-guides/getting-started.md
    912.   ##
    913.   serviceMonitor:
    914.     enabled: false
    915.     additionalLabels: {}
    916.     # Scrape interval. If not set, the Prometheus default scrape interval is used.
    917.     interval: ""
    918.     # Metric relabel configs to apply to samples before ingestion.
    919.     metricRelabelings:
    920.       []
    921.       # - action: keep
    922.       #   regex: 'kube_(daemonset|deployment|pod|namespace|node|statefulset).+'
    923.       #   sourceLabels: [__name__]
    924.     # Relabel configs to apply to samples before ingestion.
    925.     relabelings:
    926.       []
    927.       # - sourceLabels: [__meta_kubernetes_pod_node_name]
    928.       #   separator: ;
    929.       #   regex: ^(.*)$
    930.       #   targetLabel: nodename
    931.       #   replacement: $1
    932.       #   action: replace
    933.  
    934. trace:
    935.   enabled: false
    936.   # trace provider: jaeger or otel
    937.   # jaeger should be 1.26+
    938.   provider: jaeger
    939.   # set sample_rate to 1 if you wanna sampling 100% of trace data; set 0.5 if you wanna sampling 50% of trace data, and so forth
    940.   sample_rate: 1
    941.   # namespace used to differentiate different harbor services
    942.   # namespace:
    943.   # attributes is a key value dict contains user defined attributes used to initialize trace provider
    944.   # attributes:
    945.   #   application: harbor
    946.   jaeger:
    947.     # jaeger supports two modes:
    948.     #   collector mode(uncomment endpoint and uncomment username, password if needed)
    949.     #   agent mode(uncomment agent_host and agent_port)
    950.     endpoint: http://hostname:14268/api/traces
    951.     # username:
    952.     # password:
    953.     # agent_host: hostname
    954.     # export trace data by jaeger.thrift in compact mode
    955.     # agent_port: 6831
    956.   otel:
    957.     endpoint: hostname:4318
    958.     url_path: /v1/traces
    959.     compression: false
    960.     insecure: true
    961.     timeout: 10s
    962.  
    963. # cache layer configurations
    964. # if this feature enabled, harbor will cache the resource
    965. # `project/project_metadata/repository/artifact/manifest` in the redis
    966. # which help to improve the performance of high concurrent pulling manifest.
    967. cache:
    968.   # default is not enabled.
    969.   enabled: false
    970.   # default keep cache for one day.
    971.   expireHours: 24

    2.8、部署执行命令

    1.  kubectl apply -f harbor-pv.yaml  
    2.  kubectl apply -f harbor-pvc.yaml 
    3.  helm install harbor ./ -f values.yaml -n pig-dev
    4.  kubectl get pv,pvc -A

    删除的命令

    1. helm list -A
    2.  
    3. helm uninstall harbor -n pig-dev
    4. kubectl delete -f harbor-pvc.yaml
    5. kubectl delete -f harbor-pv.yaml

    2.9、编辑ingress文件，类型vim操作

    1. kubectl edit ingress -n pig-dev harbor-ingress
    2. kubectl edit ingress -n pig-dev harbor-ingress-notary

