added harbor

helm-overrides/k8s-admin-prd-ase1/harbor/custom-values.yaml

@@ -0,0 +1,112 @@
+harbor:
+  # Fresh install (helm list -n harbor came back empty — claude.md's "Just
+  # installed this session" note was stale). Minimal footprint by request:
+  # Trivy disabled (Notary/ChartMuseum aren't even in this chart anymore —
+  # dropped upstream, not something to disable), database/redis are
+  # Harbor's own required internal state (not optional the way Trivy is,
+  # despite what I initially suggested), everything else trimmed.
+  #
+  # Plain HTTP, matching every other app here (Vault tls_disable, ArgoCD
+  # --insecure, etc.) — avoids cert-manager entirely for this homelab.
+  # Note: this only affects the ingress. Jenkins pushing images should go
+  # through Harbor's internal cluster-DNS service (harbor-core.harbor.svc.cluster.local)
+  # instead, per claude.md's own plan — pod-to-pod traffic never touches
+  # the ingress, so no client-side insecure-registry config needed for CI.
+  # Pulling/pushing from outside the cluster (e.g. your laptop) through the
+  # ingress WOULD need Docker configured to treat this host as an insecure
+  # registry, since there's no TLS here.
+  expose:
+    type: ingress
+    tls:
+      enabled: false
+    ingress:
+      hosts:
+        core: "harbor.192.168.1.7.nip.io"
+      className: contour
+
+  externalURL: "http://harbor.192.168.1.7.nip.io"
+
+  # Vault-backed from the start, same pattern as jenkins-admin-credentials.
+  # See devops-infra-argo-config/secretstores/harbor-admin-credentials.yaml
+  # and vault kv path secret/harbor/admin.
+  existingSecretAdminPassword: harbor-admin-credentials
+  existingSecretAdminPasswordKey: HARBOR_ADMIN_PASSWORD
+
+  trivy:
+    enabled: false
+
+  persistence:
+    enabled: true
+    resourcePolicy: "keep"
+    persistentVolumeClaim:
+      registry:
+        storageClass: local-path
+        size: 5Gi
+      jobservice:
+        jobLog:
+          storageClass: local-path
+          size: 1Gi
+      database:
+        storageClass: local-path
+        size: 1Gi
+      redis:
+        storageClass: local-path
+        size: 1Gi
+
+  portal:
+    resources:
+      requests:
+        cpu: 50m
+        memory: 128Mi
+      limits:
+        memory: 256Mi
+
+  core:
+    resources:
+      requests:
+        cpu: 100m
+        memory: 256Mi
+      limits:
+        memory: 512Mi
+
+  jobservice:
+    resources:
+      requests:
+        cpu: 50m
+        memory: 128Mi
+      limits:
+        memory: 256Mi
+
+  registry:
+    registry:
+      resources:
+        requests:
+          cpu: 100m
+          memory: 128Mi
+        limits:
+          memory: 256Mi
+    controller:
+      resources:
+        requests:
+          cpu: 50m
+          memory: 64Mi
+        limits:
+          memory: 128Mi
+
+  database:
+    internal:
+      resources:
+        requests:
+          cpu: 100m
+          memory: 256Mi
+        limits:
+          memory: 512Mi
+
+  redis:
+    internal:
+      resources:
+        requests:
+          cpu: 50m
+          memory: 64Mi
+        limits:
+          memory: 128Mi

helm-templates/harbor/Chart.lock

@@ -0,0 +1,6 @@
+dependencies:
+- name: harbor
+  repository: https://helm.goharbor.io
+  version: 1.19.1
+digest: sha256:b87afb2f24094de7a6f5e3d561722b432b95ce1338295df32067b59cdcfa1ae4
+generated: "2026-08-31T13:04:36.886249+05:30"

helm-templates/harbor/Chart.yaml

@@ -0,0 +1,10 @@
+apiVersion: v2
+name: harbor
+version: 1.0.0
+dependencies:
+  - name: harbor
+    # Fresh install — helm list -n harbor came back empty, so unlike
+    # Vault/Contour there's no live release to match. Pinned to current
+    # stable (checked 2026-08-31), not an adoption-matching version.
+    version: "1.19.1"
+    repository: https://helm.goharbor.io