chore(chart-deps): update harbor to version 1.17.0

chart/chart-index/Chart.yaml

@@ -27,7 +27,7 @@ dependencies:
     version: 11.0.1
     repository: https://dl.gitea.io/charts
   - name: harbor
-    version: 1.16.2
+    version: 1.17.0
     repository: https://helm.goharbor.io
   - name: ingress-nginx
     version: 4.11.6

charts/harbor/Chart.yaml

@@ -1,5 +1,5 @@
 apiVersion: v1
-appVersion: 2.12.2
+appVersion: 2.13.0
 description: An open source trusted cloud native registry that stores, signs, and
   scans content
 home: https://goharbor.io
@@ -11,12 +11,14 @@ keywords:
 maintainers:
 - email: [email protected]
   name: Yan Wang
-- email: stone.zhang@broadcom.com
-  name: Stone Zhang
+- email: wenkai.yin@broadcom.com
+  name: Wenkai Yin
 - email: [email protected]
   name: Miner Yang
+- email: [email protected]
+  name: Shengwen Yu
 name: harbor
 sources:
 - https://github.com/goharbor/harbor
 - https://github.com/goharbor/harbor-helm
-version: 1.16.2
+version: 1.17.0

charts/harbor/README.md

@@ -86,6 +86,7 @@ The following table lists the configurable parameters of the Harbor chart and th
 | `expose.ingress.hosts.core`                                           | The host of Harbor core service in ingress rule                                                                                                                                                                                                                                                                                                                                                                                                                  | `core.harbor.domain`                  |
 | `expose.ingress.controller`                                           | The ingress controller type. Currently supports `default`, `gce`, `alb`, `f5-bigip` and `ncp`                                                                                                                                                                                                                                                                                                                                                                    | `default`                             |
 | `expose.ingress.kubeVersionOverride`                                  | Allows the ability to override the kubernetes version used while templating the ingress                                                                                                                                                                                                                                                                                                                                                                          |                                       |
+| `expose.ingress.className`                                            | Specify the `ingressClassName` used to implement the Ingress (Kubernetes 1.18+)                                                                                                                                                                                                                                                                                                                                                                                  |                                       |
 | `expose.ingress.annotations`                                          | The annotations used commonly for ingresses                                                                                                                                                                                                                                                                                                                                                                                                                      |                                       |
 | `expose.ingress.labels`                                               | The labels specific to ingress                                                                                                                                                                                                                                                                                                                                                                                                                             | {}                                    |
 | `expose.clusterIP.name`                                               | The name of ClusterIP service                                                                                                                                                                                                                                                                                                                                                                                                                                    | `harbor`                              |

charts/harbor/index.yaml

@@ -0,0 +1,3 @@
+apiVersion: v1
+entries: {}
+generated: "2025-04-15T06:42:47.301127596Z"

charts/harbor/templates/_helpers.tpl

@@ -148,7 +148,21 @@ app: "{{ template "harbor.name" . }}"
 
 {{- define "harbor.redis.scheme" -}}
   {{- with .Values.redis }}
-    {{- ternary "redis+sentinel" "redis"  (and (eq .type "external" ) (not (not .external.sentinelMasterSet))) }}
+    {{- if eq .type "external" -}}
+      {{- if not (not .external.sentinelMasterSet) -}}
+        {{- ternary "rediss+sentinel" "redis+sentinel" (.external.tlsOptions.enable) }}
+      {{- else -}}
+        {{- ternary "rediss" "redis" (.external.tlsOptions.enable) }}
+      {{- end -}}
+    {{- else -}}
+      {{ print "redis" }}
+    {{- end -}}
+  {{- end }}
+{{- end -}}
+
+{{- define "harbor.redis.enableTLS" -}}
+  {{- with .Values.redis }}
+    {{- ternary "true" "false" (and ( eq .type "external") (.external.tlsOptions.enable)) }}
   {{- end }}
 {{- end -}}
 
@@ -161,7 +175,7 @@ app: "{{ template "harbor.name" . }}"
 
 {{- define "harbor.redis.masterSet" -}}
   {{- with .Values.redis }}
-    {{- ternary .external.sentinelMasterSet "" (eq "redis+sentinel" (include "harbor.redis.scheme" $)) }}
+    {{- ternary .external.sentinelMasterSet "" (contains "+sentinel" (include "harbor.redis.scheme" $)) }}
   {{- end }}
 {{- end -}}
 

charts/harbor/templates/jobservice/jobservice-cm-env.yaml

@@ -15,6 +15,8 @@ data:
   JOBSERVICE_WEBHOOK_JOB_MAX_RETRY: "{{ .Values.jobservice.notification.webhook_job_max_retry }}"
   JOBSERVICE_WEBHOOK_JOB_HTTP_CLIENT_TIMEOUT: "{{ .Values.jobservice.notification.webhook_job_http_client_timeout }}"
 
