harbor init

2024-10-11 01:57:51 +00:00 · 2024-10-11 01:57:51 +00:00 · a08d78a154
parent d315d375e1
commit a08d78a154
25 changed files with 53086 additions and 0 deletions
--- a/on-premise/cicd/argocd_v2.12.3/argocd_v2.12.3.yaml
+++ b/on-premise/cicd/argocd_v2.12.3/argocd_v2.12.3.yaml
--- a/on-premise/cicd/argocd_v2.12.3/argocd_v2.12.3_add_ns.yaml
+++ b/on-premise/cicd/argocd_v2.12.3/argocd_v2.12.3_add_ns.yaml
--- a/on-premise/cicd/argocd_v2.12.3/ing-argocd.yaml
+++ b/on-premise/cicd/argocd_v2.12.3/ing-argocd.yaml
@ -0,0 +1,28 @@
+# Offloading setting.
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: ing-argocd
+  namespace: argocd
+  annotations:
+    #nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/backend-protocol: "https"
+    nginx.ingress.kubernetes.io/ssl-passthrough: "true"
+spec:
+  ingressClassName: nginx
+  rules:
+  - host: argocd.inje-private.com # 사전 생성된 인증서의 도메인적용.
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: argocd-server
+            port:
+              number: 443
+  tls:
+    - hosts:
+      - "argocd.inje-private.com.com"
+      secretName: argocd-ssl
+
--- a/on-premise/cicd/argocd_v2.12.3/kustomization.yaml
+++ b/on-premise/cicd/argocd_v2.12.3/kustomization.yaml
@ -0,0 +1,5 @@
+# kustomization.yaml
+namespace: argocd
+
+resources:
+  - argocd_v2.12.3.yaml
--- a/on-premise/cicd/nexus/1_configure/init.yaml
+++ b/on-premise/cicd/nexus/1_configure/init.yaml
@ -0,0 +1,22 @@
+# Warning
+# PersistentVolumeClaim 오브젝트에서 StorageClass 이름을 변경하고 사용.
+# 
+apiVersion: v1
+kind: Namespace
+metadata:
+  labels:
+    kubernetes.io/metadata.name: nexus
+  name: nexus
+spec:
+  finalizers:
+  - kubernetes
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  labels:
+    app.kubernetes.io/instance: nexus
+    app.kubernetes.io/name: nexus-repository-manager
+    app.kubernetes.io/version: 3.72.0
+  name: nexus-nexus-repository-manager
+  namespace: nexus
--- a/on-premise/cicd/nexus/1_configure/pvc.yaml
+++ b/on-premise/cicd/nexus/1_configure/pvc.yaml
@ -0,0 +1,16 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  labels:
+    app.kubernetes.io/instance: nexus
+    app.kubernetes.io/name: nexus-repository-manager
+    app.kubernetes.io/version: 3.72.0
+  name: nexus-nexus-repository-manager-data
+  namespace: nexus
+spec:
+  accessModes:
+  - ReadWriteMany
+  resources:
+    requests:
+      storage: 50Gi
+  storageClassName: sc-monitoring
--- a/on-premise/cicd/nexus/3_apply/deploy.yaml
+++ b/on-premise/cicd/nexus/3_apply/deploy.yaml
@ -0,0 +1,96 @@
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app.kubernetes.io/instance: nexus
+    app.kubernetes.io/name: nexus-repository-manager
+    app.kubernetes.io/version: 3.62.0
+  name: nexus-nexus-repository-manager
+  namespace: nexus
+spec:
+  ports:
+  - name: nexus-ui
+    port: 8081
+    protocol: TCP
+  selector:
+    app.kubernetes.io/instance: nexus
+    app.kubernetes.io/name: nexus-repository-manager
+  type: ClusterIP
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app.kubernetes.io/instance: nexus
+    app.kubernetes.io/name: nexus-repository-manager
+    app.kubernetes.io/version: 3.62.0
+  name: nexus-nexus-repository-manager
+  namespace: nexus
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: nexus
+      app.kubernetes.io/name: nexus-repository-manager
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/instance: nexus
+        app.kubernetes.io/name: nexus-repository-manager
+    spec:
+      containers:
+      - env:
+        - name: INSTALL4J_ADD_VM_PARAMS
+          value: "-Xms2703M -Xmx2703M -XX:MaxDirectMemorySize=2703M -XX:+UnlockExperimentalVMOptions -Djava.util.prefs.userRoot=/nexus-data/javaprefs"
+        - name: NEXUS_SECURITY_RANDOMPASSWORD
+          value: "true"
+        envFrom: null
+        image: reg.inje-private.com/nnd002/sonatype/nexus3:3.72.0
+        imagePullPolicy: IfNotPresent
+        lifecycle: null
+        livenessProbe:
+          failureThreshold: 6
+          httpGet:
+            path: /
+            port: 8081
+          initialDelaySeconds: 30
+          periodSeconds: 30
+          timeoutSeconds: 10
+        name: nexus-repository-manager
+        ports:
+        - containerPort: 8081
+          name: nexus-ui
+        readinessProbe:
+          failureThreshold: 6
+          httpGet:
+            path: /
+            port: 8081
+          initialDelaySeconds: 30
+          periodSeconds: 30
+          timeoutSeconds: 10
+            #resources: # by ljh
+          #limits:
+            #cpu: 4
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          runAsNonRoot: true
+          seccompProfile:
+            type: RuntimeDefault
+        volumeMounts:
+        - mountPath: /nexus-data
+          name: nexus-repository-manager-data
+      securityContext:
+        fsGroup: 200
+        runAsGroup: 200
+        runAsUser: 200
+      serviceAccountName: nexus-nexus-repository-manager
+      terminationGracePeriodSeconds: 120
+      volumes:
+      - name: nexus-repository-manager-data
+        persistentVolumeClaim:
+          claimName: nexus-nexus-repository-manager-data
--- a/on-premise/cicd/nexus/3_apply/ing.yaml
+++ b/on-premise/cicd/nexus/3_apply/ing.yaml
@ -0,0 +1,24 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  annotations:
+    nginx.ingress.kubernetes.io/proxy-body-size: "0"
+  name: ing-nexus
+  namespace: nexus
+spec:
+  ingressClassName: nginx
+  rules:
+  - host: nexus.inje-private.com
+    http:
+      paths:
+      - backend:
+          service:
+            name: nexus-nexus-repository-manager
+            port:
+              name: nexus-ui
+        path: /
+        pathType: Prefix
+  tls:
+  - hosts:
+    - "nexus.inje-private.com"
+    secretName: nexus-ssl
--- a/on-premise/cicd/sonarqube/deploy.yaml
+++ b/on-premise/cicd/sonarqube/deploy.yaml
@ -0,0 +1,618 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  labels:
+    kubernetes.io/metadata.name: sonarqube
+  name: sonarqube
+spec:
+  finalizers:
+  - kubernetes
+---
+# Source: sonarqube/charts/postgresql/templates/secrets.yaml
+apiVersion: v1
+kind: Secret
+metadata:
+  name: sonarqube-postgresql
+  namespace: sonarqube
+  labels:
+    app.kubernetes.io/name: postgresql
+    helm.sh/chart: postgresql-10.15.0
+    app.kubernetes.io/instance: sonarqube
+    app.kubernetes.io/managed-by: Helm
+  namespace: sonarqube
+type: Opaque
+data:
+  postgresql-postgres-password: "YjlLdzZzWVlYOQ=="
+  postgresql-password: "c29uYXJQYXNz"
+---
+# Source: sonarqube/templates/secret.yaml
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: sonarqube-sonarqube-monitoring-passcode
+  namespace: sonarqube
+  labels:
+    app: sonarqube
+    chart: sonarqube-10.6.0_3033
+    release: sonarqube
+    heritage: Helm
+type: Opaque
+data:
+  SONAR_WEB_SYSTEMPASSCODE: "ZGVmaW5lX2l0"
+---
+# Source: sonarqube/templates/config.yaml
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: sonarqube-sonarqube-config
+  namespace: sonarqube
+  labels:
+    app: sonarqube
+    chart: sonarqube-10.6.0_3033
+    release: sonarqube
+    heritage: Helm
+data:
+  sonar.properties: |
+---
+# Source: sonarqube/templates/init-fs.yaml
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: sonarqube-sonarqube-init-fs
+  namespace: sonarqube
+  labels:
+    app: sonarqube
+    chart: sonarqube-10.6.0_3033
+    release: sonarqube
+    heritage: Helm
+data:
+  init_fs.sh: |-
+---
+# Source: sonarqube/templates/init-sysctl.yaml
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: sonarqube-sonarqube-init-sysctl
+  namespace: sonarqube
+  labels:
+    app: sonarqube
+    chart: sonarqube-10.6.0_3033
+    release: sonarqube
+    heritage: Helm
+data:
+  init_sysctl.sh: |-
+    if [[ "$(sysctl -n vm.max_map_count)" -lt 524288 ]]; then
+      sysctl -w vm.max_map_count=524288
+    fi
+    if [[ "$(sysctl -n fs.file-max)" -lt 131072 ]]; then
+      sysctl -w fs.file-max=131072
+    fi
+    if [[ "$(ulimit -n)" != "unlimited" ]]; then
+      if [[ "$(ulimit -n)" -lt 131072 ]]; then
+        echo "ulimit -n 131072"
+        ulimit -n 131072
+      fi
+    fi
+    if [[ "$(ulimit -u)" != "unlimited" ]]; then
+      if [[ "$(ulimit -u)" -lt 8192 ]]; then
+        echo "ulimit -u 8192"
+        ulimit -u 8192
+      fi
+    fi
+---
+# Source: sonarqube/templates/install-plugins.yaml
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: sonarqube-sonarqube-install-plugins
+  namespace: sonarqube
+  labels:
+    app: sonarqube
+    chart: sonarqube-10.6.0_3033
+    release: sonarqube
+    heritage: Helm
+data:
+  install_plugins.sh: |-
+---
+# Source: sonarqube/templates/jdbc-config.yaml
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: sonarqube-sonarqube-jdbc-config
+  namespace: sonarqube
+  labels:
+    app: sonarqube
+    chart: sonarqube-10.6.0_3033
+    release: sonarqube
+    heritage: Helm
+data:
+  SONAR_JDBC_USERNAME: "sonarUser"
+  SONAR_JDBC_URL: "jdbc:postgresql://sonarqube-postgresql:5432/sonarDB"
+---
+# Source: sonarqube/charts/postgresql/templates/svc-headless.yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: sonarqube-postgresql-headless
+  labels:
+    app.kubernetes.io/name: postgresql
+    helm.sh/chart: postgresql-10.15.0
+    app.kubernetes.io/instance: sonarqube
+    app.kubernetes.io/managed-by: Helm
+    # Use this annotation in addition to the actual publishNotReadyAddresses
+    # field below because the annotation will stop being respected soon but the
+    # field is broken in some versions of Kubernetes:
+    # https://github.com/kubernetes/kubernetes/issues/58662
+    service.alpha.kubernetes.io/tolerate-unready-endpoints: "true"
+  namespace: sonarqube
+spec:
+  type: ClusterIP
+  clusterIP: None
+  # We want all pods in the StatefulSet to have their addresses published for
+  # the sake of the other Postgresql pods even before they're ready, since they
+  # have to be able to talk to each other in order to become ready.
