KuberSphere安装harbor的配置文件解读

# 这个配置文件，其实就是上面部分是harbor配置，下面都是自定义的配置需要的镜像配置。 
# 综合下来，其实秘钥用系统默认就行，会自动生成的。没有特殊的配置，基本用默认的都能启动啊。为啥我安装会报错？
expose:
  # Set the way how to expose the service. Set the type as "ingress",
  # "clusterIP", "nodePort" or "loadBalancer" and fill the information
  # in the corresponding section
  # 中文解读
  	# 配置harbor外部访问方式，其中包括4种：ingress、clusterIP、nodePort、loadBalancer
  # 配置作用
  	# 这个配置的目的就是外部通过哪种方式访问搭建的harbor，对于每一种方式，都要进行相应的配置。配置在下面能看到。
  # 采坑记录
  type: ingress
  tls:
    # Enable the tls or not. Note: if the type is "ingress" and the tls
    # is disabled, the port must be included in the command when pull/push
    # images. Refer to https://github.com/goharbor/harbor/issues/5291
    # for the detail.
    # 中文解读
    	# 就是tls开关，强调。如果外部访问方式是"ingress",tls=disabled，那么在执行pull/push命令时，端口号一定要包含到命令中
    # 配置作用
    # 采坑记录
    enabled: true
    # Fill the name of secret if you want to use your own TLS certificate.
    # The secret contains keys named:
    # "tls.crt" - the certificate (required)
    # "tls.key" - the private key (required)
    # "ca.crt" - the certificate of CA (optional), this enables the download
    # link on portal to download the certificate of CA
    # These files will be generated automatically if the "secretName" is not set
    # 中文解读
    	# 填写秘钥名称，如果要使用自己的秘钥。介绍了密码需要包括 其中tls.crt和tls.key是必须的，ca.crt可选。
    	# 登录门harbor的门户网站下载秘钥，如果“secretName”设置为空，这些文件将会自动生成
    # 配置作用
    	# 其实就是harbor验证机制，相当于项目总的koken的作用
    # 采坑记录
    secretName: ""
    # By default, the Notary service will use the same cert and key as
    # described above. Fill the name of secret if you want to use a
    # separated one. Only needed when the type is "ingress".
    # 中文解读
    	# 默认值，验证服务会使用相同的cert和key
    	# 如果需要使用另外的，可以填写自己的，这个配置在ingres访问方式下才需要
    # 配置作用
    	# 一般用默认值就可以，如果真的需要自己的验证服务，可以自定义。配置就是在这里。
    # 采坑记录
    notarySecretName: ""
    # The common name used to generate the certificate, it's necessary
    # when the type isn't "ingress" and "secretName" is null
    # 中文解读
    	# 这个配置常常是用来生成验证证书的，当访问方式不是“ingress"并且“secretName”为null,这个配置是必须的。
    # 配置作用
    	# 记住上面说的这个配置的限制条件，不然是跑不起来的。
    # 采坑记录
    commonName: ""
  ingress:
    hosts:
      core: core.harbor.domain
      notary: notary.harbor.domain
    # set to the type of ingress controller if it has specific requirements.
    # leave as `default` for most ingress controllers.
    # set to `gce` if using the GCE ingress controller
    # set to `ncp` if using the NCP (NSX-T Container Plugin) ingress controller
    # 中文解读
    	# 如果有特殊的需求需要配置，没有的话就用默认的就行。这里有两种方式：GCE和NCP
    # 配置作用
    # 采坑记录
    controller: default
    annotations:
      ingress.kubernetes.io/ssl-redirect: "true"
      ingress.kubernetes.io/proxy-body-size: "0"
      nginx.ingress.kubernetes.io/ssl-redirect: "true"
      nginx.ingress.kubernetes.io/proxy-body-size: "0"
	# clusterIP属性配置，这里我暂时是用的ingress,暂时不研究这个配置
  clusterIP:
    # The name of ClusterIP service
    # 中文解读
    # 配置作用
    # 采坑记录
    name: harbor
    ports:
      # The service port Harbor listens on when serving with HTTP
      # 中文解读
      # 配置作用
      # 采坑记录
      httpPort: 80
      # The service port Harbor listens on when serving with HTTPS
      # 中文解读
      # 配置作用
      # 采坑记录
      httpsPort: 443
      # The service port Notary listens on. Only needed when notary.enabled
      # is set to true
      # 中文解读
      # 配置作用
      # 采坑记录
      notaryPort: 4443
  nodePort:
    # The name of NodePort service
    # 中文解读
    # 配置租用
    # 采坑记录
    name: harbor
    ports:
      http:
        # The service port Harbor listens on when serving with HTTP
        # 中文解读
    	# 配置作用
    	# 采坑记录
        port: 80
        # The node port Harbor listens on when serving with HTTP
        # 中文解读
    	# 配置租用
    	# 采坑记录
        nodePort: 30002
      https:
        # The service port Harbor listens on when serving with HTTPS
        # 中文解读
    	# 配置作用
    	# 采坑记录
        port: 443
        # The node port Harbor listens on when serving with HTTPS
        # 中文解读
    	# 配置作用
    	# 采坑记录
        nodePort: 30003
      # Only needed when notary.enabled is set to true
      # 中文解读
      # 配置作用
      # 采坑记录
      notary:
        # The service port Notary listens on
        port: 4443
        # The node port Notary listens on
        nodePort: 30004
  loadBalancer:
    # The name of LoadBalancer service
    name: harbor
    # Set the IP if the LoadBalancer supports assigning IP
    IP: ""
    ports:
      # The service port Harbor listens on when serving with HTTP
      httpPort: 80
      # The service port Harbor listens on when serving with HTTPS
      httpsPort: 443
      # The service port Notary listens on. Only needed when notary.enabled
      # is set to true
      notaryPort: 4443
    annotations: {}
    sourceRanges: []

