diff --git a/harbor/README.md b/harbor/README.md
new file mode 100644
index 0000000..7db8647
--- /dev/null
+++ b/harbor/README.md
@@ -0,0 +1,60 @@
+# Harbor GitOps Catalog Application
+
+## Overview
+
+This Harbor deployment is configured for the Kubefirst GitOps catalog with:
+
+- HTTPS ingress at `harbor.<DOMAIN_NAME>`
+- External secrets integration with Vault
+- Persistent storage for all components
+- Trivy vulnerability scanning enabled
+
+## Required Vault Configuration
+
+Before deploying Harbor, configure the following secrets need to be in Vault:
+
+```bash
+vault kv put secret/harbor \
+  HARBOR_ADMIN_PASSWORD="your-secure-admin-password" \
+  POSTGRES_PASSWORD="your-secure-db-password" \
+  REDIS_PASSWORD="your-secure-redis-password"
+```
+
+These are configured as secret inputs and will be added to vault automatically, and pulled into your Harbor instand correctly.
+
+## Token Service Private Key
+
+Harbor automatically generates the required private key for its token service during deployment. This ensures Docker authentication works properly without storing any sensitive keys in Git.
+
+## Components
+
+- **Core**: Harbor's main API server
+- **Portal**: Web UI
+- **Registry**: Docker registry
+- **Database**: PostgreSQL (internal)
+- **Redis**: Cache and session storage (internal)
+- **Trivy**: Vulnerability scanner
+- **Jobservice**: Background job processing
+
+## Troubleshooting
+
+Check component logs:
+
+```bash
+kubectl logs -n harbor -l component=core
+kubectl logs -n harbor -l component=registry
+kubectl logs -n harbor -l component=jobservice
+```
+
+Verify all secrets are created:
+
+```bash
+kubectl get secrets -n harbor
+```
+
+The deployment should create:
+
+- `harbor-admin-secret` - Admin credentials (from Vault)
+- `harbor-database-secret` - PostgreSQL password (from Vault)
+- `harbor-redis-secret` - Redis password (from Vault)
+- `harbor-core` - Core component secrets including token signing keys (auto-generated by Harbor)
diff --git a/harbor/components/harbor/application.yaml b/harbor/components/harbor/application.yaml
index 0a7df90..b0dbc53 100644
--- a/harbor/components/harbor/application.yaml
+++ b/harbor/components/harbor/application.yaml
@@ -87,13 +87,9 @@ spec:
           enabled: false
         # Core secret for internal components
         core:
-          secret: ""  # Let Harbor generate this
-          secretName: harbor-core
-            password: ""  # Will be auto-generated
-        redis:
-          type: internal
-          internal:
-            password: ""  # Will be auto-generated
+          secret: ""
+          # Don't set secretName - let Harbor generate it
+          # secretName: ""
         metrics:
           enabled: true
           serviceMonitor: