harbor

Helm chart

Last changed

Request a free trial

Contact our team to test out this Helm chart and related images for free. Please also indicate any other images you would like to evaluate.

Tag:

Compare:

expose:

# Set how to expose the service. Set the type as "ingress", "clusterIP", "nodePort", "loadBalancer" or "route"

# and fill the information in the corresponding section

type: ingress

tls:

# Enable TLS or not.

# Delete the "ssl-redirect" annotations in "expose.ingress.annotations" when TLS is disabled and "expose.type" is "ingress"

# Note: if the "expose.type" is "ingress" and TLS is disabled,

# the port must be included in the command when pulling/pushing images.

# Refer to https://github.com/goharbor/harbor/issues/5291 for details.

enabled: true

# The source of the tls certificate. Set as "auto", "secret"

# or "none" and fill the information in the corresponding section

# 1) auto: generate the tls certificate automatically

# 2) secret: read the tls certificate from the specified secret.

# The tls certificate can be generated manually or by cert manager

# 3) none: configure no tls certificate for the ingress. If the default

# tls certificate is configured in the ingress controller, choose this option

certSource: auto

auto:

# The common name used to generate the certificate, it's necessary

# when the type isn't "ingress"

commonName: ""

secret:

# The name of secret which contains keys named:

# "tls.crt" - the certificate

# "tls.key" - the private key

secretName: ""

ingress:

hosts:

core: core.harbor.domain

# set to the type of ingress controller if it has specific requirements.

# leave as `default` for most ingress controllers.

# set to `gce` if using the GCE ingress controller

# set to `ncp` if using the NCP (NSX-T Container Plugin) ingress controller

# set to `alb` if using the ALB ingress controller

# set to `f5-bigip` if using the F5 BIG-IP ingress controller

controller: default

## Allow .Capabilities.KubeVersion.Version to be overridden while creating ingress

kubeVersionOverride: ""

className: ""

annotations:

# note different ingress controllers may require a different ssl-redirect annotation

# for Envoy, use ingress.kubernetes.io/force-ssl-redirect: "true" and remove the nginx lines below

ingress.kubernetes.io/ssl-redirect: "true"

ingress.kubernetes.io/proxy-body-size: "0"

nginx.ingress.kubernetes.io/ssl-redirect: "true"

nginx.ingress.kubernetes.io/proxy-body-size: "0"

# ingress-specific labels

labels: {}

route:

labels: {}

annotations: {}

# References to the parent gateways

parentRefs: []

# - name: envoy-internal

# namespace: networking

# sectionName: https

# group: gateway.networking.k8s.io

# kind: Gateway

# The hostnames for the HTTPRoute

hosts: []

# - "harbor.example.com"

clusterIP:

# The name of ClusterIP service

# The ip address of the ClusterIP service (leave empty for acquiring dynamic ip)

staticClusterIP: ""

ports:

# The service port Harbor listens on when serving HTTP

httpPort: 80

# The service port Harbor listens on when serving HTTPS

httpsPort: 443

# Annotations on the ClusterIP service

annotations: {}

# ClusterIP-specific labels

labels: {}

nodePort:

# The name of NodePort service

ports:

http:

# The service port Harbor listens on when serving HTTP

port: 80

# The node port Harbor listens on when serving HTTP

nodePort: 30002

https:

# The service port Harbor listens on when serving HTTPS

port: 443

# The node port Harbor listens on when serving HTTPS

nodePort: 30003

# Annotations on the nodePort service

annotations: {}

# nodePort-specific labels

labels: {}

loadBalancer:

# The name of LoadBalancer service

# Set the IP if the LoadBalancer supports assigning IP

100

IP: ""

101

ports:

102

# The service port Harbor listens on when serving HTTP

103

httpPort: 80

104

# The service port Harbor listens on when serving HTTPS

105

httpsPort: 443

106

# Annotations on the loadBalancer service

107

annotations: {}

108

# loadBalancer-specific labels

109

labels: {}

110

sourceRanges: []

111

# The external URL for Harbor core service. It is used to

112

# 1) populate the docker/helm commands showed on portal

113

# 2) populate the token service URL returned to docker client

114

115

# Format: protocol://domain[:port]. Usually:

116

# 1) if "expose.type" is "ingress", the "domain" should be

117

# the value of "expose.ingress.hosts.core"

118

# 2) if "expose.type" is "clusterIP", the "domain" should be

119

# the value of "expose.clusterIP.name"

120

# 3) if "expose.type" is "nodePort", the "domain" should be

121

# the IP address of k8s node

122

123

# If Harbor is deployed behind the proxy, set it as the URL of proxy

124

externalURL: https://core.harbor.domain

125

# The persistence is enabled by default and a default StorageClass

126

# is needed in the k8s cluster to provision volumes dynamically.

127

# Specify another StorageClass in the "storageClass" or set "existingClaim"

128

# if you already have existing persistent volumes to use

129

130

# For storing images and charts, you can also use "azure", "gcs", "s3",

131

# "swift" or "oss". Set it in the "imageChartStorage" section

132

persistence:

133

enabled: true

134

# Setting it to "keep" to avoid removing PVCs during a helm delete

135

# operation. Leaving it empty will delete PVCs after the chart deleted

136

# (this does not apply for PVCs that are created for internal database

137

# and redis components, i.e. they are never deleted automatically)

138

resourcePolicy: "keep"

139

persistentVolumeClaim:

140

registry:

141

# Use the existing PVC which must be created manually before bound,

142

# and specify the "subPath" if the PVC is shared with other components

143

existingClaim: ""

144

# Specify the "storageClass" used to provision the volume. Or the default

145

# StorageClass will be used (the default).

146

# Set it to "-" to disable dynamic provisioning

147

storageClass: ""

148

subPath: ""

149

accessMode: ReadWriteOnce

150

size: 5Gi

151

annotations: {}

152

jobservice:

153

jobLog:

154

existingClaim: ""

155

storageClass: ""

156

subPath: ""

157

accessMode: ReadWriteOnce

158

size: 1Gi

159

annotations: {}

160

# If external database is used, the following settings for database will

161

# be ignored

162

database:

163

existingClaim: ""

164

storageClass: ""

165

subPath: ""

