jhlim
/
shdsbilling
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

harbor init

This commit is contained in:
root 2024-10-11 01:57:51 +00:00
parent d315d375e1
commit a08d78a154
25 changed files with 53086 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23156
on-premise/cicd/argocd_v2.12.3/argocd_v2.12.3.yaml Normal file
View File

File diff suppressed because it is too large Load Diff

23211
on-premise/cicd/argocd_v2.12.3/argocd_v2.12.3_add_ns.yaml Normal file
View File

File diff suppressed because it is too large Load Diff

28
on-premise/cicd/argocd_v2.12.3/ing-argocd.yaml Normal file
View File

@ -0,0 +1,28 @@
# Offloading setting.
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: ing-argocd
namespace: argocd
annotations:
#nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
nginx.ingress.kubernetes.io/backend-protocol: "https"
nginx.ingress.kubernetes.io/ssl-passthrough: "true"
spec:
ingressClassName: nginx
rules:
- host: argocd.inje-private.com # 사전 생성된 인증서의 도메인적용.
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: argocd-server
port:
number: 443
tls:
- hosts:
- "argocd.inje-private.com.com"
secretName: argocd-ssl

5
on-premise/cicd/argocd_v2.12.3/kustomization.yaml Normal file
View File

@ -0,0 +1,5 @@
# kustomization.yaml
namespace: argocd
resources:
- argocd_v2.12.3.yaml

22
on-premise/cicd/nexus/1_configure/init.yaml Normal file
View File

@ -0,0 +1,22 @@
# Warning
# PersistentVolumeClaim 오브젝트에서 StorageClass 이름을 변경하고 사용.
#
apiVersion: v1
kind: Namespace
metadata:
labels:
kubernetes.io/metadata.name: nexus
name: nexus
spec:
finalizers:
- kubernetes
---
apiVersion: v1
kind: ServiceAccount
metadata:
labels:
app.kubernetes.io/instance: nexus
app.kubernetes.io/name: nexus-repository-manager
app.kubernetes.io/version: 3.72.0
name: nexus-nexus-repository-manager
namespace: nexus

16
on-premise/cicd/nexus/1_configure/pvc.yaml Normal file
View File

@ -0,0 +1,16 @@
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
labels:
app.kubernetes.io/instance: nexus
app.kubernetes.io/name: nexus-repository-manager
app.kubernetes.io/version: 3.72.0
name: nexus-nexus-repository-manager-data
namespace: nexus
spec:
accessModes:
- ReadWriteMany
resources:
requests:
storage: 50Gi
storageClassName: sc-monitoring

96
on-premise/cicd/nexus/3_apply/deploy.yaml Normal file
View File

@ -0,0 +1,96 @@
apiVersion: v1
kind: Service
metadata:
labels:
app.kubernetes.io/instance: nexus
app.kubernetes.io/name: nexus-repository-manager
app.kubernetes.io/version: 3.62.0
name: nexus-nexus-repository-manager
namespace: nexus
spec:
ports:
- name: nexus-ui
port: 8081
protocol: TCP
selector:
app.kubernetes.io/instance: nexus
app.kubernetes.io/name: nexus-repository-manager
type: ClusterIP
---
apiVersion: apps/v1
kind: Deployment
metadata:
labels:
app.kubernetes.io/instance: nexus
app.kubernetes.io/name: nexus-repository-manager
app.kubernetes.io/version: 3.62.0
name: nexus-nexus-repository-manager
namespace: nexus
spec:
replicas: 1
selector:
matchLabels:
app.kubernetes.io/instance: nexus
app.kubernetes.io/name: nexus-repository-manager
strategy:
type: Recreate
template:
metadata:
labels:
app.kubernetes.io/instance: nexus
app.kubernetes.io/name: nexus-repository-manager
spec:
containers:
- env:
- name: INSTALL4J_ADD_VM_PARAMS
value: "-Xms2703M -Xmx2703M -XX:MaxDirectMemorySize=2703M -XX:+UnlockExperimentalVMOptions -Djava.util.prefs.userRoot=/nexus-data/javaprefs"
- name: NEXUS_SECURITY_RANDOMPASSWORD
value: "true"
envFrom: null
image: reg.inje-private.com/nnd002/sonatype/nexus3:3.72.0
imagePullPolicy: IfNotPresent
lifecycle: null
livenessProbe:
failureThreshold: 6
httpGet:
path: /
port: 8081
initialDelaySeconds: 30
periodSeconds: 30
timeoutSeconds: 10
name: nexus-repository-manager
ports:
- containerPort: 8081
name: nexus-ui
readinessProbe:
failureThreshold: 6
httpGet:
path: /
port: 8081
initialDelaySeconds: 30
periodSeconds: 30
timeoutSeconds: 10
#resources: # by ljh
#limits:
#cpu: 4
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
runAsNonRoot: true
seccompProfile:
type: RuntimeDefault
volumeMounts:
- mountPath: /nexus-data
name: nexus-repository-manager-data
securityContext:
fsGroup: 200
runAsGroup: 200
runAsUser: 200
serviceAccountName: nexus-nexus-repository-manager
terminationGracePeriodSeconds: 120
volumes:
- name: nexus-repository-manager-data
persistentVolumeClaim:
claimName: nexus-nexus-repository-manager-data

24
on-premise/cicd/nexus/3_apply/ing.yaml Normal file
View File

@ -0,0 +1,24 @@
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
annotations:
nginx.ingress.kubernetes.io/proxy-body-size: "0"
name: ing-nexus
namespace: nexus
spec:
ingressClassName: nginx
rules:
- host: nexus.inje-private.com
http:
paths:
- backend:
service:
name: nexus-nexus-repository-manager
port:
name: nexus-ui
path: /
pathType: Prefix
tls:
- hosts:
- "nexus.inje-private.com"
secretName: nexus-ssl

