Initial commit

templates/admission-control.yml

@@ -0,0 +1,55 @@
+{{ if .Values.admissionController }}
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: admission-control
+spec:
+  secretName: admission-control
+  dnsNames:
+    - admission-control.harbor-operator.svc
+  issuerRef:
+    name: harbor-operator
+---
+apiVersion: admissionregistration.k8s.io/v1
+kind: MutatingWebhookConfiguration
+metadata:
+  name: harbor-operator-admission-control
+  annotations:
+    cert-manager.io/inject-ca-from: harbor-operator/admission-control
+webhooks:
+  - name: harbor-operator-admission-control.codemowers.io
+    rules:
+      - apiGroups:
+          - ""
+        apiVersions:
+          - v1
+        operations:
+          - CREATE
+        resources:
+          - pods
+        scope: Namespaced
+    clientConfig:
+      service:
+        namespace: harbor-operator
+        name: admission-control
+    admissionReviewVersions:
+      - v1
+    sideEffects: None
+    timeoutSeconds: 30
+    failurePolicy: Ignore
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: admission-control
+  labels:
+    app.kubernetes.io/name: harbor-operator
+spec:
+  selector:
+    app.kubernetes.io/name: harbor-operator
+  ports:
+  - name: http
+    targetPort: 3001
+    port: 443
+{{ end }}

