SREWorks云原生数智运维平台

# Helm Chart for Harbor **Notes:** The master branch is in heavy development, please use the other stable versions instead. A high available solution for Harbor based on chart can be find [here](docs/High%20Availability.md). And refer to the [guide](docs/Upgrade.md) to upgrade the existing deployment. This repository, including the issues, focus on deploying Harbor chart via helm. So for the functionality issues or questions of Harbor, please open issues on [goharbor/harbor](https://github.com/goharbor/harbor) ## Introduction This [Helm](https://github.com/kubernetes/helm) chart installs [Harbor](https://github.com/goharbor/harbor) in a Kubernetes cluster. Welcome to [contribute](CONTRIBUTING.md) to Helm Chart for Harbor. ## Prerequisites - Kubernetes cluster 1.18+ - Helm 2.10.0+ ## Installation ### Add Helm repository ```bash helm repo add harbor https://helm.goharbor.io ``` ### Configure the chart The following items can be set via `--set` flag during installation or configured by editing the `values.yaml` directly(need to download the chart first). #### Configure the way how to expose Harbor service - **Ingress**: The ingress controller must be installed in the Kubernetes cluster. **Notes:** if the TLS is disabled, the port must be included in the command when pulling/pushing images. Refer to issue [#5291](https://github.com/goharbor/harbor/issues/5291) for the detail. - **ClusterIP**: Exposes the service on a cluster-internal IP. Choosing this value makes the service only reachable from within the cluster. - **NodePort**: Exposes the service on each Node’s IP at a static port (the NodePort). You’ll be able to contact the NodePort service, from outside the cluster, by requesting `NodeIP:NodePort`. - **LoadBalancer**: Exposes the service externally using a cloud provider’s load balancer. #### Configure the external URL The external URL for Harbor core service is used to: 1. populate the docker/helm commands showed on portal 2. populate the token service URL returned to docker/notary client Format: `protocol://domain[:port]`. Usually: - if expose the service via `Ingress`, the `domain` should be the value of `expose.ingress.hosts.core` - if expose the service via `ClusterIP`, the `domain` should be the value of `expose.clusterIP.name` - if expose the service via `NodePort`, the `domain` should be the IP address of one Kubernetes node - if expose the service via `LoadBalancer`, set the `domain` as your own domain name and add a CNAME record to map the domain name to the one you got from the cloud provider If Harbor is deployed behind the proxy, set it as the URL of proxy. #### Configure the way how to persistent data - **Disable**: The data does not survive the termination of a pod. - **Persistent Volume Claim(default)**: A default `StorageClass` is needed in the Kubernetes cluster to dynamic provision the volumes. Specify another StorageClass in the `storageClass` or set `existingClaim` if you have already existing persistent volumes to use. - **External Storage(only for images and charts)**: For images and charts, the external storages are supported: `azure`, `gcs`, `s3` `swift` and `oss`. #### Configure the other items listed in [configuration](#configuration) section ### Install the chart Install the Harbor helm chart with a release name `my-release`: helm 2: ```bash helm install --name my-release harbor/harbor ``` helm 3: ```bash helm install my-release harbor/harbor ``` ## Uninstallation To uninstall/delete the `my-release` deployment: helm 2: ```bash helm delete --purge my-release ``` helm 3: ``` helm uninstall my-release ``` ## Configuration The following table lists the configurable parameters of the Harbor chart and the default values. | Parameter | Description | Default | | --------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------- | | **Expose** | | | | `expose.type` | The way how to expose the service: `ingress`, `clusterIP`, `nodePort` or `loadBalancer`, other values will be ignored and the creation of service will be skipped. | `ingress` | | `expose.tls.enabled` | Enable the tls or not. Delete the `ssl-redirect` annotations in `expose.ingress.annotations` when TLS is disabled and `expose.type` is `ingress`. Note: if the `expose.type` is `ingress` and the tls is disabled, the port must be included in the command when pull/push images. Refer to https://github.com/goharbor/harbor/issues/5291 for the detail. | `true` | | `expose.tls.certSource` | The source of the tls certificate. Set it as `auto`, `secret` or `none` and fill the information in the corresponding section: 1) auto: generate the tls certificate automatically 2) secret: read the tls certificate from the specified secret. The tls certificate can be generated manually or by cert manager 3) none: configure no tls certificate for the ingress. If the default tls certificate is configured in the ingress controller, choose this option | `auto` | | `expose.tls.auto.commonName` | The common name used to generate the certificate, it's necessary when the type isn't `ingress`