    增减内容：ingressClassName: nginx

    两个文件都要增加ingressClassName: nginx

     2.9.1、部署nginx-ingress-controller

    1. apiVersion: v1
    2. kind: Namespace
    3. metadata:
    4.   labels:
    5.     app.kubernetes.io/instance: ingress-nginx
    6.     app.kubernetes.io/name: ingress-nginx
    7.   name: ingress-nginx
    8. ---
    9. apiVersion: v1
    10. automountServiceAccountToken: true
    11. kind: ServiceAccount
    12. metadata:
    13.   labels:
    14.     app.kubernetes.io/component: controller
    15.     app.kubernetes.io/instance: ingress-nginx
    16.     app.kubernetes.io/name: ingress-nginx
    17.     app.kubernetes.io/part-of: ingress-nginx
    18.     app.kubernetes.io/version: 1.2.1
    19.   name: ingress-nginx
    20.   namespace: pig-dev
    21. ---
    22. apiVersion: v1
    23. kind: ServiceAccount
    24. metadata:
    25.   labels:
    26.     app.kubernetes.io/component: admission-webhook
    27.     app.kubernetes.io/instance: ingress-nginx
    28.     app.kubernetes.io/name: ingress-nginx
    29.     app.kubernetes.io/part-of: ingress-nginx
    30.     app.kubernetes.io/version: 1.2.1
    31.   name: ingress-nginx-admission
    32.   namespace: pig-dev
    33. ---
    34. apiVersion: rbac.authorization.k8s.io/v1
    35. kind: Role
    36. metadata:
    37.   labels:
    38.     app.kubernetes.io/component: controller
    39.     app.kubernetes.io/instance: ingress-nginx
    40.     app.kubernetes.io/name: ingress-nginx
    41.     app.kubernetes.io/part-of: ingress-nginx
    42.     app.kubernetes.io/version: 1.2.1
    43.   name: ingress-nginx
    44.   namespace: pig-dev
    45. rules:
    46. - apiGroups:
    47.   - ""
    48.   resources:
    49.   - namespaces
    50.   verbs:
    51.   - get
    52. - apiGroups:
    53.   - ""
    54.   resources:
    55.   - configmaps
    56.   - pods
    57.   - secrets
    58.   - endpoints
    59.   verbs:
    60.   - get
    61.   - list
    62.   - watch
    63. - apiGroups:
    64.   - ""
    65.   resources:
    66.   - services
    67.   verbs:
    68.   - get
    69.   - list
    70.   - watch
    71. - apiGroups:
    72.   - networking.k8s.io
    73.   resources:
    74.   - ingresses
    75.   verbs:
    76.   - get
    77.   - list
    78.   - watch
    79. - apiGroups:
    80.   - networking.k8s.io
    81.   resources:
    82.   - ingresses/status
    83.   verbs:
    84.   - update
    85. - apiGroups:
    86.   - networking.k8s.io
    87.   resources:
    88.   - ingressclasses
    89.   verbs:
    90.   - get
    91.   - list
    92.   - watch
    93. - apiGroups:
    94.   - ""
    95.   resourceNames:
    96.   - ingress-controller-leader
    97.   resources:
    98.   - configmaps
    99.   verbs:
    100.   - get
    101.   - update
    102. - apiGroups:
    103.   - ""
    104.   resources:
    105.   - configmaps
    106.   verbs:
    107.   - create
    108. - apiGroups:
    109.   - ""
    110.   resources:
    111.   - events
    112.   verbs:
    113.   - create
    114.   - patch
    115. ---
    116. apiVersion: rbac.authorization.k8s.io/v1
    117. kind: Role
    118. metadata:
    119.   labels:
    120.     app.kubernetes.io/component: admission-webhook
    121.     app.kubernetes.io/instance: ingress-nginx
    122.     app.kubernetes.io/name: ingress-nginx
    123.     app.kubernetes.io/part-of: ingress-nginx
    124.     app.kubernetes.io/version: 1.2.1
    125.   name: ingress-nginx-admission
    126.   namespace: pig-dev
    127. rules:
    128. - apiGroups:
    129.   - ""
    130.   resources:
    131.   - secrets
    132.   verbs:
    133.   - get
    134.   - create
    135. ---
    136. apiVersion: rbac.authorization.k8s.io/v1
    137. kind: ClusterRole
    138. metadata:
    139.   labels:
    140.     app.kubernetes.io/instance: ingress-nginx
    141.     app.kubernetes.io/name: ingress-nginx
    142.     app.kubernetes.io/part-of: ingress-nginx
    143.     app.kubernetes.io/version: 1.2.1
    144.   name: ingress-nginx
    145. rules:
    146. - apiGroups:
    147.   - ""
    148.   resources:
    149.   - configmaps
    150.   - endpoints
    151.   - nodes
    152.   - pods
    153.   - secrets
    154.   - namespaces
