.lagoon.harbor-secrets.yaml

apiVersion: v1
kind: Template
metadata:
  creationTimestamp: null
  name: lagoon-secret-environment-template
parameters:
  - name: HARBOR_CORE_SECRET
    description: The secret used to connect to harbor's core service
    generate: expression
    from: "[a-zA-Z0-9]{16}"
  - name: HARBOR_JOBSERVICE_SECRET
    description: The secret used to connect to harbor's jobservice service
    generate: expression
    from: "[a-zA-Z0-9]{16}"
  - name: HARBOR_REGISTRY_SECRET
    description: The secret used to connect to harbor's registry service
    generate: expression
    from: "[a-zA-Z0-9]{16}"
  - name: HARBOR_ADMIN_PASSWORD
    description: Harbor's admin password
    generate: expression
    from: "[a-zA-Z0-9]{32}"
  - name: CLAIR_DB_PASSWORD
    description: The password clair should use to talk to the postgres db
    generate: expression
    from: "[a-zA-Z0-9]{32}"
  - name: SAFE_BRANCH
    description: Which branch this belongs to, special chars replaced with dashes
    required: true
  - name: SAFE_PROJECT
    description: Which project this belongs to, special chars replaced with dashes
    required: true
  - name: BRANCH
    description: Which branch this belongs to, original value
    required: true
  - name: PROJECT
    description: Which project this belongs to, original value
    required: true
  - name: LAGOON_GIT_SHA
    description: git hash sha of the current deployment
    required: true
  - name: OPENSHIFT_PROJECT
    description: Name of the Project that this service is in
    required: true
objects:
- kind: Secret
  apiVersion: v1
  metadata:
    name: harbor-core-secret
  stringData:
    HARBOR_CORE_SECRET: ${HARBOR_CORE_SECRET}
- kind: Secret
  apiVersion: v1
  metadata:
    name: harbor-jobservice-secret
  stringData:
    HARBOR_JOBSERVICE_SECRET: ${HARBOR_JOBSERVICE_SECRET}
- kind: Secret
  apiVersion: v1
  metadata:
    name: harborregistry-secret
  stringData:
    HARBOR_REGISTRY_SECRET: ${HARBOR_REGISTRY_SECRET}
- kind: Secret
  apiVersion: v1
  metadata:
    name: harbor-admin-password
  stringData:
    HARBOR_ADMIN_PASSWORD: ${HARBOR_ADMIN_PASSWORD}
- kind: Secret
  apiVersion: v1
  metadata:
    name: clair-db-password
  stringData:
    CLAIR_DB_PASSWORD: ${CLAIR_DB_PASSWORD}
- kind: Secret
  apiVersion: v1
  metadata:
    name: postgresql-password
  stringData:
    POSTGRESQL_PASSWORD: ${CLAIR_DB_PASSWORD}
- kind: Secret
  apiVersion: v1
  metadata:
    name: notary-db-url
  stringData:
    NOTARY_DB_URL: postgres://postgres:${CLAIR_DB_PASSWORD}@harbor-database:5432/notaryserver?sslmode=disable
- apiVersion: v1
  kind: ConfigMap
  metadata:
    name: harborclair
    labels:
      service: harborclair
      branch: ${SAFE_BRANCH}
      project: ${SAFE_PROJECT}
  type: Opaque
  data:
    config.yaml: |
      clair:
        database:
          type: pgsql
          options:
            source: "postgres://postgres:${CLAIR_DB_PASSWORD}@harbor-database:5432/postgres?sslmode=disable"
            # Number of elements kept in the cache
            # Values unlikely to change (e.g. namespaces) are cached in order to save prevent needless roundtrips to the database.
            cachesize: 16384
        api:
          # API server port
          port: 6060
          healthport: 6061
          # Deadline before an API request will respond with a 503
          timeout: 300s
        updater:
          interval: 1h
    redis: "redis://harbor-redis:6379/4"
    database: "postgres://postgres:${CLAIR_DB_PASSWORD}@harbor-database:5432/postgres?sslmode=disable"