chore: migrate harbor from 2.1.5 to 2.2.2
Sven Ketelsen
5 years ago
parent
8951bd1bb2
commit
26ee698c77
@ -1 +1,3 @@
|
||||
---
|
||||
|
||||
harbor_version: v2.2.2
|
||||
|
||||
@ -1,37 +0,0 @@
|
||||
## Settings should be set
|
||||
PORT=9999
|
||||
|
||||
# Only support redis now. If redis is setup, then enable cache
|
||||
CACHE=redis
|
||||
CACHE_REDIS_ADDR=redis:6379
|
||||
CACHE_REDIS_PASSWORD=
|
||||
CACHE_REDIS_DB=3
|
||||
|
||||
# Credential for internal communication
|
||||
BASIC_AUTH_USER=chart_controller
|
||||
BASIC_AUTH_PASS=
|
||||
|
||||
# Multiple tenants
|
||||
# Must be set with 1 to support project namespace
|
||||
DEPTH=1
|
||||
|
||||
# Backend storage driver: e.g. "local", "amazon", "google" etc.
|
||||
STORAGE=local
|
||||
# Storage driver settings
|
||||
STORAGE_LOCAL_ROOTDIR=/chart_storage
|
||||
## Settings with default values. Just put here for future changes
|
||||
DEBUG=false
|
||||
LOG_JSON=true
|
||||
DISABLE_METRICS=false
|
||||
DISABLE_API=false
|
||||
DISABLE_STATEFILES=false
|
||||
ALLOW_OVERWRITE=true
|
||||
CHART_URL=
|
||||
AUTH_ANONYMOUS_GET=false
|
||||
CONTEXT_PATH=
|
||||
INDEX_LIMIT=0
|
||||
MAX_STORAGE_OBJECTS=0
|
||||
MAX_UPLOAD_SIZE=20971520
|
||||
CHART_POST_FORM_FIELD_NAME=chart
|
||||
PROV_POST_FORM_FIELD_NAME=prov
|
||||
STORAGE_TIMESTAMP_TOLERANCE=1s
|
||||
@ -1,6 +0,0 @@
|
||||
appname = Harbor
|
||||
runmode = prod
|
||||
enablegzip = true
|
||||
|
||||
[prod]
|
||||
httpport = 8080
|
||||
@ -1,50 +0,0 @@
|
||||
CONFIG_PATH=/etc/core/app.conf
|
||||
UAA_CA_ROOT=/etc/core/certificates/uaa_ca.pem
|
||||
_REDIS_URL_CORE=redis://redis:6379?idle_timeout_seconds=30
|
||||
SYNC_QUOTA=true
|
||||
CHART_CACHE_DRIVER=redis
|
||||
_REDIS_URL_REG=redis://redis:6379/1?idle_timeout_seconds=30
|
||||
|
||||
LOG_LEVEL=info
|
||||
EXT_ENDPOINT=https://dev-docker-registry-01.smardigo.digital
|
||||
DATABASE_TYPE=postgresql
|
||||
POSTGRESQL_HOST=postgresql
|
||||
POSTGRESQL_PORT=5432
|
||||
POSTGRESQL_USERNAME=postgres
|
||||
POSTGRESQL_PASSWORD={{ harbor_postgresql_password }}
|
||||
POSTGRESQL_DATABASE=registry
|
||||
POSTGRESQL_SSLMODE=disable
|
||||
POSTGRESQL_MAX_IDLE_CONNS=50
|
||||
POSTGRESQL_MAX_OPEN_CONNS=1000
|
||||
REGISTRY_URL=http://registry:5000
|
||||
PORTAL_URL=http://portal:8080
|
||||
TOKEN_SERVICE_URL=http://core:8080/service/token
|
||||
HARBOR_ADMIN_PASSWORD={{ harbor_admin_password }}
|
||||
MAX_JOB_WORKERS=10
|
||||
CORE_SECRET=ydNg7WrBhEcyJuL3
|
||||
JOBSERVICE_SECRET=9fjG7ZiGRpyZ3nX1
|
||||
WITH_NOTARY=False
|
||||
WITH_CLAIR=False
|
||||
WITH_TRIVY=True
|
||||
CORE_URL=http://core:8080
|
||||
CORE_LOCAL_URL=http://127.0.0.1:8080
|
||||