618
on-premise/cicd/sonarqube/deploy.yaml Normal file
View File

@ -0,0 +1,618 @@
apiVersion: v1
kind: Namespace
metadata:
labels:
kubernetes.io/metadata.name: sonarqube
name: sonarqube
spec:
finalizers:
- kubernetes
---
# Source: sonarqube/charts/postgresql/templates/secrets.yaml
apiVersion: v1
kind: Secret
metadata:
name: sonarqube-postgresql
namespace: sonarqube
labels:
app.kubernetes.io/name: postgresql
helm.sh/chart: postgresql-10.15.0
app.kubernetes.io/instance: sonarqube
app.kubernetes.io/managed-by: Helm
namespace: sonarqube
type: Opaque
data:
postgresql-postgres-password: "YjlLdzZzWVlYOQ=="
postgresql-password: "c29uYXJQYXNz"
---
# Source: sonarqube/templates/secret.yaml
---
apiVersion: v1
kind: Secret
metadata:
name: sonarqube-sonarqube-monitoring-passcode
namespace: sonarqube
labels:
app: sonarqube
chart: sonarqube-10.6.0_3033
release: sonarqube
heritage: Helm
type: Opaque
data:
SONAR_WEB_SYSTEMPASSCODE: "ZGVmaW5lX2l0"
---
# Source: sonarqube/templates/config.yaml
apiVersion: v1
kind: ConfigMap
metadata:
name: sonarqube-sonarqube-config
namespace: sonarqube
labels:
app: sonarqube
chart: sonarqube-10.6.0_3033
release: sonarqube
heritage: Helm
data:
sonar.properties: |
---
# Source: sonarqube/templates/init-fs.yaml
apiVersion: v1
kind: ConfigMap
metadata:
name: sonarqube-sonarqube-init-fs
namespace: sonarqube
labels:
app: sonarqube
chart: sonarqube-10.6.0_3033
release: sonarqube
heritage: Helm
data:
init_fs.sh: |-
---
# Source: sonarqube/templates/init-sysctl.yaml
apiVersion: v1
kind: ConfigMap
metadata:
name: sonarqube-sonarqube-init-sysctl
namespace: sonarqube
labels:
app: sonarqube
chart: sonarqube-10.6.0_3033
release: sonarqube
heritage: Helm
data:
init_sysctl.sh: |-
if [[ "$(sysctl -n vm.max_map_count)" -lt 524288 ]]; then
sysctl -w vm.max_map_count=524288
fi
if [[ "$(sysctl -n fs.file-max)" -lt 131072 ]]; then
sysctl -w fs.file-max=131072
fi
if [[ "$(ulimit -n)" != "unlimited" ]]; then
if [[ "$(ulimit -n)" -lt 131072 ]]; then
echo "ulimit -n 131072"
ulimit -n 131072
fi
fi
if [[ "$(ulimit -u)" != "unlimited" ]]; then
if [[ "$(ulimit -u)" -lt 8192 ]]; then
echo "ulimit -u 8192"
ulimit -u 8192
fi
fi
---
# Source: sonarqube/templates/install-plugins.yaml
apiVersion: v1
kind: ConfigMap
metadata:
name: sonarqube-sonarqube-install-plugins
namespace: sonarqube
labels:
app: sonarqube
chart: sonarqube-10.6.0_3033
release: sonarqube
heritage: Helm
data:
install_plugins.sh: |-
---
# Source: sonarqube/templates/jdbc-config.yaml
apiVersion: v1
kind: ConfigMap
metadata:
name: sonarqube-sonarqube-jdbc-config
namespace: sonarqube
labels:
app: sonarqube
chart: sonarqube-10.6.0_3033
release: sonarqube
heritage: Helm
data:
SONAR_JDBC_USERNAME: "sonarUser"
SONAR_JDBC_URL: "jdbc:postgresql://sonarqube-postgresql:5432/sonarDB"
---
# Source: sonarqube/charts/postgresql/templates/svc-headless.yaml
apiVersion: v1
kind: Service
metadata:
name: sonarqube-postgresql-headless
labels:
app.kubernetes.io/name: postgresql
helm.sh/chart: postgresql-10.15.0
app.kubernetes.io/instance: sonarqube
app.kubernetes.io/managed-by: Helm
# Use this annotation in addition to the actual publishNotReadyAddresses
# field below because the annotation will stop being respected soon but the
# field is broken in some versions of Kubernetes:
# https://github.com/kubernetes/kubernetes/issues/58662
service.alpha.kubernetes.io/tolerate-unready-endpoints: "true"
namespace: sonarqube
spec:
type: ClusterIP
clusterIP: None
# We want all pods in the StatefulSet to have their addresses published for
# the sake of the other Postgresql pods even before they're ready, since they
# have to be able to talk to each other in order to become ready.
publishNotReadyAddresses: true
ports:
- name: tcp-postgresql
port: 5432
targetPort: tcp-postgresql
selector:
app.kubernetes.io/name: postgresql
app.kubernetes.io/instance: sonarqube
---
# Source: sonarqube/charts/postgresql/templates/svc.yaml
apiVersion: v1
kind: Service
metadata:
name: sonarqube-postgresql
labels:
app.kubernetes.io/name: postgresql
helm.sh/chart: postgresql-10.15.0
app.kubernetes.io/instance: sonarqube
app.kubernetes.io/managed-by: Helm
annotations:
namespace: sonarqube
spec:
type: ClusterIP
ports:
- name: tcp-postgresql
port: 5432
targetPort: tcp-postgresql
selector:
app.kubernetes.io/name: postgresql
app.kubernetes.io/instance: sonarqube
role: primary
---
# Source: sonarqube/templates/service.yaml
apiVersion: v1
kind: Service
metadata:
name: sonarqube-sonarqube
namespace: sonarqube
labels:
app: sonarqube
chart: sonarqube-10.6.0_3033
release: sonarqube
heritage: Helm
spec:
type: ClusterIP
ports:
- port: 9000
targetPort: http
protocol: TCP
name: http
selector:
app: sonarqube
release: sonarqube
---
# Source: sonarqube/charts/postgresql/templates/statefulset.yaml
apiVersion: apps/v1
kind: StatefulSet
metadata:
name: sonarqube-postgresql
labels:
app.kubernetes.io/name: postgresql
helm.sh/chart: postgresql-10.15.0
app.kubernetes.io/instance: sonarqube
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/component: primary
annotations:
namespace: sonarqube
spec:
serviceName: sonarqube-postgresql-headless
replicas: 1
updateStrategy:
type: RollingUpdate
selector:
matchLabels:
app.kubernetes.io/name: postgresql
app.kubernetes.io/instance: sonarqube
role: primary
template:
metadata:
name: sonarqube-postgresql
labels:
app.kubernetes.io/name: postgresql
helm.sh/chart: postgresql-10.15.0
app.kubernetes.io/instance: sonarqube
app.kubernetes.io/managed-by: Helm
role: primary
app.kubernetes.io/component: primary
spec:
affinity:
podAffinity:
podAntiAffinity:
preferredDuringSchedulingIgnoredDuringExecution:
- podAffinityTerm:
labelSelector:
matchLabels:
app.kubernetes.io/name: postgresql
app.kubernetes.io/instance: sonarqube
app.kubernetes.io/component: primary
namespaces:
- "sonarqube"
topologyKey: kubernetes.io/hostname
weight: 1
nodeAffinity:
securityContext:
fsGroup: 1001
automountServiceAccountToken: false
containers:
- name: sonarqube-postgresql
image: reg.inje-private.com/nnd002/bitnami/postgresql:11.14.0-debian-10-r22
imagePullPolicy: "IfNotPresent"
resources:
limits:
cpu: 2
memory: 2Gi
requests:
cpu: 100m
memory: 200Mi
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
runAsNonRoot: true
runAsUser: 1001
seccompProfile:
type: RuntimeDefault
env:
- name: BITNAMI_DEBUG
value: "false"
- name: POSTGRESQL_PORT_NUMBER
value: "5432"
- name: POSTGRESQL_VOLUME_DIR
value: "/bitnami/postgresql"
- name: PGDATA
value: "/bitnami/postgresql/data"
- name: POSTGRES_POSTGRES_PASSWORD
valueFrom:
secretKeyRef:
name: sonarqube-postgresql
key: postgresql-postgres-password
- name: POSTGRES_USER
value: "sonarUser"
- name: POSTGRES_PASSWORD
valueFrom:
secretKeyRef:
name: sonarqube-postgresql
key: postgresql-password
- name: POSTGRES_DB
value: "sonarDB"
- name: POSTGRESQL_ENABLE_LDAP
value: "no"
- name: POSTGRESQL_ENABLE_TLS
value: "no"
- name: POSTGRESQL_LOG_HOSTNAME
value: "false"
- name: POSTGRESQL_LOG_CONNECTIONS
value: "false"
- name: POSTGRESQL_LOG_DISCONNECTIONS
value: "false"
- name: POSTGRESQL_PGAUDIT_LOG_CATALOG
value: "off"
- name: POSTGRESQL_CLIENT_MIN_MESSAGES
value: "error"
- name: POSTGRESQL_SHARED_PRELOAD_LIBRARIES
value: "pgaudit"
ports:
- name: tcp-postgresql
containerPort: 5432
livenessProbe:
exec:
command:
- /bin/sh
- -c
- exec pg_isready -U "sonarUser" -d "dbname=sonarDB" -h 127.0.0.1 -p 5432
initialDelaySeconds: 30
periodSeconds: 10
timeoutSeconds: 5
successThreshold: 1
failureThreshold: 6
readinessProbe:
exec:
command:
- /bin/sh
- -c
- -e
- |
exec pg_isready -U "sonarUser" -d "dbname=sonarDB" -h 127.0.0.1 -p 5432
[ -f /opt/bitnami/postgresql/tmp/.initialized ] || [ -f /bitnami/postgresql/.initialized ]
initialDelaySeconds: 5
periodSeconds: 10
timeoutSeconds: 5
successThreshold: 1
failureThreshold: 6
volumeMounts:
- name: dshm
mountPath: /dev/shm
- name: data
mountPath: /bitnami/postgresql
subPath:
volumes:
- name: dshm
emptyDir:
medium: Memory
volumeClaimTemplates:
- metadata:
name: data
spec:
accessModes:
- "ReadWriteOnce"
resources:
requests:
storage: "20Gi"
---
# Source: sonarqube/templates/sonarqube-sts.yaml
apiVersion: apps/v1
kind: StatefulSet
metadata:
name: sonarqube-sonarqube
namespace: sonarqube
labels:
app: sonarqube
chart: sonarqube-10.6.0_3033
release: sonarqube
heritage: Helm
app.kubernetes.io/name: sonarqube-sonarqube-sonarqube
app.kubernetes.io/instance: sonarqube
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/part-of: sonarqube
app.kubernetes.io/component: sonarqube-sonarqube
app.kubernetes.io/version: "10.6.0-community"
spec:
replicas: 1
revisionHistoryLimit: 10
serviceName: sonarqube-sonarqube
selector:
matchLabels:
app: sonarqube
release: sonarqube
template:
metadata:
annotations:
checksum/config: 2256323f7d9ffc8a4e18606aa35e18a28b05412806a19e4e6a15359f9b710ad0
checksum/init-fs: 915551fa9592e2d81312781f423a59e6ba0837510c2e1d996e899eecd057ee91
checksum/init-sysctl: 7aa0dd9441283780322cf0596f09a398219af7dd756fcead24179a08adcebc32
checksum/plugins: 14cc0e459ae2f5de6499309b22cfdbcc1452d9e0e4f01a0ea45a43793e95e550
checksum/secret: b433376554b78de7ccf285d4ffebc8759355e6916f285189ce33ba1eba4ba28a
labels:
app: sonarqube
release: sonarqube
spec:
automountServiceAccountToken: false
securityContext:
fsGroup: 0
initContainers:
- name: "wait-for-db"
image: reg.inje-private.com/nnd002/sonarqube:10.6.0-community
imagePullPolicy: IfNotPresent
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
runAsGroup: 0
runAsNonRoot: true
runAsUser: 1000
seccompProfile:
type: RuntimeDefault
command: ["/bin/bash", "-c"]
args: ['set -o pipefail;for i in {1..200};do (echo > /dev/tcp/sonarqube-postgresql/5432) && exit 0; sleep 2;done; exit 1']
- name: init-sysctl
image: reg.inje-private.com/nnd002/sonarqube:10.6.0-community
imagePullPolicy: IfNotPresent
securityContext:
privileged: true
runAsUser: 0
command: ["/bin/bash", "-e", "/tmp/scripts/init_sysctl.sh"]
volumeMounts:
- name: init-sysctl
mountPath: /tmp/scripts/
env:
- name: SONAR_WEB_CONTEXT
value: "/"
- name: SONAR_WEB_JAVAOPTS
value: ""
- name: SONAR_CE_JAVAOPTS
value: ""
containers:
- name: sonarqube
image: reg.inje-private.com/nnd002/sonarqube:10.6.0-community
imagePullPolicy: IfNotPresent
ports:
- name: http
containerPort: 9000
protocol: TCP
resources:
limits:
cpu: 800m
ephemeral-storage: 512000M
memory: 6144M
requests:
cpu: 400m
ephemeral-storage: 1536M
memory: 2048M
env:
- name: SONAR_HELM_CHART_VERSION
value: 10.6.0_3033
- name: SONAR_JDBC_PASSWORD
valueFrom:
secretKeyRef:
name: sonarqube-postgresql
key: postgresql-password
- name: SONAR_WEB_SYSTEMPASSCODE
valueFrom:
secretKeyRef:
name: sonarqube-sonarqube-monitoring-passcode
key: SONAR_WEB_SYSTEMPASSCODE
- name: SONAR_WEB_CONTEXT
value: "/"
- name: SONAR_WEB_JAVAOPTS
value: ""
- name: SONAR_CE_JAVAOPTS
value: ""
envFrom:
- configMapRef:
name: sonarqube-sonarqube-jdbc-config
livenessProbe:
exec:
command:
- sh
- -c
- |
wget --no-proxy --quiet -O /dev/null --timeout=1 --header="X-Sonar-Passcode: $SONAR_WEB_SYSTEMPASSCODE" "http://localhost:9000/api/system/liveness"
failureThreshold: 6
initialDelaySeconds: 60
periodSeconds: 30
timeoutSeconds: 1
readinessProbe:
exec:
command:
- sh
- -c
- |
#!/bin/bash
# A Sonarqube container is considered ready if the status is UP, DB_MIGRATION_NEEDED or DB_MIGRATION_RUNNING
# status about migration are added to prevent the node to be kill while sonarqube is upgrading the database.
if wget --no-proxy -qO- http://localhost:9000/api/system/status | grep -q -e '"status":"UP"' -e '"status":"DB_MIGRATION_NEEDED"' -e '"status":"DB_MIGRATION_RUNNING"'; then
exit 0
fi
exit 1
failureThreshold: 6
initialDelaySeconds: 60
periodSeconds: 30
timeoutSeconds: 1
startupProbe:
httpGet:
scheme: HTTP
path: /api/system/status
port: http
initialDelaySeconds: 30
periodSeconds: 10
failureThreshold: 24
timeoutSeconds: 1
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
runAsGroup: 0
runAsNonRoot: true
runAsUser: 1000
seccompProfile:
type: RuntimeDefault
volumeMounts:
- mountPath: /opt/sonarqube/data
name: sonarqube
subPath: data
- mountPath: /opt/sonarqube/temp
name: sonarqube
subPath: temp
- mountPath: /opt/sonarqube/logs
name: sonarqube
subPath: logs
- mountPath: /tmp
name: tmp-dir
serviceAccountName: default
volumes:
- name: init-sysctl
configMap:
name: sonarqube-sonarqube-init-sysctl
items:
- key: init_sysctl.sh
path: init_sysctl.sh
- name: init-fs
configMap:
name: sonarqube-sonarqube-init-fs
items:
- key: init_fs.sh
path: init_fs.sh
- name: sonarqube
persistentVolumeClaim:
claimName: sonarqube-sonarqube
- name : tmp-dir
emptyDir:
{}
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
labels:
app: sonarqube
chart: sonarqube-10.6.0_3033
release: sonarqube
name: sonarqube-sonarqube
namespace: sonarqube
spec:
accessModes:
- ReadWriteMany
storageClassName: sc-monitoring
resources:
requests:
storage: 20Gi
---
# Source: sonarqube/templates/tests/sonarqube-test.yaml
apiVersion: v1
kind: Pod
metadata:
name: "sonarqube-ui-test"
namespace: sonarqube
annotations:
"helm.sh/hook": test-success
labels:
app: sonarqube
chart: sonarqube-10.6.0_3033
release: sonarqube
heritage: Helm
spec:
automountServiceAccountToken: false
containers:
- name: sonarqube-ui-test
image: "reg.inje-private.com/nnd002/sonarqube:10.6.0-community"
imagePullPolicy: IfNotPresent
command: ['wget']
args: [
'--retry-connrefused',
'--waitretry=1',
'--timeout=5',
'-t',
'12',
'-qO-',
'sonarqube-sonarqube:9000/api/system/status'
]
resources:
limits:
cpu: 500m
ephemeral-storage: 1000M
memory: 200M
requests:
cpu: 500m
ephemeral-storage: 100M
memory: 200M
restartPolicy: Never