166

accessMode: ReadWriteOnce

167

size: 1Gi

168

annotations: {}

169

# If external Redis is used, the following settings for Redis will

170

# be ignored

171

redis:

172

existingClaim: ""

173

storageClass: ""

174

subPath: ""

175

accessMode: ReadWriteOnce

176

size: 1Gi

177

annotations: {}

178

trivy:

179

existingClaim: ""

180

storageClass: ""

181

subPath: ""

182

accessMode: ReadWriteOnce

183

size: 5Gi

184

annotations: {}

185

# Define which storage backend is used for registry to store

186

# images and charts. Refer to

187

# https://github.com/distribution/distribution/blob/release/2.8/docs/configuration.md#storage

188

# for the detail.

189

imageChartStorage:

190

# Specify whether to disable `redirect` for images and chart storage, for

191

# backends which not supported it (such as using minio for `s3` storage type), please disable

192

# it. To disable redirects, simply set `disableredirect` to `true` instead.

193

# Refer to

194

# https://github.com/distribution/distribution/blob/release/2.8/docs/configuration.md#redirect

195

# for the detail.

196

disableredirect: false

197

# Specify the "caBundleSecretName" if the storage service uses a self-signed certificate.

198

# The secret must contain keys named "ca.crt" which will be injected into the trust store

199

# of registry's containers.

200

# caBundleSecretName:

201

202

# Specify the type of storage: "filesystem", "azure", "gcs", "s3", "swift",

203

# "oss" and fill the information needed in the corresponding section. The type

204

# must be "filesystem" if you want to use persistent volumes for registry

205

type: filesystem

206

filesystem:

207

rootdirectory: /storage

208

#maxthreads: 100

209

azure:

210

accountname: accountname

211

accountkey: base64encodedaccountkey

212

container: containername

213

#realm: core.windows.net

214

# To use existing secret, the key must be AZURE_STORAGE_ACCESS_KEY

215

existingSecret: ""

216

gcs:

217

bucket: bucketname

218

# The base64 encoded json file which contains the key

219

encodedkey: base64-encoded-json-key-file

220

#rootdirectory: /gcs/object/name/prefix

221

#chunksize: "5242880"

222

# To use existing secret, the key must be GCS_KEY_DATA

223

existingSecret: ""

224

useWorkloadIdentity: false

225

s3:

226

# Set an existing secret for S3 accesskey and secretkey

227

# keys in the secret should be REGISTRY_STORAGE_S3_ACCESSKEY and REGISTRY_STORAGE_S3_SECRETKEY for registry

228

#existingSecret: ""

229

region: us-west-1

230

bucket: bucketname

231

#accesskey: awsaccesskey

232

#secretkey: awssecretkey

233

#regionendpoint: http://myobjects.local

234

#encrypt: false

235

#keyid: mykeyid

236

#secure: true

237

#skipverify: false

238

#v4auth: true

239

#chunksize: "5242880"

240

#rootdirectory: /s3/object/name/prefix

241

#storageclass: STANDARD

242

#multipartcopychunksize: "33554432"

243

#multipartcopymaxconcurrency: 100

244

#multipartcopythresholdsize: "33554432"

245

swift:

246

authurl: https://storage.myprovider.com/v3/auth

247

username: username

248

password: password

249

container: containername

250

# keys in existing secret must be REGISTRY_STORAGE_SWIFT_PASSWORD, REGISTRY_STORAGE_SWIFT_SECRETKEY, REGISTRY_STORAGE_SWIFT_ACCESSKEY

251

existingSecret: ""

252

#region: fr

253

#tenant: tenantname

254

#tenantid: tenantid

255

#domain: domainname

256

#domainid: domainid

257

#trustid: trustid

258

#insecureskipverify: false

259

#chunksize: 5M

260

#prefix:

261

#secretkey: secretkey

262

#accesskey: accesskey

263

#authversion: 3

264

#endpointtype: public

265

#tempurlcontainerkey: false

266

#tempurlmethods:

267

oss:

268

accesskeyid: accesskeyid

269

accesskeysecret: accesskeysecret

270

region: regionname

271

bucket: bucketname

272

# key in existingSecret must be REGISTRY_STORAGE_OSS_ACCESSKEYSECRET

273

existingSecret: ""

274

#endpoint: endpoint

275

#internal: false

276

#encrypt: false

277

#secure: true

278

#chunksize: 10M

279

#rootdirectory: rootdirectory

280

# The initial password of Harbor admin. Change it from portal after launching Harbor

281

# or give an existing secret for it

282

# key in secret is given via (default to HARBOR_ADMIN_PASSWORD)

283

existingSecretAdminPassword: ""

284

existingSecretAdminPasswordKey: HARBOR_ADMIN_PASSWORD

285

harborAdminPassword: "Harbor12345"

286

# The internal TLS used for harbor components secure communicating. In order to enable https

287

# in each component tls cert files need to provided in advance.

288

internalTLS:

289

# If internal TLS enabled

290

enabled: false

291

# enable strong ssl ciphers (default: false)

292

strong_ssl_ciphers: false

293

# There are three ways to provide tls

294

# 1) "auto" will generate cert automatically

295

# 2) "manual" need provide cert file manually in following value

296

# 3) "secret" internal certificates from secret

297

certSource: "auto"

298

# The content of trust ca, only available when `certSource` is "manual"

299

trustCa: ""

300

# core related cert configuration

301

core:

302

# secret name for core's tls certs

303

secretName: ""

304

# Content of core's TLS cert file, only available when `certSource` is "manual"

305

crt: ""

306

# Content of core's TLS key file, only available when `certSource` is "manual"

307

key: ""

308

# jobservice related cert configuration

309

jobservice:

310

# secret name for jobservice's tls certs

311

secretName: ""

312

# Content of jobservice's TLS key file, only available when `certSource` is "manual"

313

crt: ""

314

# Content of jobservice's TLS key file, only available when `certSource` is "manual"

315

key: ""

316

# registry related cert configuration

317

registry:

318

# secret name for registry's tls certs

319

secretName: ""

320

# Content of registry's TLS key file, only available when `certSource` is "manual"

321

crt: ""

322

# Content of registry's TLS key file, only available when `certSource` is "manual"

323

key: ""