JOBSERVICE_URL=http://jobservice:8080
|
||||
CLAIR_ADAPTER_URL=http://clair-adapter:8080
|
||||
TRIVY_ADAPTER_URL=http://trivy-adapter:8080
|
||||
NOTARY_URL=http://notary-server:4443
|
||||
REGISTRY_STORAGE_PROVIDER_NAME=filesystem
|
||||
READ_ONLY=false
|
||||
RELOAD_KEY=
|
||||
CHART_REPOSITORY_URL=http://chartmuseum:9999
|
||||
REGISTRY_CONTROLLER_URL=http://registryctl:8080
|
||||
WITH_CHARTMUSEUM=True
|
||||
REGISTRY_CREDENTIAL_USERNAME=harbor_registry_user
|
||||
REGISTRY_CREDENTIAL_PASSWORD=spYrLufyLbHrqlAFUPlnijhIFKS3ys1H
|
||||
CSRF_KEY=fNvrK554TPxFnLUUByjumlvirGOQGdRi
|
||||
PERMITTED_REGISTRY_TYPES_FOR_PROXY_CACHE=docker-hub,harbor
|
||||
|
||||
HTTP_PROXY=
|
||||
HTTPS_PROXY=
|
||||
NO_PROXY=clair,jobservice,registryctl,core,notary-server,clair-adapter,trivy-adapter,postgresql,chartmuseum,localhost,db,nginx,notary-signer,.internal,portal,log,127.0.0.1,.local,registry,redis
|
||||
|
||||
PORT=8080
|
||||
@ -1 +0,0 @@
|
||||
POSTGRES_PASSWORD={{ harbor_postgresql_password }}
|
||||
@ -1,35 +0,0 @@
|
||||
---
|
||||
#Protocol used to serve
|
||||
protocol: "http"
|
||||
|
||||
#Server listening port
|
||||
port: 8080
|
||||
|
||||
#Worker pool
|
||||
worker_pool:
|
||||
#Worker concurrency
|
||||
workers: 10
|
||||
backend: "redis"
|
||||
#Additional config if use 'redis' backend
|
||||
redis_pool:
|
||||
#redis://[arbitrary_username:password@]ipaddress:port/database_index
|
||||
redis_url: redis://redis:6379/2?idle_timeout_seconds=30
|
||||
namespace: "harbor_job_service_namespace"
|
||||
idle_timeout_second: 3600
|
||||
#Loggers for the running job
|
||||
job_loggers:
|
||||
- name: "STD_OUTPUT" # logger backend name, only support "FILE" and "STD_OUTPUT"
|
||||
level: "INFO" # INFO/DEBUG/WARNING/ERROR/FATAL
|
||||
- name: "FILE"
|
||||
level: "INFO"
|
||||
settings: # Customized settings of logger
|
||||
base_dir: "/var/log/jobs"
|
||||
sweeper:
|
||||
duration: 1 #days
|
||||
settings: # Customized settings of sweeper
|
||||
work_dir: "/var/log/jobs"
|
||||
|
||||
#Loggers for the job service
|
||||
loggers:
|
||||
- name: "STD_OUTPUT" # Same with above
|
||||
level: "INFO"
|
||||
@ -1,13 +0,0 @@
|
||||
CORE_SECRET=ydNg7WrBhEcyJuL3
|
||||
REGISTRY_URL=http://registry:5000
|
||||
JOBSERVICE_SECRET=9fjG7ZiGRpyZ3nX1
|
||||
CORE_URL=http://core:8080
|
||||
REGISTRY_CONTROLLER_URL=http://registryctl:8080
|
||||
JOBSERVICE_WEBHOOK_JOB_MAX_RETRY=10
|
||||
|
||||
|
||||
HTTP_PROXY=
|
||||
HTTPS_PROXY=
|
||||
NO_PROXY=clair,jobservice,registryctl,core,notary-server,clair-adapter,trivy-adapter,postgresql,chartmuseum,localhost,db,nginx,notary-signer,.internal,portal,log,127.0.0.1,.local,registry,redis