23
on-premise/cicd/sonarqube/ing.yaml Normal file
View File

@ -0,0 +1,23 @@
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: sonarqube-ingress
namespace: sonarqube
spec:
ingressClassName: nginx
rules:
- host: sonar.inje-private.com
http:
paths:
- backend:
service:
name: sonarqube-sonarqube
port:
name: http
path: /
pathType: Prefix
tls:
- hosts:
- "sonar.inje-private.com"
secretName: sonarqube-ssl

3366
on-premise/cicd/tekton/1_configure/init.yaml Normal file
View File

File diff suppressed because it is too large Load Diff

87
on-premise/cicd/tekton/3_apply/ValidatingWebhookConfiguration.yaml Normal file
View File

@ -0,0 +1,87 @@
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
labels:
app.kubernetes.io/component: webhook
app.kubernetes.io/instance: default
app.kubernetes.io/part-of: tekton-pipelines
pipeline.tekton.dev/release: v0.57.0
name: config.webhook.pipeline.tekton.dev
webhooks:
- admissionReviewVersions:
- v1
clientConfig:
service:
name: tekton-pipelines-webhook
namespace: tekton-pipelines
failurePolicy: Fail
name: config.webhook.pipeline.tekton.dev
objectSelector:
matchLabels:
app.kubernetes.io/part-of: tekton-pipelines
sideEffects: None
---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
labels:
app.kubernetes.io/component: webhook
app.kubernetes.io/instance: default
app.kubernetes.io/part-of: tekton-triggers
triggers.tekton.dev/release: v0.26.1
name: config.webhook.triggers.tekton.dev
webhooks:
- admissionReviewVersions:
- v1
clientConfig:
service:
name: tekton-triggers-webhook
namespace: tekton-pipelines
failurePolicy: Fail
name: config.webhook.triggers.tekton.dev
namespaceSelector:
matchExpressions:
- key: triggers.tekton.dev/release
operator: Exists
sideEffects: None
---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
labels:
app.kubernetes.io/component: webhook
app.kubernetes.io/instance: default
app.kubernetes.io/part-of: tekton-pipelines
pipeline.tekton.dev/release: v0.57.0
name: validation.webhook.pipeline.tekton.dev
webhooks:
- admissionReviewVersions:
- v1
clientConfig:
service:
name: tekton-pipelines-webhook
namespace: tekton-pipelines
failurePolicy: Fail
name: validation.webhook.pipeline.tekton.dev
sideEffects: None
---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
labels:
app.kubernetes.io/component: webhook
app.kubernetes.io/instance: default
app.kubernetes.io/part-of: tekton-triggers
triggers.tekton.dev/release: v0.26.1
name: validation.webhook.triggers.tekton.dev
webhooks:
- admissionReviewVersions:
- v1
clientConfig:
service:
name: tekton-triggers-webhook
namespace: tekton-pipelines
failurePolicy: Fail
name: validation.webhook.triggers.tekton.dev
sideEffects: None

1054
on-premise/cicd/tekton/3_apply/deploy.yaml Normal file
View File

File diff suppressed because it is too large Load Diff

119
on-premise/cicd/tekton/3_apply/extention.yaml Normal file
View File

@ -0,0 +1,119 @@
apiVersion: dashboard.tekton.dev/v1alpha1
kind: Extension
metadata:
name: cronjobs
spec:
apiVersion: batch/v1
displayname: k8s cronjobs
name: cronjobs
---
apiVersion: triggers.tekton.dev/v1alpha1
kind: ClusterInterceptor
metadata:
labels:
server/type: https
name: bitbucket
spec:
clientConfig:
service:
name: tekton-triggers-core-interceptors
namespace: tekton-pipelines
path: bitbucket
port: 8443
---
apiVersion: triggers.tekton.dev/v1alpha1
kind: ClusterInterceptor
metadata:
labels:
server/type: https
name: cel
spec:
clientConfig:
service:
name: tekton-triggers-core-interceptors
namespace: tekton-pipelines
path: cel
port: 8443
---
apiVersion: triggers.tekton.dev/v1alpha1
kind: ClusterInterceptor
metadata:
labels:
server/type: https
name: github
spec:
clientConfig:
service:
name: tekton-triggers-core-interceptors
namespace: tekton-pipelines
path: github
port: 8443
---
apiVersion: triggers.tekton.dev/v1alpha1
kind: ClusterInterceptor
metadata:
labels:
server/type: https
name: gitlab
spec:
clientConfig:
service:
name: tekton-triggers-core-interceptors
namespace: tekton-pipelines
path: gitlab
port: 8443
---
apiVersion: triggers.tekton.dev/v1alpha1
kind: ClusterInterceptor
metadata:
labels:
server/type: https
name: slack
spec:
clientConfig:
service:
name: tekton-triggers-core-interceptors
namespace: tekton-pipelines
path: slack
port: 8443
---
apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:
labels:
app.kubernetes.io/component: webhook
app.kubernetes.io/instance: default
app.kubernetes.io/part-of: tekton-pipelines
pipeline.tekton.dev/release: v0.57.0
name: webhook.pipeline.tekton.dev
webhooks:
- admissionReviewVersions:
- v1
clientConfig:
service:
name: tekton-pipelines-webhook
namespace: tekton-pipelines
failurePolicy: Fail
name: webhook.pipeline.tekton.dev
sideEffects: None
---
apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:
labels:
app.kubernetes.io/component: webhook
app.kubernetes.io/instance: default
app.kubernetes.io/part-of: tekton-triggers
triggers.tekton.dev/release: v0.26.1
name: webhook.triggers.tekton.dev
webhooks:
- admissionReviewVersions:
- v1
clientConfig:
service:
name: tekton-triggers-webhook
namespace: tekton-pipelines
failurePolicy: Fail
name: webhook.triggers.tekton.dev
sideEffects: None

25
on-premise/cicd/tekton/3_apply/ing.yaml Normal file
View File

@ -0,0 +1,25 @@
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: ing-tekton
namespace: tekton-pipelines
annotations:
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
spec:
ingressClassName: nginx
rules:
- host: tekton.inje-private.com # 사전 생성된 인증서의 도메인적용.
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: tekton-dashboard
port:
number: 9097
tls:
- hosts:
- "tekton.inje-private.com"
secretName: tekton-ssl