    155.   verbs:
    156.   - list
    157.   - watch
    158. - apiGroups:
    159.   - ""
    160.   resources:
    161.   - nodes
    162.   verbs:
    163.   - get
    164. - apiGroups:
    165.   - ""
    166.   resources:
    167.   - services
    168.   verbs:
    169.   - get
    170.   - list
    171.   - watch
    172. - apiGroups:
    173.   - networking.k8s.io
    174.   resources:
    175.   - ingresses
    176.   verbs:
    177.   - get
    178.   - list
    179.   - watch
    180. - apiGroups:
    181.   - ""
    182.   resources:
    183.   - events
    184.   verbs:
    185.   - create
    186.   - patch
    187. - apiGroups:
    188.   - networking.k8s.io
    189.   resources:
    190.   - ingresses/status
    191.   verbs:
    192.   - update
    193. - apiGroups:
    194.   - networking.k8s.io
    195.   resources:
    196.   - ingressclasses
    197.   verbs:
    198.   - get
    199.   - list
    200.   - watch
    201. ---
    202. apiVersion: rbac.authorization.k8s.io/v1
    203. kind: ClusterRole
    204. metadata:
    205.   labels:
    206.     app.kubernetes.io/component: admission-webhook
    207.     app.kubernetes.io/instance: ingress-nginx
    208.     app.kubernetes.io/name: ingress-nginx
    209.     app.kubernetes.io/part-of: ingress-nginx
    210.     app.kubernetes.io/version: 1.2.1
    211.   name: ingress-nginx-admission
    212. rules:
    213. - apiGroups:
    214.   - admissionregistration.k8s.io
    215.   resources:
    216.   - validatingwebhookconfigurations
    217.   verbs:
    218.   - get
    219.   - update
    220. ---
    221. apiVersion: rbac.authorization.k8s.io/v1
    222. kind: RoleBinding
    223. metadata:
    224.   labels:
    225.     app.kubernetes.io/component: controller
    226.     app.kubernetes.io/instance: ingress-nginx
    227.     app.kubernetes.io/name: ingress-nginx
    228.     app.kubernetes.io/part-of: ingress-nginx
    229.     app.kubernetes.io/version: 1.2.1
    230.   name: ingress-nginx
    231.   namespace: pig-dev
    232. roleRef:
    233.   apiGroup: rbac.authorization.k8s.io
    234.   kind: Role
    235.   name: ingress-nginx
    236. subjects:
    237. - kind: ServiceAccount
    238.   name: ingress-nginx
    239.   namespace: pig-dev
    240. ---
    241. apiVersion: rbac.authorization.k8s.io/v1
    242. kind: RoleBinding
    243. metadata:
    244.   labels:
    245.     app.kubernetes.io/component: admission-webhook
    246.     app.kubernetes.io/instance: ingress-nginx
    247.     app.kubernetes.io/name: ingress-nginx
    248.     app.kubernetes.io/part-of: ingress-nginx
    249.     app.kubernetes.io/version: 1.2.1
    250.   name: ingress-nginx-admission
    251.   namespace: pig-dev
    252. roleRef:
    253.   apiGroup: rbac.authorization.k8s.io
    254.   kind: Role
    255.   name: ingress-nginx-admission
    256. subjects:
    257. - kind: ServiceAccount
    258.   name: ingress-nginx-admission
    259.   namespace: pig-dev
    260. ---
    261. apiVersion: rbac.authorization.k8s.io/v1
    262. kind: ClusterRoleBinding
    263. metadata:
    264.   labels:
    265.     app.kubernetes.io/instance: ingress-nginx
    266.     app.kubernetes.io/name: ingress-nginx
    267.     app.kubernetes.io/part-of: ingress-nginx
    268.     app.kubernetes.io/version: 1.2.1
    269.   name: ingress-nginx
    270. roleRef:
    271.   apiGroup: rbac.authorization.k8s.io
    272.   kind: ClusterRole
    273.   name: ingress-nginx
    274. subjects:
    275. - kind: ServiceAccount
    276.   name: ingress-nginx
    277.   namespace: pig-dev
    278. ---
    279. apiVersion: rbac.authorization.k8s.io/v1
    280. kind: ClusterRoleBinding
    281. metadata:
    282.   labels:
    283.     app.kubernetes.io/component: admission-webhook
    284.     app.kubernetes.io/instance: ingress-nginx
    285.     app.kubernetes.io/name: ingress-nginx
    286.     app.kubernetes.io/part-of: ingress-nginx
    287.     app.kubernetes.io/version: 1.2.1
    288.   name: ingress-nginx-admission
    289. roleRef:
    290.   apiGroup: rbac.authorization.k8s.io
    291.   kind: ClusterRole
    292.   name: ingress-nginx-admission
    293. subjects:
    294. - kind: ServiceAccount
