apiVersion: v1
kind: Service
metadata:
  labels:
    app: harbor
    release: harbor
  name: harbor-core
  namespace: harbor
spec:
  ports:
  - name: http-web
    port: 80
    targetPort: 8080
  selector:
    app: harbor
    component: core
    release: harbor
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app: harbor
    release: harbor
  name: harbor-database
  namespace: harbor
spec:
  ports:
  - port: 5432
  selector:
    app: harbor
    component: database
    release: harbor
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app: harbor
    release: harbor
  name: harbor-jobservice
  namespace: harbor
spec:
  ports:
  - name: http-jobservice
    port: 80
    targetPort: 8080
  selector:
    app: harbor
    component: jobservice
    release: harbor
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app: harbor
    release: harbor
  name: harbor-portal
  namespace: harbor
spec:
  ports:
  - port: 80
    targetPort: 8080
  selector:
    app: harbor
    component: portal
    release: harbor
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app: harbor
    release: harbor
  name: harbor-redis
  namespace: harbor
spec:
  ports:
  - port: 6379
  selector:
    app: harbor
    component: redis
    release: harbor
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app: harbor
    release: harbor
  name: harbor-registry
  namespace: harbor
spec:
  ports:
  - name: http-registry
    port: 5000
  - name: http-controller
    port: 8080
  selector:
    app: harbor
    component: registry
    release: harbor
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app: harbor
    release: harbor
  name: harbor-trivy
  namespace: harbor
spec:
  ports:
  - name: http-trivy
    port: 8080
    protocol: TCP
  selector:
    app: harbor
    component: trivy
    release: harbor
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  labels:
    app: harbor
    component: jobservice
    release: harbor
  name: harbor-jobservice
  namespace: harbor
spec:
  accessModes:
  - ReadWriteMany
  storageClassName: sc-monitoring
  resources:
    requests:
      storage: 10Gi
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  labels:
    app: harbor
    component: registry
    release: harbor
  name: harbor-registry
  namespace: harbor
spec:
  storageClassName: sc-monitoring
  accessModes:
  - ReadWriteMany
  resources:
    requests:
      storage: 50Gi
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: harbor
    component: core
    release: harbor
  name: harbor-core
  namespace: harbor
spec:
  replicas: 1
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      app: harbor
      component: core
      release: harbor
  template:
    metadata:
      labels:
        app: harbor
        component: core
        release: harbor
    spec:
      automountServiceAccountToken: false
      containers:
      - env:
        - name: CORE_SECRET
          valueFrom:
            secretKeyRef:
              key: secret
              name: harbor-core
        - name: JOBSERVICE_SECRET
          valueFrom:
            secretKeyRef:
              key: JOBSERVICE_SECRET
              name: harbor-jobservice
        envFrom:
        - configMapRef:
            name: harbor-core
        - secretRef:
            name: harbor-core
        image: reg.inje-private.com/nnd002/goharbor/harbor-core:v2.9.1
        imagePullPolicy: IfNotPresent
        livenessProbe:
          failureThreshold: 2
          httpGet:
            path: /api/v2.0/ping
            port: 8080
            scheme: HTTP
          periodSeconds: 10
        name: core
        ports:
        - containerPort: 8080
        readinessProbe:
          failureThreshold: 2
          httpGet:
            path: /api/v2.0/ping
            port: 8080
            scheme: HTTP
          periodSeconds: 10
        startupProbe:
          failureThreshold: 360
          httpGet:
            path: /api/v2.0/ping
            port: 8080
            scheme: HTTP
          initialDelaySeconds: 10
          periodSeconds: 10
        volumeMounts:
        - mountPath: /etc/core/app.conf
          name: config
          subPath: app.conf
        - mountPath: /etc/core/key
          name: secret-key
          subPath: key
        - mountPath: /etc/core/private_key.pem
          name: token-service-private-key
          subPath: tls.key
        - mountPath: /etc/core/ca
          name: ca-download
        - mountPath: /etc/core/token
          name: psc
      securityContext:
        fsGroup: 10000
        runAsUser: 10000
      terminationGracePeriodSeconds: 120
      volumes:
      - configMap:
          items:
          - key: app.conf
            path: app.conf
          name: harbor-core
        name: config
      - name: secret-key
        secret:
          items:
          - key: secretKey
            path: key