324

# portal related cert configuration

325

portal:

326

# secret name for portal's tls certs

327

secretName: ""

328

# Content of portal's TLS key file, only available when `certSource` is "manual"

329

crt: ""

330

# Content of portal's TLS key file, only available when `certSource` is "manual"

331

key: ""

332

# trivy related cert configuration

333

trivy:

334

# secret name for trivy's tls certs

335

secretName: ""

336

# Content of trivy's TLS key file, only available when `certSource` is "manual"

337

crt: ""

338

# Content of trivy's TLS key file, only available when `certSource` is "manual"

339

key: ""

340

ipFamily:

341

# ipv6Enabled set to true if ipv6 is enabled in cluster, currently it affected the nginx related component

342

ipv6:

343

enabled: true

344

# ipv4Enabled set to true if ipv4 is enabled in cluster, currently it affected the nginx related component

345

ipv4:

346

enabled: true

347

# Sets the IP family policy for services to be able to configure dual-stack; see [Configure dual-stack](https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services).

348

policy: ""

349

# A list of IP families for services that should be supported, in the order in which they should be applied to ClusterIP. Can be "IPv4" and/or "IPv6".

350

families: []

351

imagePullPolicy: IfNotPresent

352

# Use this set to assign a list of default pullSecrets

353

imagePullSecrets:

354

# - name: docker-registry-secret

355

# - name: internal-registry-secret

356

357

# The update strategy for deployments with persistent volumes(jobservice, registry): "RollingUpdate" or "Recreate"

358

# Set it as "Recreate" when "RWM" for volumes isn't supported

359

updateStrategy:

360

type: RollingUpdate

361

# debug, info, warning, error or fatal

362

logLevel: info

363

# The name of the secret which contains key named "ca.crt". Setting this enables the

364

# download link on portal to download the CA certificate when the certificate isn't

365

# generated automatically

366

caSecretName: ""

367

# The secret key used for encryption. Must be a string of 16 chars.

368

secretKey: "not-a-secure-key"

369

# If using existingSecretSecretKey, the key must be secretKey

370

existingSecretSecretKey: ""

371

# The proxy settings for updating trivy vulnerabilities from the Internet and replicating

372

# artifacts from/to the registries that cannot be reached directly

373

proxy:

374

httpProxy:

375

httpsProxy:

376

noProxy: 127.0.0.1,localhost,.local,.internal

377

components:

378

- core

379

- jobservice

380

- trivy

381

# Run the migration job via helm hook

382

enableMigrateHelmHook: false

383

# The custom ca bundle secret, the secret must contain key named "ca.crt"

384

# which will be injected into the trust store for core, jobservice, registry, trivy components

385

# caBundleSecretName: ""

386

387

## UAA Authentication Options

388

# If you're using UAA for authentication behind a self-signed

389

# certificate you will need to provide the CA Cert.

390

# Set uaaSecretName below to provide a pre-created secret that

391

# contains a base64 encoded CA Certificate named `ca.crt`.

392

# uaaSecretName:

393

metrics:

394

enabled: false

395

core:

396

path: /metrics

397

port: 8001

398

registry:

399

path: /metrics

400

port: 8001

401

jobservice:

402

path: /metrics

403

port: 8001

404

exporter:

405

path: /metrics

406

port: 8001

407

## Create prometheus serviceMonitor to scrape harbor metrics.

408

## This requires the monitoring.coreos.com/v1 CRD. Please see

409

## https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/user-guides/getting-started.md

410

411

serviceMonitor:

412

enabled: false

413

additionalLabels: {}

414

# Scrape interval. If not set, the Prometheus default scrape interval is used.

415

interval: ""

416

# Metric relabel configs to apply to samples before ingestion.

417

metricRelabelings: []

418

# - action: keep

419

420

# sourceLabels: [__name__]

421

# Relabel configs to apply to samples before ingestion.

422

relabelings: []

423

# - sourceLabels: [__meta_kubernetes_pod_node_name]

424

# separator: ;

425

# regex: ^(.*)$

426

# targetLabel: nodename

427

# replacement: $1

428

# action: replace

429

trace:

430

enabled: false

431

# trace provider: jaeger or otel

432

# jaeger should be 1.26+

433

provider: jaeger

434

# set sample_rate to 1 if you wanna sampling 100% of trace data; set 0.5 if you wanna sampling 50% of trace data, and so forth

435

sample_rate: 1

436

# namespace used to differentiate different harbor services

437

# namespace:

438

# attributes is a key value dict contains user defined attributes used to initialize trace provider

439

# attributes:

440

# application: harbor

441

jaeger:

442

# jaeger supports two modes:

443

# collector mode(uncomment endpoint and uncomment username, password if needed)

444

# agent mode(uncomment agent_host and agent_port)

445

endpoint: http://hostname:14268/api/traces

446

# username:

447

# password:

448

# agent_host: hostname

449

# export trace data by jaeger.thrift in compact mode

450

# agent_port: 6831

451

otel:

452

endpoint: hostname:4318

453

url_path: /v1/traces

454

compression: false

455

insecure: true

456

# timeout is in seconds

457

timeout: 10

458

# cache layer configurations

459

# if this feature enabled, harbor will cache the resource

460

# `project/project_metadata/repository/artifact/manifest` in the redis

461

# which help to improve the performance of high concurrent pulling manifest.

462

cache:

463

# default is not enabled.

464

enabled: false

465

# default keep cache for one day.

466

expireHours: 24

467

## set Container Security Context to comply with PSP restricted policy if necessary

468

## each of the conatiner will apply the same security context

469

## containerSecurityContext:{} is initially an empty yaml that you could edit it on demand, we just filled with a common template for convenience

470

containerSecurityContext:

471

privileged: false

472

allowPrivilegeEscalation: false

473

seccompProfile:

474

type: RuntimeDefault

475

runAsNonRoot: true

476

capabilities:

477

drop:

478

- ALL

479

# If service exposed via "ingress", the Nginx will not be used

480

nginx:

481

image:

482

repository: cgr.dev/chainguard-private/nginx

483

tag: mainline@sha256:26227f1fa80092c4d5c80c83ee490c144db5bf7e43de5904d4ee8897b6d7d275