+  publishNotReadyAddresses: true
+  ports:
+    - name: tcp-postgresql
+      port: 5432
+      targetPort: tcp-postgresql
+  selector:
+    app.kubernetes.io/name: postgresql
+    app.kubernetes.io/instance: sonarqube
+---
+# Source: sonarqube/charts/postgresql/templates/svc.yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: sonarqube-postgresql
+  labels:
+    app.kubernetes.io/name: postgresql
+    helm.sh/chart: postgresql-10.15.0
+    app.kubernetes.io/instance: sonarqube
+    app.kubernetes.io/managed-by: Helm
+  annotations:
+  namespace: sonarqube
+spec:
+  type: ClusterIP
+  ports:
+    - name: tcp-postgresql
+      port: 5432
+      targetPort: tcp-postgresql
+  selector:
+    app.kubernetes.io/name: postgresql
+    app.kubernetes.io/instance: sonarqube
+    role: primary
+---
+# Source: sonarqube/templates/service.yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: sonarqube-sonarqube
+  namespace: sonarqube
+  labels:
+    app: sonarqube
+    chart: sonarqube-10.6.0_3033
+    release: sonarqube
+    heritage: Helm
+spec:
+  type: ClusterIP
+  ports:
+    - port: 9000
+      targetPort: http
+      protocol: TCP
+      name: http
+  selector:
+    app: sonarqube
+    release: sonarqube
+---
+# Source: sonarqube/charts/postgresql/templates/statefulset.yaml
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: sonarqube-postgresql
+  labels:
+    app.kubernetes.io/name: postgresql
+    helm.sh/chart: postgresql-10.15.0
+    app.kubernetes.io/instance: sonarqube
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/component: primary
+  annotations:
+  namespace: sonarqube
+spec:
+  serviceName: sonarqube-postgresql-headless
+  replicas: 1
+  updateStrategy:
+    type: RollingUpdate
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: postgresql
+      app.kubernetes.io/instance: sonarqube
+      role: primary
+  template:
+    metadata:
+      name: sonarqube-postgresql
+      labels:
+        app.kubernetes.io/name: postgresql
+        helm.sh/chart: postgresql-10.15.0
+        app.kubernetes.io/instance: sonarqube
+        app.kubernetes.io/managed-by: Helm
+        role: primary
+        app.kubernetes.io/component: primary
+    spec:      
+      affinity:
+        podAffinity:
+          
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - podAffinityTerm:
+                labelSelector:
+                  matchLabels:
+                    app.kubernetes.io/name: postgresql
+                    app.kubernetes.io/instance: sonarqube
+                    app.kubernetes.io/component: primary
+                namespaces:
+                  - "sonarqube"
+                topologyKey: kubernetes.io/hostname
+              weight: 1
+        nodeAffinity:
+          
+      securityContext:
+        fsGroup: 1001
+      automountServiceAccountToken: false
+      containers:
+        - name: sonarqube-postgresql
+          image: reg.inje-private.com/nnd002/bitnami/postgresql:11.14.0-debian-10-r22
+          imagePullPolicy: "IfNotPresent"
+          resources:
+            limits:
+              cpu: 2
+              memory: 2Gi
+            requests:
+              cpu: 100m
+              memory: 200Mi
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+              - ALL
+            runAsNonRoot: true
+            runAsUser: 1001
+            seccompProfile:
+              type: RuntimeDefault
+          env:
+            - name: BITNAMI_DEBUG
+              value: "false"
+            - name: POSTGRESQL_PORT_NUMBER
+              value: "5432"
+            - name: POSTGRESQL_VOLUME_DIR
+              value: "/bitnami/postgresql"
+            - name: PGDATA
+              value: "/bitnami/postgresql/data"
+            - name: POSTGRES_POSTGRES_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: sonarqube-postgresql
+                  key: postgresql-postgres-password
+            - name: POSTGRES_USER
+              value: "sonarUser"
+            - name: POSTGRES_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: sonarqube-postgresql
+                  key: postgresql-password
+            - name: POSTGRES_DB
+              value: "sonarDB"
+            - name: POSTGRESQL_ENABLE_LDAP
+              value: "no"
+            - name: POSTGRESQL_ENABLE_TLS
+              value: "no"
+            - name: POSTGRESQL_LOG_HOSTNAME
+              value: "false"
+            - name: POSTGRESQL_LOG_CONNECTIONS
+              value: "false"
+            - name: POSTGRESQL_LOG_DISCONNECTIONS
+              value: "false"
+            - name: POSTGRESQL_PGAUDIT_LOG_CATALOG
+              value: "off"
+            - name: POSTGRESQL_CLIENT_MIN_MESSAGES
+              value: "error"
+            - name: POSTGRESQL_SHARED_PRELOAD_LIBRARIES
+              value: "pgaudit"
+          ports:
+            - name: tcp-postgresql
+              containerPort: 5432
+          livenessProbe:
+            exec:
+              command:
+                - /bin/sh
+                - -c
+                - exec pg_isready -U "sonarUser" -d "dbname=sonarDB" -h 127.0.0.1 -p 5432
+            initialDelaySeconds: 30
+            periodSeconds: 10
+            timeoutSeconds: 5
+            successThreshold: 1
+            failureThreshold: 6
+          readinessProbe:
+            exec:
+              command:
+                - /bin/sh
+                - -c
+                - -e
+                - |
+                  exec pg_isready -U "sonarUser" -d "dbname=sonarDB" -h 127.0.0.1 -p 5432
+                  [ -f /opt/bitnami/postgresql/tmp/.initialized ] || [ -f /bitnami/postgresql/.initialized ]
+            initialDelaySeconds: 5
+            periodSeconds: 10
+            timeoutSeconds: 5
+            successThreshold: 1
+            failureThreshold: 6
+          volumeMounts:
+            - name: dshm
+              mountPath: /dev/shm
+            - name: data
+              mountPath: /bitnami/postgresql
+              subPath: 
+      volumes:
+        - name: dshm
+          emptyDir:
+            medium: Memory
+  volumeClaimTemplates:
+    - metadata:
+        name: data
+      spec:
+        accessModes:
+          - "ReadWriteOnce"
+        resources:
+          requests:
+            storage: "20Gi"
+---
+# Source: sonarqube/templates/sonarqube-sts.yaml
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: sonarqube-sonarqube
+  namespace: sonarqube
+  labels:
+    app: sonarqube
+    chart: sonarqube-10.6.0_3033
+    release: sonarqube
+    heritage: Helm
+    app.kubernetes.io/name: sonarqube-sonarqube-sonarqube
+    app.kubernetes.io/instance: sonarqube
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/part-of: sonarqube
+    app.kubernetes.io/component: sonarqube-sonarqube
+    app.kubernetes.io/version: "10.6.0-community"
+spec:
+  replicas: 1
+  revisionHistoryLimit: 10
+  serviceName: sonarqube-sonarqube
+  selector:
+    matchLabels:
+      app: sonarqube
+      release: sonarqube
+  template:
+    metadata:
+      annotations:
+        checksum/config: 2256323f7d9ffc8a4e18606aa35e18a28b05412806a19e4e6a15359f9b710ad0
+        checksum/init-fs: 915551fa9592e2d81312781f423a59e6ba0837510c2e1d996e899eecd057ee91
+        checksum/init-sysctl: 7aa0dd9441283780322cf0596f09a398219af7dd756fcead24179a08adcebc32
+        checksum/plugins: 14cc0e459ae2f5de6499309b22cfdbcc1452d9e0e4f01a0ea45a43793e95e550
+        checksum/secret: b433376554b78de7ccf285d4ffebc8759355e6916f285189ce33ba1eba4ba28a
+      labels:
+        app: sonarqube
+        release: sonarqube
+    spec:
+      automountServiceAccountToken: false
+      securityContext:
+        fsGroup: 0
+      initContainers:
+        - name: "wait-for-db"
+          image: reg.inje-private.com/nnd002/sonarqube:10.6.0-community
+          imagePullPolicy: IfNotPresent
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+              - ALL
+            runAsGroup: 0
+            runAsNonRoot: true
+            runAsUser: 1000
+            seccompProfile:
+              type: RuntimeDefault
+          command: ["/bin/bash", "-c"]
+          args: ['set -o pipefail;for i in {1..200};do (echo > /dev/tcp/sonarqube-postgresql/5432) && exit 0; sleep 2;done; exit 1']
+        - name: init-sysctl
+          image: reg.inje-private.com/nnd002/sonarqube:10.6.0-community
+          imagePullPolicy: IfNotPresent
+          securityContext:
+            privileged: true
+            runAsUser: 0
+          command: ["/bin/bash", "-e", "/tmp/scripts/init_sysctl.sh"]
+          volumeMounts:
+            - name: init-sysctl
+              mountPath: /tmp/scripts/
+          env:
+            - name: SONAR_WEB_CONTEXT
+              value: "/"
+            - name: SONAR_WEB_JAVAOPTS
+              value: ""
+            - name: SONAR_CE_JAVAOPTS
+              value: ""
+      containers:
+        - name: sonarqube
+          image: reg.inje-private.com/nnd002/sonarqube:10.6.0-community
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: http
+              containerPort: 9000
+              protocol: TCP
+          resources:
+            limits:
+              cpu: 800m
+              ephemeral-storage: 512000M
+              memory: 6144M
+            requests:
+              cpu: 400m
+              ephemeral-storage: 1536M
+              memory: 2048M
+          env:
+            - name: SONAR_HELM_CHART_VERSION
+              value: 10.6.0_3033
+            - name: SONAR_JDBC_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: sonarqube-postgresql
+                  key: postgresql-password
+            - name: SONAR_WEB_SYSTEMPASSCODE
+              valueFrom:
+                secretKeyRef:
+                  name: sonarqube-sonarqube-monitoring-passcode
+                  key: SONAR_WEB_SYSTEMPASSCODE
+            - name: SONAR_WEB_CONTEXT
+              value: "/"
+            - name: SONAR_WEB_JAVAOPTS
+              value: ""
+            - name: SONAR_CE_JAVAOPTS
+              value: ""
+          envFrom:
+            - configMapRef:
+                name: sonarqube-sonarqube-jdbc-config
+          livenessProbe:
+            exec:
+              command:
+              - sh
+              - -c
+              - |
+                wget --no-proxy --quiet -O /dev/null --timeout=1 --header="X-Sonar-Passcode: $SONAR_WEB_SYSTEMPASSCODE" "http://localhost:9000/api/system/liveness"
+            failureThreshold: 6
+            initialDelaySeconds: 60
+            periodSeconds: 30
+            timeoutSeconds: 1
+          readinessProbe:
+            exec:
+              command:
+              - sh
+              - -c
+              - |
+                #!/bin/bash
+                # A Sonarqube container is considered ready if the status is UP, DB_MIGRATION_NEEDED or DB_MIGRATION_RUNNING
+                # status about migration are added to prevent the node to be kill while sonarqube is upgrading the database.