# The external URL for Harbor core service. It is used to
# 1) populate the docker/helm commands showed on portal
# 2) populate the token service URL returned to docker/notary client
#
# Format: protocol://domain[:port]. Usually:
# 1) if "expose.type" is "ingress", the "domain" should be
# the value of "expose.ingress.hosts.core"
# 2) if "expose.type" is "clusterIP", the "domain" should be
# the value of "expose.clusterIP.name"
# 3) if "expose.type" is "nodePort", the "domain" should be
# the IP address of k8s node
#
# If Harbor is deployed behind the proxy, set it as the URL of proxy
# 中文解读
	# 如果harbor是部署在代理服务上，这里配置代理服务器的URL
# 配置作用
# 采坑记录
externalURL: https://core.harbor.domain

# The internal TLS used for harbor components secure communicating. In order to enable https
# in each components tls cert files need to provided in advance.
# 中文解读
	# 内部TLS用于harbor组件安全通信。为了开始每个组件的的验证文件https方式，这个配置需要提前提供
# 配置作用
	# 就是如果下面认证方式为HTTPS,这里的配置就是提前配置好。不然应该会出现错
# 采坑记录
internalTLS:
  # If internal TLS enabled
  # 中文解读
  	# 内部TLS的开关配置
  # 配置作用
  # 采坑记录
  enabled: false
  # There are three ways to provide tls
  # 1) "auto" will generate cert automatically
  # 2) "manual" need provide cert file manually in following value
  # 3) "secret" internal certificates from secret
  # 中文解读
  	# 有三种方式提供TLS
  	# "auto"自动生成cert
  	# "manual"需要下面配置中手动提供cert file
  	# "secret" 从秘钥中获取
  # 配置作用
  # 采坑记录
  certSource: "auto"
  # The content of trust ca, only available when `certSource` is "manual"
  # 中文解读
  	# 当centSource为nanual需要这里配置
  # 配置作用
  # 采坑记录
  trustCa: ""
  # core related cert configuration
  # 中文解读
  # 配置作用
  # 采坑记录
  core:
    # secret name for core's tls certs
    # 中文解读
    	# core的tls的秘钥名称
    # 配置作用
    # 采坑记录
    secretName: ""
    # Content of core's TLS cert file, only available when `certSource` is "manual"
    # 中文解读
    	# 之前说过，manual类型需要手动配置cert file，就是在这里配置。只有manual配置这里才生效。
    # 配置作用
    # 采坑记录
    crt: ""
    # Content of core's TLS key file, only available when `certSource` is "manual"
    # 中文解读
    	# TLS key file手动配置，也是只有manual方式才生效
    # 配置作用
    # 采坑记录
    key: ""
  # jobservice related cert configuration
  # 中文解读
  	# jobservice属性配置
  # 配置作用
  	# 没理解jobservice配置的作用
  	#  jobservice 在后端中作为守护进程为其他组件提供服务，在和其他组件进行通信时为确保通信安全，其他组件在访问jobservice的 API 时，访问请求的header中必须要有Authorization字段
  	# 就是配置不同组件之间通行的安全配置， 和上面的安全配置的是一样的。基本可以用默认值。
  # 采坑记录
  jobservice:
    # secret name for jobservice's tls certs
    # 中文解读
    # 配置作用
    # 采坑记录
    secretName: ""
    # Content of jobservice's TLS key file, only available when `certSource` is "manual"