+  LOG_LEVEL: "{{ .Values.logLevel }}"
+
   {{- if has "jobservice" .Values.proxy.components }}
   HTTP_PROXY: "{{ .Values.proxy.httpProxy }}"
   HTTPS_PROXY: "{{ .Values.proxy.httpsProxy }}"

charts/harbor/templates/registry/registry-cm.yaml

@@ -182,6 +182,7 @@ data:
       readtimeout: 10s
       writetimeout: 10s
       dialtimeout: 10s
+      enableTLS: {{ template "harbor.redis.enableTLS" . }}
       pool:
         maxidle: 100
         maxactive: 500

charts/harbor/values.yaml

@@ -483,7 +483,7 @@ containerSecurityContext:
 nginx:
   image:
     repository: goharbor/nginx-photon
-    tag: v2.12.2
+    tag: v2.13.0
   # set the service account to be used, default if left empty
   serviceAccountName: ""
   # mount the service account token
@@ -514,7 +514,7 @@ nginx:
 portal:
   image:
     repository: goharbor/harbor-portal
-    tag: v2.12.2
+    tag: v2.13.0
   # set the service account to be used, default if left empty
   serviceAccountName: ""
   # mount the service account token
@@ -554,7 +554,7 @@ portal:
 core:
   image:
     repository: goharbor/harbor-core
-    tag: v2.12.2
+    tag: v2.13.0
   # set the service account to be used, default if left empty
   serviceAccountName: ""
   # mount the service account token
@@ -625,6 +625,8 @@ core:
   # If tokenKey is set, the value of tokenCert must be set as a PEM-encoded certificate signed by tokenKey, and supplied as a multiline string, indented one more than tokenCert on the following line.
   tokenCert: |
   # The XSRF key. Will be generated automatically if it isn't specified
+  # While you specified, Please make sure it is 32 characters, otherwise would have validation issue at the harbor-core runtime
+  # https://github.com/goharbor/harbor/pull/21154 
   xsrfKey: ""
   # If using existingSecret, the key is defined by core.existingXsrfSecretKey
   existingXsrfSecret: ""
@@ -641,7 +643,7 @@ core:
 jobservice:
   image:
     repository: goharbor/harbor-jobservice
-    tag: v2.12.2
+    tag: v2.13.0
   # set the service account to be used, default if left empty
   serviceAccountName: ""
   # mount the service account token
@@ -704,7 +706,7 @@ registry:
   registry:
     image:
       repository: goharbor/registry-photon
-      tag: v2.12.2
+      tag: v2.13.0
     # resources:
     #  requests:
     #    memory: 256Mi
@@ -713,7 +715,7 @@ registry:
   controller:
     image:
       repository: goharbor/harbor-registryctl
-      tag: v2.12.2
+      tag: v2.13.0
     # resources:
     #  requests:
     #    memory: 256Mi
@@ -794,7 +796,7 @@ trivy:
     # repository the repository for Trivy adapter image
     repository: goharbor/trivy-adapter-photon
     # tag the tag for Trivy adapter image
-    tag: v2.12.2
+    tag: v2.13.0
   # set the service account to be used, default if left empty
   serviceAccountName: ""
   # mount the service account token
@@ -852,7 +854,7 @@ trivy:
   # Anonymous downloads from GitHub are subject to the limit of 60 requests per hour. Normally such rate limit is enough
   # for production operations. If, for any reason, it's not enough, you could increase the rate limit to 5000
   # requests per hour by specifying the GitHub access token. For more details on GitHub rate limiting please consult
-  # https://developer.github.com/v3/#rate-limiting
+  # https://v2.13.0eloper.github.com/v3/#rate-limiting
   #
   # You can create a GitHub token by following the instructions in
   # https://help.github.com/en/github/authenticating-to-github/creating-a-personal-access-token-for-the-command-line
@@ -887,7 +889,7 @@ database:
   internal:
     image:
       repository: goharbor/harbor-db
-      tag: v2.12.2
+      tag: v2.13.0
     # set the service account to be used, default if left empty
     serviceAccountName: ""
     # mount the service account token
@@ -967,7 +969,7 @@ redis:
   internal:
     image:
       repository: goharbor/redis-photon
-      tag: v2.12.2
+      tag: v2.13.0
     # set the service account to be used, default if left empty
     serviceAccountName: ""
     # mount the service account token
@@ -1006,6 +1008,14 @@ redis:
     addr: "192.168.0.2:6379"
     # The name of the set of Redis instances to monitor, it must be set to support redis+sentinel
     sentinelMasterSet: ""
+    # TLS configuration for redis connection
+    # only server-authentication is supported, mTLS for redis connection is not supported
+    # tls connection will be disable by default
+    # Once `tlsOptions.enable` set as true, tls/ssl connection will be used for redis
+    # Please set the `caBundleSecretName` in this configuration file which conatins redis server rootCA if it is self-signed.
+    # The secret must contain keys named "ca.crt" which will be injected into the trust store
+    tlsOptions:
+      enable: false
     # The "coreDatabaseIndex" must be "0" as the library Harbor
     # used doesn't support configuring it
     # harborDatabaseIndex defaults to "0", but it can be configured to "6", this config is optional
@@ -1029,7 +1039,7 @@ redis:
 exporter:
   image:
     repository: goharbor/harbor-exporter
-    tag: v2.12.2
+    tag: v2.13.0
   serviceAccountName: ""
   # mount the service account token
   automountServiceAccountToken: false

values/harbor/harbor.gotmpl

@@ -7,7 +7,7 @@
 {{- $harborSecretName := ($harborDomain | replace "." "-") }}
 {{- $notarySecretName := ($notaryDomain | replace "." "-") }}
 {{- $externalUrl := printf "https://%s" $harborDomain }}
-{{- $tag := $h | get "image.tag" "v2.6.4" }}
+{{- $tag := $h | get "image.tag" "v2.13.0" }}
 {{/*The cloudNativeDb operator is responsible for creating the secret*/}}
 
 externalURL: {{ $externalUrl }}

versions.yaml

@@ -1,5 +1,5 @@
 api: main
 console: main
 consoleLogin: main
-tasks: main
+tasks: APL-825
 tools: main