templates/harbor-core.yaml

@@ -0,0 +1,264 @@
+---
+apiVersion: cert-manager.io/v1
+kind: Issuer
+metadata:
+  name: harbor-operator
+spec:
+  selfSigned: {}
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: harbor-core
+spec:
+  secretName: harbor-core-key
+  dnsNames:
+    - harbor-core.harbor-operator.svc
+  issuerRef:
+    name: harbor-operator
+---
+apiVersion: codemowers.io/v1alpha1
+kind: GeneratedSecret
+metadata:
+  name: harbor-admin-secrets
+spec:
+  mapping:
+    - key: HARBOR_ADMIN_PASSWORD
+      value: "%(password)s"
+    - key: HARBOR_URI
+      value: "https://admin:%(password)s@{{ .Values.ingress.host }}"
+---
+apiVersion: codemowers.io/v1alpha1
+kind: GeneratedSecret
+metadata:
+  name: harbor-core-secret
+spec:
+  mapping:
+    - key: CORE_SECRET
+      value: "%(password)s"
+---
+apiVersion: codemowers.io/v1alpha1
+kind: GeneratedSecret
+metadata:
+  name: harbor-core-oidc-secret-encryption-key
+spec:
+  size: 32
+  mapping:
+    - key: secretKey
+      value: "%(password)s"
+---
+apiVersion: codemowers.io/v1alpha1
+kind: GeneratedSecret
+metadata:
+  name: harbor-core-csrf-key
+spec:
+  size: 32
+  mapping:
+    - key: CSRF_KEY
+      value: "%(password)s"
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: harbor-core
+  labels:
+    app: harbor
+data:
+  app.conf: |+
+    appname = Harbor
+    runmode = prod
+    enablegzip = true
+    [prod]
+    httpport = 8080
+  PORT: "8080"
+  POSTGRESQL_MAX_IDLE_CONNS: "100"
+  POSTGRESQL_MAX_OPEN_CONNS: "900"
+  EXT_ENDPOINT: "https://{{ .Values.ingress.host }}"
+  CORE_URL: "http://harbor-core:80"
+  JOBSERVICE_URL: "http://harbor-jobservice"
+  REGISTRY_URL: "http://harbor-registry:5000"
+  TOKEN_SERVICE_URL: "http://harbor-core:80/service/token"
+  CORE_LOCAL_URL: "http://127.0.0.1:8080"
+  REGISTRY_STORAGE_PROVIDER_NAME: "filesystem"
+  LOG_LEVEL: "info"
+  CONFIG_PATH: "/etc/core/app.conf"
+  CHART_CACHE_DRIVER: "redis"
+  PORTAL_URL: "http://harbor-portal"
+  REGISTRY_CONTROLLER_URL: "http://harbor-registry:8080"
+  PERMITTED_REGISTRY_TYPES_FOR_PROXY_CACHE: "docker-hub,harbor,azure-acr,aws-ecr,google-gcr,quay,docker-registry"
+  METRIC_ENABLE: "true"
+  METRIC_PATH: "/metrics"
+  METRIC_PORT: "8001"
+  METRIC_NAMESPACE: harbor
+  METRIC_SUBSYSTEM: core
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: harbor-core
+  labels:
+    app: harbor
+spec:
+  ports:
+    - name: http
+      port: 80
+      targetPort: 8080
+  selector:
+    app: harbor
+    component: core
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: harbor-core
+  labels:
+    app: harbor
+    component: core
+spec:
+  replicas: 2
+  revisionHistoryLimit: 0
+  selector:
+    matchLabels: &selectorLabels
+      app: harbor
+      component: core
+  template:
+    metadata:
+      labels: *selectorLabels
+    spec:
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: kubernetes.io/arch
+                    operator: In
+                    values:
+                      - amd64
+      securityContext:
+        runAsUser: 10000
+        fsGroup: 10000
+      automountServiceAccountToken: false
+      terminationGracePeriodSeconds: 120
+      containers:
+        - name: core
+          image: "{{ .Values.image.repository }}/harbor-core:{{ .Values.image.tag }}"
+          startupProbe:
+            httpGet:
+              path: /api/v2.0/ping
+              scheme: HTTP
+              port: 8080
+            failureThreshold: 360
+            initialDelaySeconds: 10
+            periodSeconds: 10
+          readinessProbe:
+            httpGet:
+              path: /api/v2.0/ping
+              scheme: HTTP
+              port: 8080
+            failureThreshold: 2
+            periodSeconds: 10
+          envFrom:
+            - configMapRef:
+                name: harbor-core
+          env:
+            - name: REGISTRY_CREDENTIAL_USERNAME
+              value: harbor_registry_user
+            - name: REGISTRY_CREDENTIAL_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: harbor-registry-credentials
+                  key: REGISTRY_CREDENTIAL_PASSWORD
+            - name: DATABASE_TYPE
+              value: postgresql
+            - name: POSTGRESQL_SSLMODE
+              value: require
+            - name: CSRF_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: harbor-core-csrf-key
+                  key: CSRF_KEY
+            - name: HARBOR_ADMIN_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: harbor-admin-secrets
+                  key: HARBOR_ADMIN_PASSWORD
+            - name: POSTGRESQL_HOST
+              valueFrom:
+                secretKeyRef:
+                  name: harbor-pguser-harbor
+                  key: host
+            - name: POSTGRESQL_PORT
+              valueFrom:
+                secretKeyRef:
+                  name: harbor-pguser-harbor
+                  key: port
+            - name: POSTGRESQL_DATABASE
+              valueFrom:
+                secretKeyRef:
+                  name: harbor-pguser-harbor
+                  key: dbname
+            - name: POSTGRESQL_USERNAME
+              valueFrom:
+                secretKeyRef:
+                  name: harbor-pguser-harbor
+                  key: user
+            - name: POSTGRESQL_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: harbor-pguser-harbor
+                  key: password
+            - name: _REDIS_URL_CORE
+              valueFrom:
+                secretKeyRef:
+                  name: harbor-core-redis-secrets
+                  key: REDIS_URI
+            - name: _REDIS_URL_REG
+              valueFrom:
+                secretKeyRef:
+                  name: harbor-registry-redis-secrets
+                  key: REDIS_URI
+            - name: CORE_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: harbor-core-secret
+                  key: CORE_SECRET
+            - name: JOBSERVICE_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: harbor-jobservice
+                  key: JOBSERVICE_SECRET
+          ports:
+            - containerPort: 8080
+              name: http
+            - containerPort: 8001
+              name: metrics
+          volumeMounts:
+            - name: config
+              mountPath: /etc/core/app.conf
+              subPath: app.conf
+            - name: secret-key
+              mountPath: /etc/core/key
+              subPath: key
+            - name: token-service-private-key
+              mountPath: /etc/core/private_key.pem
+              subPath: tls.key
+            - name: psc
+              mountPath: /etc/core/token
+      volumes:
+        - name: config
+          configMap:
+            name: harbor-core
+            items:
+              - key: app.conf
+                path: app.conf
+        - name: secret-key
+          secret:
+            secretName: harbor-core-oidc-secret-encryption-key
+            items:
+              - key: secretKey
+                path: key
+        - name: token-service-private-key
+          secret:
+            secretName: harbor-core-key
+        - name: psc
+          emptyDir: {}