          secretName: harbor-core
      - name: token-service-private-key
        secret:
          secretName: harbor-core
      - name: ca-download
        secret:
          secretName: harbor-cacerts
      - emptyDir: {}
        name: psc
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: harbor
    component: jobservice
    release: harbor
  name: harbor-jobservice
  namespace: harbor
spec:
  replicas: 1
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      app: harbor
      component: jobservice
      release: harbor
  strategy:
    type: RollingUpdate
  template:
    metadata:
      labels:
        app: harbor
        component: jobservice
        release: harbor
    spec:
      automountServiceAccountToken: false
      containers:
      - env:
        - name: CORE_SECRET
          valueFrom:
            secretKeyRef:
              key: secret
              name: harbor-core
        envFrom:
        - configMapRef:
            name: harbor-jobservice-env
        - secretRef:
            name: harbor-jobservice
        image: reg.inje-private.com/nnd002/goharbor/harbor-jobservice:v2.9.1
        imagePullPolicy: IfNotPresent
        livenessProbe:
          httpGet:
            path: /api/v1/stats
            port: 8080
            scheme: HTTP
          initialDelaySeconds: 300
          periodSeconds: 10
        name: jobservice
        ports:
        - containerPort: 8080
        readinessProbe:
          httpGet:
            path: /api/v1/stats
            port: 8080
            scheme: HTTP
          initialDelaySeconds: 20
          periodSeconds: 10
        volumeMounts:
        - mountPath: /etc/jobservice/config.yml
          name: jobservice-config
          subPath: config.yml
        - mountPath: /var/log/jobs
          name: job-logs
          subPath: null
      securityContext:
        fsGroup: 10000
        runAsUser: 10000
      terminationGracePeriodSeconds: 120
      volumes:
      - configMap:
          name: harbor-jobservice
        name: jobservice-config
      - name: job-logs
        persistentVolumeClaim:
          claimName: harbor-jobservice
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: harbor
    component: portal
    release: harbor
  name: harbor-portal
  namespace: harbor
spec:
  replicas: 1
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      app: harbor
      component: portal
      release: harbor
  template:
    metadata:
      labels:
        app: harbor
        component: portal
        release: harbor
    spec:
      automountServiceAccountToken: false
      containers:
      - image: reg.inje-private.com/nnd002/goharbor/harbor-portal:v2.9.1
        imagePullPolicy: IfNotPresent
        livenessProbe:
          httpGet:
            path: /
            port: 8080
            scheme: HTTP
          initialDelaySeconds: 300
          periodSeconds: 10
        name: portal
        ports:
        - containerPort: 8080
        readinessProbe:
          httpGet:
            path: /
            port: 8080
            scheme: HTTP
          initialDelaySeconds: 1
          periodSeconds: 10
        volumeMounts:
        - mountPath: /etc/nginx/nginx.conf
          name: portal-config
          subPath: nginx.conf
      securityContext:
        fsGroup: 10000
        runAsUser: 10000
      volumes:
      - configMap:
          name: harbor-portal
        name: portal-config
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: harbor
    component: registry
    release: harbor
  name: harbor-registry
  namespace: harbor
spec:
  replicas: 1
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      app: harbor
      component: registry
      release: harbor
  strategy:
    type: RollingUpdate
  template:
    metadata:
      labels:
        app: harbor
        component: registry
        release: harbor
    spec:
      automountServiceAccountToken: false
      containers:
      - args:
        - serve
        - /etc/registry/config.yml
        env: null
        envFrom:
        - secretRef:
            name: harbor-registry
        image: reg.inje-private.com/nnd002/goharbor/registry-photon:v2.9.1
        imagePullPolicy: IfNotPresent
        livenessProbe:
          httpGet:
            path: /
            port: 5000
            scheme: HTTP
          initialDelaySeconds: 300
          periodSeconds: 10
        name: registry
        ports:
        - containerPort: 5000
        - containerPort: 5001
        readinessProbe:
          httpGet:
            path: /
            port: 5000
            scheme: HTTP
          initialDelaySeconds: 1
          periodSeconds: 10
        volumeMounts:
        - mountPath: /storage
          name: registry-data
          subPath: null
        - mountPath: /etc/registry/passwd
          name: registry-htpasswd
          subPath: passwd
        - mountPath: /etc/registry/config.yml