484

# set the service account to be used, default if left empty

485

serviceAccountName: ""

486

# mount the service account token

487

automountServiceAccountToken: false

488

replicas: 1

489

podDisruptionBudget:

490

enabled: false

491

minAvailable: 1

492

# maxUnavailable: 1

493

revisionHistoryLimit: 10

494

# resources:

495

# requests:

496

# memory: 256Mi

497

# cpu: 100m

498

extraEnvVars: []

499

nodeSelector: {}

500

tolerations: []

501

affinity: {}

502

# Spread Pods across failure-domains like regions, availability zones or nodes

503

topologySpreadConstraints: []

504

# - maxSkew: 1

505

# topologyKey: topology.kubernetes.io/zone

506

# nodeTaintsPolicy: Honor

507

# whenUnsatisfiable: DoNotSchedule

508

## Additional deployment annotations

509

podAnnotations: {}

510

## Additional deployment labels

511

podLabels: {}

512

## The priority class to run the pod as

513

priorityClassName:

514

## Liveness probe values

515

livenessProbe:

516

initialDelaySeconds: 300

517

periodSeconds: 10

518

timeoutSeconds: 1

519

failureThreshold: 3

520

successThreshold: 1

521

## Readiness probe values

522

readinessProbe:

523

initialDelaySeconds: 1

524

periodSeconds: 10

525

timeoutSeconds: 1

526

failureThreshold: 3

527

successThreshold: 1

528

portal:

529

image:

530

repository: cgr.dev/chainguard-private/harbor-portal

531

tag: 2.15.2-r7@sha256:cfa93b362231de0f9f419d86e8ea9719d31640d3a1df481d0a3eab15cf9d5023

532

# set the service account to be used, default if left empty

533

serviceAccountName: ""

534

# mount the service account token

535

automountServiceAccountToken: false

536

replicas: 1

537

podDisruptionBudget:

538

enabled: false

539

minAvailable: 1

540

# maxUnavailable: 1

541

revisionHistoryLimit: 10

542

# resources:

543

# requests:

544

# memory: 256Mi

545

# cpu: 100m

546

extraEnvVars: []

547

nodeSelector: {}

548

tolerations: []

549

affinity: {}

550

# Spread Pods across failure-domains like regions, availability zones or nodes

551

topologySpreadConstraints: []

552

# - maxSkew: 1

553

# topologyKey: topology.kubernetes.io/zone

554

# nodeTaintsPolicy: Honor

555

# whenUnsatisfiable: DoNotSchedule

556

## Additional deployment annotations

557

podAnnotations: {}

558

## Additional deployment labels

559

podLabels: {}

560

## Additional service annotations

561

serviceAnnotations: {}

562

## The priority class to run the pod as

563

priorityClassName:

564

## Liveness probe values

565

livenessProbe:

566

initialDelaySeconds: 300

567

periodSeconds: 10

568

timeoutSeconds: 1

569

failureThreshold: 3

570

successThreshold: 1

571

## Readiness probe values

572

readinessProbe:

573

initialDelaySeconds: 1

574

periodSeconds: 10

575

timeoutSeconds: 1

576

failureThreshold: 3

577

successThreshold: 1

578

# containers to be run before the controller's container starts.

579

initContainers: []

580

# Example:

581

582

# - name: wait

583

# image: busybox

584

# command: [ 'sh', '-c', "sleep 20" ]

585

core:

586

image:

587

repository: cgr.dev/chainguard-private/harbor-core

588

tag: 2.15.2-r7@sha256:c1c7c81f0fb497f287553ac1ee84910f22cefdb0ff86ef4e3bb60a369ffb98a8

589

# set the service account to be used, default if left empty

590

serviceAccountName: ""

591

# mount the service account token

592

automountServiceAccountToken: false

593

replicas: 1

594

podDisruptionBudget:

595

enabled: false

596

minAvailable: 1

597

# maxUnavailable: 1

598

revisionHistoryLimit: 10

599

## Startup probe values

600

startupProbe:

601

enabled: true

602

initialDelaySeconds: 10

603

periodSeconds: 10

604

timeoutSeconds: 1

605

failureThreshold: 360

606

successThreshold: 1

607

## Liveness probe values

608

livenessProbe:

609

initialDelaySeconds: 0

610

periodSeconds: 10

611

timeoutSeconds: 1

612

failureThreshold: 2

613

successThreshold: 1

614

## Readiness probe values

615

readinessProbe:

616

initialDelaySeconds: 0

617

periodSeconds: 10

618

timeoutSeconds: 1

619

failureThreshold: 2

620

successThreshold: 1

621

# resources:

622

# requests:

623

# memory: 256Mi

624

# cpu: 100m

625

extraEnvVars: []

626

nodeSelector: {}

627

tolerations: []

628

affinity: {}

629

# Spread Pods across failure-domains like regions, availability zones or nodes

630

topologySpreadConstraints: []

631

# - maxSkew: 1

632

# topologyKey: topology.kubernetes.io/zone

633

# nodeTaintsPolicy: Honor

634

# whenUnsatisfiable: DoNotSchedule

635

## Additional deployment annotations

636

podAnnotations: {}

637

## Additional deployment labels

638

podLabels: {}

639

## Additional service annotations

640

serviceAnnotations: {}

641

## The priority class to run the pod as

642

priorityClassName:

643

# containers to be run before the controller's container starts.

644

initContainers: []

645

# Example:

646

647

# - name: wait

648

# image: busybox

649

# command: [ 'sh', '-c', "sleep 20" ]

650

## User settings configuration json string

651

configureUserSettings:

652

# The provider for updating project quota(usage), there are 2 options, redis or db.

653

# By default it is implemented by db but you can configure it to redis which

654

# can improve the performance of high concurrent pushing to the same project,

655

# and reduce the database connections spike and occupies.

656

# Using redis will bring up some delay for quota usage updation for display, so only

657

# suggest switch provider to redis if you were ran into the db connections spike around

658

# the scenario of high concurrent pushing to same project, no improvment for other scenes.

659

quotaUpdateProvider: db # Or redis

660

# Secret is used when core server communicates with other components.

661

# If a secret key is not specified, Helm will generate one. Alternatively set existingSecret to use an existing secret

662

# Must be a string of 16 chars.

663

secret: ""

664

# Fill in the name of a kubernetes secret if you want to use your own

665

# If using existingSecret, the key must be secret

666

existingSecret: ""

667

# Fill the name of a kubernetes secret if you want to use your own

668

# TLS certificate and private key for token encryption/decryption.

669

# The secret must contain keys named:

670

# "tls.key" - the private key

671

# "tls.crt" - the certificate

672

secretName: ""

673

# If not specifying a preexisting secret, a secret can be created from tokenKey and tokenCert and used instead.

674

# If none of secretName, tokenKey, and tokenCert are specified, an ephemeral key and certificate will be autogenerated.

675

# tokenKey and tokenCert must BOTH be set or BOTH unset.

676

# The tokenKey value is formatted as a multiline string containing a PEM-encoded RSA key, indented one more than tokenKey on the following line.