|
||||
REGISTRY_CREDENTIAL_USERNAME=harbor_registry_user
|
||||
REGISTRY_CREDENTIAL_PASSWORD=spYrLufyLbHrqlAFUPlnijhIFKS3ys1H
|
||||
@ -1,8 +0,0 @@
|
||||
/var/log/docker/*.log {
|
||||
rotate 50
|
||||
size 200M
|
||||
copytruncate
|
||||
compress
|
||||
missingok
|
||||
nodateext
|
||||
}
|
||||
@ -1,7 +0,0 @@
|
||||
# Rsyslog configuration file for docker.
|
||||
|
||||
template(name="DynaFile" type="string" string="/var/log/docker/%programname%.log")
|
||||
|
||||
if $programname != "rsyslogd" then {
|
||||
action(type="omfile" dynaFile="DynaFile")
|
||||
}
|
||||
@ -1,137 +0,0 @@
|
||||
worker_processes auto;
|
||||
pid /tmp/nginx.pid;
|
||||
|
||||
events {
|
||||
worker_connections 1024;
|
||||
use epoll;
|
||||
multi_accept on;
|
||||
}
|
||||
|
||||
http {
|
||||
client_body_temp_path /tmp/client_body_temp;
|
||||
proxy_temp_path /tmp/proxy_temp;
|
||||
fastcgi_temp_path /tmp/fastcgi_temp;
|
||||
uwsgi_temp_path /tmp/uwsgi_temp;
|
||||
scgi_temp_path /tmp/scgi_temp;
|
||||
tcp_nodelay on;
|
||||
|
||||
# this is necessary for us to be able to disable request buffering in all cases
|
||||
proxy_http_version 1.1;
|
||||
|
||||
upstream core {
|
||||
server core:8080;
|
||||
}
|
||||
|
||||
upstream portal {
|
||||
server portal:8080;
|
||||
}
|
||||
|
||||
log_format timed_combined '$remote_addr - '
|
||||
'"$request" $status $body_bytes_sent '
|
||||
'"$http_referer" "$http_user_agent" '
|
||||
'$request_time $upstream_response_time $pipe';
|
||||
|
||||
access_log /dev/stdout timed_combined;
|
||||
|
||||
server {
|
||||
listen 8080;
|
||||
server_tokens off;
|
||||
# disable any limits to avoid HTTP 413 for large image uploads
|
||||
client_max_body_size 0;
|
||||
|
||||
# Add extra headers
|
||||
add_header X-Frame-Options DENY;
|
||||
add_header Content-Security-Policy "frame-ancestors 'none'";
|
||||
|
||||
# costumized location config file can place to /etc/nginx/etc with prefix harbor.http. and suffix .conf
|
||||
include /etc/nginx/conf.d/harbor.http.*.conf;
|
||||
|
||||
location / {
|
||||
proxy_pass http://portal/;
|
||||
# proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
|
||||
# When setting up Harbor behind other proxy, such as an Nginx instance, remove the below line if the proxy already has similar settings.
|
||||
# proxy_set_header X-Forwarded-Proto $scheme;
|
||||
|
||||
proxy_buffering off;
|
||||
proxy_request_buffering off;
|
||||
}
|
||||
|
||||
location /c/ {
|
||||
proxy_pass http://core/c/;
|
||||
# proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
|
||||
# When setting up Harbor behind other proxy, such as an Nginx instance, remove the below line if the proxy already has similar settings.
|
||||
# proxy_set_header X-Forwarded-Proto $scheme;
|
||||
|
||||
proxy_buffering off;
|
||||
proxy_request_buffering off;
|
||||
}
|
||||
|
||||
location /api/ {
|
||||
proxy_pass http://core/api/;
|
||||
# proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
|
||||
# When setting up Harbor behind other proxy, such as an Nginx instance, remove the below line if the proxy already has similar settings.
|
||||
# proxy_set_header X-Forwarded-Proto $scheme;
|
||||
|
||||
proxy_buffering off;
|
||||
proxy_request_buffering off;
|
||||
}
|
||||
|
||||
location /chartrepo/ {
|
||||
proxy_pass http://core/chartrepo/;
|
||||
# proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
|
||||
# When setting up Harbor behind other proxy, such as an Nginx instance, remove the below line if the proxy already has similar settings.
|
||||
# proxy_set_header X-Forwarded-Proto $scheme;
|
||||
|
||||
proxy_buffering off;
|
||||
proxy_request_buffering off;
|
||||
}
|
||||
|
||||
location /v1/ {
|
||||
return 404;
|
||||
}
|
||||
|
||||
location /v2/ {
|
||||
proxy_pass http://core/v2/;
|
||||
# proxy_set_header Host $http_host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
|
||||
# When setting up Harbor behind other proxy, such as an Nginx instance, remove the below line if the proxy already has similar settings.
|
||||
# proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_buffering off;
|
||||
proxy_request_buffering off;
|
||||
|
||||
proxy_send_timeout 900;
|
||||
proxy_read_timeout 900;
|
||||
}
|
||||
|
||||
location /service/ {
|
||||
proxy_pass http://core/service/;
|
||||
# proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
|
||||
# When setting up Harbor behind other proxy, such as an Nginx instance, remove the below line if the proxy already has similar settings.