          name: registry-config
          subPath: config.yml
      - env:
        - name: CORE_SECRET
          valueFrom:
            secretKeyRef:
              key: secret
              name: harbor-core
        - name: JOBSERVICE_SECRET
          valueFrom:
            secretKeyRef:
              key: JOBSERVICE_SECRET
              name: harbor-jobservice
        envFrom:
        - configMapRef:
            name: harbor-registryctl
        - secretRef:
            name: harbor-registry
        - secretRef:
            name: harbor-registryctl
        image: reg.inje-private.com/nnd002/goharbor/harbor-registryctl:v2.9.1
        imagePullPolicy: IfNotPresent
        livenessProbe:
          httpGet:
            path: /api/health
            port: 8080
            scheme: HTTP
          initialDelaySeconds: 300
          periodSeconds: 10
        name: registryctl
        ports:
        - containerPort: 8080
        readinessProbe:
          httpGet:
            path: /api/health
            port: 8080
            scheme: HTTP
          initialDelaySeconds: 1
          periodSeconds: 10
        volumeMounts:
        - mountPath: /storage
          name: registry-data
          subPath: null
        - mountPath: /etc/registry/config.yml
          name: registry-config
          subPath: config.yml
        - mountPath: /etc/registryctl/config.yml
          name: registry-config
          subPath: ctl-config.yml
      securityContext:
        fsGroup: 10000
        fsGroupChangePolicy: OnRootMismatch
        runAsUser: 10000
      terminationGracePeriodSeconds: 120
      volumes:
      - name: registry-htpasswd
        secret:
          items:
          - key: REGISTRY_HTPASSWD
            path: passwd
          secretName: harbor-registry-htpasswd
      - configMap:
          name: harbor-registry
        name: registry-config
      - name: registry-data
        persistentVolumeClaim:
          claimName: harbor-registry
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
  labels:
    app: harbor
    component: database
    release: harbor
  name: harbor-database
  namespace: harbor
spec:
  replicas: 1
  selector:
    matchLabels:
      app: harbor
      component: database
      release: harbor
  serviceName: harbor-database
  template:
    metadata:
      labels:
        app: harbor
        component: database
        release: harbor
    spec:
      automountServiceAccountToken: false
      containers:
      - env:
        - name: PGDATA
          value: /var/lib/postgresql/data/pgdata
        envFrom:
        - secretRef:
            name: harbor-database
        image: reg.inje-private.com/nnd002/goharbor/harbor-db:v2.9.1
        imagePullPolicy: IfNotPresent
        livenessProbe:
          exec:
            command:
            - /docker-healthcheck.sh
          initialDelaySeconds: 300
          periodSeconds: 10
          timeoutSeconds: 1
        name: database
        readinessProbe:
          exec:
            command:
            - /docker-healthcheck.sh
          initialDelaySeconds: 1
          periodSeconds: 10
          timeoutSeconds: 1
        volumeMounts:
        - mountPath: /var/lib/postgresql/data
          name: database-data
        - mountPath: /dev/shm
          name: shm-volume
      initContainers:
      - args:
        - -c
        - '[ -e /var/lib/postgresql/data/postgresql.conf ] && [ ! -d /var/lib/postgresql/data/pgdata
          ] && mkdir -m 0700 /var/lib/postgresql/data/pgdata && mv /var/lib/postgresql/data/*
          /var/lib/postgresql/data/pgdata/ || true'
        command:
        - /bin/sh
        image: reg.inje-private.com/nnd002/goharbor/harbor-db:v2.9.1
        imagePullPolicy: IfNotPresent
        name: data-migrator
        volumeMounts:
        - mountPath: /var/lib/postgresql/data
          name: database-data
      - args:
        - -c
        - chmod -R 700 /var/lib/postgresql/data/pgdata || true
        command:
        - /bin/sh
        image: reg.inje-private.com/nnd002/goharbor/harbor-db:v2.9.1
        imagePullPolicy: IfNotPresent
        name: data-permissions-ensurer
        volumeMounts:
        - mountPath: /var/lib/postgresql/data
          name: database-data
      securityContext:
        fsGroup: 999
        runAsUser: 999
      terminationGracePeriodSeconds: 120
      volumes:
      - emptyDir:
          medium: Memory
          sizeLimit: 512Mi
        name: shm-volume
  volumeClaimTemplates:
  - metadata:
      annotations: null
      labels:
        app: harbor
        release: harbor
      name: database-data
    spec:
      accessModes:
      - ReadWriteOnce
      resources:
        requests:
          storage: 10Gi
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
  labels:
    app: harbor
    component: redis
    release: harbor
  name: harbor-redis