677

tokenKey: ""

678

# If tokenKey is set, the value of tokenCert must be set as a PEM-encoded certificate signed by tokenKey, and supplied as a multiline string, indented one more than tokenCert on the following line.

679

tokenCert: ""

680

# The XSRF key. Will be generated automatically if it isn't specified

681

# While you specified, Please make sure it is 32 characters, otherwise would have validation issue at the harbor-core runtime

682

# https://github.com/goharbor/harbor/pull/21154

683

xsrfKey: ""

684

# If using existingSecret, the key is defined by core.existingXsrfSecretKey

685

existingXsrfSecret: ""

686

# If using existingSecret, the key

687

existingXsrfSecretKey: CSRF_KEY

688

# The time duration for async update artifact pull_time and repository

689

# pull_count, the unit is second. Will be 10 seconds if it isn't set.

690

# eg. artifactPullAsyncFlushDuration: 10

691

artifactPullAsyncFlushDuration:

692

gdpr:

693

deleteUser: false

694

auditLogsCompliant: false

695

jobservice:

696

image:

697

repository: cgr.dev/chainguard-private/harbor-jobservice

698

tag: 2.15.2-r7@sha256:f06f529c87b2384654f1e652f7869e4a83bc397b2a047a87e4cc8bc0291026e3

699

replicas: 1

700

podDisruptionBudget:

701

enabled: false

702

minAvailable: 1

703

# maxUnavailable: 1

704

revisionHistoryLimit: 10

705

# set the service account to be used, default if left empty

706

serviceAccountName: ""

707

# mount the service account token

708

automountServiceAccountToken: false

709

# resources:

710

# requests:

711

# memory: 256Mi

712

# cpu: 100m

713

## Liveness probe values

714

livenessProbe:

715

initialDelaySeconds: 300

716

periodSeconds: 10

717

timeoutSeconds: 1

718

failureThreshold: 3

719

successThreshold: 1

720

## Readiness probe values

721

readinessProbe:

722

initialDelaySeconds: 20

723

periodSeconds: 10

724

timeoutSeconds: 1

725

failureThreshold: 3

726

successThreshold: 1

727

extraEnvVars: []

728

nodeSelector: {}

729

tolerations: []

730

affinity: {}

731

# Spread Pods across failure-domains like regions, availability zones or nodes

732

topologySpreadConstraints:

733

# - maxSkew: 1

734

# topologyKey: topology.kubernetes.io/zone

735

# nodeTaintsPolicy: Honor

736

# whenUnsatisfiable: DoNotSchedule

737

## Additional deployment annotations

738

podAnnotations: {}

739

## Additional deployment labels

740

podLabels: {}

741

## The priority class to run the pod as

742

priorityClassName:

743

# containers to be run before the controller's container starts.

744

initContainers: []

745

# Example:

746

747

# - name: wait

748

# image: busybox

749

# command: [ 'sh', '-c', "sleep 20" ]

750

maxJobWorkers: 10

751

# The logger for jobs: "file", "database" or "stdout"

752

jobLoggers:

753

- file

754

# - database

755

# - stdout

756

# The jobLogger sweeper duration (ignored if `jobLogger` is `stdout`)

757

loggerSweeperDuration: 14 #days

758

notification:

759

webhook_job_max_retry: 3

760

webhook_job_http_client_timeout: 3 # in seconds

761

reaper:

762

# the max time to wait for a task to finish, if unfinished after max_update_hours, the task will be mark as error, but the task will continue to run, default value is 24

763

max_update_hours: 24

764

# the max time for execution in running state without new task created

765

max_dangling_hours: 168

766

# Secret is used when job service communicates with other components.

767

# If a secret key is not specified, Helm will generate one.

768

# Must be a string of 16 chars.

769

secret: ""

770

# Use an existing secret resource

771

existingSecret: ""

772

# Key within the existing secret for the job service secret

773

existingSecretKey: JOBSERVICE_SECRET

774

# By default, the timeout is set to 30 minutes. This field only needs be re-configured if a longer request timeout is required.

775

# the value assigned to timeout should be a number without min, e.g. registryHttpClientTimeout: 60 configures the timeout to 60 minutes

776

registryHttpClientTimeout: 30

777

registry:

778

registry:

779

image:

780

repository: cgr.dev/chainguard-private/harbor-registry

781

tag: 2.15.2-r7@sha256:e75ef36f32da3c636eef9892dbba94be8aac06bde2d9c50356249cc0b1e9c936

782

# resources:

783

# requests:

784

# memory: 256Mi

785

# cpu: 100m

786

extraEnvVars: []

787

## Liveness probe values

788

livenessProbe:

789

initialDelaySeconds: 300

790

periodSeconds: 10

791

timeoutSeconds: 1

792

failureThreshold: 3

793

successThreshold: 1

794

## Readiness probe values

795

readinessProbe:

796

initialDelaySeconds: 1

797

periodSeconds: 10

798

timeoutSeconds: 1

799

failureThreshold: 3

800

successThreshold: 1

801

controller:

802

image:

803

repository: cgr.dev/chainguard-private/harbor-registryctl

804

tag: 2.15.2-r7@sha256:5de1b1c6060d51c5344d26e1a1e8c097cad0093a3cab6b055fa9c4fed8881d56

805

# resources:

806

# requests:

807

# memory: 256Mi

808

# cpu: 100m

809

extraEnvVars: []