    # 中文解读
    # 配置作用
    # 采坑记录
    crt: ""
    # Content of jobservice's TLS key file, only available when `certSource` is "manual"
    # 中文解读
    # 配置作用
    # 采坑记录
    key: ""
  # registry related cert configuration
  # 中文解读
  	# 注册表相关的证书配置
  # 配置作用
  # 采坑记录
  registry:
    # secret name for registry's tls certs
    # 中文解读
    	# 注册表的tls证书的秘钥名称
    # 配置作用
    # 采坑记录
    secretName: ""
    # Content of registry's TLS key file, only available when `certSource` is "manual"
    # 中文解读
    	# 注册表的TLS密钥文件的内容，仅在“ certSource”为“manual”时可用
    # 配置作用
    # 采坑记录
    crt: ""
    # Content of registry's TLS key file, only available when `certSource` is "manual"
    # 中文解读
    	# 注册表的TLS密钥文件的内容，仅在“ certSource”为“manual”时可用
    # 配置作用
    # 采坑记录
    key: ""
  # portal related cert configuration
  portal:
    # secret name for portal's tls certs
    # 中文解读
    	# 门户网站相关的证书配置,这种配置都是一样的，暂时不详细介绍了。都是在“manual”方式下才会生效
    # 配置作用
    # 采坑记录
    secretName: ""
    # Content of portal's TLS key file, only available when `certSource` is "manual"
    # 中文解读
    # 配置作用
    # 采坑记录
    crt: ""
    # Content of portal's TLS key file, only available when `certSource` is "manual"
    # 中文解读
    # 配置作用
    # 采坑记录
    key: ""
  # chartmuseum related cert configuration
  chartmuseum:
    # secret name for chartmuseum's tls certs
    # 中文解读
    	# Chartmuseum相关证书配置
    # 配置作用
    # 采坑记录
    secretName: ""
    # Content of chartmuseum's TLS key file, only available when `certSource` is "manual"
    # 中文解读
    # 配置作用
    # 采坑记录
    crt: ""
    # Content of chartmuseum's TLS key file, only available when `certSource` is "manual"
    # 中文解读
    # 配置作用
    # 采坑记录
    key: ""
  # clair related cert configuration
  clair:
    # secret name for clair's tls certs
    # 中文解读
    	# 与clair相关的证书配置
    # 配置作用
    # 采坑记录
    secretName: ""
    # Content of clair's TLS key file, only available when `certSource` is "manual"
    # 中文解读
    # 配置作用
    # 采坑记录
    crt: ""
    # Content of clair's TLS key file, only available when `certSource` is "manual"
    # 中文解读
    # 配置作用
    # 采坑记录
    key: ""
  # trivy related cert configuration
  trivy:
    # secret name for trivy's tls certs
    # 中文解读
    	# trivy相关证书配置
    # 配置作用
    	# trivy是镜像漏洞扫描。
    # 采坑记录
    secretName: ""
    # Content of trivy's TLS key file, only available when `certSource` is "manual"
    # 中文解读
    # 配置作用
    # 采坑记录
    crt: ""
    # Content of trivy's TLS key file, only available when `certSource` is "manual"
    # 中文解读
    # 配置作用
    # 采坑记录
    key: ""

