harbor adjustments to the gitops catalog

harbor/components/harbor/application.yaml

@@ -39,7 +39,8 @@ spec:
               nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
               nginx.ingress.kubernetes.io/proxy-send-timeout: "600"
         externalURL: https://harbor.<DOMAIN_NAME>
-        harborAdminPassword: ""  # Will be set by external secret
+        harborAdminPassword: ""  # Don't set this when using existingSecretAdminPassword
+        secretKey: harbor-admin
         existingSecretAdminPassword: harbor-admin-secret
         existingSecretAdminPasswordKey: HARBOR_ADMIN_PASSWORD
         persistence:
@@ -63,13 +64,31 @@ spec:
           replicas: 1
         registry:
           replicas: 1
+        jobservice:
+          replicas: 1
         trivy:
           enabled: true
           gitHubToken: ""
           skipUpdate: false
         database:
           type: internal
           internal:
+            # Password from external secret
+            existingSecret: harbor-database-secret
+            existingSecretPasswordKey: POSTGRES_PASSWORD
+        redis:
+          type: internal
+          internal:
+            # Password from external secret
+            existingSecret: harbor-redis-secret
+            existingSecretPasswordKey: REDIS_PASSWORD
+        # Disable internal TLS to avoid the SSL directory errors
+        internalTLS:
+          enabled: false
+        # Core secret for internal components
+        core:
+          secret: ""  # Let Harbor generate this
+          secretName: harbor-core
             password: ""  # Will be auto-generated
         redis:
           type: internal

harbor/components/harbor/external-secret.yaml

@@ -14,3 +14,39 @@ spec:
   dataFrom:
     - extract:
         key: /harbor
+---
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: <CLUSTER_NAME>-harbor-database-secret
+  namespace: harbor
+spec:
+  target:
+    name: harbor-database-secret
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault-kv-secret
+  refreshInterval: 10s
+  data:
+    - secretKey: POSTGRES_PASSWORD
+      remoteRef:
+        key: /harbor
+        property: POSTGRES_PASSWORD
+---
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: <CLUSTER_NAME>-harbor-redis-secret
+  namespace: harbor
+spec:
+  target:
+    name: harbor-redis-secret
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault-kv-secret
+  refreshInterval: 10s
+  data:
+    - secretKey: REDIS_PASSWORD
+      remoteRef:
+        key: /harbor
+        property: REDIS_PASSWORD

index.yaml

@@ -91,6 +91,12 @@ apps:
       - name: HARBOR_ADMIN_PASSWORD
         label: Harbor admin password
         env: HARBOR_ADMIN_PASSWORD
+      - name: POSTGRES_PASSWORD
+        label: Harbor database password
+        env: POSTGRES_PASSWORD
+      - name: REDIS_PASSWORD
+        label: Harbor Redis password
+        env: REDIS_PASSWORD
     imageUrl: "https://raw.githubusercontent.com/konstructio/gitops-catalog/main/logos/harbor.svg"
     description: "Harbor is an open source cloud native registry that stores, signs, and scans container images for vulnerabilities with built-in security policies and RBAC."
     category: Infrastructure