+                if wget --no-proxy -qO- http://localhost:9000/api/system/status | grep -q -e '"status":"UP"' -e '"status":"DB_MIGRATION_NEEDED"' -e '"status":"DB_MIGRATION_RUNNING"'; then
+                  exit 0
+                fi
+                exit 1
+            failureThreshold: 6
+            initialDelaySeconds: 60
+            periodSeconds: 30
+            timeoutSeconds: 1
+          startupProbe:
+            httpGet:
+              scheme: HTTP
+              path: /api/system/status
+              port: http
+            initialDelaySeconds: 30
+            periodSeconds: 10
+            failureThreshold: 24
+            timeoutSeconds: 1
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+              - ALL
+            runAsGroup: 0
+            runAsNonRoot: true
+            runAsUser: 1000
+            seccompProfile:
+              type: RuntimeDefault
+          volumeMounts:
+            - mountPath: /opt/sonarqube/data
+              name: sonarqube
+              subPath: data
+            - mountPath: /opt/sonarqube/temp
+              name: sonarqube
+              subPath: temp
+            - mountPath: /opt/sonarqube/logs
+              name: sonarqube
+              subPath: logs
+            - mountPath: /tmp
+              name: tmp-dir
+      serviceAccountName: default
+      volumes:
+        - name: init-sysctl
+          configMap:
+            name: sonarqube-sonarqube-init-sysctl
+            items:
+              - key: init_sysctl.sh
+                path: init_sysctl.sh
+        - name: init-fs
+          configMap:
+            name: sonarqube-sonarqube-init-fs
+            items:
+              - key: init_fs.sh
+                path: init_fs.sh
+        - name: sonarqube
+          persistentVolumeClaim:
+            claimName: sonarqube-sonarqube
+        - name : tmp-dir
+          emptyDir:
+            {}
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  labels:
+    app: sonarqube
+    chart: sonarqube-10.6.0_3033
+    release: sonarqube
+  name: sonarqube-sonarqube
+  namespace: sonarqube
+spec:
+  accessModes:
+  - ReadWriteMany
+  storageClassName: sc-monitoring
+  resources:
+    requests:
+      storage: 20Gi
+
+---
+# Source: sonarqube/templates/tests/sonarqube-test.yaml
+apiVersion: v1
+kind: Pod
+metadata:
+  name: "sonarqube-ui-test"
+  namespace: sonarqube
+  annotations:
+    "helm.sh/hook": test-success
+  labels:
+    app: sonarqube
+    chart: sonarqube-10.6.0_3033
+    release: sonarqube
+    heritage: Helm
+spec:
+  automountServiceAccountToken: false
+  containers:
+    - name: sonarqube-ui-test
+      image: "reg.inje-private.com/nnd002/sonarqube:10.6.0-community"
+      imagePullPolicy: IfNotPresent
+      command: ['wget']
+      args: [
+        '--retry-connrefused',
+        '--waitretry=1',
+        '--timeout=5',
+        '-t',
+        '12',
+        '-qO-',
+        'sonarqube-sonarqube:9000/api/system/status'
+        ]
+      resources:
+        limits:
+          cpu: 500m
+          ephemeral-storage: 1000M
+          memory: 200M
+        requests:
+          cpu: 500m
+          ephemeral-storage: 100M
+          memory: 200M
+  restartPolicy: Never
--- a/on-premise/cicd/sonarqube/ing.yaml
+++ b/on-premise/cicd/sonarqube/ing.yaml
@ -0,0 +1,23 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: sonarqube-ingress
+  namespace: sonarqube
+spec:
+  ingressClassName: nginx
+  rules:
+  - host: sonar.inje-private.com
+    http:
+      paths:
+      - backend:
+          service:
+            name: sonarqube-sonarqube
+            port:
+              name: http
+        path: /
+        pathType: Prefix
+  tls:
+  - hosts:
+    - "sonar.inje-private.com"
+    secretName: sonarqube-ssl
+
--- a/on-premise/cicd/tekton/1_configure/init.yaml
+++ b/on-premise/cicd/tekton/1_configure/init.yaml
--- a/on-premise/cicd/tekton/3_apply/ValidatingWebhookConfiguration.yaml
+++ b/on-premise/cicd/tekton/3_apply/ValidatingWebhookConfiguration.yaml
@ -0,0 +1,87 @@
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingWebhookConfiguration
+metadata:
+  labels:
+    app.kubernetes.io/component: webhook
+    app.kubernetes.io/instance: default
+    app.kubernetes.io/part-of: tekton-pipelines
+    pipeline.tekton.dev/release: v0.57.0
+  name: config.webhook.pipeline.tekton.dev
+webhooks:
+- admissionReviewVersions:
+  - v1
+  clientConfig:
+    service:
+      name: tekton-pipelines-webhook
+      namespace: tekton-pipelines
+  failurePolicy: Fail
+  name: config.webhook.pipeline.tekton.dev
+  objectSelector:
+    matchLabels:
+      app.kubernetes.io/part-of: tekton-pipelines
+  sideEffects: None
+---
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingWebhookConfiguration
+metadata:
+  labels:
+    app.kubernetes.io/component: webhook
+    app.kubernetes.io/instance: default
+    app.kubernetes.io/part-of: tekton-triggers
+    triggers.tekton.dev/release: v0.26.1
+  name: config.webhook.triggers.tekton.dev
+webhooks:
+- admissionReviewVersions:
+  - v1
+  clientConfig:
+    service:
+      name: tekton-triggers-webhook
+      namespace: tekton-pipelines
+  failurePolicy: Fail
+  name: config.webhook.triggers.tekton.dev
+  namespaceSelector:
+    matchExpressions:
+    - key: triggers.tekton.dev/release
+      operator: Exists
+  sideEffects: None
+---
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingWebhookConfiguration
+metadata:
+  labels:
+    app.kubernetes.io/component: webhook
+    app.kubernetes.io/instance: default
+    app.kubernetes.io/part-of: tekton-pipelines
+    pipeline.tekton.dev/release: v0.57.0
+  name: validation.webhook.pipeline.tekton.dev
+webhooks:
+- admissionReviewVersions:
+  - v1
+  clientConfig:
+    service:
+      name: tekton-pipelines-webhook
+      namespace: tekton-pipelines
+  failurePolicy: Fail
+  name: validation.webhook.pipeline.tekton.dev
+  sideEffects: None
+---
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingWebhookConfiguration
+metadata:
+  labels:
+    app.kubernetes.io/component: webhook
+    app.kubernetes.io/instance: default
+    app.kubernetes.io/part-of: tekton-triggers
+    triggers.tekton.dev/release: v0.26.1
+  name: validation.webhook.triggers.tekton.dev
+webhooks:
+- admissionReviewVersions:
+  - v1
+  clientConfig:
+    service:
+      name: tekton-triggers-webhook
+      namespace: tekton-pipelines
+  failurePolicy: Fail
+  name: validation.webhook.triggers.tekton.dev
+  sideEffects: None
+
--- a/on-premise/cicd/tekton/3_apply/deploy.yaml
+++ b/on-premise/cicd/tekton/3_apply/deploy.yaml
--- a/on-premise/cicd/tekton/3_apply/extention.yaml
+++ b/on-premise/cicd/tekton/3_apply/extention.yaml
@ -0,0 +1,119 @@
+apiVersion: dashboard.tekton.dev/v1alpha1
+kind: Extension
+metadata:
+  name: cronjobs
+spec:
+  apiVersion: batch/v1
+  displayname: k8s cronjobs
+  name: cronjobs
+---
+apiVersion: triggers.tekton.dev/v1alpha1
+kind: ClusterInterceptor
+metadata:
+  labels:
+    server/type: https
+  name: bitbucket
+spec:
+  clientConfig:
+    service:
+      name: tekton-triggers-core-interceptors
+      namespace: tekton-pipelines
+      path: bitbucket
+      port: 8443
+---
+apiVersion: triggers.tekton.dev/v1alpha1
+kind: ClusterInterceptor
+metadata:
+  labels:
+    server/type: https
+  name: cel
+spec:
+  clientConfig:
+    service:
+      name: tekton-triggers-core-interceptors
+      namespace: tekton-pipelines
+      path: cel
+      port: 8443
+---
+apiVersion: triggers.tekton.dev/v1alpha1
+kind: ClusterInterceptor
+metadata:
+  labels:
+    server/type: https
+  name: github
+spec:
+  clientConfig:
+    service:
+      name: tekton-triggers-core-interceptors
+      namespace: tekton-pipelines
+      path: github
+      port: 8443
+---
+apiVersion: triggers.tekton.dev/v1alpha1
+kind: ClusterInterceptor
+metadata:
+  labels:
+    server/type: https
+  name: gitlab
+spec:
+  clientConfig:
+    service:
+      name: tekton-triggers-core-interceptors
+      namespace: tekton-pipelines
+      path: gitlab
+      port: 8443
+---
+apiVersion: triggers.tekton.dev/v1alpha1
+kind: ClusterInterceptor
+metadata:
+  labels:
+    server/type: https
+  name: slack
+spec:
+  clientConfig:
+    service:
+      name: tekton-triggers-core-interceptors
+      namespace: tekton-pipelines
+      path: slack
+      port: 8443
+---
+apiVersion: admissionregistration.k8s.io/v1
+kind: MutatingWebhookConfiguration
+metadata:
+  labels:
+    app.kubernetes.io/component: webhook
+    app.kubernetes.io/instance: default
+    app.kubernetes.io/part-of: tekton-pipelines
+    pipeline.tekton.dev/release: v0.57.0
+  name: webhook.pipeline.tekton.dev
+webhooks:
+- admissionReviewVersions:
+  - v1
+  clientConfig:
+    service:
+      name: tekton-pipelines-webhook
+      namespace: tekton-pipelines
+  failurePolicy: Fail
+  name: webhook.pipeline.tekton.dev
+  sideEffects: None
+---
+apiVersion: admissionregistration.k8s.io/v1
+kind: MutatingWebhookConfiguration
+metadata:
+  labels:
+    app.kubernetes.io/component: webhook
+    app.kubernetes.io/instance: default
+    app.kubernetes.io/part-of: tekton-triggers
+    triggers.tekton.dev/release: v0.26.1
+  name: webhook.triggers.tekton.dev
+webhooks:
+- admissionReviewVersions:
+  - v1
+  clientConfig:
+    service:
+      name: tekton-triggers-webhook
+      namespace: tekton-pipelines
+  failurePolicy: Fail
+  name: webhook.triggers.tekton.dev
+  sideEffects: None
+
--- a/on-premise/cicd/tekton/3_apply/ing.yaml
+++ b/on-premise/cicd/tekton/3_apply/ing.yaml
@ -0,0 +1,25 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: ing-tekton
+  namespace: tekton-pipelines
+  annotations:
+    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+spec:
+  ingressClassName: nginx
+  rules:
+  - host: tekton.inje-private.com # 사전 생성된 인증서의 도메인적용.