|
||||
# proxy_set_header X-Forwarded-Proto $scheme;
|
||||
|
||||
proxy_buffering off;
|
||||
proxy_request_buffering off;
|
||||
}
|
||||
|
||||
location /service/notifications {
|
||||
return 404;
|
||||
}
|
||||
}
|
||||
}
|
||||
@ -1,38 +0,0 @@
|
||||
|
||||
worker_processes auto;
|
||||
pid /tmp/nginx.pid;
|
||||
|
||||
events {
|
||||
worker_connections 1024;
|
||||
}
|
||||
|
||||
http {
|
||||
|
||||
client_body_temp_path /tmp/client_body_temp;
|
||||
proxy_temp_path /tmp/proxy_temp;
|
||||
fastcgi_temp_path /tmp/fastcgi_temp;
|
||||
uwsgi_temp_path /tmp/uwsgi_temp;
|
||||
scgi_temp_path /tmp/scgi_temp;
|
||||
|
||||
server {
|
||||
listen 8080;
|
||||
server_name localhost;
|
||||
|
||||
root /usr/share/nginx/html;
|
||||
index index.html index.htm;
|
||||
include /etc/nginx/mime.types;
|
||||
|
||||
gzip on;
|
||||
gzip_min_length 1000;
|
||||
gzip_proxied expired no-cache no-store private auth;
|
||||
gzip_types text/plain text/css application/json application/javascript application/x-javascript text/xml application/xml application/xml+rss text/javascript;
|
||||
|
||||
location / {
|
||||
try_files $uri $uri/ /index.html;
|
||||
}
|
||||
|
||||
location = /index.html {
|
||||
add_header Cache-Control "no-store, no-cache, must-revalidate";
|
||||
}
|
||||
}
|
||||
}
|
||||
@ -1,36 +0,0 @@
|
||||
version: 0.1
|
||||
log:
|
||||
level: info
|
||||
fields:
|
||||
service: registry
|
||||
storage:
|
||||
cache:
|
||||
layerinfo: redis
|
||||
filesystem:
|
||||
rootdirectory: /storage
|
||||
maintenance:
|
||||
uploadpurging:
|
||||
enabled: false
|
||||
delete:
|
||||
enabled: true
|
||||
redis:
|
||||
addr: redis:6379
|
||||
readtimeout: 10s
|
||||
writetimeout: 10s
|
||||
dialtimeout: 10s
|
||||
password:
|
||||
db: 1
|
||||
http:
|
||||
addr: :5000
|
||||
secret: placeholder
|
||||
debug:
|
||||
addr: localhost:5001
|
||||
auth:
|
||||
htpasswd:
|
||||
realm: harbor-registry-basic-realm
|
||||
path: /etc/registry/passwd
|
||||
validation:
|
||||
disabled: true
|
||||
compatibility:
|
||||
schema1:
|
||||
enabled: true
|
||||
@ -1 +0,0 @@
|
||||
harbor_registry_user:$2y$05$EE3OyDzK1lhlSFIDIc0HcuMAl2hiwZraRg0yWgnfSfa1459Z5sFey
|
||||
@ -1,5 +0,0 @@
|
||||
---
|
||||
protocol: "http"
|
||||
port: 8080
|
||||
log_level: "INFO"
|
||||
registry_config: "/etc/registry/config.yml"
|
||||
@ -1,2 +0,0 @@
|
||||
CORE_SECRET=ydNg7WrBhEcyJuL3
|
||||
JOBSERVICE_SECRET=9fjG7ZiGRpyZ3nX1
|
||||
@ -1,17 +0,0 @@
|
||||
SCANNER_LOG_LEVEL=info
|
||||
SCANNER_REDIS_URL=redis://redis:6379/5?idle_timeout_seconds=30
|
||||
SCANNER_STORE_REDIS_URL=redis://redis:6379/5?idle_timeout_seconds=30
|
||||
SCANNER_STORE_REDIS_NAMESPACE=harbor.scanner.trivy:store
|
||||
SCANNER_JOB_QUEUE_REDIS_URL=redis://redis:6379/5?idle_timeout_seconds=30
|
||||
SCANNER_JOB_QUEUE_REDIS_NAMESPACE=harbor.scanner.trivy:job-queue
|
||||
SCANNER_TRIVY_CACHE_DIR=/home/scanner/.cache/trivy
|
||||
SCANNER_TRIVY_REPORTS_DIR=/home/scanner/.cache/reports
|
||||
SCANNER_TRIVY_VULN_TYPE=os,library
|
||||
SCANNER_TRIVY_SEVERITY=UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL
|
||||
SCANNER_TRIVY_IGNORE_UNFIXED=False
|
||||
SCANNER_TRIVY_SKIP_UPDATE=False
|
||||
SCANNER_TRIVY_GITHUB_TOKEN=
|
||||
SCANNER_TRIVY_INSECURE=False
|
||||
HTTP_PROXY=
|
||||
HTTPS_PROXY=
|
||||
NO_PROXY=clair,jobservice,registryctl,core,notary-server,clair-adapter,trivy-adapter,postgresql,chartmuseum,localhost,db,nginx,notary-signer,.internal,portal,log,127.0.0.1,.local,registry,redis
|
||||
Loading…
Reference in New Issue