Exclude CNI, CSI namespaces from mutation

app/harbor-operator.py

@@ -15,7 +15,6 @@ mutation_excluded_namespaces = set([
     "kube-system", # kube-proxy hosted here
     "tigera-operator",
     "calico-system",
-    "metallb-system",
 
     # Do not fiddle with CSI stuff
     "longhorn-system",
@@ -23,7 +22,6 @@ mutation_excluded_namespaces = set([
     # Don't touch Harbor itself
     "harbor-operator",
 ])
-
 harbor = Harbor(os.environ["HARBOR_URI"])
 cached_registries = set()
 app = Sanic("admission_control")

templates/harbor-core.yaml

@@ -1,20 +1,4 @@
 ---
-apiVersion: codemowers.io/v1alpha1
-kind: PostgresDatabase
-metadata:
-  name: harbor
-spec:
-  capacity: {{ .Values.storage.postgres.storage }}
-  class: {{ .Values.storage.postgres.class }}
----
-apiVersion: codemowers.io/v1alpha1
-kind: Redis
-metadata:
-  name: core
-spec:
-  class: ephemeral
-  capacity: 512Mi
----
 apiVersion: cert-manager.io/v1
 kind: Issuer
 metadata:
@@ -34,7 +18,7 @@ spec:
     name: harbor-operator
 ---
 apiVersion: codemowers.io/v1alpha1
-kind: Secret
+kind: GeneratedSecret
 metadata:
   name: harbor-admin-secrets
 spec:
@@ -45,7 +29,7 @@ spec:
       value: "https://admin:%(password)s@{{ .Values.ingress.host }}"
 ---
 apiVersion: codemowers.io/v1alpha1
-kind: Secret
+kind: GeneratedSecret
 metadata:
   name: harbor-core-secret
 spec:
@@ -54,7 +38,7 @@ spec:
       value: "%(password)s"
 ---
 apiVersion: codemowers.io/v1alpha1
-kind: Secret
+kind: GeneratedSecret
 metadata:
   name: harbor-core-oidc-secret-encryption-key
 spec:
@@ -64,7 +48,7 @@ spec:
       value: "%(password)s"
 ---
 apiVersion: codemowers.io/v1alpha1
-kind: Secret
+kind: GeneratedSecret
 metadata:
   name: harbor-core-csrf-key
 spec:
@@ -131,7 +115,7 @@ metadata:
     app: harbor
     component: core
 spec:
-  replicas: 1
+  replicas: 2
   revisionHistoryLimit: 0
   selector:
     matchLabels: &selectorLabels
@@ -201,37 +185,37 @@ spec:
             - name: POSTGRESQL_HOST
               valueFrom:
                 secretKeyRef:
-                  name: postgres-database-harbor-owner-secrets
-                  key: PGHOST
+                  name: harbor-pguser-harbor
+                  key: host
             - name: POSTGRESQL_PORT
               valueFrom:
                 secretKeyRef:
-                  name: postgres-database-harbor-owner-secrets
-                  key: PGPORT
+                  name: harbor-pguser-harbor
+                  key: port
             - name: POSTGRESQL_DATABASE
               valueFrom:
                 secretKeyRef:
-                  name: postgres-database-harbor-owner-secrets
-                  key: PGDATABASE
+                  name: harbor-pguser-harbor
+                  key: dbname
             - name: POSTGRESQL_USERNAME
               valueFrom:
                 secretKeyRef:
-                  name: postgres-database-harbor-owner-secrets
-                  key: PGUSER
+                  name: harbor-pguser-harbor
+                  key: user
             - name: POSTGRESQL_PASSWORD
               valueFrom:
                 secretKeyRef:
-                  name: postgres-database-harbor-owner-secrets
-                  key: PGPASSWORD
+                  name: harbor-pguser-harbor
+                  key: password
             - name: _REDIS_URL_CORE
               valueFrom:
                 secretKeyRef:
-                  name: redis-core-owner-secrets
+                  name: harbor-core-redis-secrets
                   key: REDIS_URI
             - name: _REDIS_URL_REG
               valueFrom:
                 secretKeyRef:
-                  name: redis-registry-owner-secrets
+                  name: harbor-registry-redis-secrets
                   key: REDIS_URI
             - name: CORE_SECRET
               valueFrom:

templates/harbor-jobservice.yaml

@@ -1,14 +1,6 @@
 ---
 apiVersion: codemowers.io/v1alpha1
-kind: Redis
-metadata:
-  name: jobservice
-spec:
-  class: ephemeral
-  capacity: 512Mi
----
-apiVersion: codemowers.io/v1alpha1
-kind: Secret
+kind: GeneratedSecret
 metadata:
   name: harbor-jobservice
 spec:
@@ -44,6 +36,7 @@ data:
       workers: 1
       backend: "redis"
       redis_pool:
+        redis_url: "redis://harbor-jobservice-redis:6379/0"
         namespace: "harbor_job_service_namespace"
         idle_timeout_second: 3600
     job_loggers:
@@ -128,7 +121,7 @@ spec:
             - name: JOB_SERVICE_POOL_REDIS_URL
               valueFrom:
                 secretKeyRef:
-                  name: redis-jobservice-owner-secrets
+                  name: harbor-jobservice-redis-secrets
                   key: REDIS_URI
             - name: CORE_SECRET
               valueFrom:
@@ -138,7 +131,7 @@ spec:
             - name: _REDIS_URL_CORE
               valueFrom:
                 secretKeyRef:
-                  name: redis-core-owner-secrets
+                  name: harbor-core-redis-secrets
                   key: REDIS_URI
           envFrom:
             - configMapRef:

templates/harbor-registry.yaml

@@ -1,22 +1,6 @@
 ---
 apiVersion: codemowers.io/v1alpha1
-kind: Bucket
-metadata:
-  name: registry
-spec:
-  capacity: {{ .Values.storage.registry.storage }}
-  class: {{ .Values.storage.registry.class }}
----
-apiVersion: codemowers.io/v1alpha1
-kind: Redis
-metadata:
-  name: registry
-spec:
-  class: ephemeral
-  capacity: 512Mi
----
-apiVersion: codemowers.io/v1alpha1
-kind: Secret
+kind: GeneratedSecret
 metadata:
   name: harbor-registry-credentials
 spec:
@@ -27,7 +11,7 @@ spec:
       value: "harbor_registry_user:%(bcrypt)s"
 ---
 apiVersion: codemowers.io/v1alpha1
-kind: Secret
+kind: GeneratedSecret
 metadata:
   name: harbor-registry
 spec:
@@ -49,6 +33,8 @@ data:
       fields:
         service: registry
     storage:
+      filesystem:
+        rootdirectory: /storage
       cache:
         layerinfo: redis
       maintenance:
@@ -59,7 +45,10 @@ data:
           dryrun: false
       delete:
         enabled: true
+      redirect:
+        disable: false
     redis:
+      addr: harbor-registry-redis:6379
       db: 0
       readtimeout: 10s
       writetimeout: 10s
@@ -92,6 +81,21 @@ data:
     log_level: info
     registry_config: "/etc/registry/config.yml"
 ---
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: harbor-registry
+  labels:
+    app: harbor
+    component: registry
+spec:
+  storageClassName: {{ .Values.storage.registry.storageClass }}
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: {{ .Values.storage.registry.storage }}
+---
 apiVersion: v1
 kind: Service
 metadata:
@@ -150,52 +154,20 @@ spec:
             - serve
             - /etc/registry/config.yml
           env:
-            - name: REGISTRY_HTTP_SECRET
-              valueFrom:
-                secretKeyRef:
-                  name: harbor-registry
-                  key: REGISTRY_HTTP_SECRET
-            - name: REGISTRY_REDIS_ADDR
-              valueFrom:
-                secretKeyRef:
-                  name: redis-registry-owner-secrets
-                  key: REDIS_HOST_PORT
             - name: REGISTRY_REDIS_PASSWORD
               valueFrom:
                 secretKeyRef:
-                  name: redis-registry-owner-secrets
+                  name: harbor-registry-redis-secrets
                   key: REDIS_PASSWORD
-            - name: REGISTRY_STORAGE_S3_ACCESSKEY
-              valueFrom:
-                secretKeyRef:
-                  name: bucket-registry-owner-secrets
-                  key: AWS_ACCESS_KEY_ID
-            - name: REGISTRY_STORAGE_S3_SECRETKEY
-              valueFrom:
-                secretKeyRef:
-                  name: bucket-registry-owner-secrets
-                  key: AWS_SECRET_ACCESS_KEY
-            - name: REGISTRY_STORAGE_S3_REGION
-              valueFrom:
-                secretKeyRef:
-                  name: bucket-registry-owner-secrets
-                  key: AWS_DEFAULT_REGION
-            - name: REGISTRY_STORAGE_S3_REGIONENDPOINT
-              valueFrom:
-                secretKeyRef:
-                  name: bucket-registry-owner-secrets
-                  key: AWS_S3_ENDPOINT_URL
-            - name: REGISTRY_STORAGE_S3_BUCKET
-              valueFrom:
-                secretKeyRef:
-                  name: bucket-registry-owner-secrets
-                  key: BUCKET_NAME
           ports:
             - containerPort: 5000
               name: http
             - containerPort: 5001
               name: metrics
           volumeMounts:
+            - name: registry-data
+              mountPath: /storage
+              subPath:
             - name: registry-htpasswd
               mountPath: /etc/registry/passwd
               subPath: passwd
@@ -227,45 +199,13 @@ spec:
                 secretKeyRef:
                   name: harbor-registry
                   key: REGISTRY_HTTP_SECRET
-            - name: REGISTRY_REDIS_ADDR
-              valueFrom:
-                secretKeyRef:
-                  name: redis-registry-owner-secrets
-                  key: REDIS_HOST_PORT
-            - name: REGISTRY_REDIS_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: redis-registry-owner-secrets
-                  key: REDIS_PASSWORD
-            - name: REGISTRY_STORAGE_S3_ACCESSKEY
-              valueFrom:
-                secretKeyRef:
-                  name: bucket-registry-owner-secrets
-                  key: AWS_ACCESS_KEY_ID
-            - name: REGISTRY_STORAGE_S3_SECRETKEY
-              valueFrom:
-                secretKeyRef:
-                  name: bucket-registry-owner-secrets
-                  key: AWS_SECRET_ACCESS_KEY
-            - name: REGISTRY_STORAGE_S3_REGION
-              valueFrom:
-                secretKeyRef:
-                  name: bucket-registry-owner-secrets
-                  key: AWS_DEFAULT_REGION
-            - name: REGISTRY_STORAGE_S3_REGIONENDPOINT
-              valueFrom:
-                secretKeyRef:
-                  name: bucket-registry-owner-secrets
-                  key: AWS_S3_ENDPOINT_URL
-            - name: REGISTRY_STORAGE_S3_BUCKET
-              valueFrom:
-                secretKeyRef:
-                  name: bucket-registry-owner-secrets
-                  key: BUCKET_NAME
           ports:
             - containerPort: 8080
               name: http
           volumeMounts:
+            - name: registry-data
+              mountPath: /storage
+              subPath:
             - name: registry-config
               mountPath: /etc/registry/config.yml
               subPath: config.yml
@@ -282,3 +222,6 @@ spec:
         - name: registry-config
           configMap:
             name: harbor-registry
+        - name: registry-data
+          persistentVolumeClaim:
+            claimName: harbor-registry