templates/harbor-jobservice.yaml

@@ -0,0 +1,155 @@
+---
+apiVersion: codemowers.io/v1alpha1
+kind: GeneratedSecret
+metadata:
+  name: harbor-jobservice
+spec:
+  mapping:
+    - key: JOBSERVICE_SECRET
+      value: "%(password)s"
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: harbor-jobservice-env
+  labels:
+    app: harbor
+data:
+  CORE_URL: "http://harbor-core:80"
+  TOKEN_SERVICE_URL: "http://harbor-core:80/service/token"
+  REGISTRY_URL: "http://harbor-registry:5000"
+  REGISTRY_CONTROLLER_URL: "http://harbor-registry:8080"
+  METRIC_NAMESPACE: harbor
+  METRIC_SUBSYSTEM: jobservice
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: harbor-jobservice
+  labels:
+    app: harbor
+data:
+  config.yml: |+
+    protocol: "http"
+    port: 8080
+    worker_pool:
+      workers: 1
+      backend: "redis"
+      redis_pool:
+        redis_url: "redis://harbor-jobservice-redis:6379/0"
+        namespace: "harbor_job_service_namespace"
+        idle_timeout_second: 3600
+    job_loggers:
+      - name: "STD_OUTPUT"
+        level: INFO
+    metric:
+      enabled: true
+      path: /metrics
+      port: 8001
+    loggers:
+      - name: "STD_OUTPUT"
+        level: INFO
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: harbor-jobservice
+spec:
+  ports:
+    - name: http
+      port: 80
+      targetPort: 8080
+  selector:
+    app: harbor
+    component: jobservice
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: harbor-jobservice
+  labels:
+    app: harbor
+    component: jobservice
+spec:
+  replicas: 3
+  revisionHistoryLimit: 0
+  selector:
+    matchLabels: &selectorLabels
+      app: harbor
+      component: jobservice
+  template:
+    metadata:
+      labels: *selectorLabels
+    spec:
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: kubernetes.io/arch
+                    operator: In
+                    values:
+                      - amd64
+      securityContext:
+        runAsUser: 10000
+        fsGroup: 10000
+      automountServiceAccountToken: false
+      terminationGracePeriodSeconds: 120
+      containers:
+        - name: jobservice
+          image: "{{ .Values.image.repository }}/harbor-jobservice:{{ .Values.image.tag }}"
+          readinessProbe:
+            httpGet:
+              path: /api/v1/stats
+              scheme: HTTP
+              port: 8080
+            initialDelaySeconds: 20
+            periodSeconds: 10
+          env:
+            - name: REGISTRY_CREDENTIAL_USERNAME
+              value: harbor_registry_user
+            - name: REGISTRY_CREDENTIAL_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: harbor-registry-credentials
+                  key: REGISTRY_CREDENTIAL_PASSWORD
+            - name: JOBSERVICE_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: harbor-jobservice
+                  key: JOBSERVICE_SECRET
+            - name: JOB_SERVICE_POOL_REDIS_URL
+              valueFrom:
+                secretKeyRef:
+                  name: harbor-jobservice-redis-secrets
+                  key: REDIS_URI
+            - name: CORE_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: harbor-core-secret
+                  key: CORE_SECRET
+            - name: _REDIS_URL_CORE
+              valueFrom:
+                secretKeyRef:
+                  name: harbor-core-redis-secrets
+                  key: REDIS_URI
+          envFrom:
+            - configMapRef:
+                name: harbor-jobservice-env
+          ports:
+            - containerPort: 8080
+              name: http
+            - containerPort: 8001
+              name: metrics
+          volumeMounts:
+            - name: jobservice-config
+              mountPath: /etc/jobservice/config.yml
+              subPath: config.yml
+            - name: job-scandata-exports
+              mountPath: /var/scandata_exports
+      volumes:
+        - name: jobservice-config
+          configMap:
+            name: harbor-jobservice
+        - name: job-scandata-exports
+          emptyDir: {}