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: tekton-dashboard
+            port:
+              number: 9097
+  tls:
+    - hosts:
+      - "tekton.inje-private.com"
+      secretName: tekton-ssl
+
--- a/on-premise/main/harbor_2.9.1/1.init.yaml
+++ b/on-premise/main/harbor_2.9.1/1.init.yaml
@ -0,0 +1,311 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  labels:
+    kubernetes.io/metadata.name: harbor
+  name: harbor
+spec:
+  finalizers:
+  - kubernetes
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  labels:
+    app: harbor
+    release: harbor
+  name: harbor-core
+  namespace: harbor
+data:
+  _REDIS_URL_CORE: redis://harbor-redis:6379/0?idle_timeout_seconds=30
+  _REDIS_URL_REG: redis://harbor-redis:6379/2?idle_timeout_seconds=30
+  CHART_CACHE_DRIVER: redis
+  CONFIG_PATH: /etc/core/app.conf
+  CORE_LOCAL_URL: http://127.0.0.1:8080
+  CORE_URL: http://harbor-core:80
+  DATABASE_TYPE: postgresql
+  EXT_ENDPOINT: https://harbor.icurfer.com
+  HTTP_PROXY: ""
+  HTTPS_PROXY: ""
+  JOBSERVICE_URL: http://harbor-jobservice
+  LOG_LEVEL: info
+  NO_PROXY: harbor-core,harbor-jobservice,harbor-database,harbor-registry,harbor-portal,harbor-trivy,harbor-exporter,127.0.0.1,localhost,.local,.internal
+  PERMITTED_REGISTRY_TYPES_FOR_PROXY_CACHE: docker-hub,harbor,azure-acr,aws-ecr,google-gcr,quay,docker-registry,github-ghcr,jfrog-artifactory
+  PORT: "8080"
+  PORTAL_URL: http://harbor-portal
+  POSTGRESQL_DATABASE: registry
+  POSTGRESQL_HOST: harbor-database
+  POSTGRESQL_MAX_IDLE_CONNS: "100"
+  POSTGRESQL_MAX_OPEN_CONNS: "900"
+  POSTGRESQL_PORT: "5432"
+  POSTGRESQL_SSLMODE: disable
+  POSTGRESQL_USERNAME: postgres
+  QUOTA_UPDATE_PROVIDER: db
+  REGISTRY_CONTROLLER_URL: http://harbor-registry:8080
+  REGISTRY_CREDENTIAL_USERNAME: harbor_registry_user
+  REGISTRY_STORAGE_PROVIDER_NAME: filesystem
+  REGISTRY_URL: http://harbor-registry:5000
+  TOKEN_SERVICE_URL: http://harbor-core:80/service/token
+  TRIVY_ADAPTER_URL: http://harbor-trivy:8080
+  WITH_TRIVY: "true"
+  app.conf: |
+    appname = Harbor
+    runmode = prod
+    enablegzip = true
+
+    [prod]
+    httpport = 8080
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  labels:
+    app: harbor
+    release: harbor
+  name: harbor-jobservice
+  namespace: harbor
+data:
+  config.yml: |
+    #Server listening port
+    protocol: "http"
+    port: 8080
+    worker_pool:
+      workers: 10
+      backend: "redis"
+      redis_pool:
+        redis_url: "redis://harbor-redis:6379/1"
+        namespace: "harbor_job_service_namespace"
+        idle_timeout_second: 3600
+    job_loggers:
+      - name: "FILE"
+        level: INFO
+        settings: # Customized settings of logger
+          base_dir: "/var/log/jobs"
+        sweeper:
+          duration: 14 #days
+          settings: # Customized settings of sweeper
+            work_dir: "/var/log/jobs"
+    metric:
+      enabled: false
+      path: /metrics
+      port: 8001
+    #Loggers for the job service
+    loggers:
+      - name: "STD_OUTPUT"
+        level: INFO
+    reaper:
+      # the max time to wait for a task to finish, if unfinished after max_update_hours, the task will be mark as error, but the task will continue to run, default value is 24
+      max_update_hours: 24
+      # the max time for execution in running state without new task created
+      max_dangling_hours: 168
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  labels:
+    app: harbor
+    release: harbor
+  name: harbor-jobservice-env
+  namespace: harbor
+data:
+  CORE_URL: http://harbor-core:80
+  HTTP_PROXY: ""
+  HTTPS_PROXY: ""
+  JOBSERVICE_WEBHOOK_JOB_HTTP_CLIENT_TIMEOUT: "3"
+  JOBSERVICE_WEBHOOK_JOB_MAX_RETRY: "3"
+  NO_PROXY: harbor-core,harbor-jobservice,harbor-database,harbor-registry,harbor-portal,harbor-trivy,harbor-exporter,127.0.0.1,localhost,.local,.internal
+  REGISTRY_CONTROLLER_URL: http://harbor-registry:8080
+  REGISTRY_CREDENTIAL_USERNAME: harbor_registry_user
+  REGISTRY_URL: http://harbor-registry:5000
+  TOKEN_SERVICE_URL: http://harbor-core:80/service/token
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  labels:
+    app: harbor
+    release: harbor
+  name: harbor-portal
+  namespace: harbor
+data:
+  nginx.conf: |
+    worker_processes auto;
+    pid /tmp/nginx.pid;
+    events {
+        worker_connections  1024;
+    }
+    http {
+        client_body_temp_path /tmp/client_body_temp;
+        proxy_temp_path /tmp/proxy_temp;
+        fastcgi_temp_path /tmp/fastcgi_temp;
+        uwsgi_temp_path /tmp/uwsgi_temp;
+        scgi_temp_path /tmp/scgi_temp;
+        server {
+            listen 8080;
+            listen [::]:8080;
+            server_name  localhost;
+            root   /usr/share/nginx/html;
+            index  index.html index.htm;
+            include /etc/nginx/mime.types;
+            gzip on;
+            gzip_min_length 1000;
+            gzip_proxied expired no-cache no-store private auth;
+            gzip_types text/plain text/css application/json application/javascript application/x-javascript text/xml application/xml application/xml+rss text/javascript;
+            location /devcenter-api-2.0 {
+                try_files $uri $uri/ /swagger-ui-index.html;
+            }
+            location / {
+                try_files $uri $uri/ /index.html;
+            }
+            location = /index.html {
+                add_header Cache-Control "no-store, no-cache, must-revalidate";
+            }
+        }
+    }
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  labels:
+    app: harbor
+    release: harbor
+  name: harbor-registry
+  namespace: harbor
+data:
+  config.yml: |
+    version: 0.1
+    log:
+      level: info
+      fields:
+        service: registry
+    storage:
+      filesystem:
+        rootdirectory: /storage
+      cache:
+        layerinfo: redis
+      maintenance:
+        uploadpurging:
+          enabled: true
+          age: 168h
+          interval: 24h
+          dryrun: false
+      delete:
+        enabled: true
+      redirect:
+        disable: false
+    redis:
+      addr: harbor-redis:6379
+      db: 2
+      readtimeout: 10s
+      writetimeout: 10s
+      dialtimeout: 10s
+      pool:
+        maxidle: 100
+        maxactive: 500
+        idletimeout: 60s
+    http:
+      addr: :5000
+      #relativeurls: false
+      relativeurls: true
+      # set via environment variable
+      # secret: placeholder
+      debug:
+        addr: localhost:5001
+    auth:
+      htpasswd:
+        realm: harbor-registry-basic-realm
+        path: /etc/registry/passwd
+    validation:
+      disabled: true
+    compatibility:
+      schema1:
+        enabled: true
+  ctl-config.yml: |
+    ---
+    protocol: "http"
+    port: 8080
+    log_level: info
+    registry_config: "/etc/registry/config.yml"
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  labels:
+    app: harbor
+    release: harbor
+  name: harbor-registryctl
+  namespace: harbor
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  labels:
+    app: harbor
+    release: harbor
+  name: harbor-database
+  namespace: harbor
+type: Opaque
+data:
+  POSTGRES_PASSWORD: UmxheG9kbXM5MCFA
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  labels:
+    app: harbor
+    release: harbor
+  name: harbor-jobservice
+  namespace: harbor
+type: Opaque
+data:
+  JOBSERVICE_SECRET: akVWbzlyNFJaU2R1clJqUA==
+  REGISTRY_CREDENTIAL_PASSWORD: aGFyYm9yX3JlZ2lzdHJ5X3Bhc3N3b3Jk
+---
+apiVersion: v1
+data:
+  REGISTRY_HTTP_SECRET: dHlCdm41MXpIakxLRm5mRw==
+  REGISTRY_REDIS_PASSWORD: ""
+kind: Secret
+metadata:
+  labels:
+    app: harbor
+    release: harbor
+  name: harbor-registry
+  namespace: harbor
+type: Opaque
+---
+apiVersion: v1
+data:
+  REGISTRY_HTPASSWD: aGFyYm9yX3JlZ2lzdHJ5X3VzZXI6JDJhJDEwJG1uRkVSQkVyRmROYnNuZDVHWUxTQXVUOTRaUWxZNGkxU3BtNTk4dWlmV2pLbEJrQnJhbHEu
+kind: Secret
+metadata:
+  labels:
+    app: harbor
+    release: harbor
+  name: harbor-registry-htpasswd
+  namespace: harbor
+type: Opaque
+---
+apiVersion: v1
+data: null
+kind: Secret
+metadata:
+  labels:
+    app: harbor
+    release: harbor
+  name: harbor-registryctl
+  namespace: harbor
+type: Opaque
+---
+apiVersion: v1
+data:
+  gitHubToken: ""
+  redisURL: cmVkaXM6Ly9oYXJib3ItcmVkaXM6NjM3OS81P2lkbGVfdGltZW91dF9zZWNvbmRzPTMw
+kind: Secret
+metadata:
+  labels:
+    app: harbor
+    release: harbor
+  name: harbor-trivy
+  namespace: harbor
+type: Opaque
--- a/on-premise/main/harbor_2.9.1/2.cert.yaml
+++ b/on-premise/main/harbor_2.9.1/2.cert.yaml
@ -0,0 +1,27 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: harbor-cacerts
+  namespace: harbor
+data:
+  cert: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUU5RENDQTl5Z0F3SUJBZ0lTQktsUkF1R24rM2N1R2xKS1o5aVY4Vmx4TUEwR0NTcUdTSWIzRFFFQkN3VUEKTURJeEN6QUpCZ05WQkFZVEFsVlRNUll3RkFZRFZRUUtFdzFNWlhRbmN5QkZibU55ZVhCME1Rc3dDUVlEVlFRRApFd0pTTXpBZUZ3MHlOREF6TURJeE5EQTVOVFZhRncweU5EQTFNekV4TkRBNU5UUmFNQmd4RmpBVUJnTlZCQU1NCkRTb3VhV04xY21abGNpNWpiMjB3Z2dFaU1BMEdDU3FHU0liM0RRRUJBUVVBQTRJQkR3QXdnZ0VLQW9JQkFRQ3oKQWVxVS9KSkJGWWJpeFQwbTRKTXU3QW5CdTVYRUFVSUhHendsR3ZjdjJXRTBxajNwU1JCeUdJWEo0eHdycnl3eAprYjgrRkxTSjh4U3Q2TXpwZjVxNTBQMm9PYklFdkMwY0drNHZuZThGVm1YckNKckNMaUtld0JBRWhFcC9IUjdYClVFSFRLVFpXTE5oUkIzNjMxZFkrcHhHU1AxeWNMblBXYkJQOUVSa2xzeUhoUnJpWHBxTmZDcGVIM3kxb3VJOUwKV3l5Yks3SUdmSkVzN1g0TE1OZ2RycEZtUzlCdTNZQ0JVMExZMlZtWVFJNVFaNkNhbisrQk51bVN6U0M4ZVRUaApJamY0Uk14R2JIUFNDYjBXb3hxM3M4RmZmQVd1a2JOSmhXSTlidXNucWxNTnRrQnREdFYxdVpaQUlLMno0cnFCCmlJbDlaS0lza3FEQUJaMWFSb0JkQWdNQkFBR2pnZ0ljTUlJQ0dEQU9CZ05WSFE4QkFmOEVCQU1DQmFBd0hRWUQKVlIwbEJCWXdGQVlJS3dZQkJRVUhBd0VHQ0NzR0FRVUZCd01DTUF3R0ExVWRFd0VCL3dRQ01BQXdIUVlEVlIwTwpCQllFRk51b3p0ZmprQ25FRGFxd01zVlBwdU5CaU5YaU1COEdBMVVkSXdRWU1CYUFGQlF1c3hlM1dGYkxybEFKClFPWWZyNTJMRk1MR01GVUdDQ3NHQVFVRkJ3RUJCRWt3UnpBaEJnZ3JCZ0VGQlFjd0FZWVZhSFIwY0RvdkwzSXoKTG04dWJHVnVZM0l1YjNKbk1DSUdDQ3NHQVFVRkJ6QUNoaFpvZEhSd09pOHZjak11YVM1c1pXNWpjaTV2Y21jdgpNQ1VHQTFVZEVRUWVNQnlDRFNvdWFXTjFjbVpsY2k1amIyMkNDMmxqZFhKbVpYSXVZMjl0TUJNR0ExVWRJQVFNCk1Bb3dDQVlHWjRFTUFRSUJNSUlCQkFZS0t3WUJCQUhXZVFJRUFnU0I5UVNCOGdEd0FIVUFPMU4zZFQ0dHVZQk8KaXpCYkJ2NUFPMmZZVDhQMHg3MEFEUzF5YitINjFCY0FBQUdOLzdidTJ3QUFCQU1BUmpCRUFpQkdEcW5xZytIcwpQUmVmYTc5TXdVZjlmUzFOYWh3SEsrRlJrVlg4REE2QUN3SWdPN2NsOU1IcC9hVVFSbkhZNFlRU01lMG5WbHhUCkpBY0RuY2syUkJQMFhBUUFkd0R1emRCazFkc2F6c1ZjdDUyMHpST2lNb2RHZkx6czNzTlJTRmxHY1IrMW13QUEKQVkzL3R1N0tBQUFFQXdCSU1FWUNJUUNTWTlxczV0ZFY2ejR5c01acG9yOXZXcmhsVXlScFNINVJIVGRQZGdlWQpsd0loQUpvblNHeVJOYmVNcEs3SW5uYVJxOVFuajB3R1hhWnVNMnZXTmlUYWFLTzBNQTBHQ1NxR1NJYjNEUUVCCkN3VUFBNElCQVFCMmlWcEttN0IxZ3p0a01Ud2QrQXBNOWh4SzkwYndWSTZxUnZLNmpsZVFJV0JCZG84Z3I0QlEKTlpPNDBWa21OaFhoY3ljQ1ZsSmlhT3JLd1J0c1VhMzVmc29BVTFCQzlodFRPT3R4TXYvb2lDZlA4aEZQNGttagpOTVFzNVZ2eFR6cmRjbWxhRmJaOWJkNVF2dko3L2hadTBnZ1ZrSUZVRXVZcWtQNFFzSHU1dXhOd01rWUY3RGUxCnVsVGY1YlFQcTJ0TEk5cTk1OUNsM2xMTTJqYklkM2h1bkRrMDFLZ2dSOWNkUmEzZnEzM2VZNkY2eWNWSVBPblMKdGhXck9melc5K2IrSFNDWHkyd3BJR0VTUTVJQU95cUdibnBBR1Z6U294UnVrNW1Wd0FqeDBaMW94eUdPRVprTgpEQUhHa21aNThIOUJpcXJ0VzBuaEMyKzN0cCtmR2kydwotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tQkVHSU4gQ0VSVElGSUNBVEUtLS0tLQpNSUlGRmpDQ0F2NmdBd0lCQWdJUkFKRXJDRXJQREJpblUvYldMaVduWDFvd0RRWUpLb1pJaHZjTkFRRUxCUUF3ClR6RUxNQWtHQTFVRUJoTUNWVk14S1RBbkJnTlZCQW9USUVsdWRHVnlibVYwSUZObFkzVnlhWFI1SUZKbGMyVmgKY21Ob0lFZHliM1Z3TVJVd0V3WURWUVFERXd4SlUxSkhJRkp2YjNRZ1dERXdIaGNOTWpBd09UQTBNREF3TURBdwpXaGNOTWpVd09URTFNVFl3TURBd1dqQXlNUXN3Q1FZRFZRUUdFd0pWVXpFV01CUUdBMVVFQ2hNTlRHVjBKM01nClJXNWpjbmx3ZERFTE1Ba0dBMVVFQXhNQ1VqTXdnZ0VpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElCRHdBd2dnRUsKQW9JQkFRQzdBaFVvelBhZ2xOTVBFdXlOVlpMRCtJTHhtYVo2UW9pblhTYXF0U3U1eFV5eHI0NXIrWFhJbzljUApSNVFVVlRWWGpKNm9vamtaOVlJOFFxbE9idlU3d3k3YmpjQ3dYUE5aT09mdHoybndXZ3NidnNDVUpDV0gramR4CnN4UG5IS3pobSsvYjVEdEZVa1dXcWNGVHpqVElVdTYxcnUyUDNtQnc0cVZVcTdadERwZWxRRFJySzlPOFp1dG0KTkh6NmE0dVBWeW1aK0RBWFhicHliL3VCeGEzU2hsZzlGOGZuQ2J2eEsvZUczTUhhY1YzVVJ1UE1yU1hCaUx4ZwpaM1Ztcy9FWTk2SmM1bFAvT29pMlI2WC9FeGpxbUFsM1A1MVQrYzhCNWZXbWNCY1VyMk9rLzVtems1M2NVNmNHCi9raUZIYUZwcmlWMXV4UE1VZ1AxN1ZHaGk5c1ZBZ01CQUFHamdnRUlNSUlCQkRBT0JnTlZIUThCQWY4RUJBTUMKQVlZd0hRWURWUjBsQkJZd0ZBWUlLd1lCQlFVSEF3SUdDQ3NHQVFVRkJ3TUJNQklHQTFVZEV3RUIvd1FJTUFZQgpBZjhDQVFBd0hRWURWUjBPQkJZRUZCUXVzeGUzV0ZiTHJsQUpRT1lmcjUyTEZNTEdNQjhHQTFVZEl3UVlNQmFBCkZIbTBXZVo3dHVYa0FYT0FDSWpJR2xqMjZadHVNRElHQ0NzR0FRVUZCd0VCQkNZd0pEQWlCZ2dyQmdFRkJRY3cKQW9ZV2FIUjBjRG92TDNneExta3ViR1Z1WTNJdWIzSm5MekFuQmdOVkhSOEVJREFlTUJ5Z0dxQVloaFpvZEhSdwpPaTh2ZURFdVl5NXNaVzVqY2k1dmNtY3ZNQ0lHQTFVZElBUWJNQmt3Q0FZR1o0RU1BUUlCTUEwR0N5c0dBUVFCCmd0OFRBUUVCTUEwR0NTcUdTSWIzRFFFQkN3VUFBNElDQVFDRnlrNUhQcVAzaFVTRnZOVm5lTEtZWTYxMVRSNlcKUFRObGNsUXRnYURxdyszNElMOWZ6TGR3QUxkdU8vWmVsTjdrSUorbTc0dXlBK2VpdFJZOGtjNjA3VGtDNTN3bAppa2ZtWlc0L1J2VFo4TTZVSys1VXpoSzhqQ2RMdU1HWUw2S3Z6WEdSU2dpM3lMZ2pld1F0Q1BrSVZ6NkQyUVF6CkNrY2hlQW1DSjhNcXlKdTV6bHp5Wk1qQXZubkFUNDV0UkF4ZWtyc3U5NHNRNGVnZFJDbmJXU0R0WTdraCtCSW0KbEpOWG9CMWxCTUVLSXE0UURVT1hvUmdmZnVEZ2hqZTFXckc5TUwrSGJpc3EveUZPR3dYRDlSaVg4RjZzdzZXNAphdkF1dkRzenVlNUwzc3o4NUsrRUM0WS93RlZETnZabzRUWVhhbzZaMGYrbFFLYzB0OERRWXprMU9YVnU4cnAyCnlKTUM2YWxMYkJmT0RBTFp2WUg3bjdkbzFBWmxzNEk5ZDFQNGpua0RyUW94QjNVcVE5aFZsM0xFS1E3M3hGMU8KeUs1R2hERFg4b1ZmR0tGNXUrZGVjSXNINFlhVHc3bVAzR0Z4SlNxdjMrMGxVRkpvaTVMYzVkYTE0OXA5MElkcwpoQ0V4cm9MMSs3bXJ5SWtYUGVGTTVUZ085cjBydlphQkZPdlYyejBncDM1WjArTDRXUGxidUVqTi9seFBGaW4rCkhsVWpyOGdSc0kzcWZKT1FGeS85cktJSlIwWS84T213dC84b1RXZ3kxbWRlSG1tams3ajFuWXN2QzlKU1E2WnYKTWxkbFRUS0IzemhUaFYxK1hXWXA2cmpkNUpXMXpiVldFa0xOeEU3R0pUaEVVRzNzemdCVkdQN3BTV1RVVHNxWApuTFJid0hPb3E3aEh3Zz09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  labels:
+    app: harbor
+    release: harbor
+  name: harbor-core
+  namespace: harbor
+type: Opaque
+data:
+  CSRF_KEY: Tk9ORjNTYjZoZ2tIdlZmcXNlcTVEdjNhUlBjWDZ6Rjg=
+  HARBOR_ADMIN_PASSWORD: UmxheG9kbXM5MCFA
+  POSTGRESQL_PASSWORD: UmxheG9kbXM5MCFA
+  REGISTRY_CREDENTIAL_PASSWORD: aGFyYm9yX3JlZ2lzdHJ5X3Bhc3N3b3Jk
+  secret: RTRQY0FxZ3RPVmdKWTBRRw==
+  secretKey: bm90LWEtc2VjdXJlLWtleQ==
+  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUU5RENDQTl5Z0F3SUJBZ0lTQktsUkF1R24rM2N1R2xKS1o5aVY4Vmx4TUEwR0NTcUdTSWIzRFFFQkN3VUEKTURJeEN6QUpCZ05WQkFZVEFsVlRNUll3RkFZRFZRUUtFdzFNWlhRbmN5QkZibU55ZVhCME1Rc3dDUVlEVlFRRApFd0pTTXpBZUZ3MHlOREF6TURJeE5EQTVOVFZhRncweU5EQTFNekV4TkRBNU5UUmFNQmd4RmpBVUJnTlZCQU1NCkRTb3VhV04xY21abGNpNWpiMjB3Z2dFaU1BMEdDU3FHU0liM0RRRUJBUVVBQTRJQkR3QXdnZ0VLQW9JQkFRQ3oKQWVxVS9KSkJGWWJpeFQwbTRKTXU3QW5CdTVYRUFVSUhHendsR3ZjdjJXRTBxajNwU1JCeUdJWEo0eHdycnl3eAprYjgrRkxTSjh4U3Q2TXpwZjVxNTBQMm9PYklFdkMwY0drNHZuZThGVm1YckNKckNMaUtld0JBRWhFcC9IUjdYClVFSFRLVFpXTE5oUkIzNjMxZFkrcHhHU1AxeWNMblBXYkJQOUVSa2xzeUhoUnJpWHBxTmZDcGVIM3kxb3VJOUwKV3l5Yks3SUdmSkVzN1g0TE1OZ2RycEZtUzlCdTNZQ0JVMExZMlZtWVFJNVFaNkNhbisrQk51bVN6U0M4ZVRUaApJamY0Uk14R2JIUFNDYjBXb3hxM3M4RmZmQVd1a2JOSmhXSTlidXNucWxNTnRrQnREdFYxdVpaQUlLMno0cnFCCmlJbDlaS0lza3FEQUJaMWFSb0JkQWdNQkFBR2pnZ0ljTUlJQ0dEQU9CZ05WSFE4QkFmOEVCQU1DQmFBd0hRWUQKVlIwbEJCWXdGQVlJS3dZQkJRVUhBd0VHQ0NzR0FRVUZCd01DTUF3R0ExVWRFd0VCL3dRQ01BQXdIUVlEVlIwTwpCQllFRk51b3p0ZmprQ25FRGFxd01zVlBwdU5CaU5YaU1COEdBMVVkSXdRWU1CYUFGQlF1c3hlM1dGYkxybEFKClFPWWZyNTJMRk1MR01GVUdDQ3NHQVFVRkJ3RUJCRWt3UnpBaEJnZ3JCZ0VGQlFjd0FZWVZhSFIwY0RvdkwzSXoKTG04dWJHVnVZM0l1YjNKbk1DSUdDQ3NHQVFVRkJ6QUNoaFpvZEhSd09pOHZjak11YVM1c1pXNWpjaTV2Y21jdgpNQ1VHQTFVZEVRUWVNQnlDRFNvdWFXTjFjbVpsY2k1amIyMkNDMmxqZFhKbVpYSXVZMjl0TUJNR0ExVWRJQVFNCk1Bb3dDQVlHWjRFTUFRSUJNSUlCQkFZS0t3WUJCQUhXZVFJRUFnU0I5UVNCOGdEd0FIVUFPMU4zZFQ0dHVZQk8KaXpCYkJ2NUFPMmZZVDhQMHg3MEFEUzF5YitINjFCY0FBQUdOLzdidTJ3QUFCQU1BUmpCRUFpQkdEcW5xZytIcwpQUmVmYTc5TXdVZjlmUzFOYWh3SEsrRlJrVlg4REE2QUN3SWdPN2NsOU1IcC9hVVFSbkhZNFlRU01lMG5WbHhUCkpBY0RuY2syUkJQMFhBUUFkd0R1emRCazFkc2F6c1ZjdDUyMHpST2lNb2RHZkx6czNzTlJTRmxHY1IrMW13QUEKQVkzL3R1N0tBQUFFQXdCSU1FWUNJUUNTWTlxczV0ZFY2ejR5c01acG9yOXZXcmhsVXlScFNINVJIVGRQZGdlWQpsd0loQUpvblNHeVJOYmVNcEs3SW5uYVJxOVFuajB3R1hhWnVNMnZXTmlUYWFLTzBNQTBHQ1NxR1NJYjNEUUVCCkN3VUFBNElCQVFCMmlWcEttN0IxZ3p0a01Ud2QrQXBNOWh4SzkwYndWSTZxUnZLNmpsZVFJV0JCZG84Z3I0QlEKTlpPNDBWa21OaFhoY3ljQ1ZsSmlhT3JLd1J0c1VhMzVmc29BVTFCQzlodFRPT3R4TXYvb2lDZlA4aEZQNGttagpOTVFzNVZ2eFR6cmRjbWxhRmJaOWJkNVF2dko3L2hadTBnZ1ZrSUZVRXVZcWtQNFFzSHU1dXhOd01rWUY3RGUxCnVsVGY1YlFQcTJ0TEk5cTk1OUNsM2xMTTJqYklkM2h1bkRrMDFLZ2dSOWNkUmEzZnEzM2VZNkY2eWNWSVBPblMKdGhXck9melc5K2IrSFNDWHkyd3BJR0VTUTVJQU95cUdibnBBR1Z6U294UnVrNW1Wd0FqeDBaMW94eUdPRVprTgpEQUhHa21aNThIOUJpcXJ0VzBuaEMyKzN0cCtmR2kydwotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0t