311
on-premise/main/harbor_2.9.1/1.init.yaml Normal file
View File

@ -0,0 +1,311 @@
apiVersion: v1
kind: Namespace
metadata:
labels:
kubernetes.io/metadata.name: harbor
name: harbor
spec:
finalizers:
- kubernetes
---
apiVersion: v1
kind: ConfigMap
metadata:
labels:
app: harbor
release: harbor
name: harbor-core
namespace: harbor
data:
_REDIS_URL_CORE: redis://harbor-redis:6379/0?idle_timeout_seconds=30
_REDIS_URL_REG: redis://harbor-redis:6379/2?idle_timeout_seconds=30
CHART_CACHE_DRIVER: redis
CONFIG_PATH: /etc/core/app.conf
CORE_LOCAL_URL: http://127.0.0.1:8080
CORE_URL: http://harbor-core:80
DATABASE_TYPE: postgresql
EXT_ENDPOINT: https://harbor.icurfer.com
HTTP_PROXY: ""
HTTPS_PROXY: ""
JOBSERVICE_URL: http://harbor-jobservice
LOG_LEVEL: info
NO_PROXY: harbor-core,harbor-jobservice,harbor-database,harbor-registry,harbor-portal,harbor-trivy,harbor-exporter,127.0.0.1,localhost,.local,.internal
PERMITTED_REGISTRY_TYPES_FOR_PROXY_CACHE: docker-hub,harbor,azure-acr,aws-ecr,google-gcr,quay,docker-registry,github-ghcr,jfrog-artifactory
PORT: "8080"
PORTAL_URL: http://harbor-portal
POSTGRESQL_DATABASE: registry
POSTGRESQL_HOST: harbor-database
POSTGRESQL_MAX_IDLE_CONNS: "100"
POSTGRESQL_MAX_OPEN_CONNS: "900"
POSTGRESQL_PORT: "5432"
POSTGRESQL_SSLMODE: disable
POSTGRESQL_USERNAME: postgres
QUOTA_UPDATE_PROVIDER: db
REGISTRY_CONTROLLER_URL: http://harbor-registry:8080
REGISTRY_CREDENTIAL_USERNAME: harbor_registry_user
REGISTRY_STORAGE_PROVIDER_NAME: filesystem
REGISTRY_URL: http://harbor-registry:5000
TOKEN_SERVICE_URL: http://harbor-core:80/service/token
TRIVY_ADAPTER_URL: http://harbor-trivy:8080
WITH_TRIVY: "true"
app.conf: |
appname = Harbor
runmode = prod
enablegzip = true
[prod]
httpport = 8080
---
apiVersion: v1
kind: ConfigMap
metadata:
labels:
app: harbor
release: harbor
name: harbor-jobservice
namespace: harbor
data:
config.yml: |
#Server listening port
protocol: "http"
port: 8080
worker_pool:
workers: 10
backend: "redis"
redis_pool:
redis_url: "redis://harbor-redis:6379/1"
namespace: "harbor_job_service_namespace"
idle_timeout_second: 3600
job_loggers:
- name: "FILE"
level: INFO
settings: # Customized settings of logger
base_dir: "/var/log/jobs"
sweeper:
duration: 14 #days
settings: # Customized settings of sweeper
work_dir: "/var/log/jobs"
metric:
enabled: false
path: /metrics
port: 8001
#Loggers for the job service
loggers:
- name: "STD_OUTPUT"
level: INFO
reaper:
# the max time to wait for a task to finish, if unfinished after max_update_hours, the task will be mark as error, but the task will continue to run, default value is 24
max_update_hours: 24
# the max time for execution in running state without new task created
max_dangling_hours: 168
---
apiVersion: v1
kind: ConfigMap
metadata:
labels:
app: harbor
release: harbor
name: harbor-jobservice-env
namespace: harbor
data:
CORE_URL: http://harbor-core:80
HTTP_PROXY: ""
HTTPS_PROXY: ""
JOBSERVICE_WEBHOOK_JOB_HTTP_CLIENT_TIMEOUT: "3"
JOBSERVICE_WEBHOOK_JOB_MAX_RETRY: "3"
NO_PROXY: harbor-core,harbor-jobservice,harbor-database,harbor-registry,harbor-portal,harbor-trivy,harbor-exporter,127.0.0.1,localhost,.local,.internal
REGISTRY_CONTROLLER_URL: http://harbor-registry:8080
REGISTRY_CREDENTIAL_USERNAME: harbor_registry_user
REGISTRY_URL: http://harbor-registry:5000
TOKEN_SERVICE_URL: http://harbor-core:80/service/token
---
apiVersion: v1
kind: ConfigMap
metadata:
labels:
app: harbor
release: harbor
name: harbor-portal
namespace: harbor
data:
nginx.conf: |
worker_processes auto;
pid /tmp/nginx.pid;
events {
worker_connections 1024;
}
http {
client_body_temp_path /tmp/client_body_temp;
proxy_temp_path /tmp/proxy_temp;
fastcgi_temp_path /tmp/fastcgi_temp;
uwsgi_temp_path /tmp/uwsgi_temp;
scgi_temp_path /tmp/scgi_temp;
server {
listen 8080;
listen [::]:8080;
server_name localhost;
root /usr/share/nginx/html;
index index.html index.htm;
include /etc/nginx/mime.types;
gzip on;
gzip_min_length 1000;
gzip_proxied expired no-cache no-store private auth;
gzip_types text/plain text/css application/json application/javascript application/x-javascript text/xml application/xml application/xml+rss text/javascript;
location /devcenter-api-2.0 {
try_files $uri $uri/ /swagger-ui-index.html;
}
location / {
try_files $uri $uri/ /index.html;
}
location = /index.html {
add_header Cache-Control "no-store, no-cache, must-revalidate";
}
}
}
---
apiVersion: v1
kind: ConfigMap
metadata:
labels:
app: harbor
release: harbor
name: harbor-registry
namespace: harbor
data:
config.yml: |
version: 0.1
log:
level: info
fields:
service: registry
storage:
filesystem:
rootdirectory: /storage
cache:
layerinfo: redis
maintenance:
uploadpurging:
enabled: true
age: 168h
interval: 24h
dryrun: false
delete:
enabled: true
redirect:
disable: false
redis:
addr: harbor-redis:6379
db: 2
readtimeout: 10s
writetimeout: 10s
dialtimeout: 10s
pool:
maxidle: 100
maxactive: 500
idletimeout: 60s
http:
addr: :5000
#relativeurls: false
relativeurls: true
# set via environment variable
# secret: placeholder
debug:
addr: localhost:5001
auth:
htpasswd:
realm: harbor-registry-basic-realm
path: /etc/registry/passwd
validation:
disabled: true
compatibility:
schema1:
enabled: true
ctl-config.yml: |
---
protocol: "http"
port: 8080
log_level: info
registry_config: "/etc/registry/config.yml"
---
apiVersion: v1
kind: ConfigMap
metadata:
labels:
app: harbor
release: harbor
name: harbor-registryctl
namespace: harbor
---
apiVersion: v1
kind: Secret
metadata:
labels:
app: harbor
release: harbor
name: harbor-database
namespace: harbor
type: Opaque
data:
POSTGRES_PASSWORD: UmxheG9kbXM5MCFA
---
apiVersion: v1
kind: Secret
metadata:
labels:
app: harbor
release: harbor
name: harbor-jobservice
namespace: harbor
type: Opaque
data:
JOBSERVICE_SECRET: akVWbzlyNFJaU2R1clJqUA==
REGISTRY_CREDENTIAL_PASSWORD: aGFyYm9yX3JlZ2lzdHJ5X3Bhc3N3b3Jk
---
apiVersion: v1
data:
REGISTRY_HTTP_SECRET: dHlCdm41MXpIakxLRm5mRw==
REGISTRY_REDIS_PASSWORD: ""
kind: Secret
metadata:
labels:
app: harbor
release: harbor
name: harbor-registry
namespace: harbor
type: Opaque
---
apiVersion: v1
data:
REGISTRY_HTPASSWD: aGFyYm9yX3JlZ2lzdHJ5X3VzZXI6JDJhJDEwJG1uRkVSQkVyRmROYnNuZDVHWUxTQXVUOTRaUWxZNGkxU3BtNTk4dWlmV2pLbEJrQnJhbHEu
kind: Secret
metadata:
labels:
app: harbor
release: harbor
name: harbor-registry-htpasswd
namespace: harbor
type: Opaque
---
apiVersion: v1
data: null
kind: Secret
metadata:
labels:
app: harbor
release: harbor
name: harbor-registryctl
namespace: harbor
type: Opaque
---
apiVersion: v1
data:
gitHubToken: ""
redisURL: cmVkaXM6Ly9oYXJib3ItcmVkaXM6NjM3OS81P2lkbGVfdGltZW91dF9zZWNvbmRzPTMw
kind: Secret
metadata:
labels:
app: harbor
release: harbor
name: harbor-trivy
namespace: harbor
type: Opaque

