Mukul SharmaandClaude Opus 5
f83cedca65
Ports the rest of the homelab's stack: external-secrets, harbor, jenkins, postgresql, redis, victoria-metrics-single, vmagent, node-exporter and grafana. All nine verified with helm template. Most are the homelab's values with storage moved from local-path to standard-rwo and hostnames rebuilt on the reserved ingress IP. vmagent and node-exporter are unchanged outright — everything in them is addressed by cluster DNS, namespace or container port, none of which differs here. Harbor is the substantial one. The homelab serves it over plain HTTP and makes containerd accept that by hand-editing hosts.toml on the node; GKE nodes are managed and replaced, so that edit cannot survive. Instead the node pool was told at creation to trust a private CA for exactly this hostname, and cert-manager now signs Harbor's certificate from that same CA via an ingress-shim annotation. certSource is "secret" rather than the chart's "auto", which would self-sign a certificate nothing trusts. externalURL moves to https to match, since Harbor hands that URL to docker clients and a mismatch surfaces as registry errors. Jenkins drops secondaryingress, which exists in the homelab only to serve its Tailscale hostname. Its plugin pins are carried over deliberately: each fixes a failure whose symptom points somewhere else, above all the kubernetes/kubernetes-client-api pairing, without which agents never come online and builds hang at "Still waiting to schedule task". Postgres and Redis keep the homelab's deliberately small memory settings. Those were chosen for an 8GB node under pressure, and while this cluster has room, a bigger cache buys nothing for a handful of small tools. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LEsTefWWifp4ikvhHF5s6N
133 lines
3.8 KiB
YAML
133 lines
3.8 KiB
YAML
harbor:
|
|
# GKE counterpart of helm-overrides/k8s-admin-prd-ase1/harbor, same chart
|
|
# (1.19.1), with one fundamental difference: this Harbor is served over
|
|
# real TLS, and it has to be.
|
|
#
|
|
# The homelab runs Harbor on plain HTTP and works around containerd's
|
|
# refusal to pull from an insecure registry by hand-editing
|
|
# /etc/containerd/certs.d/<host>/hosts.toml on the node. GKE nodes are
|
|
# managed and replaced, so that edit cannot survive. Instead the node pool
|
|
# is told, at creation, to trust a private CA for exactly this hostname,
|
|
# fetching it from Secret Manager (see toolshed-gke-infra's gke-cluster
|
|
# module). cert-manager signs Harbor's certificate from that same CA.
|
|
#
|
|
# Let's Encrypt is not an option: nip.io is not on the public suffix list,
|
|
# so every *.nip.io certificate on the internet shares one rate limit.
|
|
# A private CA is fine for image pulls, which is what matters, but
|
|
# browsers will warn on the Harbor UI. That is expected, not a fault.
|
|
expose:
|
|
type: ingress
|
|
tls:
|
|
enabled: true
|
|
# secret, not the chart's "auto": auto generates its own self-signed
|
|
# certificate, which the nodes have no reason to trust. This one is
|
|
# signed by the CA they were told to trust.
|
|
certSource: secret
|
|
secret:
|
|
secretName: harbor-tls
|
|
ingress:
|
|
hosts:
|
|
core: "harbor.35.238.248.203.nip.io"
|
|
className: contour
|
|
annotations:
|
|
# cert-manager's ingress-shim watches for this and creates the
|
|
# Certificate itself, writing the result into the secret named
|
|
# above. Nothing here ever touches a Certificate resource directly.
|
|
# The issuer is defined in devops-infra-argo-config-gcp's
|
|
# extra-manifests/registry-ca-clusterissuer.yaml.
|
|
cert-manager.io/cluster-issuer: registry-ca-issuer
|
|
|
|
# https, matching the ingress above. Harbor hands this URL to docker
|
|
# clients in its own API responses, so a mismatch here breaks pushes in
|
|
# ways that look like registry errors rather than configuration.
|
|
externalURL: "https://harbor.35.238.248.203.nip.io"
|
|
|
|
# From Vault through External Secrets — see
|
|
# secretstores/harbor-admin-credentials.yaml and Vault path
|
|
# secret/harbor/admin.
|
|
existingSecretAdminPassword: harbor-admin-credentials
|
|
existingSecretAdminPasswordKey: HARBOR_ADMIN_PASSWORD
|
|
|
|
# The one genuinely optional component. Harbor's database and redis are
|
|
# its own required internal state, not add-ons.
|
|
trivy:
|
|
enabled: false
|
|
|
|
persistence:
|
|
enabled: true
|
|
# Keeps the PVCs if the release is ever uninstalled: these hold the
|
|
# actual images.
|
|
resourcePolicy: "keep"
|
|
persistentVolumeClaim:
|
|
registry:
|
|
storageClass: standard-rwo
|
|
size: 5Gi
|
|
jobservice:
|
|
jobLog:
|
|
storageClass: standard-rwo
|
|
size: 1Gi
|
|
database:
|
|
storageClass: standard-rwo
|
|
size: 1Gi
|
|
redis:
|
|
storageClass: standard-rwo
|
|
size: 1Gi
|
|
|
|
portal:
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 128Mi
|
|
limits:
|
|
memory: 256Mi
|
|
|
|
core:
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 256Mi
|
|
limits:
|
|
memory: 512Mi
|
|
|
|
jobservice:
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 128Mi
|
|
limits:
|
|
memory: 256Mi
|
|
|
|
registry:
|
|
registry:
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 128Mi
|
|
limits:
|
|
memory: 256Mi
|
|
controller:
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 64Mi
|
|
limits:
|
|
memory: 128Mi
|
|
|
|
database:
|
|
internal:
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 256Mi
|
|
limits:
|
|
memory: 512Mi
|
|
|
|
redis:
|
|
internal:
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 64Mi
|
|
limits:
|
|
memory: 128Mi
|