templates/harbor-operator.yml

@@ -0,0 +1,129 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: harbor-operator
+  labels:
+    app.kubernetes.io/name: harbor-operator
+spec:
+  replicas: 1
+  selector:
+    matchLabels: &selectorLabels
+      app.kubernetes.io/name: harbor-operator
+  template:
+    metadata:
+      labels: *selectorLabels
+    spec:
+      serviceAccountName: harbor-operator
+      affinity:
+        podAntiAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+          - topologyKey: {{ .Values.topologyKey }}
+            labelSelector:
+              matchLabels: *selectorLabels
+      containers:
+        - name: harbor-operator
+          image: codemowers/harbor-operator:latest
+          securityContext:
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
+            runAsUser: 1000
+          env:
+            - name: MY_POD_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+            - name: HARBOR_URI
+              valueFrom:
+                secretKeyRef:
+                  name: harbor-admin-secrets
+                  key: HARBOR_URI
+          volumeMounts:
+            - name: tls-config
+              mountPath: /tls
+              readOnly: true
+      volumes:
+        - name: tls-config
+          secret:
+            secretName: admission-control
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: harbor-operator
+rules:
+  - apiGroups:
+      - zalando.org
+    resources:
+      - clusterkopfpeerings
+    verbs:
+      - get
+      - list
+      - watch
+      - patch
+  - apiGroups:
+      - ""
+    resources:
+      - events
+    verbs:
+      - create
+  - apiGroups:
+      - apiextensions.k8s.io
+    resources:
+      - customresourcedefinitions
+    verbs:
+      - list
+      - watch
+  - apiGroups:
+      - ""
+    resources:
+      - namespaces
+    verbs:
+      - list
+      - watch
+  - apiGroups:
+      - ""
+    resources:
+      - secrets
+    verbs:
+      - create
+      - get
+  - apiGroups:
+      - codemowers.io
+    resources:
+      - clusterharborregistries
+      - clusterharborprojectmembers
+      - clusterharborprojects
+      - harborcredentials
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - codemowers.io
+    resources:
+      - clusterharborregistries/status
+      - clusterharborprojectmembers/status
+      - clusterharborprojects/status
+      - harborcredentials/status
+    verbs:
+      - patch
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: harbor-operator
+---
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: harbor-operator
+subjects:
+  - kind: ServiceAccount
+    name: harbor-operator
+    namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: ClusterRole
+  # TODO: With the ACL-s above no errors are reporter by Kopf but yet it doesn't work
+  name: cluster-admin
+  apiGroup: rbac.authorization.k8s.io