templates/postgres.yaml

@@ -0,0 +1,68 @@
+apiVersion: postgres-operator.crunchydata.com/v1beta1
+kind: PostgresCluster
+metadata:
+  name: harbor
+spec:
+  postgresVersion: 14
+  instances:
+    - name: postgres
+      replicas: 3
+      dataVolumeClaimSpec:
+        storageClassName: {{ .Values.storage.postgres.storageClass }}
+        accessModes:
+          - "ReadWriteOnce"
+        resources:
+          requests:
+            storage: {{ .Values.storage.postgres.storage }}
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+            - matchExpressions:
+              - key: kubernetes.io/arch
+                operator: In
+                values:
+                - amd64
+        podAntiAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+          - topologyKey: {{ .Values.topologyKey }}
+            labelSelector:
+              matchLabels:
+                postgres-operator.crunchydata.com/cluster: harbor
+                postgres-operator.crunchydata.com/instance-set: postgres
+  backups:
+    pgbackrest:
+      global:
+        repo1-retention-full: "1"
+        repo1-retention-full-type: time
+      repoHost:
+        affinity:
+          nodeAffinity:
+            requiredDuringSchedulingIgnoredDuringExecution:
+              nodeSelectorTerms:
+              - matchExpressions:
+                - key: kubernetes.io/arch
+                  operator: In
+                  values:
+                  - amd64
+      jobs:
+        affinity:
+          nodeAffinity:
+            requiredDuringSchedulingIgnoredDuringExecution:
+              nodeSelectorTerms:
+              - matchExpressions:
+                - key: kubernetes.io/arch
+                  operator: In
+                  values:
+                  - amd64
+      repos:
+        - name: repo1
+          schedules:
+            full: "0 5 31 2 *"
+          volume:
+            volumeClaimSpec:
+              accessModes:
+                - ReadWriteOnce
+              resources:
+                requests:
+                  storage: 100Mi

templates/redis.yaml

@@ -0,0 +1,21 @@
+---
+apiVersion: codemowers.io/v1alpha1
+kind: KeyDBCluster
+metadata:
+  name: harbor-core-redis
+spec:
+  replicas: 3
+---
+apiVersion: codemowers.io/v1alpha1
+kind: KeyDBCluster
+metadata:
+  name: harbor-jobservice-redis
+spec:
+  replicas: 3
+---
+apiVersion: codemowers.io/v1alpha1
+kind: KeyDBCluster
+metadata:
+  name: harbor-registry-redis
+spec:
+  replicas: 3

values.yaml

@@ -26,10 +26,10 @@ image:
 # Storage options
 storage:
   postgres:
-    class: shared
+    storageClass: postgres
     storage: 5Gi
   registry:
-    class: shared
+    storageClass: longhorn
     storage: 30Gi
 
 # Harbor projects to initialize