+  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2Z0lCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktnd2dnU2tBZ0VBQW9JQkFRQ3pBZXFVL0pKQkZZYmkKeFQwbTRKTXU3QW5CdTVYRUFVSUhHendsR3ZjdjJXRTBxajNwU1JCeUdJWEo0eHdycnl3eGtiOCtGTFNKOHhTdAo2TXpwZjVxNTBQMm9PYklFdkMwY0drNHZuZThGVm1YckNKckNMaUtld0JBRWhFcC9IUjdYVUVIVEtUWldMTmhSCkIzNjMxZFkrcHhHU1AxeWNMblBXYkJQOUVSa2xzeUhoUnJpWHBxTmZDcGVIM3kxb3VJOUxXeXliSzdJR2ZKRXMKN1g0TE1OZ2RycEZtUzlCdTNZQ0JVMExZMlZtWVFJNVFaNkNhbisrQk51bVN6U0M4ZVRUaElqZjRSTXhHYkhQUwpDYjBXb3hxM3M4RmZmQVd1a2JOSmhXSTlidXNucWxNTnRrQnREdFYxdVpaQUlLMno0cnFCaUlsOVpLSXNrcURBCkJaMWFSb0JkQWdNQkFBRUNnZ0VBQmdGVTNvOG82VHlManN6VVMvQ0JsNGtpY2FpZjhnTDRkVmNTcEl4YjlGNW0KbmxidUVVY0ZkczBVK0pjaElUa0tSK3ZEcytyZ3ZLRUE2d0w4bEMwVzk5QUhvUmxnWnJ3WkI2WG43MmZYdG9EZwphMEJadXIvRCtHU1Q2bEdLMDBBRmw4TzdsWlhVR3I0bk9wNnEvN0ttM09sZ3ZrY3R1RUtacnhJOG9HM1pWTFJOCmJMTUpLMFhMdGRSZDFIUWg4ZHNycDNldndYSUwzS3dnOEpDV2xEb2FPc0tCbUdxQU5LRTY4MDVNbm5uZWk5RlEKZ01lTFRxdmJzUkRJWFdpdDM4WEZLdmRBSUhnVTB3clh1djhXUXplYitjdnd0MFlRUEpyU0lraFFHUG10TlFQUgpHYWh3cGhlNXBVRUZranlxTXQxcHB2QmZTeFhWaU0zM3hlaEdZOTNtd1FLQmdRQzJWbjJPNWlmdUJUQVVqeDVyCkxoRTdGMWpnZGdZTWJRZUFjNDdUZkdXNjA1VGNlRk5TeDdBYk9tUHduR01xUWRiT0M4dEUzZXR3MURsV1hyRjcKL3NlRmxtVmduNWRWdGQxRWNoVUUvVVlxejIweldjSGpSN1lDbktmdDRIZmM3YWVmWGZZOG50TGVDUENtQVpsVgpycTVjSFUvOENLc3RwNmdHbVdFV0I0S25IUUtCZ1FEN1V2ODBxUzd6TDBsTFNWVTEycDMrUTl6NDU3MHgybmhOCmgvS3pnWnJpZ1FXMHRLdnlpRkdndHZ6V1BGMncvOUdDVDgyRHN2R2FMSURsa2o1VUpGalczUUQzWmxERFk5dEcKYU5zTEdwSkt4UDZwaEFwSUlMSjdYUXI2QXNWVm5yZXNSRGxZMU1LQXhFZGMxUHFNUk1sWEdpdzl3amdLQXA4UQpNZ2RYTlR1NlFRS0JnSDZmQzJ4YnlpalJjM1VqZWlWR0JYTTZvRjZudDBXVHhWemZZclRjc3l5TlY5Zk91MVpHCkU3YWswdGc1VWVmN2RyYjVtN3dFUEViTEtkSWZ5akxvV0JnZHUrTGdrTkJWamdYRkQzRzZqS3FZQnlaYzAzY0kKeW8xL3ltSTN1aVV5NkcrVWFiWHBPVmcxYnlCcEJkbHBoKzJ4OFdSOWhKb2N6bU5leWZ2cFZVTEZBb0dCQU1rZwpSNG4rSnN1SXVSQWQ5S292ZFNiSmFtcHJFaloyVHJaRktJNU5Gd1ZUR1p6ZXhZaEhYWVBQVFJHcHA1VUJkTW5qClVXV202OEJsQXhZMWJkbnFhSW95dlJZLzlEd1ppcDZUUlZCaWlGWjd4ZzBrMVJHWjBSdjJmdFZMS0Y3M3NLZVUKeFl2NFlGdXFPQzNyWjBLZnZiME4vZi9Da1JRNXVzKzhLYkc1c1QzQkFvR0JBSms2VmJvK3BtSE5ab0E2cDY5MApCY2lJRFJ3ZUJXQmZ2dmJ3ek8xbiswcE9IdEF1N1ZCS3ZmSGZ1bkhjMGNkdjdTdks0RjN3NW03blJBR3cxOXFnCjFreG5PZWFlazFGMG1aZWZaNGlqajVUSWtxTnlwQldkMEZYdHk5SUwwSEhMemxQU3VDb2pRVUJ3cG5PMTJ5cTYKMC92RFA0U1p3K2hWb3JORnZzMzhDVmZjCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0=
+---
--- a/on-premise/main/harbor_2.9.1/3.harbor.yaml
+++ b/on-premise/main/harbor_2.9.1/3.harbor.yaml
@ -0,0 +1,822 @@
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app: harbor
+    release: harbor
+  name: harbor-core
+  namespace: harbor
+spec:
+  ports:
+  - name: http-web
+    port: 80
+    targetPort: 8080
+  selector:
+    app: harbor
+    component: core
+    release: harbor
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app: harbor
+    release: harbor
+  name: harbor-database
+  namespace: harbor
+spec:
+  ports:
+  - port: 5432
+  selector:
+    app: harbor
+    component: database
+    release: harbor
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app: harbor
+    release: harbor
+  name: harbor-jobservice
+  namespace: harbor
+spec:
+  ports:
+  - name: http-jobservice
+    port: 80
+    targetPort: 8080
+  selector:
+    app: harbor
+    component: jobservice
+    release: harbor
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app: harbor
+    release: harbor
+  name: harbor-portal
+  namespace: harbor
+spec:
+  ports:
+  - port: 80
+    targetPort: 8080
+  selector:
+    app: harbor
+    component: portal
+    release: harbor
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app: harbor
+    release: harbor
+  name: harbor-redis
+  namespace: harbor
+spec:
+  ports:
+  - port: 6379
+  selector:
+    app: harbor
+    component: redis
+    release: harbor
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app: harbor
+    release: harbor
+  name: harbor-registry
+  namespace: harbor
+spec:
+  ports:
+  - name: http-registry
+    port: 5000
+  - name: http-controller
+    port: 8080
+  selector:
+    app: harbor
+    component: registry
+    release: harbor
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app: harbor
+    release: harbor
+  name: harbor-trivy
+  namespace: harbor
+spec:
+  ports:
+  - name: http-trivy
+    port: 8080
+    protocol: TCP
+  selector:
+    app: harbor
+    component: trivy
+    release: harbor
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  labels:
+    app: harbor
+    component: jobservice
+    release: harbor
+  name: harbor-jobservice
+  namespace: harbor
+spec:
+  accessModes:
+  - ReadWriteMany
+  resources:
+    requests:
+      storage: 10Gi
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  labels:
+    app: harbor
+    component: registry
+    release: harbor
+  name: harbor-registry
+  namespace: harbor
+spec:
+  accessModes:
+  - ReadWriteMany
+  resources:
+    requests:
+      storage: 50Gi
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app: harbor
+    component: core
+    release: harbor
+  name: harbor-core
+  namespace: harbor
+spec:
+  replicas: 1
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      app: harbor
+      component: core
+      release: harbor
+  template:
+    metadata:
+      labels:
+        app: harbor
+        component: core
+        release: harbor
+    spec:
+      automountServiceAccountToken: false
+      containers:
+      - env:
+        - name: CORE_SECRET
+          valueFrom:
+            secretKeyRef:
+              key: secret
+              name: harbor-core
+        - name: JOBSERVICE_SECRET
+          valueFrom:
+            secretKeyRef:
+              key: JOBSERVICE_SECRET
+              name: harbor-jobservice
+        envFrom:
+        - configMapRef:
+            name: harbor-core
+        - secretRef:
+            name: harbor-core
+        image: goharbor/harbor-core:v2.9.1
+        imagePullPolicy: IfNotPresent
+        livenessProbe:
+          failureThreshold: 2
+          httpGet:
+            path: /api/v2.0/ping
+            port: 8080
+            scheme: HTTP
+          periodSeconds: 10
+        name: core
+        ports:
+        - containerPort: 8080
+        readinessProbe:
+          failureThreshold: 2
+          httpGet:
+            path: /api/v2.0/ping
+            port: 8080
+            scheme: HTTP
+          periodSeconds: 10
+        startupProbe:
+          failureThreshold: 360
+          httpGet:
+            path: /api/v2.0/ping
+            port: 8080
+            scheme: HTTP
+          initialDelaySeconds: 10
+          periodSeconds: 10
+        volumeMounts:
+        - mountPath: /etc/core/app.conf
+          name: config
+          subPath: app.conf
+        - mountPath: /etc/core/key
+          name: secret-key
+          subPath: key
+        - mountPath: /etc/core/private_key.pem
+          name: token-service-private-key
+          subPath: tls.key
+        - mountPath: /etc/core/ca
+          name: ca-download
+        - mountPath: /etc/core/token
+          name: psc
+      securityContext:
+        fsGroup: 10000
+        runAsUser: 10000
+      terminationGracePeriodSeconds: 120
+      volumes:
+      - configMap:
+          items:
+          - key: app.conf
+            path: app.conf
+          name: harbor-core
+        name: config
+      - name: secret-key
+        secret:
+          items:
+          - key: secretKey
+            path: key
+          secretName: harbor-core
+      - name: token-service-private-key
+        secret:
+          secretName: harbor-core
+      - name: ca-download
+        secret:
+          secretName: harbor-cacerts
+      - emptyDir: {}
+        name: psc
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app: harbor
+    component: jobservice
+    release: harbor
+  name: harbor-jobservice
+  namespace: harbor
+spec:
+  replicas: 1
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      app: harbor
+      component: jobservice
+      release: harbor
+  strategy:
+    type: RollingUpdate
+  template:
+    metadata:
+      labels:
+        app: harbor
+        component: jobservice
+        release: harbor
+    spec:
+      automountServiceAccountToken: false
+      containers:
+      - env:
+        - name: CORE_SECRET
+          valueFrom:
+            secretKeyRef:
+              key: secret
+              name: harbor-core
+        envFrom:
+        - configMapRef:
+            name: harbor-jobservice-env
+        - secretRef:
+            name: harbor-jobservice
+        image: goharbor/harbor-jobservice:v2.9.1
+        imagePullPolicy: IfNotPresent
+        livenessProbe:
+          httpGet:
+            path: /api/v1/stats
+            port: 8080
+            scheme: HTTP
+          initialDelaySeconds: 300
+          periodSeconds: 10
+        name: jobservice
+        ports:
+        - containerPort: 8080
+        readinessProbe:
+          httpGet:
+            path: /api/v1/stats
+            port: 8080
+            scheme: HTTP
+          initialDelaySeconds: 20
+          periodSeconds: 10
+        volumeMounts:
+        - mountPath: /etc/jobservice/config.yml
+          name: jobservice-config
+          subPath: config.yml
+        - mountPath: /var/log/jobs
+          name: job-logs
+          subPath: null
+      securityContext:
+        fsGroup: 10000
+        runAsUser: 10000
+      terminationGracePeriodSeconds: 120
+      volumes:
+      - configMap:
+          name: harbor-jobservice
+        name: jobservice-config
+      - name: job-logs
+        persistentVolumeClaim:
+          claimName: harbor-jobservice
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app: harbor
+    component: portal
+    release: harbor
+  name: harbor-portal
+  namespace: harbor
+spec:
+  replicas: 1
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      app: harbor
+      component: portal
+      release: harbor
+  template:
+    metadata:
+      labels:
+        app: harbor
+        component: portal
+        release: harbor
+    spec:
+      automountServiceAccountToken: false
+      containers:
+      - image: goharbor/harbor-portal:v2.9.1
+        imagePullPolicy: IfNotPresent
+        livenessProbe:
+          httpGet:
+            path: /
+            port: 8080
+            scheme: HTTP
+          initialDelaySeconds: 300
+          periodSeconds: 10
+        name: portal
+        ports:
+        - containerPort: 8080
+        readinessProbe:
+          httpGet:
+            path: /
+            port: 8080
+            scheme: HTTP
+          initialDelaySeconds: 1
+          periodSeconds: 10
+        volumeMounts:
+        - mountPath: /etc/nginx/nginx.conf
+          name: portal-config
+          subPath: nginx.conf
+      securityContext:
+        fsGroup: 10000
+        runAsUser: 10000
+      volumes:
+      - configMap:
+          name: harbor-portal
+        name: portal-config
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app: harbor
+    component: registry
+    release: harbor
+  name: harbor-registry
+  namespace: harbor
+spec:
+  replicas: 1
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      app: harbor
+      component: registry
+      release: harbor
+  strategy:
+    type: RollingUpdate
+  template:
+    metadata:
+      labels:
+        app: harbor
+        component: registry
+        release: harbor
+    spec:
+      automountServiceAccountToken: false
+      containers:
+      - args:
+        - serve
+        - /etc/registry/config.yml
+        env: null
+        envFrom:
+        - secretRef:
+            name: harbor-registry
+        image: goharbor/registry-photon:v2.9.1
+        imagePullPolicy: IfNotPresent
+        livenessProbe:
+          httpGet:
+            path: /
+            port: 5000
+            scheme: HTTP
+          initialDelaySeconds: 300
+          periodSeconds: 10
+        name: registry
+        ports:
+        - containerPort: 5000
+        - containerPort: 5001
+        readinessProbe:
+          httpGet:
+            path: /
+            port: 5000
+            scheme: HTTP
+          initialDelaySeconds: 1
+          periodSeconds: 10
+        volumeMounts:
+        - mountPath: /storage
+          name: registry-data
+          subPath: null
+        - mountPath: /etc/registry/passwd
+          name: registry-htpasswd
+          subPath: passwd
+        - mountPath: /etc/registry/config.yml
+          name: registry-config
+          subPath: config.yml
+      - env:
+        - name: CORE_SECRET
+          valueFrom:
+            secretKeyRef:
+              key: secret
+              name: harbor-core
+        - name: JOBSERVICE_SECRET
+          valueFrom:
+            secretKeyRef:
+              key: JOBSERVICE_SECRET
+              name: harbor-jobservice
+        envFrom:
+        - configMapRef:
+            name: harbor-registryctl
+        - secretRef:
+            name: harbor-registry
+        - secretRef:
+            name: harbor-registryctl
+        image: goharbor/harbor-registryctl:v2.9.1
+        imagePullPolicy: IfNotPresent
+        livenessProbe:
+          httpGet:
+            path: /api/health
+            port: 8080
+            scheme: HTTP
+          initialDelaySeconds: 300
+          periodSeconds: 10
+        name: registryctl
+        ports:
+        - containerPort: 8080
+        readinessProbe:
+          httpGet:
+            path: /api/health
+            port: 8080
+            scheme: HTTP
+          initialDelaySeconds: 1
+          periodSeconds: 10
+        volumeMounts:
+        - mountPath: /storage
+          name: registry-data
+          subPath: null
+        - mountPath: /etc/registry/config.yml
+          name: registry-config
+          subPath: config.yml
+        - mountPath: /etc/registryctl/config.yml
+          name: registry-config
+          subPath: ctl-config.yml
+      securityContext:
+        fsGroup: 10000
+        fsGroupChangePolicy: OnRootMismatch
+        runAsUser: 10000
+      terminationGracePeriodSeconds: 120
+      volumes:
+      - name: registry-htpasswd
+        secret:
+          items:
+          - key: REGISTRY_HTPASSWD
+            path: passwd
+          secretName: harbor-registry-htpasswd
+      - configMap:
+          name: harbor-registry
+        name: registry-config
+      - name: registry-data
+        persistentVolumeClaim:
+          claimName: harbor-registry
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  labels:
+    app: harbor
+    component: database
+    release: harbor
+  name: harbor-database
+  namespace: harbor
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: harbor
+      component: database
+      release: harbor
+  serviceName: harbor-database
+  template:
+    metadata:
+      labels:
+        app: harbor
+        component: database
+        release: harbor
+    spec:
+      automountServiceAccountToken: false
+      containers:
+      - env:
+        - name: PGDATA
+          value: /var/lib/postgresql/data/pgdata
+        envFrom:
+        - secretRef:
+            name: harbor-database
+        image: goharbor/harbor-db:v2.9.1
+        imagePullPolicy: IfNotPresent
+        livenessProbe:
+          exec:
+            command:
+            - /docker-healthcheck.sh
+          initialDelaySeconds: 300
+          periodSeconds: 10
+          timeoutSeconds: 1
+        name: database
+        readinessProbe:
+          exec:
+            command:
+            - /docker-healthcheck.sh
+          initialDelaySeconds: 1
+          periodSeconds: 10
+          timeoutSeconds: 1
+        volumeMounts:
+        - mountPath: /var/lib/postgresql/data
+          name: database-data
+        - mountPath: /dev/shm
+          name: shm-volume
+      initContainers:
+      - args:
+        - -c
+        - '[ -e /var/lib/postgresql/data/postgresql.conf ] && [ ! -d /var/lib/postgresql/data/pgdata
+          ] && mkdir -m 0700 /var/lib/postgresql/data/pgdata && mv /var/lib/postgresql/data/*
+          /var/lib/postgresql/data/pgdata/ || true'
+        command:
+        - /bin/sh
+        image: goharbor/harbor-db:v2.9.1
+        imagePullPolicy: IfNotPresent
+        name: data-migrator
+        volumeMounts:
+        - mountPath: /var/lib/postgresql/data
+          name: database-data
+      - args:
+        - -c
+        - chmod -R 700 /var/lib/postgresql/data/pgdata || true
+        command:
+        - /bin/sh
+        image: goharbor/harbor-db:v2.9.1
+        imagePullPolicy: IfNotPresent
+        name: data-permissions-ensurer
+        volumeMounts:
+        - mountPath: /var/lib/postgresql/data
