primo

2026-07-17 09:42:52 +02:00
commit 20d506407a
93 changed files with 14526 additions and 0 deletions
--- a/add-on/harbor.sh
+++ b/add-on/harbor.sh
@@ -0,0 +1,201 @@
+#HARBOR
+kubectl create namespace harbor
+
+helm repo add harbor https://helm.goharbor.io
+helm repo update
+
+cat <<EOF | cat > harbor-cert.yaml -
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: harbor-tls
+  namespace: harbor
+spec:
+  secretName: harbor-tls
+  issuerRef:
+    name: letsencrypt-prod
+    kind: ClusterIssuer
+  dnsNames:
+  - harbor.italiadatacenter.com
+  
+EOF
+
+kubectl apply -f harbor-cert.yaml
+
+
+
+
+cat <<EOF | cat > harborvalues.yaml -
+# -----------------------
+# EXPOSURE
+# -----------------------
+expose:
+  # Set how to expose the service. Set the type as "ingress", "clusterIP", "nodePort" or "loadBalancer"
+  # and fill the information in the corresponding section
+  type: clusterIP
+externalURL: https://harbor.italiadatacenter.com
+
+# -----------------------
+# ADMIN
+# -----------------------
+harborAdminPassword: "KAYQE1QA7uwUZ8uI"
+
+# -----------------------
+# PERSISTENCE
+# -----------------------
+persistence:
+  enabled: true
+  persistentVolumeClaim:
+    registry:
+      storageClass: csi-rbdfs-sc
+      size: 50Gi
+    jobservice:
+      storageClass: csi-rbdfs-sc
+      size: 2Gi
+    trivy:
+      storageClass: csi-rbdfs-sc
+      size: 2Gi
+
+# -----------------------
+# POSTGRESQL (EXTERNAL)
+# -----------------------
+database:
+  type: external
+  external:
+    host: pg-devops-rw.devops.svc
+    port: 5432
+    username: harbor
+    password: "KAYQE1QA7uwUZ8uI"
+    database: registry
+    sslmode: require
+
+# -----------------------
+# REDIS (EXTERNAL)
+# -----------------------
+redis:
+  type: external
+  external:
+    addr: redis.redis.svc.cluster.local:6379
+    password: "KAYQE1QA7uwUZ8uI"
+    database: 0
+
+# -----------------------
+# DISABLE INTERNAL SERVICES
+# -----------------------
+postgresql:
+  enabled: false
+
+redisInternal:
+  enabled: false
+
+# -----------------------
+# COMPONENTS
+# -----------------------
+trivy:
+  enabled: true
+
+metrics:
+  enabled: false
+EOF
+
+kubectl cnpg psql pg-devops -n devops
+
+CREATE DATABASE registry;
+CREATE USER harbor WITH PASSWORD 'KAYQE1QA7uwUZ8uI';
+GRANT ALL PRIVILEGES ON DATABASE registry TO harbor;
+ALTER DATABASE registry OWNER TO harbor;
+#test
+kubectl run psql-test  --rm -it --image=postgres:16 -- psql  -h pg-prod-rw.database.svc  -U harbor
+kubectl run redis-test --rm -it  --image=redis:7 -- redis-cli  -h redis.redis.svc.cluster.local  -a Japp0cam
+
+
+
+helm install harbor harbor/harbor  -n harbor -f harborvalues.yaml
+
+
+
+--- httproute & body setting nginx ----
+kubectl apply -f - <<EOF
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: harbor
+  namespace: harbor
+spec:
+  hostnames:
+  - harbor.italiadatacenter.com
+  parentRefs:
+  - name: main-gateway
+    namespace: nginx-gateway
+  rules:
+  - matches:
+    - path:
+        type: PathPrefix
+        value: /
+    backendRefs:
+    - name: harbor
+      port: 80
+---
+apiVersion: gateway.nginx.org/v1alpha1
+kind: ClientSettingsPolicy
+metadata:
+  name: gateway-client-settings
+spec:
+  targetRef:
+    group: gateway.networking.k8s.io
+    kind: Gateway
+    name: main-gateway
+  body:
+    maxSize: "0" 
+EOF
+
+
+
+#test
+#Login UI:
+https://harbor.pigreco66.it/  (admin(Japp0cam)
+
+#push
+docker login harbor.italiadatacenter.com
+docker pull nginx:1.25
+docker tag nginx:1.25 harbor.italiadatacenter.com/library/nginx:1.25
+docker push harbor.italiadatacenter.com/library/nginx:1.25
+
+#pull
+docker rmi harbor.pigreco66.it/library/nginx:1.25
+docker pull harbor.pigreco66.it/library/nginx:1.25
+
+#pull da k8s
+
+#STEP 1– Creare Robot Account in Harbor
+#Harbor UI → Projects → (es. library o apps) → Robot Accounts
+#Nome: k8s-pull
+#Permessi:
+#✔️ Repository → Pull
+
+
+kubectl create secret docker-registry harbor-pull \
+  -n default \
+  --docker-server=harbor.italiadatacenter.com \
+  --docker-username=robot$k8s-pull \
+  --docker-password=ir0ELEJEFg804qljh2p32ALzIsMJepWt \
+  --docker-email=harbor@italiadatacenter.com
+
+#per namespace nuovi
+kubectl patch serviceaccount default  -n default  -p '{"imagePullSecrets":[{"name":"harbor-pull"}]}'
+
+#applicare per i vecchi:
+kubectl patch serviceaccount default  -n primo-dev  -p '{"imagePullSecrets":[{"name":"harbor-pull"}]}'
+
+#test
+kubectl run test-nginx   --image=harbor.italiadatacenter.com/library/nginx:1.25   --restart=Never -n poc
+
+
+
+kubectl -n primo-dev create secret docker-registry harbor-pull \
+  --docker-server=harbor.italiadatacenter.com \
+  --docker-username=robot\$primo+primo \
+  --docker-password=agQLiKJ8K5qmBWhO1bHngzb9UorPLIw1 \
+  --docker-email=harbor@italiadatacenter.com
+  
+kubectl patch serviceaccount default  -n primo-dev  -p '{"imagePullSecrets":[{"name":"harbor-pull"}]}'