- name: harbor
  namespace: {{ .Modules.Registry.Namespace }}
  create_namespace: true
  chart_ref: {{ .Modules.Registry.ChartRef }}
  chart_version: {{ .Modules.Registry.ChartVersion }}
  {{- if .Modules.Registry.Enabled  }}
  release_state: "present"
  {{- else }}
  release_state: "absent"
  {{- end }}
  values:
    expose:
      type: {{ .Modules.Registry.Expose.Type }}
      tls:
        enabled: {{ .Modules.Registry.Tls.Enabled }}
        certSource: secret
        secret:
          secretName: harbor-tls
      ingress:
        hosts:
          core: {{ .Modules.Registry.Expose.Domain }}
        controller: default
        kubeVersionOverride: ""
        className: "{{ .Modules.Additional.Ingress.Type }}"
        annotations:
          ingress.kubernetes.io/ssl-redirect: "true"
          ingress.kubernetes.io/proxy-body-size: "0"
          {{- if eq .Modules.Additional.Ingress.Type "nginx" }}
          nginx.ingress.kubernetes.io/ssl-redirect: "true"
          nginx.ingress.kubernetes.io/proxy-body-size: "0"
          {{- end }}
        labels: {}

      nodePort:
        name: harbor
        ports:
          http:
            port: 80
            nodePort: {{ .Modules.Registry.Expose.NodePortHttp }}
          https:
            port: 443
            nodePort: {{ .Modules.Registry.Expose.NodePortHttps }}

    externalURL: {{ if .Modules.Registry.Tls.Enabled }}https{{ else }}http{{ end }}://{{ .Modules.Registry.Expose.Domain  }}
    persistence:
      resourcePolicy: "keep"
      persistentVolumeClaim:
        registry:
          existingClaim: ""
          storageClass: "{{ .Modules.Registry.Persistence.StorageClass }}"
          subPath: ""
          accessMode: ReadWriteOnce
          size: {{ .Modules.Registry.Persistence.RegistrySize  }}
          annotations: {}
        jobservice:
          jobLog:
            existingClaim: ""
            storageClass: "{{ .Modules.Registry.Persistence.StorageClass }}"
            subPath: ""
            accessMode: ReadWriteOnce
            size: {{ .Modules.Registry.Persistence.JobserviceSize  }}
            annotations: {}
        database:
          existingClaim: ""
          storageClass: "{{ .Modules.Registry.Persistence.StorageClass }}"
          subPath: ""
          accessMode: ReadWriteOnce
          size: {{ .Modules.Registry.Persistence.DatabaseSize  }}
          annotations: {}
        redis:
          existingClaim: ""
          storageClass: "{{ .Modules.Registry.Persistence.StorageClass }}"
          subPath: ""
          accessMode: ReadWriteOnce
          size: {{ .Modules.Registry.Persistence.RedisSize }}
          annotations: {}
        trivy:
          existingClaim: ""
          storageClass: "{{ .Modules.Registry.Persistence.StorageClass }}"
          subPath: ""
          accessMode: ReadWriteOnce
          size: {{ .Modules.Registry.Persistence.TrivySize }}
          annotations: {}

      imageChartStorage:
        disableredirect: false

        type: filesystem
        filesystem:
          rootdirectory: /storage
          #maxthreads: 100

    imagePullPolicy: IfNotPresent

    updateStrategy:
      type: RollingUpdate

    harborAdminPassword: "{{ .Modules.Registry.AdminPassword }}"

    logLevel: info

    metrics:
      enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
      core:
        path: /metrics
        port: 8001
      registry:
        path: /metrics
        port: 8001
      jobservice:
        path: /metrics
        port: 8001
      exporter:
        path: /metrics
        port: 8001

      serviceMonitor:
        enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}

    trace:
      enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Tracing.Enabled }}
      provider: otel
      sample_rate: 1
      attributes:
        application: harbor
      jaeger:
        endpoint: http://hostname:14268/api/traces
      otel:
        endpoint: observability-opentelemetry-collector-collector.observability.svc.{{ .Orchestrator.ClusterName }}:4318
        url_path: /v1/traces
        compression: false
        insecure: true
        timeout: 10