+          name: database-data
+      securityContext:
+        fsGroup: 999
+        runAsUser: 999
+      terminationGracePeriodSeconds: 120
+      volumes:
+      - emptyDir:
+          medium: Memory
+          sizeLimit: 512Mi
+        name: shm-volume
+  volumeClaimTemplates:
+  - metadata:
+      annotations: null
+      labels:
+        app: harbor
+        release: harbor
+      name: database-data
+    spec:
+      accessModes:
+      - ReadWriteOnce
+      resources:
+        requests:
+          storage: 10Gi
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  labels:
+    app: harbor
+    component: redis
+    release: harbor
+  name: harbor-redis
+  namespace: harbor
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: harbor
+      component: redis
+      release: harbor
+  serviceName: harbor-redis
+  template:
+    metadata:
+      labels:
+        app: harbor
+        component: redis
+        release: harbor
+    spec:
+      automountServiceAccountToken: false
+      containers:
+      - image: goharbor/redis-photon:v2.9.1
+        imagePullPolicy: IfNotPresent
+        livenessProbe:
+          initialDelaySeconds: 300
+          periodSeconds: 10
+          tcpSocket:
+            port: 6379
+        name: redis
+        readinessProbe:
+          initialDelaySeconds: 1
+          periodSeconds: 10
+          tcpSocket:
+            port: 6379
+        volumeMounts:
+        - mountPath: /var/lib/redis
+          name: data
+      securityContext:
+        fsGroup: 999
+        runAsUser: 999
+      terminationGracePeriodSeconds: 120
+  volumeClaimTemplates:
+  - metadata:
+      annotations: null
+      labels:
+        app: harbor
+        release: harbor
+      name: data
+    spec:
+      accessModes:
+      - ReadWriteOnce
+      resources:
+        requests:
+          storage: 10Gi
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  labels:
+    app: harbor
+    component: trivy
+    release: harbor
+  name: harbor-trivy
+  namespace: harbor
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: harbor
+      component: trivy
+      release: harbor
+  serviceName: harbor-trivy
+  template:
+    metadata:
+      labels:
+        app: harbor
+        component: trivy
+        release: harbor
+    spec:
+      automountServiceAccountToken: false
+      containers:
+      - env:
+        - name: HTTP_PROXY
+          value: ""
+        - name: HTTPS_PROXY
+          value: ""
+        - name: NO_PROXY
+          value: harbor-core,harbor-jobservice,harbor-database,harbor-registry,harbor-portal,harbor-trivy,harbor-exporter,127.0.0.1,localhost,.local,.internal
+        - name: SCANNER_LOG_LEVEL
+          value: info
+        - name: SCANNER_TRIVY_CACHE_DIR
+          value: /home/scanner/.cache/trivy
+        - name: SCANNER_TRIVY_REPORTS_DIR
+          value: /home/scanner/.cache/reports
+        - name: SCANNER_TRIVY_DEBUG_MODE
+          value: "false"
+        - name: SCANNER_TRIVY_VULN_TYPE
+          value: os,library
+        - name: SCANNER_TRIVY_TIMEOUT
+          value: 5m0s
+        - name: SCANNER_TRIVY_GITHUB_TOKEN
+          valueFrom:
+            secretKeyRef:
+              key: gitHubToken
+              name: harbor-trivy
+        - name: SCANNER_TRIVY_SEVERITY
+          value: UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL
+        - name: SCANNER_TRIVY_IGNORE_UNFIXED
+          value: "false"
+        - name: SCANNER_TRIVY_SKIP_UPDATE
+          value: "false"
+        - name: SCANNER_TRIVY_OFFLINE_SCAN
+          value: "false"
+        - name: SCANNER_TRIVY_SECURITY_CHECKS
+          value: vuln
+        - name: SCANNER_TRIVY_INSECURE
+          value: "false"
+        - name: SCANNER_API_SERVER_ADDR
+          value: :8080
+        - name: SCANNER_REDIS_URL
+          valueFrom:
+            secretKeyRef:
+              key: redisURL
+              name: harbor-trivy
+        - name: SCANNER_STORE_REDIS_URL
+          valueFrom:
+            secretKeyRef:
+              key: redisURL
+              name: harbor-trivy
+        - name: SCANNER_JOB_QUEUE_REDIS_URL
+          valueFrom:
+            secretKeyRef:
+              key: redisURL
+              name: harbor-trivy
+        image: goharbor/trivy-adapter-photon:v2.9.1
+        imagePullPolicy: IfNotPresent
+        livenessProbe:
+          failureThreshold: 10
+          httpGet:
+            path: /probe/healthy
+            port: api-server
+            scheme: HTTP
+          initialDelaySeconds: 5
+          periodSeconds: 10
+          successThreshold: 1
+        name: trivy
+        ports:
+        - containerPort: 8080
+          name: api-server
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /probe/ready
+            port: api-server
+            scheme: HTTP
+          initialDelaySeconds: 5
+          periodSeconds: 10
+          successThreshold: 1
+        resources:
+          limits:
+            cpu: 1
+            memory: 1Gi
+          requests:
+            cpu: 200m
+            memory: 512Mi
+        securityContext:
+          allowPrivilegeEscalation: false
+          privileged: false
+        volumeMounts:
+        - mountPath: /home/scanner/.cache
+          name: data
+          readOnly: false
+      securityContext:
+        fsGroup: 10000
+        runAsUser: 10000
+  volumeClaimTemplates:
+  - metadata:
+      labels:
+        app: harbor
+        release: harbor
+      name: data
+    spec:
+      accessModes:
+      - ReadWriteOnce
+      resources:
+        requests:
+          storage: 50Gi
--- a/on-premise/main/harbor_2.9.1/4.ing-harbor.yaml
+++ b/on-premise/main/harbor_2.9.1/4.ing-harbor.yaml
@ -0,0 +1,64 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  annotations:
+    ingress.kubernetes.io/proxy-body-size: "0"
+    nginx.ingress.kubernetes.io/proxy-body-size: "0"
+    #nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+  labels:
+    app: harbor
+    release: harbor
+  name: harbor-ingress
+  namespace: harbor
+spec:
+  ingressClassName: nginx
+  #tls:
+  #- hosts:
+  #  - "harbor.icurfer.com"
+  #  secretName: secret-harbor-ssl
+  rules:
+  - host: harbor.icurfer.com
+    http:
+      paths:
+      - backend:
+          service:
+            name: harbor-core
+            port:
+              number: 80
+        path: /api/
+        pathType: Prefix
+      - backend:
+          service:
+            name: harbor-core
+            port:
+              number: 80
+        path: /service/
+        pathType: Prefix
+      - backend:
+          service:
+            name: harbor-core
+            port:
+              number: 80
+        path: /v2/
+        pathType: Prefix
+      - backend:
+          service:
+            name: harbor-core
+            port:
+              number: 80
+        path: /chartrepo/
+        pathType: Prefix
+      - backend:
+          service:
+            name: harbor-core
+            port:
+              number: 80
+        path: /c/
+        pathType: Prefix
+      - backend:
+          service:
+            name: harbor-portal
+            port:
+              number: 80
+        path: /
+        pathType: Prefix
--- a/on-premise/main/harbor_2.9.1/pv-delete.py
+++ b/on-premise/main/harbor_2.9.1/pv-delete.py
@ -0,0 +1,12 @@
+#!/usr/bin/python3
+import os
+import subprocess
+
+pv_str = os.popen("kubectl get -n default pv | grep harbor | awk '$1 > 0 {print $1}'").read()
+print(pv_str)
+pv_list = pv_str.split('\n')
+i = 0
+for pv in pv_list:
+    print(pv)
+    # os.system(f"kubectl delete -n {ns} pv {pv}")
+    os.system(f"kubectl delete pv {pv}")
--- a/on-premise/main/nfs-provisioner/1.configuration/init_add_ns.yaml
+++ b/on-premise/main/nfs-provisioner/1.configuration/init_add_ns.yaml
--- a/on-premise/main/nfs-provisioner/3.deploy/\
+++ b/on-premise/main/nfs-provisioner/3.deploy/\
--- a/on-premise/main/nfs-provisioner/3.deploy/sample-deploy.yaml
+++ b/on-premise/main/nfs-provisioner/3.deploy/sample-deploy.yaml
--- a/on-premise/main/nfs-provisioner/4.postSettings/sc-hm.yaml
+++ b/on-premise/main/nfs-provisioner/4.postSettings/sc-hm.yaml
--- a/on-premise/main/nfs-provisioner/4.postSettings/sc-vm.yaml
+++ b/on-premise/main/nfs-provisioner/4.postSettings/sc-vm.yaml