# The persistence is enabled by default and a default StorageClass
# is needed in the k8s cluster to provision volumes dynamicly.
# Specify another StorageClass in the "storageClass" or set "existingClaim"
# if you have already existing persistent volumes to use
#
# For storing images and charts, you can also use "azure", "gcs", "s3",
# "swift" or "oss". Set it in the "imageChartStorage" section
# 中文解读
	# 就是配置持久化，可以挂在持久化盘。
	# 持久性默认情况下启用，默认情况下为StorageClass
# 配置作用
# 采坑记录
persistence:
  enabled: true
  # Setting it to "keep" to avoid removing PVCs during a helm delete
  # operation. Leaving it empty will delete PVCs after the chart deleted
  # 中文解读
  	# 配置为keep时，删除harbor是不会删除该挂载的盘的。
  # 配置作用
  # 采坑记录
  resourcePolicy: "keep"
  persistentVolumeClaim:
    registry:
      # Use the existing PVC which must be created manually before bound,
      # and specify the "subPath" if the PVC is shared with other components
      # 中文解读
      	# 使用必须在绑定之前手动创建的现有PVC
      	# 如果PVC与其他组件共享，则指定“ subPath”
      # 配置作用
      # 采坑记录
      existingClaim: ""
      # Specify the "storageClass" used to provision the volume. Or the default
      # StorageClass will be used(the default).
      # Set it to "-" to disable dynamic provisioning
      # 中文解读
      	# 就是配置默认的挂载盘，这里配置就是默认的。上面说过，不指定挂载盘，将使用默认，默认的盘是在这里设置
      	# 配置包括： 盘名称、子盘路径、访问权限和大小
      # 配置作用
      # 采坑记录
      storageClass: ""
      subPath: ""
      accessMode: ReadWriteOnce
      size: 5Gi
    chartmuseum:
      existingClaim: ""
      storageClass: ""
      subPath: ""
      accessMode: ReadWriteOnce
      size: 5Gi
    jobservice:
      existingClaim: ""
      storageClass: ""
      subPath: ""
      accessMode: ReadWriteOnce
      size: 1Gi
    # If external database is used, the following settings for database will
    # be ignored
    # 中文解读
    	# 如果使用外部数据库，则数据库的以下设置将会被忽略。这里就是数据库配置
    # 配置作用
    # 采坑记录
    database:
      existingClaim: ""
      storageClass: ""
      subPath: ""
      accessMode: ReadWriteOnce
      size: 1Gi
    # If external Redis is used, the following settings for Redis will
    # be ignored
    # 中文解读
    	# redis配置，如果使用了外部redis，这里将会被忽视
    # 配置作用
    # 采坑记录
    redis:
      existingClaim: ""
      storageClass: ""
      subPath: ""
      accessMode: ReadWriteOnce
      size: 1Gi
    trivy:
      existingClaim: ""
      storageClass: ""
      subPath: ""
      accessMode: ReadWriteOnce
      size: 5Gi
  # Define which storage backend is used for registry and chartmuseum to store
  # images and charts. Refer to
  # https://github.com/docker/distribution/blob/master/docs/configuration.md#storage
  # for the detail.
  # 中文解读
  	# 定义用于注册表和图表的存储后端
  # 配置作用
  # 采坑记录
  imageChartStorage:
    # Specify whether to disable `redirect` for images and chart storage, for
    # backends which not supported it (such as using minio for `s3` storage type), please disable
    # it. To disable redirects, simply set `disableredirect` to `true` instead.
    # Refer to
    # https://github.com/docker/distribution/blob/master/docs/configuration.md#redirect
    # for the detail.
    # 中文解读
    	# 就是配置禁止重定向
    # 配合作用
    # 采坑记录
    disableredirect: false
    # Specify the "caBundleSecretName" if the storage service uses a self-signed certificate.
    # The secret must contain keys named "ca.crt" which will be injected into the trust store
    # of registry's and chartmuseum's containers.
    # caBundleSecretName:

    # Specify the type of storage: "filesystem", "azure", "gcs", "s3", "swift",
    # "oss" and fill the information needed in the corresponding section. The type
    # must be "filesystem" if you want to use persistent volumes for registry
    # and chartmuseum
    # 中文解读
    	# 如果存储服务使用自签名证书，请指定“ caBundleSecretName”。
    	# 指定文件系统，如果要使用永久卷进行注册表，则必须为“文件系统”
    # 配置作用
    # 采坑记录
    type: filesystem
    filesystem:
      rootdirectory: /storage
      #maxthreads: 100
    azure:
      accountname: accountname
      accountkey: base64encodedaccountkey
      container: containername
      #realm: core.windows.net
    gcs:
      bucket: bucketname
      # The base64 encoded json file which contains the key
      # 中文解读
      # 配置作用
      # 采坑记录
      encodedkey: base64-encoded-json-key-file
      #rootdirectory: /gcs/object/name/prefix
      #chunksize: "5242880"
      
    s3:
      region: us-west-1
      bucket: bucketname
      #accesskey: awsaccesskey
      #secretkey: awssecretkey
      #regionendpoint: http://myobjects.local
      #encrypt: false
      #keyid: mykeyid
      #secure: true
      #v4auth: true
      #chunksize: "5242880"
      #rootdirectory: /s3/object/name/prefix
      #storageclass: STANDARD
     
    swift:
      authurl: https://storage.myprovider.com/v3/auth
      username: username
      password: password
      container: containername
      #region: fr
      #tenant: tenantname
      #tenantid: tenantid
      #domain: domainname
      #domainid: domainid
      #trustid: trustid
      #insecureskipverify: false
      #chunksize: 5M
      #prefix:
      #secretkey: secretkey
      #accesskey: accesskey
      #authversion: 3
      #endpointtype: public
      #tempurlcontainerkey: false
      #tempurlmethods:
     
    oss:
      accesskeyid: accesskeyid
      accesskeysecret: accesskeysecret
      region: regionname
      bucket: bucketname
      #endpoint: endpoint
      #internal: false
      #encrypt: false
      #secure: true
      #chunksize: 10M
      #rootdirectory: rootdirectory
      # 中文解读
      # 配置作用
      # 采坑记录

imagePullPolicy: IfNotPresent

# Use this set to assign a list of default pullSecrets
# 中文解读
	# 使用此设置分配默认pullSecrets列表
# 配置作用
# 采坑记录
imagePullSecrets:
#  - name: docker-registry-secret
#  - name: internal-registry-secret

# The update strategy for deployments with persistent volumes(jobservice, registry
# and chartmuseum): "RollingUpdate" or "Recreate"
# Set it as "Recreate" when "RWM" for volumes isn't supported
# 中文解读
	# 具有持久卷（jobservice，注册表）的部署的更新策略 和chartmuseum）：“ RollingUpdate”或“重新创建”
	# 如果不支持卷的“ RWM”，则将其设置为“重新创建”
# 配置作用
# 采坑记录
updateStrategy:
  type: RollingUpdate

# debug, info, warning, error or fatal
# 中文解读
	# 配置更新策略，这里和日志过滤的等级是一致的。
# 配置作用
# 采坑记录
logLevel: info

# The initial password of Harbor admin. Change it from portal after launching Harbor
# 中文解读
	# 配置harbor初始密码，第一次登陆之后将会失效
# 配置作用
# 采坑记录
harborAdminPassword: "Harbor12345"
# The secret key used for encryption. Must be a string of 16 chars.
# 中文解读
	# 用于加密的秘密密钥。必须是16个字符的字符串
# 配置作用
# 采坑记录
secretKey: "not-a-secure-key"

# The proxy settings for updating clair vulnerabilities from the Internet and replicating
# artifacts from/to the registries that cannot be reached directly
# 中文解读
	# 代理设置，用于从Internet更新安全漏洞并进行复制
	# 无法直接到达/来自注册表的组件
# 配置作用
# 采坑记录
proxy:
  httpProxy:
  httpsProxy:
  noProxy: 127.0.0.1,localhost,.local,.internal
  # 无法到达注册表的组件配置
  components:
    - core
    - jobservice
    - clair

## UAA Authentication Options
# If you're using UAA for authentication behind a self-signed
# certificate you will need to provide the CA Cert.
# Set uaaSecretName below to provide a pre-created secret that
# contains a base64 encoded CA Certificate named `ca.crt`.
# uaaSecretName:

# If expose the service via "ingress", the Nginx will not be used
# 中文解读
	# 如果暴露的方式是ingress,则nginx将不会被使用
	# 这里就是nginx的配置地方
# 配置作用
# 采坑记录
nginx:
  image:
    repository: goharbor/nginx-photon
    tag: v2.0.0
  replicas: 1
  # resources:
  #  requests:
  #    memory: 256Mi
  #    cpu: 100m
  nodeSelector: {}
  tolerations: []
  affinity: {}
  ## Additional deployment annotations
  podAnnotations: {}

portal:
  image:
    repository: goharbor/harbor-portal
    tag: v2.0.0
  replicas: 1
# resources:
#  requests:
#    memory: 256Mi
#    cpu: 100m
  nodeSelector: {}
  tolerations: []
  affinity: {}
  ## Additional deployment annotations
  podAnnotations: {}

core:
  image:
    repository: goharbor/harbor-core
    tag: v2.0.0
  replicas: 1
  ## Liveness probe values
  livenessProbe:
    initialDelaySeconds: 300
# resources:
#  requests:
#    memory: 256Mi
#    cpu: 100m
  nodeSelector: {}
  tolerations: []
  affinity: {}
  ## Additional deployment annotations
  podAnnotations: {}
  # Secret is used when core server communicates with other components.
  # If a secret key is not specified, Helm will generate one.
  # Must be a string of 16 chars.
  # 中文解读
  	# 核心服务器与其他组件通信时使用秘钥
  # 配置作用
  # 采坑记录
  secret: ""
  # Fill the name of a kubernetes secret if you want to use your own
  # TLS certificate and private key for token encryption/decryption.
  # The secret must contain keys named:
  # "tls.crt" - the certificate
  # "tls.key" - the private key
  # The default key pair will be used if it isn't set
  # 中文解读
  	# 配置使用自己的秘钥名称，这个应该是要在kuberSphere中配置的秘钥
  # 配置作用
  # 采坑记录
  secretName: ""
  # The XSRF key. Will be generated automatically if it isn't specified
  # 中文解读
  # 配置作用
  # 采坑记录
  xsrfKey: ""

jobservice:
  image:
    repository: goharbor/harbor-jobservice
    tag: v2.0.0
  replicas: 1
  maxJobWorkers: 10
  # The logger for jobs: "file", "database" or "stdout"
  # 中文解读
  # 配置作用
  # 采坑记录
  jobLogger: file
# resources:
#   requests:
#     memory: 256Mi
#     cpu: 100m
  nodeSelector: {}
  tolerations: []
  affinity: {}
  ## Additional deployment annotations
  podAnnotations: {}
  # Secret is used when job service communicates with other components.
  # If a secret key is not specified, Helm will generate one.
  # Must be a string of 16 chars.
  # 中文解读
  	# 业服务与其他组件通信时使用秘钥
  	# 如果未指定密钥，Helm将生成一个
  	# 必须要16位字符串
  # 配置作用
  # 采坑记录
  secret: ""
# 注册表镜像配置
registry:
  registry:
    image:
      repository: goharbor/registry-photon
      tag: v2.0.0

    # resources:
    #  requests:
    #    memory: 256Mi
    #    cpu: 100m
  # 这里就是上面的controller镜像配置
  controller:
    image:
      repository: goharbor/harbor-registryctl
      tag: v2.0.0