27
on-premise/main/harbor_2.9.1/2.cert.yaml Normal file
View File

@ -0,0 +1,27 @@
apiVersion: v1
kind: Secret
metadata:
name: harbor-cacerts
namespace: harbor
data:
cert: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUU5RENDQTl5Z0F3SUJBZ0lTQktsUkF1R24rM2N1R2xKS1o5aVY4Vmx4TUEwR0NTcUdTSWIzRFFFQkN3VUEKTURJeEN6QUpCZ05WQkFZVEFsVlRNUll3RkFZRFZRUUtFdzFNWlhRbmN5QkZibU55ZVhCME1Rc3dDUVlEVlFRRApFd0pTTXpBZUZ3MHlOREF6TURJeE5EQTVOVFZhRncweU5EQTFNekV4TkRBNU5UUmFNQmd4RmpBVUJnTlZCQU1NCkRTb3VhV04xY21abGNpNWpiMjB3Z2dFaU1BMEdDU3FHU0liM0RRRUJBUVVBQTRJQkR3QXdnZ0VLQW9JQkFRQ3oKQWVxVS9KSkJGWWJpeFQwbTRKTXU3QW5CdTVYRUFVSUhHendsR3ZjdjJXRTBxajNwU1JCeUdJWEo0eHdycnl3eAprYjgrRkxTSjh4U3Q2TXpwZjVxNTBQMm9PYklFdkMwY0drNHZuZThGVm1YckNKckNMaUtld0JBRWhFcC9IUjdYClVFSFRLVFpXTE5oUkIzNjMxZFkrcHhHU1AxeWNMblBXYkJQOUVSa2xzeUhoUnJpWHBxTmZDcGVIM3kxb3VJOUwKV3l5Yks3SUdmSkVzN1g0TE1OZ2RycEZtUzlCdTNZQ0JVMExZMlZtWVFJNVFaNkNhbisrQk51bVN6U0M4ZVRUaApJamY0Uk14R2JIUFNDYjBXb3hxM3M4RmZmQVd1a2JOSmhXSTlidXNucWxNTnRrQnREdFYxdVpaQUlLMno0cnFCCmlJbDlaS0lza3FEQUJaMWFSb0JkQWdNQkFBR2pnZ0ljTUlJQ0dEQU9CZ05WSFE4QkFmOEVCQU1DQmFBd0hRWUQKVlIwbEJCWXdGQVlJS3dZQkJRVUhBd0VHQ0NzR0FRVUZCd01DTUF3R0ExVWRFd0VCL3dRQ01BQXdIUVlEVlIwTwpCQllFRk51b3p0ZmprQ25FRGFxd01zVlBwdU5CaU5YaU1COEdBMVVkSXdRWU1CYUFGQlF1c3hlM1dGYkxybEFKClFPWWZyNTJMRk1MR01GVUdDQ3NHQVFVRkJ3RUJCRWt3UnpBaEJnZ3JCZ0VGQlFjd0FZWVZhSFIwY0RvdkwzSXoKTG04dWJHVnVZM0l1YjNKbk1DSUdDQ3NHQVFVRkJ6QUNoaFpvZEhSd09pOHZjak11YVM1c1pXNWpjaTV2Y21jdgpNQ1VHQTFVZEVRUWVNQnlDRFNvdWFXTjFjbVpsY2k1amIyMkNDMmxqZFhKbVpYSXVZMjl0TUJNR0ExVWRJQVFNCk1Bb3dDQVlHWjRFTUFRSUJNSUlCQkFZS0t3WUJCQUhXZVFJRUFnU0I5UVNCOGdEd0FIVUFPMU4zZFQ0dHVZQk8KaXpCYkJ2NUFPMmZZVDhQMHg3MEFEUzF5YitINjFCY0FBQUdOLzdidTJ3QUFCQU1BUmpCRUFpQkdEcW5xZytIcwpQUmVmYTc5TXdVZjlmUzFOYWh3SEsrRlJrVlg4REE2QUN3SWdPN2NsOU1IcC9hVVFSbkhZNFlRU01lMG5WbHhUCkpBY0RuY2syUkJQMFhBUUFkd0R1emRCazFkc2F6c1ZjdDUyMHpST2lNb2RHZkx6czNzTlJTRmxHY1IrMW13QUEKQVkzL3R1N0tBQUFFQXdCSU1FWUNJUUNTWTlxczV0ZFY2ejR5c01acG9yOXZXcmhsVXlScFNINVJIVGRQZGdlWQpsd0loQUpvblNHeVJOYmVNcEs3SW5uYVJxOVFuajB3R1hhWnVNMnZXTmlUYWFLTzBNQTBHQ1NxR1NJYjNEUUVCCkN3VUFBNElCQVFCMmlWcEttN0IxZ3p0a01Ud2QrQXBNOWh4SzkwYndWSTZxUnZLNmpsZVFJV0JCZG84Z3I0QlEKTlpPNDBWa21OaFhoY3ljQ1ZsSmlhT3JLd1J0c1VhMzVmc29BVTFCQzlodFRPT3R4TXYvb2lDZlA4aEZQNGttagpOTVFzNVZ2eFR6cmRjbWxhRmJaOWJkNVF2dko3L2hadTBnZ1ZrSUZVRXVZcWtQNFFzSHU1dXhOd01rWUY3RGUxCnVsVGY1YlFQcTJ0TEk5cTk1OUNsM2xMTTJqYklkM2h1bkRrMDFLZ2dSOWNkUmEzZnEzM2VZNkY2eWNWSVBPblMKdGhXck9melc5K2IrSFNDWHkyd3BJR0VTUTVJQU95cUdibnBBR1Z6U294UnVrNW1Wd0FqeDBaMW94eUdPRVprTgpEQUhHa21aNThIOUJpcXJ0VzBuaEMyKzN0cCtmR2kydwotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tQkVHSU4gQ0VSVElGSUNBVEUtLS0tLQpNSUlGRmpDQ0F2NmdBd0lCQWdJUkFKRXJDRXJQREJpblUvYldMaVduWDFvd0RRWUpLb1pJaHZjTkFRRUxCUUF3ClR6RUxNQWtHQTFVRUJoTUNWVk14S1RBbkJnTlZCQW9USUVsdWRHVnlibVYwSUZObFkzVnlhWFI1SUZKbGMyVmgKY21Ob0lFZHliM1Z3TVJVd0V3WURWUVFERXd4SlUxSkhJRkp2YjNRZ1dERXdIaGNOTWpBd09UQTBNREF3TURBdwpXaGNOTWpVd09URTFNVFl3TURBd1dqQXlNUXN3Q1FZRFZRUUdFd0pWVXpFV01CUUdBMVVFQ2hNTlRHVjBKM01nClJXNWpjbmx3ZERFTE1Ba0dBMVVFQXhNQ1VqTXdnZ0VpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElCRHdBd2dnRUsKQW9JQkFRQzdBaFVvelBhZ2xOTVBFdXlOVlpMRCtJTHhtYVo2UW9pblhTYXF0U3U1eFV5eHI0NXIrWFhJbzljUApSNVFVVlRWWGpKNm9vamtaOVlJOFFxbE9idlU3d3k3YmpjQ3dYUE5aT09mdHoybndXZ3NidnNDVUpDV0gramR4CnN4UG5IS3pobSsvYjVEdEZVa1dXcWNGVHpqVElVdTYxcnUyUDNtQnc0cVZVcTdadERwZWxRRFJySzlPOFp1dG0KTkh6NmE0dVBWeW1aK0RBWFhicHliL3VCeGEzU2hsZzlGOGZuQ2J2eEsvZUczTUhhY1YzVVJ1UE1yU1hCaUx4ZwpaM1Ztcy9FWTk2SmM1bFAvT29pMlI2WC9FeGpxbUFsM1A1MVQrYzhCNWZXbWNCY1VyMk9rLzVtems1M2NVNmNHCi9raUZIYUZwcmlWMXV4UE1VZ1AxN1ZHaGk5c1ZBZ01CQUFHamdnRUlNSUlCQkRBT0JnTlZIUThCQWY4RUJBTUMKQVlZd0hRWURWUjBsQkJZd0ZBWUlLd1lCQlFVSEF3SUdDQ3NHQVFVRkJ3TUJNQklHQTFVZEV3RUIvd1FJTUFZQgpBZjhDQVFBd0hRWURWUjBPQkJZRUZCUXVzeGUzV0ZiTHJsQUpRT1lmcjUyTEZNTEdNQjhHQTFVZEl3UVlNQmFBCkZIbTBXZVo3dHVYa0FYT0FDSWpJR2xqMjZadHVNRElHQ0NzR0FRVUZCd0VCQkNZd0pEQWlCZ2dyQmdFRkJRY3cKQW9ZV2FIUjBjRG92TDNneExta3ViR1Z1WTNJdWIzSm5MekFuQmdOVkhSOEVJREFlTUJ5Z0dxQVloaFpvZEhSdwpPaTh2ZURFdVl5NXNaVzVqY2k1dmNtY3ZNQ0lHQTFVZElBUWJNQmt3Q0FZR1o0RU1BUUlCTUEwR0N5c0dBUVFCCmd0OFRBUUVCTUEwR0NTcUdTSWIzRFFFQkN3VUFBNElDQVFDRnlrNUhQcVAzaFVTRnZOVm5lTEtZWTYxMVRSNlcKUFRObGNsUXRnYURxdyszNElMOWZ6TGR3QUxkdU8vWmVsTjdrSUorbTc0dXlBK2VpdFJZOGtjNjA3VGtDNTN3bAppa2ZtWlc0L1J2VFo4TTZVSys1VXpoSzhqQ2RMdU1HWUw2S3Z6WEdSU2dpM3lMZ2pld1F0Q1BrSVZ6NkQyUVF6CkNrY2hlQW1DSjhNcXlKdTV6bHp5Wk1qQXZubkFUNDV0UkF4ZWtyc3U5NHNRNGVnZFJDbmJXU0R0WTdraCtCSW0KbEpOWG9CMWxCTUVLSXE0UURVT1hvUmdmZnVEZ2hqZTFXckc5TUwrSGJpc3EveUZPR3dYRDlSaVg4RjZzdzZXNAphdkF1dkRzenVlNUwzc3o4NUsrRUM0WS93RlZETnZabzRUWVhhbzZaMGYrbFFLYzB0OERRWXprMU9YVnU4cnAyCnlKTUM2YWxMYkJmT0RBTFp2WUg3bjdkbzFBWmxzNEk5ZDFQNGpua0RyUW94QjNVcVE5aFZsM0xFS1E3M3hGMU8KeUs1R2hERFg4b1ZmR0tGNXUrZGVjSXNINFlhVHc3bVAzR0Z4SlNxdjMrMGxVRkpvaTVMYzVkYTE0OXA5MElkcwpoQ0V4cm9MMSs3bXJ5SWtYUGVGTTVUZ085cjBydlphQkZPdlYyejBncDM1WjArTDRXUGxidUVqTi9seFBGaW4rCkhsVWpyOGdSc0kzcWZKT1FGeS85cktJSlIwWS84T213dC84b1RXZ3kxbWRlSG1tams3ajFuWXN2QzlKU1E2WnYKTWxkbFRUS0IzemhUaFYxK1hXWXA2cmpkNUpXMXpiVldFa0xOeEU3R0pUaEVVRzNzemdCVkdQN3BTV1RVVHNxWApuTFJid0hPb3E3aEh3Zz09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
---
apiVersion: v1
kind: Secret
metadata:
labels:
app: harbor
release: harbor
name: harbor-core
namespace: harbor
type: Opaque
data:
CSRF_KEY: Tk9ORjNTYjZoZ2tIdlZmcXNlcTVEdjNhUlBjWDZ6Rjg=
HARBOR_ADMIN_PASSWORD: UmxheG9kbXM5MCFA
POSTGRESQL_PASSWORD: UmxheG9kbXM5MCFA
REGISTRY_CREDENTIAL_PASSWORD: aGFyYm9yX3JlZ2lzdHJ5X3Bhc3N3b3Jk
secret: RTRQY0FxZ3RPVmdKWTBRRw==
secretKey: bm90LWEtc2VjdXJlLWtleQ==
tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUU5RENDQTl5Z0F3SUJBZ0lTQktsUkF1R24rM2N1R2xKS1o5aVY4Vmx4TUEwR0NTcUdTSWIzRFFFQkN3VUEKTURJeEN6QUpCZ05WQkFZVEFsVlRNUll3RkFZRFZRUUtFdzFNWlhRbmN5QkZibU55ZVhCME1Rc3dDUVlEVlFRRApFd0pTTXpBZUZ3MHlOREF6TURJeE5EQTVOVFZhRncweU5EQTFNekV4TkRBNU5UUmFNQmd4RmpBVUJnTlZCQU1NCkRTb3VhV04xY21abGNpNWpiMjB3Z2dFaU1BMEdDU3FHU0liM0RRRUJBUVVBQTRJQkR3QXdnZ0VLQW9JQkFRQ3oKQWVxVS9KSkJGWWJpeFQwbTRKTXU3QW5CdTVYRUFVSUhHendsR3ZjdjJXRTBxajNwU1JCeUdJWEo0eHdycnl3eAprYjgrRkxTSjh4U3Q2TXpwZjVxNTBQMm9PYklFdkMwY0drNHZuZThGVm1YckNKckNMaUtld0JBRWhFcC9IUjdYClVFSFRLVFpXTE5oUkIzNjMxZFkrcHhHU1AxeWNMblBXYkJQOUVSa2xzeUhoUnJpWHBxTmZDcGVIM3kxb3VJOUwKV3l5Yks3SUdmSkVzN1g0TE1OZ2RycEZtUzlCdTNZQ0JVMExZMlZtWVFJNVFaNkNhbisrQk51bVN6U0M4ZVRUaApJamY0Uk14R2JIUFNDYjBXb3hxM3M4RmZmQVd1a2JOSmhXSTlidXNucWxNTnRrQnREdFYxdVpaQUlLMno0cnFCCmlJbDlaS0lza3FEQUJaMWFSb0JkQWdNQkFBR2pnZ0ljTUlJQ0dEQU9CZ05WSFE4QkFmOEVCQU1DQmFBd0hRWUQKVlIwbEJCWXdGQVlJS3dZQkJRVUhBd0VHQ0NzR0FRVUZCd01DTUF3R0ExVWRFd0VCL3dRQ01BQXdIUVlEVlIwTwpCQllFRk51b3p0ZmprQ25FRGFxd01zVlBwdU5CaU5YaU1COEdBMVVkSXdRWU1CYUFGQlF1c3hlM1dGYkxybEFKClFPWWZyNTJMRk1MR01GVUdDQ3NHQVFVRkJ3RUJCRWt3UnpBaEJnZ3JCZ0VGQlFjd0FZWVZhSFIwY0RvdkwzSXoKTG04dWJHVnVZM0l1YjNKbk1DSUdDQ3NHQVFVRkJ6QUNoaFpvZEhSd09pOHZjak11YVM1c1pXNWpjaTV2Y21jdgpNQ1VHQTFVZEVRUWVNQnlDRFNvdWFXTjFjbVpsY2k1amIyMkNDMmxqZFhKbVpYSXVZMjl0TUJNR0ExVWRJQVFNCk1Bb3dDQVlHWjRFTUFRSUJNSUlCQkFZS0t3WUJCQUhXZVFJRUFnU0I5UVNCOGdEd0FIVUFPMU4zZFQ0dHVZQk8KaXpCYkJ2NUFPMmZZVDhQMHg3MEFEUzF5YitINjFCY0FBQUdOLzdidTJ3QUFCQU1BUmpCRUFpQkdEcW5xZytIcwpQUmVmYTc5TXdVZjlmUzFOYWh3SEsrRlJrVlg4REE2QUN3SWdPN2NsOU1IcC9hVVFSbkhZNFlRU01lMG5WbHhUCkpBY0RuY2syUkJQMFhBUUFkd0R1emRCazFkc2F6c1ZjdDUyMHpST2lNb2RHZkx6czNzTlJTRmxHY1IrMW13QUEKQVkzL3R1N0tBQUFFQXdCSU1FWUNJUUNTWTlxczV0ZFY2ejR5c01acG9yOXZXcmhsVXlScFNINVJIVGRQZGdlWQpsd0loQUpvblNHeVJOYmVNcEs3SW5uYVJxOVFuajB3R1hhWnVNMnZXTmlUYWFLTzBNQTBHQ1NxR1NJYjNEUUVCCkN3VUFBNElCQVFCMmlWcEttN0IxZ3p0a01Ud2QrQXBNOWh4SzkwYndWSTZxUnZLNmpsZVFJV0JCZG84Z3I0QlEKTlpPNDBWa21OaFhoY3ljQ1ZsSmlhT3JLd1J0c1VhMzVmc29BVTFCQzlodFRPT3R4TXYvb2lDZlA4aEZQNGttagpOTVFzNVZ2eFR6cmRjbWxhRmJaOWJkNVF2dko3L2hadTBnZ1ZrSUZVRXVZcWtQNFFzSHU1dXhOd01rWUY3RGUxCnVsVGY1YlFQcTJ0TEk5cTk1OUNsM2xMTTJqYklkM2h1bkRrMDFLZ2dSOWNkUmEzZnEzM2VZNkY2eWNWSVBPblMKdGhXck9melc5K2IrSFNDWHkyd3BJR0VTUTVJQU95cUdibnBBR1Z6U294UnVrNW1Wd0FqeDBaMW94eUdPRVprTgpEQUhHa21aNThIOUJpcXJ0VzBuaEMyKzN0cCtmR2kydwotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0t
tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2Z0lCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktnd2dnU2tBZ0VBQW9JQkFRQ3pBZXFVL0pKQkZZYmkKeFQwbTRKTXU3QW5CdTVYRUFVSUhHendsR3ZjdjJXRTBxajNwU1JCeUdJWEo0eHdycnl3eGtiOCtGTFNKOHhTdAo2TXpwZjVxNTBQMm9PYklFdkMwY0drNHZuZThGVm1YckNKckNMaUtld0JBRWhFcC9IUjdYVUVIVEtUWldMTmhSCkIzNjMxZFkrcHhHU1AxeWNMblBXYkJQOUVSa2xzeUhoUnJpWHBxTmZDcGVIM3kxb3VJOUxXeXliSzdJR2ZKRXMKN1g0TE1OZ2RycEZtUzlCdTNZQ0JVMExZMlZtWVFJNVFaNkNhbisrQk51bVN6U0M4ZVRUaElqZjRSTXhHYkhQUwpDYjBXb3hxM3M4RmZmQVd1a2JOSmhXSTlidXNucWxNTnRrQnREdFYxdVpaQUlLMno0cnFCaUlsOVpLSXNrcURBCkJaMWFSb0JkQWdNQkFBRUNnZ0VBQmdGVTNvOG82VHlManN6VVMvQ0JsNGtpY2FpZjhnTDRkVmNTcEl4YjlGNW0KbmxidUVVY0ZkczBVK0pjaElUa0tSK3ZEcytyZ3ZLRUE2d0w4bEMwVzk5QUhvUmxnWnJ3WkI2WG43MmZYdG9EZwphMEJadXIvRCtHU1Q2bEdLMDBBRmw4TzdsWlhVR3I0bk9wNnEvN0ttM09sZ3ZrY3R1RUtacnhJOG9HM1pWTFJOCmJMTUpLMFhMdGRSZDFIUWg4ZHNycDNldndYSUwzS3dnOEpDV2xEb2FPc0tCbUdxQU5LRTY4MDVNbm5uZWk5RlEKZ01lTFRxdmJzUkRJWFdpdDM4WEZLdmRBSUhnVTB3clh1djhXUXplYitjdnd0MFlRUEpyU0lraFFHUG10TlFQUgpHYWh3cGhlNXBVRUZranlxTXQxcHB2QmZTeFhWaU0zM3hlaEdZOTNtd1FLQmdRQzJWbjJPNWlmdUJUQVVqeDVyCkxoRTdGMWpnZGdZTWJRZUFjNDdUZkdXNjA1VGNlRk5TeDdBYk9tUHduR01xUWRiT0M4dEUzZXR3MURsV1hyRjcKL3NlRmxtVmduNWRWdGQxRWNoVUUvVVlxejIweldjSGpSN1lDbktmdDRIZmM3YWVmWGZZOG50TGVDUENtQVpsVgpycTVjSFUvOENLc3RwNmdHbVdFV0I0S25IUUtCZ1FEN1V2ODBxUzd6TDBsTFNWVTEycDMrUTl6NDU3MHgybmhOCmgvS3pnWnJpZ1FXMHRLdnlpRkdndHZ6V1BGMncvOUdDVDgyRHN2R2FMSURsa2o1VUpGalczUUQzWmxERFk5dEcKYU5zTEdwSkt4UDZwaEFwSUlMSjdYUXI2QXNWVm5yZXNSRGxZMU1LQXhFZGMxUHFNUk1sWEdpdzl3amdLQXA4UQpNZ2RYTlR1NlFRS0JnSDZmQzJ4YnlpalJjM1VqZWlWR0JYTTZvRjZudDBXVHhWemZZclRjc3l5TlY5Zk91MVpHCkU3YWswdGc1VWVmN2RyYjVtN3dFUEViTEtkSWZ5akxvV0JnZHUrTGdrTkJWamdYRkQzRzZqS3FZQnlaYzAzY0kKeW8xL3ltSTN1aVV5NkcrVWFiWHBPVmcxYnlCcEJkbHBoKzJ4OFdSOWhKb2N6bU5leWZ2cFZVTEZBb0dCQU1rZwpSNG4rSnN1SXVSQWQ5S292ZFNiSmFtcHJFaloyVHJaRktJNU5Gd1ZUR1p6ZXhZaEhYWVBQVFJHcHA1VUJkTW5qClVXV202OEJsQXhZMWJkbnFhSW95dlJZLzlEd1ppcDZUUlZCaWlGWjd4ZzBrMVJHWjBSdjJmdFZMS0Y3M3NLZVUKeFl2NFlGdXFPQzNyWjBLZnZiME4vZi9Da1JRNXVzKzhLYkc1c1QzQkFvR0JBSms2VmJvK3BtSE5ab0E2cDY5MApCY2lJRFJ3ZUJXQmZ2dmJ3ek8xbiswcE9IdEF1N1ZCS3ZmSGZ1bkhjMGNkdjdTdks0RjN3NW03blJBR3cxOXFnCjFreG5PZWFlazFGMG1aZWZaNGlqajVUSWtxTnlwQldkMEZYdHk5SUwwSEhMemxQU3VDb2pRVUJ3cG5PMTJ5cTYKMC92RFA0U1p3K2hWb3JORnZzMzhDVmZjCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0=
---