    portal:
      image:
        repository: goharbor/harbor-portal
        tag: {{ .Modules.Registry.Version }}
      serviceAccountName: ""
      automountServiceAccountToken: false
      replicas: 1
      revisionHistoryLimit: 10

      topologySpreadConstraints: []

      podLabels:
        "app.kubernetes.io/component": "harbor-portal"
      priorityClassName:

    core:
      image:
        repository: goharbor/harbor-core
        tag: {{ .Modules.Registry.Version }}
      serviceAccountName: ""
      automountServiceAccountToken: false
      replicas: 1
      revisionHistoryLimit: 10
      startupProbe:
        enabled: true
        initialDelaySeconds: 10
      extraEnvVars: []
      nodeSelector: {}
      tolerations: []
      affinity: {}
      topologySpreadConstraints: []
      podLabels:
        "app.kubernetes.io/component": "harbor-core"
      serviceAnnotations: {}
      priorityClassName:
      configureUserSettings:
      quotaUpdateProvider: db # Or redis
      secret: ""
      existingSecret: ""
      secretName: ""
      tokenKey: ""

      tokenCert: ""

      xsrfKey: ""
      existingXsrfSecret: ""
      existingXsrfSecretKey: CSRF_KEY
      artifactPullAsyncFlushDuration:
      gdpr:
        deleteUser: false
        auditLogsCompliant: false


    jobservice:
      image:
        repository: goharbor/harbor-jobservice
        tag: {{ .Modules.Registry.Version }}
      serviceAccountName: ""
      automountServiceAccountToken: false
      replicas: 1
      revisionHistoryLimit: 10
      topologySpreadConstraints:
      podLabels:
        "app.kubernetes.io/component": "harbor-jobservice"
      priorityClassName:
      maxJobWorkers: 10
      jobLoggers:
        - file
        # - database
        # - stdout
      loggerSweeperDuration: 14 #days
      notification:
        webhook_job_max_retry: 3
        webhook_job_http_client_timeout: 3 # in seconds
      reaper:
        max_update_hours: 24
        max_dangling_hours: 168
      secret: ""
      existingSecret: ""
      existingSecretKey: JOBSERVICE_SECRET

    registry:
      registry:
        image:
          repository: goharbor/registry-photon
          tag: {{ .Modules.Registry.Version }}
        extraEnvVars: []
      controller:
        image:
          repository: goharbor/harbor-registryctl
          tag: {{ .Modules.Registry.Version }}
        extraEnvVars: []
      serviceAccountName: ""
      automountServiceAccountToken: false
      replicas: 1
      revisionHistoryLimit: 10
      topologySpreadConstraints: []
      podLabels:
        "app.kubernetes.io/component": "harbor-registry"
      priorityClassName:
      secret: ""
      existingSecret: ""
      existingSecretKey: REGISTRY_HTTP_SECRET
      relativeurls: false
      credentials:
        # If using existingSecret, the key must be REGISTRY_PASSWD and REGISTRY_HTPASSWD
        existingSecret: ""
        # Login and password in htpasswd string format. Excludes `registry.credentials.username`  and `registry.credentials.password`. May come in handy when integrating with tools like argocd or flux. This allows the same line to be generated each time the template is rendered, instead of the `htpasswd` function from helm, which generates different lines each time because of the salt.
        # htpasswdString: $apr1$XLefHzeG$Xl4.s00sMSCCcMyJljSZb0 # example string
        # htpasswdString: ""
      middleware:
        enabled: false
        type: cloudFront
        cloudFront:
          baseurl: example.cloudfront.net
          keypairid: KEYPAIRID
          duration: 3000s
          ipfilteredby: none
          # The secret key that should be present is CLOUDFRONT_KEY_DATA, which should be the encoded private key
          # that allows access to CloudFront
          privateKeySecret: "my-secret"
      # enable purge _upload directories
      upload_purging:
        enabled: true
        # remove files in _upload directories which exist for a period of time, default is one week.
        age: 168h
        # the interval of the purge operations
        interval: 24h
        dryrun: false