810

## Liveness probe values

811

livenessProbe:

812

initialDelaySeconds: 300

813

periodSeconds: 10

814

timeoutSeconds: 1

815

failureThreshold: 3

816

successThreshold: 1

817

## Readiness probe values

818

readinessProbe:

819

initialDelaySeconds: 1

820

periodSeconds: 10

821

timeoutSeconds: 1

822

failureThreshold: 3

823

successThreshold: 1

824

# set the service account to be used, default if left empty

825

serviceAccountName: ""

826

# mount the service account token

827

automountServiceAccountToken: false

828

replicas: 1

829

podDisruptionBudget:

830

enabled: false

831

minAvailable: 1

832

# maxUnavailable: 1

833

revisionHistoryLimit: 10

834

nodeSelector: {}

835

tolerations: []

836

affinity: {}

837

# Spread Pods across failure-domains like regions, availability zones or nodes

838

topologySpreadConstraints: []

839

# - maxSkew: 1

840

# topologyKey: topology.kubernetes.io/zone

841

# nodeTaintsPolicy: Honor

842

# whenUnsatisfiable: DoNotSchedule

843

## Additional deployment annotations

844

podAnnotations: {}

845

## Additional deployment labels

846

podLabels: {}

847

## The priority class to run the pod as

848

priorityClassName:

849

# containers to be run before the controller's container starts.

850

initContainers: []

851

# Example:

852

853

# - name: wait

854

# image: busybox

855

# command: [ 'sh', '-c', "sleep 20" ]

856

# Secret is used to secure the upload state from client

857

# and registry storage backend.

858

# See: https://github.com/distribution/distribution/blob/release/2.8/docs/configuration.md#http

859

# If a secret key is not specified, Helm will generate one.

860

# Must be a string of 16 chars.

861

secret: ""

862

# Use an existing secret resource

863

existingSecret: ""

864

# Key within the existing secret for the registry service secret

865

existingSecretKey: REGISTRY_HTTP_SECRET

866

# If true, the registry returns relative URLs in Location headers. The client is responsible for resolving the correct URL.

867

relativeurls: false

868

credentials:

869

username: "harbor_registry_user"

870

password: "harbor_registry_password"

871

# If using existingSecret, the key must be REGISTRY_PASSWD and REGISTRY_HTPASSWD

872

existingSecret: ""

873

# Login and password in htpasswd string format. Excludes `registry.credentials.username` and `registry.credentials.password`. May come in handy when integrating with tools like argocd or flux. This allows the same line to be generated each time the template is rendered, instead of the `htpasswd` function from helm, which generates different lines each time because of the salt.

874

# htpasswdString: "harbor_registry_user:$2a$05$IPnI.TSgP8ek1/ESjkULVemA.A3nSXPdN80ljsmcun7FtE3ViSYUq" # example string, bcrypt is the only accepted hashing algorithm in htpasswd here.

875

htpasswdString: ""

876

middleware:

877

enabled: false

878

type: cloudFront

879

cloudFront:

880

baseurl: example.cloudfront.net

881

keypairid: KEYPAIRID

882

duration: 3000s

883

ipfilteredby: none

884

# The secret key that should be present is CLOUDFRONT_KEY_DATA, which should be the encoded private key

885

# that allows access to CloudFront

886

privateKeySecret: "my-secret"

887

# enable purge _upload directories

888

upload_purging:

889

enabled: true

890

# remove files in _upload directories which exist for a period of time, default is one week.

891

age: 168h

892

# the interval of the purge operations

893

interval: 24h

894

dryrun: false

895

trivy:

896

# enabled the flag to enable Trivy scanner

897

enabled: true

898

image:

899

# repository the repository for Trivy adapter image

900

repository: cgr.dev/chainguard-private/harbor-trivy-adapter

901

# tag the tag for Trivy adapter image

902

tag: 2.15.2-r7@sha256:68346e055f23fb1b03502c50b8747c4e051d4279f3ae3fd2e54c74f860800a20

903

# set the service account to be used, default if left empty

904

serviceAccountName: ""

905

# mount the service account token

906

automountServiceAccountToken: false

907

# replicas the number of Pod replicas

908

replicas: 1

909

podDisruptionBudget:

910

enabled: false

911

minAvailable: 1

912

# maxUnavailable: 1

913

resources:

914

requests:

915

cpu: 200m

916

memory: 512Mi

917

limits:

918

cpu: 1

919

memory: 1Gi

920

## Liveness probe values

921

livenessProbe:

922

initialDelaySeconds: 5

923

periodSeconds: 10

924

timeoutSeconds: 1

925

failureThreshold: 10

926

successThreshold: 1

927

## Readiness probe values

928

readinessProbe:

929

initialDelaySeconds: 5

930

periodSeconds: 10

931

timeoutSeconds: 1

932

failureThreshold: 3

933

successThreshold: 1

934

extraEnvVars: []

935

nodeSelector: {}

936

tolerations: []

937

affinity: {}

938

# Spread Pods across failure-domains like regions, availability zones or nodes

939

topologySpreadConstraints: []

940

# - maxSkew: 1

941

# topologyKey: topology.kubernetes.io/zone

942

# nodeTaintsPolicy: Honor

943

# whenUnsatisfiable: DoNotSchedule

944

## Additional deployment annotations

945

podAnnotations: {}

946

## Additional deployment labels

947

podLabels: {}

948

## The priority class to run the pod as

949

priorityClassName:

950

# containers to be run before the controller's container starts.

951

initContainers: []

952

# Example:

953

954

# - name: wait

955

# image: busybox

956

# command: [ 'sh', '-c', "sleep 20" ]

957

# debugMode the flag to enable Trivy debug mode with more verbose scanning log

958

debugMode: false

959

# vulnType a comma-separated list of vulnerability types. Possible values are `os` and `library`.

960

vulnType: "os,library"

961

# severity a comma-separated list of severities to be checked

962

severity: "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL"