    295.   name: ingress-nginx-admission
    296.   namespace: pig-dev
    297. ---
    298. apiVersion: v1
    299. data:
    300.   allow-snippet-annotations: "true"
    301. kind: ConfigMap
    302. metadata:
    303.   labels:
    304.     app.kubernetes.io/component: controller
    305.     app.kubernetes.io/instance: ingress-nginx
    306.     app.kubernetes.io/name: ingress-nginx
    307.     app.kubernetes.io/part-of: ingress-nginx
    308.     app.kubernetes.io/version: 1.2.1
    309.   name: ingress-nginx-controller
    310.   namespace: pig-dev
    311. ---
    312. apiVersion: v1
    313. kind: Service
    314. metadata:
    315.   labels:
    316.     app.kubernetes.io/component: controller
    317.     app.kubernetes.io/instance: ingress-nginx
    318.     app.kubernetes.io/name: ingress-nginx
    319.     app.kubernetes.io/part-of: ingress-nginx
    320.     app.kubernetes.io/version: 1.2.1
    321.   name: ingress-nginx-controller
    322.   namespace: pig-dev
    323. spec:
    324.   externalTrafficPolicy: Local
    325.   ports:
    326.   - appProtocol: http
    327.     name: http
    328.     port: 80
    329.     protocol: TCP
    330.     targetPort: http
    331.   - appProtocol: https
    332.     name: https
    333.     port: 443
    334.     protocol: TCP
    335.     targetPort: https
    336.   selector:
    337.     app.kubernetes.io/component: controller
    338.     app.kubernetes.io/instance: ingress-nginx
    339.     app.kubernetes.io/name: ingress-nginx
    340.   type: LoadBalancer
    341. ---
    342. apiVersion: v1
    343. kind: Service
    344. metadata:
    345.   labels:
    346.     app.kubernetes.io/component: controller
    347.     app.kubernetes.io/instance: ingress-nginx
    348.     app.kubernetes.io/name: ingress-nginx
    349.     app.kubernetes.io/part-of: ingress-nginx
    350.     app.kubernetes.io/version: 1.2.1
    351.   name: ingress-nginx-controller-admission
    352.   namespace: pig-dev
    353. spec:
    354.   ports:
    355.   - appProtocol: https
    356.     name: https-webhook
    357.     port: 443
    358.     targetPort: webhook
    359.   selector:
    360.     app.kubernetes.io/component: controller
    361.     app.kubernetes.io/instance: ingress-nginx
    362.     app.kubernetes.io/name: ingress-nginx
    363.   type: ClusterIP
    364. ---
    365. apiVersion: apps/v1
    366. #kind: Deployment
    367. kind: DaemonSet
    368. metadata:
    369.   labels:
    370.     app.kubernetes.io/component: controller
    371.     app.kubernetes.io/instance: ingress-nginx
    372.     app.kubernetes.io/name: ingress-nginx
    373.     app.kubernetes.io/part-of: ingress-nginx
    374.     app.kubernetes.io/version: 1.2.1
    375.   name: ingress-nginx-controller
    376.   namespace: pig-dev
    377. spec:
    378.   minReadySeconds: 0
    379.   revisionHistoryLimit: 10
    380.   selector:
    381.     matchLabels:
    382.       app.kubernetes.io/component: controller
    383.       app.kubernetes.io/instance: ingress-nginx
    384.       app.kubernetes.io/name: ingress-nginx
    385.   template:
    386.     metadata:
    387.       labels:
    388.         app.kubernetes.io/component: controller
    389.         app.kubernetes.io/instance: ingress-nginx
    390.         app.kubernetes.io/name: ingress-nginx
    391.     spec:
    392.       hostNetwork: true
    393.       containers:
    394.       - args:
    395.         - /nginx-ingress-controller
    396.         - --publish-service=$(POD_NAMESPACE)/ingress-nginx-controller
    397.         - --election-id=ingress-controller-leader
    398.         - --controller-class=k8s.io/ingress-nginx
    399.         - --ingress-class=nginx
    400.         - --configmap=$(POD_NAMESPACE)/ingress-nginx-controller
    401.         - --validating-webhook=:8443
    402.         - --validating-webhook-certificate=/usr/local/certificates/cert
    403.         - --validating-webhook-key=/usr/local/certificates/key
    404.         env:
    405.         - name: POD_NAME
    406.           valueFrom:
    407.             fieldRef:
    408.               fieldPath: metadata.name
    409.         - name: POD_NAMESPACE