    trivy:
      enabled: {{ .Modules.Registry.EnabledScanner }}
      image:
        repository: goharbor/trivy-adapter-photon
        tag: {{ .Modules.Registry.Version }}
      serviceAccountName: ""
      automountServiceAccountToken: false
      resources:
        requests:
          cpu: 200m
          memory: 512Mi
        limits:
          cpu: 1
          memory: 1Gi


    database:
      # if external database is used, set "type" to "external"
      # and fill the connection information in "external" section
      type: internal
      internal:
        image:
          repository: goharbor/harbor-db
          tag: {{ .Modules.Registry.Version }}
        serviceAccountName: ""
        automountServiceAccountToken: false
        livenessProbe:
          timeoutSeconds: 1
        readinessProbe:
          timeoutSeconds: 1
        priorityClassName:
        # The initial superuser password for internal database
        # password: "changeit"
        # The size limit for Shared memory, pgSQL use it for shared_buffer
        # More details see:
        # https://github.com/goharbor/harbor/issues/15034
        shmSizeLimit: 512Mi
        initContainer:
          migrator: {}
          # resources:
          #  requests:
          #    memory: 128Mi
          #    cpu: 100m
          permissions: {}
          # resources:
          #  requests:
          #    memory: 128Mi
          #    cpu: 100m
      external:
        host: "192.168.0.1"
        port: "5432"
        username: "user"
        password: "password"
        coreDatabase: "registry"
        # if using existing secret, the key must be "password"
        existingSecret: ""
        # "disable" - No SSL
        # "require" - Always SSL (skip verification)
        # "verify-ca" - Always SSL (verify that the certificate presented by the
        # server was signed by a trusted CA)
        # "verify-full" - Always SSL (verify that the certification presented by the
        # server was signed by a trusted CA and the server host name matches the one
        # in the certificate)
        sslmode: "disable"
      # The maximum number of connections in the idle connection pool per pod (core+exporter).
      # If it <=0, no idle connections are retained.
      maxIdleConns: 100
      # The maximum number of open connections to the database per pod (core+exporter).
      # If it <= 0, then there is no limit on the number of open connections.
      # Note: the default number of connections is 1024 for postgre of harbor.
      maxOpenConns: 900
      ## Additional deployment annotations
      podAnnotations: {}
      ## Additional deployment labels
      podLabels: {}


    redis:
      type: internal
      internal:
        image:
          repository: goharbor/redis-photon
          tag: {{ .Modules.Registry.Version }}
        serviceAccountName: ""
        automountServiceAccountToken: false
        extraEnvVars: []
        nodeSelector: {}
        tolerations: []
        affinity: {}
        priorityClassName:
        jobserviceDatabaseIndex: "1"
        registryDatabaseIndex: "2"
        trivyAdapterIndex: "5"
        # harborDatabaseIndex: "6"
        # cacheLayerDatabaseIndex: "7"
      external:
        # support redis, redis+sentinel
        # addr for redis: <host_redis>:<port_redis>
        # addr for redis+sentinel: <host_sentinel1>:<port_sentinel1>,<host_sentinel2>:<port_sentinel2>,<host_sentinel3>:<port_sentinel3>
        addr: "192.168.0.2:6379"
        # The name of the set of Redis instances to monitor, it must be set to support redis+sentinel
        sentinelMasterSet: ""
        # The "coreDatabaseIndex" must be "0" as the library Harbor
        # used doesn't support configuring it
        # harborDatabaseIndex defaults to "0", but it can be configured to "6", this config is optional
        # cacheLayerDatabaseIndex defaults to "0", but it can be configured to "7", this config is optional
        coreDatabaseIndex: "0"
        jobserviceDatabaseIndex: "1"
        registryDatabaseIndex: "2"
        trivyAdapterIndex: "5"
        # harborDatabaseIndex: "6"
        # cacheLayerDatabaseIndex: "7"
        # username field can be an empty string, and it will be authenticated against the default user
        username: ""
        password: ""
        existingSecret: ""
      podAnnotations: {}
      podLabels: {}