963

# ignoreUnfixed the flag to display only fixed vulnerabilities

964

ignoreUnfixed: false

965

# insecure the flag to skip verifying registry certificate

966

insecure: false

967

# gitHubToken the GitHub access token to download Trivy DB

968

969

# Trivy DB contains vulnerability information from NVD, Red Hat, and many other upstream vulnerability databases.

970

# It is downloaded by Trivy from the GitHub release page https://github.com/aquasecurity/trivy-db/releases and cached

971

# in the local file system (`/home/scanner/.cache/trivy/db/trivy.db`). In addition, the database contains the update

972

# timestamp so Trivy can detect whether it should download a newer version from the Internet or use the cached one.

973

# Currently, the database is updated every 12 hours and published as a new release to GitHub.

974

975

# Anonymous downloads from GitHub are subject to the limit of 60 requests per hour. Normally such rate limit is enough

976

# for production operations. If, for any reason, it's not enough, you could increase the rate limit to 5000

977

# requests per hour by specifying the GitHub access token. For more details on GitHub rate limiting please consult

978

# https://developer.github.com/v3/#rate-limiting

979

980

# You can create a GitHub token by following the instructions in

981

# https://help.github.com/en/github/authenticating-to-github/creating-a-personal-access-token-for-the-command-line

982

gitHubToken: ""

983

# skipUpdate the flag to disable Trivy DB downloads from GitHub

984

985

# You might want to set the value of this flag to `true` in test or CI/CD environments to avoid GitHub rate limiting issues.

986

# If the value is set to `true` you have to manually download the `trivy.db` file and mount it in the

987

# `/home/scanner/.cache/trivy/db/trivy.db` path.

988

skipUpdate: false

989

# skipJavaDBUpdate If the flag is enabled you have to manually download the `trivy-java.db` file and mount it in the

990

# `/home/scanner/.cache/trivy/java-db/trivy-java.db` path

991

skipJavaDBUpdate: false

992

# The dbRepository and javaDBRepository flags can take multiple values, improving reliability when downloading databases.

993

# Databases are downloaded in priority order until one is successful.

994

# An attempt to download from the next repository is only made if a temporary error is received (e.g. status 429 or 5xx).

995

996

# OCI repository(ies) to retrieve the trivy vulnerability database in order of priority

997

dbRepository:

998

- "mirror.gcr.io/aquasec/trivy-db"

999

- "ghcr.io/aquasecurity/trivy-db"

1000

# OCI repository(ies) to retrieve the Java trivy vulnerability database in order of priority

1001

javaDBRepository:

1002

- "mirror.gcr.io/aquasec/trivy-java-db"

1003

- "ghcr.io/aquasecurity/trivy-java-db"

1004

# The offlineScan option prevents Trivy from sending API requests to identify dependencies.

1005

1006

# Scanning JAR files and pom.xml may require Internet access for better detection, but this option tries to avoid it.

1007

# For example, the offline mode will not try to resolve transitive dependencies in pom.xml when the dependency doesn't

1008

# exist in the local repositories. It means a number of detected vulnerabilities might be fewer in offline mode.

1009

# It would work if all the dependencies are in local.

1010

# This option doesn’t affect DB download. You need to specify skipUpdate as well as offlineScan in an air-gapped environment.

1011

offlineScan: false

1012

# Comma-separated list of what security issues to detect. Defaults to `vuln`.

1013

securityCheck: "vuln"

1014

# The duration to wait for scan completion

1015

timeout: 5m0s

1016

database:

1017

# if external database is used, set "type" to "external"

1018

# and fill the connection information in "external" section

1019

type: internal

1020

internal:

1021

image:

1022

repository: cgr.dev/chainguard-private/harbor-db

1023

tag: 2.15.2-r0@sha256:69a2ff042ae9568b42ff47bfaf3aab31109e3ecca8ee8d83dc7f56060a286a92

1024

# set the service account to be used, default if left empty

1025

serviceAccountName: ""

1026

# mount the service account token

1027

automountServiceAccountToken: false

1028

# resources:

1029

# requests:

1030

# memory: 256Mi

1031

# cpu: 100m

1032

## Liveness probe values

1033

livenessProbe:

1034

initialDelaySeconds: 300

1035

periodSeconds: 10

1036

timeoutSeconds: 1

1037

failureThreshold: 3

1038

successThreshold: 1

1039

## Readiness probe values

1040

readinessProbe:

1041

initialDelaySeconds: 1

1042

periodSeconds: 10

1043

timeoutSeconds: 1

1044

failureThreshold: 3

1045

successThreshold: 1

1046

extraEnvVars: []

1047

nodeSelector: {}

1048

tolerations: []

1049

affinity: {}

1050

## The priority class to run the pod as

1051

priorityClassName:

1052

# containers to be run before the controller's container starts.

1053

extrInitContainers: []

1054

# Example:

1055

1056

# - name: wait

1057

# image: busybox

1058

# command: [ 'sh', '-c', "sleep 20" ]

1059

# The initial superuser password for internal database

1060

password: "changeit"

1061

# The size limit for Shared memory, pgSQL use it for shared_buffer

1062

# More details see:

1063

# https://github.com/goharbor/harbor/issues/15034

1064

shmSizeLimit: 512Mi

1065

initContainer:

1066

migrator: {}

1067

# resources:

1068

# requests:

1069

# memory: 128Mi

1070

# cpu: 100m

1071

permissions: {}

1072

# resources:

1073

# requests:

1074

# memory: 128Mi

1075

# cpu: 100m

1076

external:

1077

host: "192.168.0.1"

1078

port: "5432"

1079

username: "user"

1080

password: "password"

1081

coreDatabase: "registry"

1082

# if using existing secret, the key must be "password"

1083

existingSecret: ""

1084

# "disable" - No SSL

1085

# "require" - Always SSL (skip verification)

1086

# "verify-ca" - Always SSL (verify that the certificate presented by the

1087

# server was signed by a trusted CA)

1088

# "verify-full" - Always SSL (verify that the certification presented by the

1089

# server was signed by a trusted CA and the server host name matches the one

1090

# in the certificate)

1091

sslmode: "disable"

1092

# The maximum number of connections in the idle connection pool per pod (core+exporter).

1093

# If it <=0, no idle connections are retained.

1094

maxIdleConns: 100

1095

# The maximum number of open connections to the database per pod (core+exporter).

1096

# If it <= 0, then there is no limit on the number of open connections.

1097

# Note: the default number of connections is 1024 for harbor's postgres.

1098

maxOpenConns: 900

1099

## Additional deployment annotations

1100

podAnnotations: {}

1101

## Additional deployment labels

1102

podLabels: {}

1103

redis:

1104

# if external Redis is used, set "type" to "external"

1105

# and fill the connection information in "external" section

1106

type: internal

1107

internal:

1108

image:

1109

repository: cgr.dev/chainguard-private/harbor-redis

1110

tag: 2.15.2-r7@sha256:49b4d626a9e07b5593273a895a12885c02e97010cd7d31fccd4678b09b55f056

1111

# set the service account to be used, default if left empty

1112

serviceAccountName: ""

1113

# mount the service account token

1114

automountServiceAccountToken: false

1115

# resources:

1116

# requests:

1117

# memory: 256Mi

1118

# cpu: 100m

1119

## Liveness probe values

1120

livenessProbe:

1121

initialDelaySeconds: 300

1122

periodSeconds: 10

1123

timeoutSeconds: 1

1124

failureThreshold: 3

1125

successThreshold: 1

1126

## Readiness probe values

1127

readinessProbe:

1128

initialDelaySeconds: 1

1129

periodSeconds: 10

1130

timeoutSeconds: 1

1131

failureThreshold: 3

1132

successThreshold: 1

1133

extraEnvVars: []

1134

nodeSelector: {}

1135

tolerations: []

1136

affinity: {}

1137

## The priority class to run the pod as

1138

priorityClassName:

1139

# containers to be run before the controller's container starts.

1140

initContainers: []

1141

# Example:

1142

1143

# - name: wait

1144

# image: busybox

1145

# command: [ 'sh', '-c', "sleep 20" ]

1146

# # jobserviceDatabaseIndex defaults to "1"

1147

# # registryDatabaseIndex defaults to "2"

1148

# # trivyAdapterIndex defaults to "5"

1149

# # harborDatabaseIndex defaults to "0", but it can be configured to "6", this config is optional

1150

# # cacheLayerDatabaseIndex defaults to "0", but it can be configured to "7", this config is optional

1151

jobserviceDatabaseIndex: "1"

1152

registryDatabaseIndex: "2"

1153

trivyAdapterIndex: "5"

1154

# harborDatabaseIndex: "6"

1155

# cacheLayerDatabaseIndex: "7"

1156

external:

1157

# support redis, redis+sentinel

1158

# addr for redis: <host_redis>:<port_redis>

1159

# addr for redis+sentinel: <host_sentinel1>:<port_sentinel1>,<host_sentinel2>:<port_sentinel2>,<host_sentinel3>:<port_sentinel3>

1160

addr: "192.168.0.2:6379"

1161

# The name of the set of Redis instances to monitor, it must be set to support redis+sentinel

1162

sentinelMasterSet: ""

1163

# TLS configuration for redis connection

1164

# only server-authentication is supported, mTLS for redis connection is not supported

1165

# tls connection will be disable by default

1166

# Once `tlsOptions.enable` set as true, tls/ssl connection will be used for redis

1167

# Please set the `caBundleSecretName` in this configuration file which conatins redis server rootCA if it is self-signed.

1168

# The secret must contain keys named "ca.crt" which will be injected into the trust store

1169

tlsOptions:

1170

enable: false

1171

# The "coreDatabaseIndex" must be "0" as the library Harbor

1172

# used doesn't support configuring it

1173

# harborDatabaseIndex defaults to "0", but it can be configured to "6", this config is optional

1174

# cacheLayerDatabaseIndex defaults to "0", but it can be configured to "7", this config is optional

1175

coreDatabaseIndex: "0"

1176

jobserviceDatabaseIndex: "1"

1177

registryDatabaseIndex: "2"

1178

trivyAdapterIndex: "5"

1179

# harborDatabaseIndex: "6"

1180

# cacheLayerDatabaseIndex: "7"

1181

# username field can be an empty string, and it will be authenticated against the default user

1182

username: ""

1183

password: ""

1184

# If using existingSecret, the key must be REDIS_PASSWORD, if ACL mode enabled, also inlcudes data of username, the keys must be REDIS_USERNAME

1185

existingSecret: ""

1186

## Additional deployment annotations

1187

podAnnotations: {}

1188

## Additional deployment labels

1189

podLabels: {}

1190

exporter:

1191

image:

1192

repository: cgr.dev/chainguard-private/harbor-exporter

1193

tag: 2.15.2-r7@sha256:b4a58c20abcc14e4f17b6b84118ebeb046dbad5f71df61b27d4e65e3612143cb

1194

serviceAccountName: ""

1195

# mount the service account token

1196

automountServiceAccountToken: false

1197

replicas: 1

1198

podDisruptionBudget:

1199

enabled: false

1200

minAvailable: 1

1201

# maxUnavailable: 1

1202

revisionHistoryLimit: 10

1203

# resources:

1204

# requests:

1205

# memory: 256Mi

1206

# cpu: 100m

1207

## Liveness probe values

1208

livenessProbe:

1209

initialDelaySeconds: 300

1210

periodSeconds: 10

1211

timeoutSeconds: 1

1212

failureThreshold: 3

1213

successThreshold: 1

1214

## Readiness probe values

1215

readinessProbe:

1216

initialDelaySeconds: 30

1217

periodSeconds: 10

1218

timeoutSeconds: 1

1219

failureThreshold: 3

1220

successThreshold: 1

1221

extraEnvVars: []

1222

podAnnotations: {}

1223

## Additional deployment labels

1224

podLabels: {}

1225

nodeSelector: {}

1226

tolerations: []

1227

affinity: {}

1228

# Spread Pods across failure-domains like regions, availability zones or nodes

1229

topologySpreadConstraints: []

1230

## The priority class to run the pod as

1231

priorityClassName:

1232

# - maxSkew: 1

1233

# topologyKey: topology.kubernetes.io/zone

1234

# nodeTaintsPolicy: Honor

1235

# whenUnsatisfiable: DoNotSchedule

1236

cacheDuration: 23

1237

cacheCleanInterval: 14400

1238

The trusted source for open source

Talk to an expert

Privacy

Terms

© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.

harbor

The trusted source for open source

Product

Solutions

Customers

Resources

Company