    # resources:
    #  requests:
    #    memory: 256Mi
    #    cpu: 100m
  replicas: 1
  nodeSelector: {}
  tolerations: []
  affinity: {}
  ## Additional deployment annotations
  podAnnotations: {}
  # Secret is used to secure the upload state from client
  # and registry storage backend.
  # See: https://github.com/docker/distribution/blob/master/docs/configuration.md#http
  # If a secret key is not specified, Helm will generate one.
  # Must be a string of 16 chars.
  # 中文解读
  	# 机密用于保护客户端的上传状态和注册表存储后端
  	# 如果未指定密钥，Helm将生成一个。这些都可以使用默认的
  # 配置作用
  # 采坑记录
  secret: ""
  # If true, the registry returns relative URLs in Location headers. The client is responsible for resolving the correct URL.
  # 中文解读
  	# 如果为true，则注册表在Location标头中返回相对URL。客户端负责解析正确的URL
  # 配置作用
  # 采坑记录
  relativeurls: false
  # 证书
  credentials:
    username: "harbor_registry_user"
    password: "harbor_registry_password"
    # If you update the username or password of registry, make sure use cli tool htpasswd to generate the bcrypt hash
    # e.g. "htpasswd -nbBC10 $username $password"
    
    htpasswd: "harbor_registry_user:$2y$10$9L4Tc0DJbFFMB6RdSCunrOpTHdwhid4ktBJmLD00bYgqkkGOvll3m"
# 中间件
  middleware:
    enabled: false
    type: cloudFront
    cloudFront:
      baseurl: example.cloudfront.net
      keypairid: KEYPAIRID
      duration: 3000s
      ipfilteredby: none
      # The secret key that should be present is CLOUDFRONT_KEY_DATA, which should be the encoded private key
      # that allows access to CloudFront
      privateKeySecret: "my-secret"

chartmuseum:
  enabled: true
  # Harbor defaults ChartMuseum to returning relative urls, if you want using absolute url you should enable it by change the following value to 'true'
  absoluteUrl: false
  image:
    repository: goharbor/chartmuseum-photon
    tag: v2.0.0
  replicas: 1
  # resources:
  #  requests:
  #    memory: 256Mi
  #    cpu: 100m
  nodeSelector: {}
  tolerations: []
  affinity: {}
  ## Additional deployment annotations
  podAnnotations: {}

clair:
  enabled: true
  clair:
    image:
      repository: goharbor/clair-photon
      tag: v2.0.0
    # resources:
    #  requests:
    #    memory: 256Mi
    #    cpu: 100m
  adapter:
    image:
      repository: goharbor/clair-adapter-photon
      tag: v2.0.0
    # resources:
    #  requests:
    #    memory: 256Mi
    #    cpu: 100m
  replicas: 1
  # The interval of clair updaters, the unit is hour, set to 0 to
  # disable the updaters
  updatersInterval: 12
  nodeSelector: {}
  tolerations: []
  affinity: {}
  ## Additional deployment annotations
  podAnnotations: {}

trivy:
  # enabled the flag to enable Trivy scanner
  enabled: true
  image:
    # repository the repository for Trivy adapter image
    repository: goharbor/trivy-adapter-photon
    # tag the tag for Trivy adapter image
    tag: v2.0.0
  # replicas the number of Pod replicas
  replicas: 1
  # debugMode the flag to enable Trivy debug mode with more verbose scanning log
  debugMode: false
  # vulnType a comma-separated list of vulnerability types. Possible values are `os` and `library`.
  vulnType: "os,library"
  # severity a comma-separated list of severities to be checked
  severity: "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL"
  # ignoreUnfixed the flag to display only fixed vulnerabilities
  ignoreUnfixed: false
  # insecure the flag to skip verifying registry certificate
  insecure: false
  # gitHubToken the GitHub access token to download Trivy DB
  #
  # Trivy DB contains vulnerability information from NVD, Red Hat, and many other upstream vulnerability databases.
  # It is downloaded by Trivy from the GitHub release page https://github.com/aquasecurity/trivy-db/releases and cached
  # in the local file system (`/home/scanner/.cache/trivy/db/trivy.db`). In addition, the database contains the update
  # timestamp so Trivy can detect whether it should download a newer version from the Internet or use the cached one.
  # Currently, the database is updated every 12 hours and published as a new release to GitHub.
  #
  # Anonymous downloads from GitHub are subject to the limit of 60 requests per hour. Normally such rate limit is enough
  # for production operations. If, for any reason, it's not enough, you could increase the rate limit to 5000
  # requests per hour by specifying the GitHub access token. For more details on GitHub rate limiting please consult
  # https://developer.github.com/v3/#rate-limiting
  #
  # You can create a GitHub token by following the instructions in
  # https://help.github.com/en/github/authenticating-to-github/creating-a-personal-access-token-for-the-command-line
  gitHubToken: ""
  # skipUpdate the flag to disable Trivy DB downloads from GitHub
  #
  # You might want to set the value of this flag to `true` in test or CI/CD environments to avoid GitHub rate limiting issues.
  # If the value is set to `true` you have to manually download the `trivy.db` file and mount it in the
  # `/home/scanner/.cache/trivy/db/trivy.db` path.
  skipUpdate: false
  resources:
    requests:
      cpu: 200m
      memory: 512Mi
    limits:
      cpu: 1
      memory: 1Gi
  ## Additional deployment annotations
  podAnnotations: {}