templates/harbor-portal.yaml

@@ -0,0 +1,99 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: harbor-portal
+data:
+  nginx.conf: |+
+    worker_processes auto;
+    pid /tmp/nginx.pid;
+    events {
+        worker_connections  1024;
+    }
+    http {
+        client_body_temp_path /tmp/client_body_temp;
+        proxy_temp_path /tmp/proxy_temp;
+        fastcgi_temp_path /tmp/fastcgi_temp;
+        uwsgi_temp_path /tmp/uwsgi_temp;
+        scgi_temp_path /tmp/scgi_temp;
+        server {
+            listen 8080;
+            listen [::]:8080;
+            server_name  localhost;
+            root   /usr/share/nginx/html;
+            index  index.html index.htm;
+            include /etc/nginx/mime.types;
+            gzip on;
+            gzip_min_length 1000;
+            gzip_proxied expired no-cache no-store private auth;
+            gzip_types text/plain text/css application/json application/javascript application/x-javascript text/xml application/xml application/xml+rss text/javascript;
+            location / {
+                try_files $uri $uri/ /index.html;
+            }
+            location = /index.html {
+                add_header Cache-Control "no-store, no-cache, must-revalidate";
+            }
+        }
+    }
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: harbor-portal
+spec:
+  ports:
+    - port: 80
+      targetPort: 8080
+  selector:
+    app: harbor
+    component: portal
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: harbor-portal
+spec:
+  replicas: 2
+  revisionHistoryLimit: 0
+  selector:
+    matchLabels: &selectorLabels
+      app: harbor
+      component: portal
+  template:
+    metadata:
+      labels: *selectorLabels
+    spec:
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+            - matchExpressions:
+              - key: kubernetes.io/arch
+                operator: In
+                values:
+                - amd64
+      securityContext:
+        runAsUser: 10000
+        fsGroup: 10000
+      automountServiceAccountToken: false
+      containers:
+      - name: portal
+        image: {{ .Values.image.repository }}/harbor-portal:{{ .Values.image.tag }}
+        readinessProbe:
+          httpGet:
+            path: /
+            scheme: HTTP
+            port: 8080
+          initialDelaySeconds: 1
+          periodSeconds: 10
+        ports:
+          - containerPort: 8080
+            name: http
+        volumeMounts:
+          - name: portal-config
+            mountPath: /etc/nginx/nginx.conf
+            subPath: nginx.conf
+      volumes:
+      - name: portal-config
+        configMap:
+          name: harbor-portal

templates/harbor-projects.yml

@@ -0,0 +1,10 @@
+{{- range .Values.projects }}
+apiVersion: codemowers.io/v1alpha1
+kind: ClusterHarborProject
+metadata:
+  name: {{ . | quote }}
+spec:
+  cache: false
+  public: true
+  quota: 10737418240
+{{- end }}

templates/harbor-proxy-caches.yml

@@ -0,0 +1,38 @@
+{{ if .Values.caches.quay }}
+---
+apiVersion: codemowers.io/v1alpha1
+kind: ClusterHarborRegistry
+metadata:
+  name: quay.io
+spec:
+  type: quay
+  endpoint: https://quay.io
+---
+apiVersion: codemowers.io/v1alpha1
+kind: ClusterHarborProject
+metadata:
+  name: quay.io
+spec:
+  cache: true
+  public: true
+  quota: 10737418240
+{{ end  }}
+{{ if .Values.caches.docker }}
+---
+apiVersion: codemowers.io/v1alpha1
+kind: ClusterHarborRegistry
+metadata:
+  name: docker.io
+spec:
+  type: docker-hub
+  endpoint: https://docker.io
+---
+apiVersion: codemowers.io/v1alpha1
+kind: ClusterHarborProject
+metadata:
+  name: docker.io
+spec:
+  cache: true
+  public: true
+  quota: 10737418240
+{{ end }}