  namespace: harbor
spec:
  replicas: 1
  selector:
    matchLabels:
      app: harbor
      component: redis
      release: harbor
  serviceName: harbor-redis
  template:
    metadata:
      labels:
        app: harbor
        component: redis
        release: harbor
    spec:
      automountServiceAccountToken: false
      containers:
      - image: reg.inje-private.com/nnd002/goharbor/redis-photon:v2.9.1
        imagePullPolicy: IfNotPresent
        livenessProbe:
          initialDelaySeconds: 300
          periodSeconds: 10
          tcpSocket:
            port: 6379
        name: redis
        readinessProbe:
          initialDelaySeconds: 1
          periodSeconds: 10
          tcpSocket:
            port: 6379
        volumeMounts:
        - mountPath: /var/lib/redis
          name: data
      securityContext:
        fsGroup: 999
        runAsUser: 999
      terminationGracePeriodSeconds: 120
  volumeClaimTemplates:
  - metadata:
      annotations: null
      labels:
        app: harbor
        release: harbor
      name: data
    spec:
      accessModes:
      - ReadWriteOnce
      resources:
        requests:
          storage: 10Gi
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
  labels:
    app: harbor
    component: trivy
    release: harbor
  name: harbor-trivy
  namespace: harbor
spec:
  replicas: 1
  selector:
    matchLabels:
      app: harbor
      component: trivy
      release: harbor
  serviceName: harbor-trivy
  template:
    metadata:
      labels:
        app: harbor
        component: trivy
        release: harbor
    spec:
      automountServiceAccountToken: false
      containers:
      - env:
        - name: HTTP_PROXY
          value: ""
        - name: HTTPS_PROXY
          value: ""
        - name: NO_PROXY
          value: harbor-core,harbor-jobservice,harbor-database,harbor-registry,harbor-portal,harbor-trivy,harbor-exporter,127.0.0.1,localhost,.local,.internal
        - name: SCANNER_LOG_LEVEL
          value: info
        - name: SCANNER_TRIVY_CACHE_DIR
          value: /home/scanner/.cache/trivy
        - name: SCANNER_TRIVY_REPORTS_DIR
          value: /home/scanner/.cache/reports
        - name: SCANNER_TRIVY_DEBUG_MODE
          value: "false"
        - name: SCANNER_TRIVY_VULN_TYPE
          value: os,library
        - name: SCANNER_TRIVY_TIMEOUT
          value: 5m0s
        - name: SCANNER_TRIVY_GITHUB_TOKEN
          valueFrom:
            secretKeyRef:
              key: gitHubToken
              name: harbor-trivy
        - name: SCANNER_TRIVY_SEVERITY
          value: UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL
        - name: SCANNER_TRIVY_IGNORE_UNFIXED
          value: "false"
        - name: SCANNER_TRIVY_SKIP_UPDATE
          value: "false"
        - name: SCANNER_TRIVY_OFFLINE_SCAN
          value: "false"
        - name: SCANNER_TRIVY_SECURITY_CHECKS
          value: vuln
        - name: SCANNER_TRIVY_INSECURE
          value: "false"
        - name: SCANNER_API_SERVER_ADDR
          value: :8080
        - name: SCANNER_REDIS_URL
          valueFrom:
            secretKeyRef:
              key: redisURL
              name: harbor-trivy
        - name: SCANNER_STORE_REDIS_URL
          valueFrom:
            secretKeyRef:
              key: redisURL
              name: harbor-trivy
        - name: SCANNER_JOB_QUEUE_REDIS_URL
          valueFrom:
            secretKeyRef:
              key: redisURL
              name: harbor-trivy
        image: reg.inje-private.com/nnd002/goharbor/trivy-adapter-photon:v2.9.1
        imagePullPolicy: IfNotPresent
        livenessProbe:
          failureThreshold: 10
          httpGet:
            path: /probe/healthy
            port: api-server
            scheme: HTTP
          initialDelaySeconds: 5
          periodSeconds: 10
          successThreshold: 1
        name: trivy
        ports:
        - containerPort: 8080
          name: api-server
        readinessProbe:
          failureThreshold: 3
          httpGet:
            path: /probe/ready
            port: api-server
            scheme: HTTP
          initialDelaySeconds: 5
          periodSeconds: 10
          successThreshold: 1
        resources:
          limits:
            cpu: 1
            memory: 1Gi
          requests:
            cpu: 200m
            memory: 512Mi
        securityContext:
          allowPrivilegeEscalation: false
          privileged: false
        volumeMounts:
        - mountPath: /home/scanner/.cache
          name: data
          readOnly: false
      securityContext:
        fsGroup: 10000
        runAsUser: 10000
  volumeClaimTemplates:
  - metadata:
      labels:
        app: harbor
        release: harbor
      name: data
    spec:
      accessModes:
      - ReadWriteOnce
      resources:
        requests:
          storage: 50Gi