822
on-premise/main/harbor_2.9.1/3.harbor.yaml Normal file
View File

@ -0,0 +1,822 @@
apiVersion: v1
kind: Service
metadata:
labels:
app: harbor
release: harbor
name: harbor-core
namespace: harbor
spec:
ports:
- name: http-web
port: 80
targetPort: 8080
selector:
app: harbor
component: core
release: harbor
---
apiVersion: v1
kind: Service
metadata:
labels:
app: harbor
release: harbor
name: harbor-database
namespace: harbor
spec:
ports:
- port: 5432
selector:
app: harbor
component: database
release: harbor
---
apiVersion: v1
kind: Service
metadata:
labels:
app: harbor
release: harbor
name: harbor-jobservice
namespace: harbor
spec:
ports:
- name: http-jobservice
port: 80
targetPort: 8080
selector:
app: harbor
component: jobservice
release: harbor
---
apiVersion: v1
kind: Service
metadata:
labels:
app: harbor
release: harbor
name: harbor-portal
namespace: harbor
spec:
ports:
- port: 80
targetPort: 8080
selector:
app: harbor
component: portal
release: harbor
---
apiVersion: v1
kind: Service
metadata:
labels:
app: harbor
release: harbor
name: harbor-redis
namespace: harbor
spec:
ports:
- port: 6379
selector:
app: harbor
component: redis
release: harbor
---
apiVersion: v1
kind: Service
metadata:
labels:
app: harbor
release: harbor
name: harbor-registry
namespace: harbor
spec:
ports:
- name: http-registry
port: 5000
- name: http-controller
port: 8080
selector:
app: harbor
component: registry
release: harbor
---
apiVersion: v1
kind: Service
metadata:
labels:
app: harbor
release: harbor
name: harbor-trivy
namespace: harbor
spec:
ports:
- name: http-trivy
port: 8080
protocol: TCP
selector:
app: harbor
component: trivy
release: harbor
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
labels:
app: harbor
component: jobservice
release: harbor
name: harbor-jobservice
namespace: harbor
spec:
accessModes:
- ReadWriteMany
resources:
requests:
storage: 10Gi
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
labels:
app: harbor
component: registry
release: harbor
name: harbor-registry
namespace: harbor
spec:
accessModes:
- ReadWriteMany
resources:
requests:
storage: 50Gi
---
apiVersion: apps/v1
kind: Deployment
metadata:
labels:
app: harbor
component: core
release: harbor
name: harbor-core
namespace: harbor
spec:
replicas: 1
revisionHistoryLimit: 10
selector:
matchLabels:
app: harbor
component: core
release: harbor
template:
metadata:
labels:
app: harbor
component: core
release: harbor
spec:
automountServiceAccountToken: false
containers:
- env:
- name: CORE_SECRET
valueFrom:
secretKeyRef:
key: secret
name: harbor-core
- name: JOBSERVICE_SECRET
valueFrom:
secretKeyRef:
key: JOBSERVICE_SECRET
name: harbor-jobservice
envFrom:
- configMapRef:
name: harbor-core
- secretRef:
name: harbor-core
image: goharbor/harbor-core:v2.9.1
imagePullPolicy: IfNotPresent
livenessProbe:
failureThreshold: 2
httpGet:
path: /api/v2.0/ping
port: 8080
scheme: HTTP
periodSeconds: 10
name: core
ports:
- containerPort: 8080
readinessProbe:
failureThreshold: 2
httpGet:
path: /api/v2.0/ping
port: 8080
scheme: HTTP
periodSeconds: 10
startupProbe:
failureThreshold: 360
httpGet:
path: /api/v2.0/ping
port: 8080
scheme: HTTP
initialDelaySeconds: 10
periodSeconds: 10
volumeMounts:
- mountPath: /etc/core/app.conf
name: config
subPath: app.conf
- mountPath: /etc/core/key
name: secret-key
subPath: key
- mountPath: /etc/core/private_key.pem
name: token-service-private-key
subPath: tls.key
- mountPath: /etc/core/ca
name: ca-download
- mountPath: /etc/core/token
name: psc
securityContext:
fsGroup: 10000
runAsUser: 10000
terminationGracePeriodSeconds: 120
volumes:
- configMap:
items:
- key: app.conf
path: app.conf
name: harbor-core
name: config
- name: secret-key
secret:
items:
- key: secretKey
path: key
secretName: harbor-core
- name: token-service-private-key
secret:
secretName: harbor-core
- name: ca-download
secret:
secretName: harbor-cacerts
- emptyDir: {}
name: psc
---
apiVersion: apps/v1
kind: Deployment
metadata:
labels:
app: harbor
component: jobservice
release: harbor
name: harbor-jobservice
namespace: harbor
spec:
replicas: 1
revisionHistoryLimit: 10
selector:
matchLabels:
app: harbor
component: jobservice
release: harbor
strategy:
type: RollingUpdate
template:
metadata:
labels:
app: harbor
component: jobservice
release: harbor
spec:
automountServiceAccountToken: false
containers:
- env:
- name: CORE_SECRET
valueFrom:
secretKeyRef:
key: secret
name: harbor-core
envFrom:
- configMapRef:
name: harbor-jobservice-env
- secretRef:
name: harbor-jobservice
image: goharbor/harbor-jobservice:v2.9.1
imagePullPolicy: IfNotPresent
livenessProbe:
httpGet:
path: /api/v1/stats
port: 8080
scheme: HTTP
initialDelaySeconds: 300
periodSeconds: 10
name: jobservice
ports:
- containerPort: 8080
readinessProbe:
httpGet:
path: /api/v1/stats
port: 8080
scheme: HTTP
initialDelaySeconds: 20
periodSeconds: 10
volumeMounts:
- mountPath: /etc/jobservice/config.yml
name: jobservice-config
subPath: config.yml
- mountPath: /var/log/jobs
name: job-logs
subPath: null
securityContext:
fsGroup: 10000
runAsUser: 10000
terminationGracePeriodSeconds: 120
volumes:
- configMap:
name: harbor-jobservice
name: jobservice-config
- name: job-logs
persistentVolumeClaim:
claimName: harbor-jobservice
---
apiVersion: apps/v1
kind: Deployment
metadata:
labels:
app: harbor
component: portal
release: harbor
name: harbor-portal
namespace: harbor
spec:
replicas: 1
revisionHistoryLimit: 10
selector:
matchLabels:
app: harbor
component: portal
release: harbor
template:
metadata:
labels:
app: harbor
component: portal
release: harbor
spec:
automountServiceAccountToken: false
containers:
- image: goharbor/harbor-portal:v2.9.1
imagePullPolicy: IfNotPresent
livenessProbe:
httpGet:
path: /
port: 8080
scheme: HTTP
initialDelaySeconds: 300
periodSeconds: 10
name: portal
ports:
- containerPort: 8080
readinessProbe:
httpGet:
path: /
port: 8080
scheme: HTTP
initialDelaySeconds: 1
periodSeconds: 10
volumeMounts:
- mountPath: /etc/nginx/nginx.conf
name: portal-config
subPath: nginx.conf
securityContext:
fsGroup: 10000
runAsUser: 10000
volumes:
- configMap:
name: harbor-portal
name: portal-config
---
apiVersion: apps/v1
kind: Deployment
metadata:
labels:
app: harbor
component: registry
release: harbor
name: harbor-registry
namespace: harbor
spec:
replicas: 1
revisionHistoryLimit: 10
selector:
matchLabels:
app: harbor
component: registry
release: harbor
strategy:
type: RollingUpdate
template:
metadata:
labels:
app: harbor
component: registry
release: harbor
spec:
automountServiceAccountToken: false
containers:
- args:
- serve
- /etc/registry/config.yml
env: null
envFrom:
- secretRef:
name: harbor-registry
image: goharbor/registry-photon:v2.9.1
imagePullPolicy: IfNotPresent
livenessProbe:
httpGet:
path: /
port: 5000
scheme: HTTP
initialDelaySeconds: 300
periodSeconds: 10
name: registry
ports:
- containerPort: 5000
- containerPort: 5001
readinessProbe:
httpGet:
path: /
port: 5000
scheme: HTTP
initialDelaySeconds: 1
periodSeconds: 10
volumeMounts:
- mountPath: /storage
name: registry-data
subPath: null
- mountPath: /etc/registry/passwd
name: registry-htpasswd
subPath: passwd
- mountPath: /etc/registry/config.yml
name: registry-config
subPath: config.yml
- env:
- name: CORE_SECRET
valueFrom:
secretKeyRef:
key: secret
name: harbor-core
- name: JOBSERVICE_SECRET
valueFrom:
secretKeyRef:
key: JOBSERVICE_SECRET
name: harbor-jobservice
envFrom:
- configMapRef:
name: harbor-registryctl
- secretRef:
name: harbor-registry
- secretRef:
name: harbor-registryctl
image: goharbor/harbor-registryctl:v2.9.1
imagePullPolicy: IfNotPresent
livenessProbe:
httpGet:
path: /api/health
port: 8080
scheme: HTTP
initialDelaySeconds: 300
periodSeconds: 10
name: registryctl
ports:
- containerPort: 8080
readinessProbe:
httpGet:
path: /api/health
port: 8080
scheme: HTTP
initialDelaySeconds: 1
periodSeconds: 10
volumeMounts:
- mountPath: /storage
name: registry-data
subPath: null
- mountPath: /etc/registry/config.yml
name: registry-config
subPath: config.yml
- mountPath: /etc/registryctl/config.yml
name: registry-config
subPath: ctl-config.yml
securityContext:
fsGroup: 10000
fsGroupChangePolicy: OnRootMismatch
runAsUser: 10000
terminationGracePeriodSeconds: 120
volumes:
- name: registry-htpasswd
secret:
items:
- key: REGISTRY_HTPASSWD
path: passwd
secretName: harbor-registry-htpasswd
- configMap:
name: harbor-registry
name: registry-config
- name: registry-data
persistentVolumeClaim:
claimName: harbor-registry
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
labels:
app: harbor
component: database
release: harbor
name: harbor-database
namespace: harbor
spec:
replicas: 1
selector:
matchLabels:
app: harbor
component: database
release: harbor
serviceName: harbor-database
template:
metadata:
labels:
app: harbor
component: database
release: harbor
spec:
automountServiceAccountToken: false
containers:
- env:
- name: PGDATA
value: /var/lib/postgresql/data/pgdata
envFrom:
- secretRef:
name: harbor-database
image: goharbor/harbor-db:v2.9.1
imagePullPolicy: IfNotPresent
livenessProbe:
exec:
command:
- /docker-healthcheck.sh
initialDelaySeconds: 300
periodSeconds: 10
timeoutSeconds: 1
name: database
readinessProbe:
exec:
command:
- /docker-healthcheck.sh
initialDelaySeconds: 1
periodSeconds: 10
timeoutSeconds: 1
volumeMounts:
- mountPath: /var/lib/postgresql/data
name: database-data
- mountPath: /dev/shm
name: shm-volume
initContainers:
- args:
- -c
- '[ -e /var/lib/postgresql/data/postgresql.conf ] && [ ! -d /var/lib/postgresql/data/pgdata
] && mkdir -m 0700 /var/lib/postgresql/data/pgdata && mv /var/lib/postgresql/data/*
/var/lib/postgresql/data/pgdata/ || true'
command:
- /bin/sh
image: goharbor/harbor-db:v2.9.1
imagePullPolicy: IfNotPresent
name: data-migrator
volumeMounts:
- mountPath: /var/lib/postgresql/data
name: database-data
- args:
- -c
- chmod -R 700 /var/lib/postgresql/data/pgdata || true
command:
- /bin/sh
image: goharbor/harbor-db:v2.9.1
imagePullPolicy: IfNotPresent
name: data-permissions-ensurer
volumeMounts:
- mountPath: /var/lib/postgresql/data
name: database-data
securityContext:
fsGroup: 999
runAsUser: 999
terminationGracePeriodSeconds: 120
volumes:
- emptyDir:
medium: Memory
sizeLimit: 512Mi
name: shm-volume
volumeClaimTemplates:
- metadata:
annotations: null
labels:
app: harbor
release: harbor
name: database-data
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 10Gi
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
labels:
app: harbor
component: redis
release: harbor
name: harbor-redis
namespace: harbor
spec:
replicas: 1
selector:
matchLabels:
app: harbor
component: redis
release: harbor
serviceName: harbor-redis
template:
metadata:
labels:
app: harbor
component: redis
release: harbor
spec:
automountServiceAccountToken: false
containers:
- image: goharbor/redis-photon:v2.9.1
imagePullPolicy: IfNotPresent
livenessProbe:
initialDelaySeconds: 300
periodSeconds: 10
tcpSocket:
port: 6379
name: redis
readinessProbe:
initialDelaySeconds: 1
periodSeconds: 10
tcpSocket:
port: 6379
volumeMounts:
- mountPath: /var/lib/redis
name: data
securityContext:
fsGroup: 999
runAsUser: 999
terminationGracePeriodSeconds: 120
volumeClaimTemplates:
- metadata:
annotations: null
labels:
app: harbor
release: harbor
name: data
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 10Gi
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
labels:
app: harbor
component: trivy
release: harbor
name: harbor-trivy
namespace: harbor
spec:
replicas: 1
selector:
matchLabels:
app: harbor
component: trivy
release: harbor
serviceName: harbor-trivy
template:
metadata:
labels:
app: harbor
component: trivy
release: harbor
spec:
automountServiceAccountToken: false
containers:
- env:
- name: HTTP_PROXY
value: ""
- name: HTTPS_PROXY
value: ""
- name: NO_PROXY
value: harbor-core,harbor-jobservice,harbor-database,harbor-registry,harbor-portal,harbor-trivy,harbor-exporter,127.0.0.1,localhost,.local,.internal
- name: SCANNER_LOG_LEVEL
value: info
- name: SCANNER_TRIVY_CACHE_DIR
value: /home/scanner/.cache/trivy
- name: SCANNER_TRIVY_REPORTS_DIR
value: /home/scanner/.cache/reports
- name: SCANNER_TRIVY_DEBUG_MODE
value: "false"
- name: SCANNER_TRIVY_VULN_TYPE
value: os,library
- name: SCANNER_TRIVY_TIMEOUT
value: 5m0s
- name: SCANNER_TRIVY_GITHUB_TOKEN
valueFrom:
secretKeyRef:
key: gitHubToken
name: harbor-trivy
- name: SCANNER_TRIVY_SEVERITY
value: UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL
- name: SCANNER_TRIVY_IGNORE_UNFIXED
value: "false"
- name: SCANNER_TRIVY_SKIP_UPDATE
value: "false"
- name: SCANNER_TRIVY_OFFLINE_SCAN
value: "false"
- name: SCANNER_TRIVY_SECURITY_CHECKS
value: vuln
- name: SCANNER_TRIVY_INSECURE
value: "false"
- name: SCANNER_API_SERVER_ADDR
value: :8080
- name: SCANNER_REDIS_URL
valueFrom:
secretKeyRef:
key: redisURL
name: harbor-trivy
- name: SCANNER_STORE_REDIS_URL
valueFrom:
secretKeyRef:
key: redisURL
name: harbor-trivy
- name: SCANNER_JOB_QUEUE_REDIS_URL
valueFrom:
secretKeyRef:
key: redisURL
name: harbor-trivy
image: goharbor/trivy-adapter-photon:v2.9.1
imagePullPolicy: IfNotPresent
livenessProbe:
failureThreshold: 10
httpGet:
path: /probe/healthy
port: api-server
scheme: HTTP
initialDelaySeconds: 5
periodSeconds: 10
successThreshold: 1
name: trivy
ports:
- containerPort: 8080
name: api-server
readinessProbe:
failureThreshold: 3
httpGet:
path: /probe/ready
port: api-server
scheme: HTTP
initialDelaySeconds: 5
periodSeconds: 10
successThreshold: 1
resources:
limits:
cpu: 1
memory: 1Gi
requests:
cpu: 200m
memory: 512Mi
securityContext:
allowPrivilegeEscalation: false
privileged: false
volumeMounts:
- mountPath: /home/scanner/.cache
name: data
readOnly: false
securityContext:
fsGroup: 10000
runAsUser: 10000
volumeClaimTemplates:
- metadata:
labels:
app: harbor
release: harbor
name: data
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 50Gi