    410.           valueFrom:
    411.             fieldRef:
    412.               fieldPath: metadata.namespace
    413.         - name: LD_PRELOAD
    414.           value: /usr/local/lib/libmimalloc.so
    415.         image: zhxl1989/ingress-nginx-controller:v1.2.1
    416.         imagePullPolicy: IfNotPresent
    417.         lifecycle:
    418.           preStop:
    419.             exec:
    420.               command:
    421.               - /wait-shutdown
    422.         livenessProbe:
    423.           failureThreshold: 5
    424.           httpGet:
    425.             path: /healthz
    426.             port: 10254
    427.             scheme: HTTP
    428.           initialDelaySeconds: 10
    429.           periodSeconds: 10
    430.           successThreshold: 1
    431.           timeoutSeconds: 1
    432.         name: controller
    433.         ports:
    434.         - containerPort: 80
    435.           name: http
    436.           protocol: TCP
    437.         - containerPort: 443
    438.           name: https
    439.           protocol: TCP
    440.         - containerPort: 8443
    441.           name: webhook
    442.           protocol: TCP
    443.         readinessProbe:
    444.           failureThreshold: 3
    445.           httpGet:
    446.             path: /healthz
    447.             port: 10254
    448.             scheme: HTTP
    449.           initialDelaySeconds: 10
    450.           periodSeconds: 10
    451.           successThreshold: 1
    452.           timeoutSeconds: 1
    453.         resources:
    454.           requests:
    455.             cpu: 100m
    456.             memory: 90Mi
    457.         securityContext:
    458.           allowPrivilegeEscalation: true
    459.           capabilities:
    460.             add:
    461.             - NET_BIND_SERVICE
    462.             drop:
    463.             - ALL
    464.           runAsUser: 101
    465.         volumeMounts:
    466.         - mountPath: /usr/local/certificates/
    467.           name: webhook-cert
    468.           readOnly: true
    469.       dnsPolicy: ClusterFirstWithHostNet
    470.       nodeSelector:
    471.         kubernetes.io/os: linux
    472.       serviceAccountName: ingress-nginx
    473.       terminationGracePeriodSeconds: 300
    474.       volumes:
    475.       - name: webhook-cert
    476.         secret:
    477.           secretName: ingress-nginx-admission
    478. ---
    479. apiVersion: batch/v1
    480. kind: Job
    481. metadata:
    482.   labels:
    483.     app.kubernetes.io/component: admission-webhook
    484.     app.kubernetes.io/instance: ingress-nginx
    485.     app.kubernetes.io/name: ingress-nginx
    486.     app.kubernetes.io/part-of: ingress-nginx
    487.     app.kubernetes.io/version: 1.2.1
    488.   name: ingress-nginx-admission-create
    489.   namespace: pig-dev
    490. spec:
    491.   template:
    492.     metadata:
    493.       labels:
    494.         app.kubernetes.io/component: admission-webhook
    495.         app.kubernetes.io/instance: ingress-nginx
    496.         app.kubernetes.io/name: ingress-nginx
    497.         app.kubernetes.io/part-of: ingress-nginx
    498.         app.kubernetes.io/version: 1.2.1
    499.       name: ingress-nginx-admission-create
    500.     spec:
    501.       containers:
    502.       - args:
    503.         - create
    504.         - --host=ingress-nginx-controller-admission,ingress-nginx-controller-admission.$(POD_NAMESPACE).svc
    505.         - --namespace=$(POD_NAMESPACE)
    506.         - --secret-name=ingress-nginx-admission
    507.         env:
    508.         - name: POD_NAMESPACE
    509.           valueFrom:
    510.             fieldRef:
    511.               fieldPath: metadata.namespace
    512.         image: zhxl1989/ingress-nginx-kube-webhook-certgen:v1.1.1
    513.         imagePullPolicy: IfNotPresent
    514.         name: create
    515.         securityContext:
    516.           allowPrivilegeEscalation: false
    517.       nodeSelector:
    518.         kubernetes.io/os: linux
    519.       restartPolicy: OnFailure
    520.       securityContext:
    521.         fsGroup: 2000
