harbor-operator/templates/harbor-registry.yaml

---
apiVersion: codemowers.io/v1alpha1
kind: GeneratedSecret
metadata:
  name: harbor-registry-credentials
spec:
  mapping:
    - key: REGISTRY_CREDENTIAL_PASSWORD
      value: "%(password)s"
    - key: REGISTRY_HTPASSWD
      value: "harbor_registry_user:%(bcrypt)s"
---
apiVersion: codemowers.io/v1alpha1
kind: GeneratedSecret
metadata:
  name: harbor-registry
spec:
  mapping:
    - key: REGISTRY_HTTP_SECRET
      value: "%(password)s"
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: harbor-registry
  labels:
    app: harbor
data:
  config.yml: |+
    version: 0.1
    log:
      level: info
      fields:
        service: registry
    storage:
      filesystem:
        rootdirectory: /storage
      cache:
        layerinfo: redis
      maintenance:
        uploadpurging:
          enabled: true
          age: 168h
          interval: 24h
          dryrun: false
      delete:
        enabled: true
      redirect:
        disable: false
    redis:
      addr: harbor-registry-redis:6379
      db: 0
      readtimeout: 10s
      writetimeout: 10s
      dialtimeout: 10s
      pool:
        maxidle: 100
        maxactive: 500
        idletimeout: 60s
    http:
      addr: :5000
      relativeurls: false
      debug:
        addr: :5001
        prometheus:
          enabled: true
          path: /metrics
    auth:
      htpasswd:
        realm: harbor-registry-basic-realm
        path: /etc/registry/passwd
    validation:
      disabled: true
    compatibility:
      schema1:
        enabled: true    
  ctl-config.yml: |+
    ---
    protocol: "http"
    port: 8080
    log_level: info
    registry_config: "/etc/registry/config.yml"    
---
kind: PersistentVolumeClaim
apiVersion: v1
metadata:
  name: harbor-registry
  labels:
    app: harbor
    component: registry
spec:
  storageClassName: {{ .Values.storage.registry.storageClass }}
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: {{ .Values.storage.registry.storage }}
---
apiVersion: v1
kind: Service
metadata:
  name: harbor-registry
spec:
  ports:
    - name: http-registry
      port: 5000
    - name: http-controller
      port: 8080
  selector:
    app: harbor
    component: registry
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: harbor-registry
spec:
  replicas: 1
  revisionHistoryLimit: 0
  selector:
    matchLabels: &selectorLabels
      app: harbor
      component: registry
  template:
    metadata:
      labels: *selectorLabels
    spec:
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
              - matchExpressions:
                  - key: kubernetes.io/arch
                    operator: In
                    values:
                      - amd64
      securityContext:
        runAsUser: 10000
        fsGroup: 10000
        fsGroupChangePolicy: OnRootMismatch
      automountServiceAccountToken: false
      terminationGracePeriodSeconds: 120
      containers:
        - name: registry
          image: "{{ .Values.image.repository }}/registry-photon:{{ .Values.image.tag }}"
          readinessProbe:
            httpGet:
              path: /
              scheme: HTTP
              port: 5000
            initialDelaySeconds: 1
            periodSeconds: 10
          args:
            - serve
            - /etc/registry/config.yml
          env:
            - name: REGISTRY_REDIS_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: harbor-registry-redis-secrets
                  key: REDIS_PASSWORD
          ports:
            - containerPort: 5000
              name: http
            - containerPort: 5001
              name: metrics
          volumeMounts:
            - name: registry-data
              mountPath: /storage
              subPath:
            - name: registry-htpasswd
              mountPath: /etc/registry/passwd
              subPath: passwd
            - name: registry-config
              mountPath: /etc/registry/config.yml
              subPath: config.yml
        - name: registryctl
          image: "{{ .Values.image.repository }}/harbor-registryctl:{{ .Values.image.tag }}"
          readinessProbe:
            httpGet:
              path: /api/health
              scheme: HTTP
              port: 8080
            initialDelaySeconds: 1
            periodSeconds: 10
          env:
            - name: CORE_SECRET
              valueFrom:
                secretKeyRef:
                  name: harbor-core-secret
                  key: CORE_SECRET
            - name: JOBSERVICE_SECRET
              valueFrom:
                secretKeyRef:
                  name: harbor-jobservice
                  key: JOBSERVICE_SECRET
            - name: REGISTRY_HTTP_SECRET
              valueFrom:
                secretKeyRef:
                  name: harbor-registry
                  key: REGISTRY_HTTP_SECRET
          ports:
            - containerPort: 8080
              name: http
          volumeMounts:
            - name: registry-data
              mountPath: /storage
              subPath:
            - name: registry-config
              mountPath: /etc/registry/config.yml
              subPath: config.yml
            - name: registry-config
              mountPath: /etc/registryctl/config.yml
              subPath: ctl-config.yml
      volumes:
        - name: registry-htpasswd
          secret:
            secretName: harbor-registry-credentials
            items:
              - key: REGISTRY_HTPASSWD
                path: passwd
        - name: registry-config
          configMap:
            name: harbor-registry
        - name: registry-data
          persistentVolumeClaim:
            claimName: harbor-registry