templates/harbor-registry.yaml

@@ -0,0 +1,227 @@
+---
+apiVersion: codemowers.io/v1alpha1
+kind: GeneratedSecret
+metadata:
+  name: harbor-registry-credentials
+spec:
+  mapping:
+    - key: REGISTRY_CREDENTIAL_PASSWORD
+      value: "%(password)s"
+    - key: REGISTRY_HTPASSWD
+      value: "harbor_registry_user:%(bcrypt)s"
+---
+apiVersion: codemowers.io/v1alpha1
+kind: GeneratedSecret
+metadata:
+  name: harbor-registry
+spec:
+  mapping:
+    - key: REGISTRY_HTTP_SECRET
+      value: "%(password)s"
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: harbor-registry
+  labels:
+    app: harbor
+data:
+  config.yml: |+
+    version: 0.1
+    log:
+      level: info
+      fields:
+        service: registry
+    storage:
+      filesystem:
+        rootdirectory: /storage
+      cache:
+        layerinfo: redis
+      maintenance:
+        uploadpurging:
+          enabled: true
+          age: 168h
+          interval: 24h
+          dryrun: false
+      delete:
+        enabled: true
+      redirect:
+        disable: false
+    redis:
+      addr: harbor-registry-redis:6379
+      db: 0
+      readtimeout: 10s
+      writetimeout: 10s
+      dialtimeout: 10s
+      pool:
+        maxidle: 100
+        maxactive: 500
+        idletimeout: 60s
+    http:
+      addr: :5000
+      relativeurls: false
+      debug:
+        addr: :5001
+        prometheus:
+          enabled: true
+          path: /metrics
+    auth:
+      htpasswd:
+        realm: harbor-registry-basic-realm
+        path: /etc/registry/passwd
+    validation:
+      disabled: true
+    compatibility:
+      schema1:
+        enabled: true
+  ctl-config.yml: |+
+    ---
+    protocol: "http"
+    port: 8080
+    log_level: info
+    registry_config: "/etc/registry/config.yml"
+---
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: harbor-registry
+  labels:
+    app: harbor
+    component: registry
+spec:
+  storageClassName: {{ .Values.storage.registry.storageClass }}
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: {{ .Values.storage.registry.storage }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: harbor-registry
+spec:
+  ports:
+    - name: http-registry
+      port: 5000
+    - name: http-controller
+      port: 8080
+  selector:
+    app: harbor
+    component: registry
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: harbor-registry
+spec:
+  replicas: 1
+  revisionHistoryLimit: 0
+  selector:
+    matchLabels: &selectorLabels
+      app: harbor
+      component: registry
+  template:
+    metadata:
+      labels: *selectorLabels
+    spec:
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: kubernetes.io/arch
+                    operator: In
+                    values:
+                      - amd64
+      securityContext:
+        runAsUser: 10000
+        fsGroup: 10000
+        fsGroupChangePolicy: OnRootMismatch
+      automountServiceAccountToken: false
+      terminationGracePeriodSeconds: 120
+      containers:
+        - name: registry
+          image: "{{ .Values.image.repository }}/registry-photon:{{ .Values.image.tag }}"
+          readinessProbe:
+            httpGet:
+              path: /
+              scheme: HTTP
+              port: 5000
+            initialDelaySeconds: 1
+            periodSeconds: 10
+          args:
+            - serve
+            - /etc/registry/config.yml
+          env:
+            - name: REGISTRY_REDIS_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: harbor-registry-redis-secrets
+                  key: REDIS_PASSWORD
+          ports:
+            - containerPort: 5000
+              name: http
+            - containerPort: 5001
+              name: metrics
+          volumeMounts:
+            - name: registry-data
+              mountPath: /storage
+              subPath:
+            - name: registry-htpasswd
+              mountPath: /etc/registry/passwd
+              subPath: passwd
+            - name: registry-config
+              mountPath: /etc/registry/config.yml
+              subPath: config.yml
+        - name: registryctl
+          image: "{{ .Values.image.repository }}/harbor-registryctl:{{ .Values.image.tag }}"
+          readinessProbe:
+            httpGet:
+              path: /api/health
+              scheme: HTTP
+              port: 8080
+            initialDelaySeconds: 1
+            periodSeconds: 10
+          env:
+            - name: CORE_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: harbor-core-secret
+                  key: CORE_SECRET
+            - name: JOBSERVICE_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: harbor-jobservice
+                  key: JOBSERVICE_SECRET
+            - name: REGISTRY_HTTP_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: harbor-registry
+                  key: REGISTRY_HTTP_SECRET
+          ports:
+            - containerPort: 8080
+              name: http
+          volumeMounts:
+            - name: registry-data
+              mountPath: /storage
+              subPath:
+            - name: registry-config
+              mountPath: /etc/registry/config.yml
+              subPath: config.yml
+            - name: registry-config
+              mountPath: /etc/registryctl/config.yml
+              subPath: ctl-config.yml
+      volumes:
+        - name: registry-htpasswd
+          secret:
+            secretName: harbor-registry-credentials
+            items:
+              - key: REGISTRY_HTPASSWD
+                path: passwd
+        - name: registry-config
+          configMap:
+            name: harbor-registry
+        - name: registry-data
+          persistentVolumeClaim:
+            claimName: harbor-registry

