201 lines
4.5 KiB
Bash
201 lines
4.5 KiB
Bash
#HARBOR
|
||
kubectl create namespace harbor
|
||
|
||
helm repo add harbor https://helm.goharbor.io
|
||
helm repo update
|
||
|
||
cat <<EOF | cat > harbor-cert.yaml -
|
||
apiVersion: cert-manager.io/v1
|
||
kind: Certificate
|
||
metadata:
|
||
name: harbor-tls
|
||
namespace: harbor
|
||
spec:
|
||
secretName: harbor-tls
|
||
issuerRef:
|
||
name: letsencrypt-prod
|
||
kind: ClusterIssuer
|
||
dnsNames:
|
||
- harbor.italiadatacenter.com
|
||
|
||
EOF
|
||
|
||
kubectl apply -f harbor-cert.yaml
|
||
|
||
|
||
|
||
|
||
cat <<EOF | cat > harborvalues.yaml -
|
||
# -----------------------
|
||
# EXPOSURE
|
||
# -----------------------
|
||
expose:
|
||
# Set how to expose the service. Set the type as "ingress", "clusterIP", "nodePort" or "loadBalancer"
|
||
# and fill the information in the corresponding section
|
||
type: clusterIP
|
||
externalURL: https://harbor.italiadatacenter.com
|
||
|
||
# -----------------------
|
||
# ADMIN
|
||
# -----------------------
|
||
harborAdminPassword: "KAYQE1QA7uwUZ8uI"
|
||
|
||
# -----------------------
|
||
# PERSISTENCE
|
||
# -----------------------
|
||
persistence:
|
||
enabled: true
|
||
persistentVolumeClaim:
|
||
registry:
|
||
storageClass: csi-rbdfs-sc
|
||
size: 50Gi
|
||
jobservice:
|
||
storageClass: csi-rbdfs-sc
|
||
size: 2Gi
|
||
trivy:
|
||
storageClass: csi-rbdfs-sc
|
||
size: 2Gi
|
||
|
||
# -----------------------
|
||
# POSTGRESQL (EXTERNAL)
|
||
# -----------------------
|
||
database:
|
||
type: external
|
||
external:
|
||
host: pg-devops-rw.devops.svc
|
||
port: 5432
|
||
username: harbor
|
||
password: "KAYQE1QA7uwUZ8uI"
|
||
database: registry
|
||
sslmode: require
|
||
|
||
# -----------------------
|
||
# REDIS (EXTERNAL)
|
||
# -----------------------
|
||
redis:
|
||
type: external
|
||
external:
|
||
addr: redis.redis.svc.cluster.local:6379
|
||
password: "KAYQE1QA7uwUZ8uI"
|
||
database: 0
|
||
|
||
# -----------------------
|
||
# DISABLE INTERNAL SERVICES
|
||
# -----------------------
|
||
postgresql:
|
||
enabled: false
|
||
|
||
redisInternal:
|
||
enabled: false
|
||
|
||
# -----------------------
|
||
# COMPONENTS
|
||
# -----------------------
|
||
trivy:
|
||
enabled: true
|
||
|
||
metrics:
|
||
enabled: false
|
||
EOF
|
||
|
||
kubectl cnpg psql pg-devops -n devops
|
||
|
||
CREATE DATABASE registry;
|
||
CREATE USER harbor WITH PASSWORD 'KAYQE1QA7uwUZ8uI';
|
||
GRANT ALL PRIVILEGES ON DATABASE registry TO harbor;
|
||
ALTER DATABASE registry OWNER TO harbor;
|
||
#test
|
||
kubectl run psql-test --rm -it --image=postgres:16 -- psql -h pg-prod-rw.database.svc -U harbor
|
||
kubectl run redis-test --rm -it --image=redis:7 -- redis-cli -h redis.redis.svc.cluster.local -a Japp0cam
|
||
|
||
|
||
|
||
helm install harbor harbor/harbor -n harbor -f harborvalues.yaml
|
||
|
||
|
||
|
||
--- httproute & body setting nginx ----
|
||
kubectl apply -f - <<EOF
|
||
apiVersion: gateway.networking.k8s.io/v1
|
||
kind: HTTPRoute
|
||
metadata:
|
||
name: harbor
|
||
namespace: harbor
|
||
spec:
|
||
hostnames:
|
||
- harbor.italiadatacenter.com
|
||
parentRefs:
|
||
- name: main-gateway
|
||
namespace: nginx-gateway
|
||
rules:
|
||
- matches:
|
||
- path:
|
||
type: PathPrefix
|
||
value: /
|
||
backendRefs:
|
||
- name: harbor
|
||
port: 80
|
||
---
|
||
apiVersion: gateway.nginx.org/v1alpha1
|
||
kind: ClientSettingsPolicy
|
||
metadata:
|
||
name: gateway-client-settings
|
||
spec:
|
||
targetRef:
|
||
group: gateway.networking.k8s.io
|
||
kind: Gateway
|
||
name: main-gateway
|
||
body:
|
||
maxSize: "0"
|
||
EOF
|
||
|
||
|
||
|
||
#test
|
||
#Login UI:
|
||
https://harbor.pigreco66.it/ (admin(Japp0cam)
|
||
|
||
#push
|
||
docker login harbor.italiadatacenter.com
|
||
docker pull nginx:1.25
|
||
docker tag nginx:1.25 harbor.italiadatacenter.com/library/nginx:1.25
|
||
docker push harbor.italiadatacenter.com/library/nginx:1.25
|
||
|
||
#pull
|
||
docker rmi harbor.pigreco66.it/library/nginx:1.25
|
||
docker pull harbor.pigreco66.it/library/nginx:1.25
|
||
|
||
#pull da k8s
|
||
|
||
#STEP 1– Creare Robot Account in Harbor
|
||
#Harbor UI → Projects → (es. library o apps) → Robot Accounts
|
||
#Nome: k8s-pull
|
||
#Permessi:
|
||
#✔️ Repository → Pull
|
||
|
||
|
||
kubectl create secret docker-registry harbor-pull \
|
||
-n default \
|
||
--docker-server=harbor.italiadatacenter.com \
|
||
--docker-username=robot$k8s-pull \
|
||
--docker-password=ir0ELEJEFg804qljh2p32ALzIsMJepWt \
|
||
--docker-email=harbor@italiadatacenter.com
|
||
|
||
#per namespace nuovi
|
||
kubectl patch serviceaccount default -n default -p '{"imagePullSecrets":[{"name":"harbor-pull"}]}'
|
||
|
||
#applicare per i vecchi:
|
||
kubectl patch serviceaccount default -n primo-dev -p '{"imagePullSecrets":[{"name":"harbor-pull"}]}'
|
||
|
||
#test
|
||
kubectl run test-nginx --image=harbor.italiadatacenter.com/library/nginx:1.25 --restart=Never -n poc
|
||
|
||
|
||
|
||
kubectl -n primo-dev create secret docker-registry harbor-pull \
|
||
--docker-server=harbor.italiadatacenter.com \
|
||
--docker-username=robot\$primo+primo \
|
||
--docker-password=agQLiKJ8K5qmBWhO1bHngzb9UorPLIw1 \
|
||
--docker-email=harbor@italiadatacenter.com
|
||
|
||
kubectl patch serviceaccount default -n primo-dev -p '{"imagePullSecrets":[{"name":"harbor-pull"}]}' |