    522.         runAsNonRoot: true
    523.         runAsUser: 2000
    524.       serviceAccountName: ingress-nginx-admission
    525. ---
    526. apiVersion: batch/v1
    527. kind: Job
    528. metadata:
    529.   labels:
    530.     app.kubernetes.io/component: admission-webhook
    531.     app.kubernetes.io/instance: ingress-nginx
    532.     app.kubernetes.io/name: ingress-nginx
    533.     app.kubernetes.io/part-of: ingress-nginx
    534.     app.kubernetes.io/version: 1.2.1
    535.   name: ingress-nginx-admission-patch
    536.   namespace: pig-dev
    537. spec:
    538.   template:
    539.     metadata:
    540.       labels:
    541.         app.kubernetes.io/component: admission-webhook
    542.         app.kubernetes.io/instance: ingress-nginx
    543.         app.kubernetes.io/name: ingress-nginx
    544.         app.kubernetes.io/part-of: ingress-nginx
    545.         app.kubernetes.io/version: 1.2.1
    546.       name: ingress-nginx-admission-patch
    547.     spec:
    548.       containers:
    549.       - args:
    550.         - patch
    551.         - --webhook-name=ingress-nginx-admission
    552.         - --namespace=$(POD_NAMESPACE)
    553.         - --patch-mutating=false
    554.         - --secret-name=ingress-nginx-admission
    555.         - --patch-failure-policy=Fail
    556.         env:
    557.         - name: POD_NAMESPACE
    558.           valueFrom:
    559.             fieldRef:
    560.               fieldPath: metadata.namespace
    561.         image: zhxl1989/ingress-nginx-kube-webhook-certgen:v1.1.1
    562.         imagePullPolicy: IfNotPresent
    563.         name: patch
    564.         securityContext:
    565.           allowPrivilegeEscalation: false
    566.       nodeSelector:
    567.         kubernetes.io/os: linux
    568.       restartPolicy: OnFailure
    569.       securityContext:
    570.         fsGroup: 2000
    571.         runAsNonRoot: true
    572.         runAsUser: 2000
    573.       serviceAccountName: ingress-nginx-admission
    574. ---
    575. apiVersion: networking.k8s.io/v1
    576. kind: IngressClass
    577. metadata:
    578.   labels:
    579.     app.kubernetes.io/component: controller
    580.     app.kubernetes.io/instance: ingress-nginx
    581.     app.kubernetes.io/name: ingress-nginx
    582.     app.kubernetes.io/part-of: ingress-nginx
    583.     app.kubernetes.io/version: 1.2.1
    584.   name: nginx
    585. spec:
    586.   controller: k8s.io/ingress-nginx
    587. ---
    588. apiVersion: admissionregistration.k8s.io/v1
    589. kind: ValidatingWebhookConfiguration
    590. metadata:
    591.   labels:
    592.     app.kubernetes.io/component: admission-webhook
    593.     app.kubernetes.io/instance: ingress-nginx
    594.     app.kubernetes.io/name: ingress-nginx
    595.     app.kubernetes.io/part-of: ingress-nginx
    596.     app.kubernetes.io/version: 1.2.1
    597.   name: ingress-nginx-admission
    598. webhooks:
    599. - admissionReviewVersions:
    600.   - v1
    601.   clientConfig:
    602.     service:
    603.       name: ingress-nginx-controller-admission
    604.       namespace: pig-dev
    605.       path: /networking/v1/ingresses
    606.   failurePolicy: Fail
    607.   matchPolicy: Equivalent
    608.   name: validate.nginx.ingress.kubernetes.io
    609.   rules:
    610.   - apiGroups:
    611.     - networking.k8s.io
    612.     apiVersions:
    613.     - v1
    614.     operations:
    615.     - CREATE
    616.     - UPDATE
    617.     resources:
    618.     - ingresses
    619.   sideEffects: None

    2.9.2、查看配置Ingress的配置结果

    kubectl describe ingress/harbor-ingress -n pig-dev

    3、访问

    3.1、window配置hosts

     3.2、访问地址

    https://harbor.liebe.com.cn/harbor/projects

    用户名：admin

    密码：Harbor12345

     

     

     

  • 相关阅读:
    Worthington用于细胞收获的胰蛋白酶&细胞释放程序
    Discuz! X3.4 升级至 Discuz! X3.5 详细教程
    Fiddler导出JMeter脚本插件原理
    【毕业设计】基于 stm32 的病房呼叫系统 - 物联网 嵌入式 单片机
    【每日刷题】Day63
    Android平台GB28181设备接入模块相关博客概览
    App加固中的代码混淆功能，让逆向工程师很头疼
    Docker创建FTP服务器
    python用opencv将标注文件中的标注提取画框到对应的图像中
    JavaEE（入门）
  • 原文地址：https://blog.csdn.net/TT1024167802/article/details/128085646