templates/ingress.yaml

@@ -0,0 +1,64 @@
+{{ if .Values.ingress.enabled }}
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: harbor
+  annotations:
+    ingress.kubernetes.io/proxy-body-size: "0"
+    ingress.kubernetes.io/ssl-redirect: "true"
+    external-dns.alpha.kubernetes.io/target: "{{ .Values.ingress.target }}"
+    kubernetes.io/ingress.class: "{{ .Values.ingress.class }}"
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.tls: "true"
+spec:
+  tls:
+    - hosts:
+        - "{{ .Values.ingress.tls.host }}"
+  rules:
+    - host: "{{ .Values.ingress.host }}"
+      http:
+        paths:
+          - path: /api/
+            pathType: Prefix
+            backend:
+              service:
+                name: harbor-core
+                port:
+                  name: http
+          - path: /service/
+            pathType: Prefix
+            backend:
+              service:
+                name: harbor-core
+                port:
+                  number: 80
+          - path: /v2/
+            pathType: Prefix
+            backend:
+              service:
+                name: harbor-core
+                port:
+                  number: 80
+          - path: /chartrepo/
+            pathType: Prefix
+            backend:
+              service:
+                name: harbor-core
+                port:
+                  number: 80
+          - path: /c/
+            pathType: Prefix
+            backend:
+              service:
+                name: harbor-core
+                port:
+                  number: 80
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: harbor-portal
+                port:
+                  number: 80
+{{ end }}

templates/postgres.yaml

@@ -0,0 +1,26 @@
+apiVersion: postgres-operator.crunchydata.com/v1beta1
+kind: PostgresCluster
+metadata:
+  name: harbor
+spec:
+  postgresVersion: 14
+  instances:
+    - name: postgres
+      replicas: 3
+      dataVolumeClaimSpec:
+        storageClassName: {{ .Values.storage.postgres.storageClass }}
+        accessModes:
+          - "ReadWriteOnce"
+        resources:
+          requests:
+            storage: {{ .Values.storage.postgres.storage }}
+      affinity:
+        podAntiAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+          - topologyKey: {{ .Values.topologyKey }}
+            labelSelector:
+              matchLabels:
+                postgres-operator.crunchydata.com/cluster: harbor
+  backups:
+    pgbackrest:
+      repos: []

templates/redis.yaml

@@ -0,0 +1,21 @@
+---
+apiVersion: codemowers.io/v1alpha1
+kind: KeyDBCluster
+metadata:
+  name: harbor-core-redis
+spec:
+  replicas: 3
+---
+apiVersion: codemowers.io/v1alpha1
+kind: KeyDBCluster
+metadata:
+  name: harbor-jobservice-redis
+spec:
+  replicas: 3
+---
+apiVersion: codemowers.io/v1alpha1
+kind: KeyDBCluster
+metadata:
+  name: harbor-registry-redis
+spec:
+  replicas: 3