64
on-premise/main/harbor_2.9.1/4.ing-harbor.yaml Normal file
View File

@ -0,0 +1,64 @@
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
annotations:
ingress.kubernetes.io/proxy-body-size: "0"
nginx.ingress.kubernetes.io/proxy-body-size: "0"
#nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
labels:
app: harbor
release: harbor
name: harbor-ingress
namespace: harbor
spec:
ingressClassName: nginx
#tls:
#- hosts:
# - "harbor.icurfer.com"
# secretName: secret-harbor-ssl
rules:
- host: harbor.icurfer.com
http:
paths:
- backend:
service:
name: harbor-core
port:
number: 80
path: /api/
pathType: Prefix
- backend:
service:
name: harbor-core
port:
number: 80
path: /service/
pathType: Prefix
- backend:
service:
name: harbor-core
port:
number: 80
path: /v2/
pathType: Prefix
- backend:
service:
name: harbor-core
port:
number: 80
path: /chartrepo/
pathType: Prefix
- backend:
service:
name: harbor-core
port:
number: 80
path: /c/
pathType: Prefix
- backend:
service:
name: harbor-portal
port:
number: 80
path: /
pathType: Prefix

12
on-premise/main/harbor_2.9.1/pv-delete.py Normal file
View File

@ -0,0 +1,12 @@
#!/usr/bin/python3
import os
import subprocess
pv_str = os.popen("kubectl get -n default pv | grep harbor | awk '$1 > 0 {print $1}'").read()
print(pv_str)
pv_list = pv_str.split('\n')
i = 0
for pv in pv_list:
print(pv)
# os.system(f"kubectl delete -n {ns} pv {pv}")
os.system(f"kubectl delete pv {pv}")

0
on-premise/nfs-provisioner/1.configuration/init_add_ns.yaml → on-premise/main/nfs-provisioner/1.configuration/init_add_ns.yaml
View File

0
on-premise/nfs-provisioner/3.deploy/\ → on-premise/main/nfs-provisioner/3.deploy/\
View File

0
on-premise/nfs-provisioner/3.deploy/sample-deploy.yaml → on-premise/main/nfs-provisioner/3.deploy/sample-deploy.yaml
View File

0
on-premise/nfs-provisioner/4.postSettings/sc-hm.yaml → on-premise/main/nfs-provisioner/4.postSettings/sc-hm.yaml
View File

0
on-premise/nfs-provisioner/4.postSettings/sc-vm.yaml → on-premise/main/nfs-provisioner/4.postSettings/sc-vm.yaml
View File