notary:
  enabled: true
  server:
    image:
      repository: goharbor/notary-server-photon
      tag: v2.0.0
    replicas: 1
    # resources:
    #  requests:
    #    memory: 256Mi
    #    cpu: 100m
  signer:
    image:
      repository: goharbor/notary-signer-photon
      tag: v2.0.0
    replicas: 1
    # resources:
    #  requests:
    #    memory: 256Mi
    #    cpu: 100m
  nodeSelector: {}
  tolerations: []
  affinity: {}
  ## Additional deployment annotations
  podAnnotations: {}
  # Fill the name of a kubernetes secret if you want to use your own
  # TLS certificate authority, certificate and private key for notary
  # communications.
  # The secret must contain keys named ca.crt, tls.crt and tls.key that
  # contain the CA, certificate and private key.
  # They will be generated if not set.
  secretName: ""

database:
  # if external database is used, set "type" to "external"
  # and fill the connection informations in "external" section
  type: internal
  internal:
    image:
      repository: goharbor/harbor-db
      tag: v2.0.0
    # the image used by the init container
    initContainerImage:
      repository: busybox
      tag: latest
    # The initial superuser password for internal database
    password: "changeit"
    # resources:
    #  requests:
    #    memory: 256Mi
    #    cpu: 100m
    nodeSelector: {}
    tolerations: []
    affinity: {}
  external:
    host: "192.168.0.1"
    port: "5432"
    username: "user"
    password: "password"
    coreDatabase: "registry"
    clairDatabase: "clair"
    notaryServerDatabase: "notary_server"
    notarySignerDatabase: "notary_signer"
    # "disable" - No SSL
    # "require" - Always SSL (skip verification)
    # "verify-ca" - Always SSL (verify that the certificate presented by the
    # server was signed by a trusted CA)
    # "verify-full" - Always SSL (verify that the certification presented by the
    # server was signed by a trusted CA and the server host name matches the one
    # in the certificate)
    sslmode: "disable"
  # The maximum number of connections in the idle connection pool.
  # If it <=0, no idle connections are retained.
  maxIdleConns: 50
  # The maximum number of open connections to the database.
  # If it <= 0, then there is no limit on the number of open connections.
  # Note: the default number of connections is 100 for postgre.
  maxOpenConns: 100
  ## Additional deployment annotations
  podAnnotations: {}

redis:
  # if external Redis is used, set "type" to "external"
  # and fill the connection informations in "external" section
  type: internal
  internal:
    image:
      repository: goharbor/redis-photon
      tag: v2.0.0
    # resources:
    #  requests:
    #    memory: 256Mi
    #    cpu: 100m
    nodeSelector: {}
    tolerations: []
    affinity: {}
  external:
    host: "192.168.0.2"
    port: "6379"
    # The "coreDatabaseIndex" must be "0" as the library Harbor
    # used doesn't support configuring it
    coreDatabaseIndex: "0"
    jobserviceDatabaseIndex: "1"
    registryDatabaseIndex: "2"
    chartmuseumDatabaseIndex: "3"
    clairAdapterIndex: "4"
    trivyAdapterIndex: "5"
    password: ""
  ## Additional deployment annotations
  podAnnotations: {}

总结

正在学习KuberSphere中通过应用商店安装harbor，这是配置文件解读。后期再完善各种采坑记录和配置。