Add feature : use existing secret to set HTTP_PROXY & HTTPS_PROXY

.github/workflows/publish_release.yaml

@@ -23,9 +23,9 @@ jobs:
       - name: Publish Helm Chart
         run: |
           helm registry login registry-1.docker.io -u ${{ secrets.DOCKER_HUB_USERNAME }} -p ${{ secrets.DOCKER_HUB_PASSWORD }}
-          helm push ${{ env.PACKAGE_PATH }} oci://registry-1.docker.io/${{ secrets.DOCKER_HUB_USERNAME }}
+          helm push ${{ env.PACKAGE_PATH }} oci://registry-1.docker.io/goharbor
           helm registry login ghcr.io -u ${{ github.actor }} -p ${{ secrets.GITHUB_TOKEN }}
-          helm push ${{ env.PACKAGE_PATH }} oci://ghcr.io/${{ github.actor }}
+          helm push ${{ env.PACKAGE_PATH }} oci://ghcr.io/goharbor
       - name: Upload to chart repository
         run: |
           git config --global user.email "${{ github.event.repository.name }}@users.noreply.github.com"

Chart.yaml

@@ -1,7 +1,7 @@
 apiVersion: v1
 name: harbor
-version: 1.4.0-dev
-appVersion: dev
+version: 1.15.1-proxy-0.2
+appVersion: 2.11.1
 description: An open source trusted cloud native registry that stores, signs, and scans content
 keywords:
 - docker
@@ -13,10 +13,12 @@ sources:
 - https://github.com/goharbor/harbor
 - https://github.com/goharbor/harbor-helm
 maintainers:
+- name: Yan Wang
+  email: [email protected]
 - name: Wenkai Yin
-  email: yinw@vmware.com
-- name: Weiwei He
-  email: hweiwei@vmware.com
+  email: wenkai.yin@broadcom.com
+- name: Miner Yang
+  email: miner.yang@broadcom.com
 - name: Shengwen Yu
-  email: yshengwen@vmware.com
+  email: shengwen.yu@broadcom.com
 engine: gotpl

templates/core/core-cm.yaml

@@ -47,9 +47,11 @@ data:
   {{- if .Values.uaaSecretName }}
   UAA_CA_ROOT: "/etc/core/auth-ca/auth-ca.crt"
   {{- end }}
-  {{- if has "core" .Values.proxy.components }}
+  {{- if and (has "core" .Values.proxy.components) (not .Values.proxy.existingSecret) }}
   HTTP_PROXY: "{{ .Values.proxy.httpProxy }}"
   HTTPS_PROXY: "{{ .Values.proxy.httpsProxy }}"
+  {{- end }}
+  {{- if has "core" .Values.proxy.components }}
   NO_PROXY: "{{ template "harbor.noProxy" . }}"
   {{- end }}
   PERMITTED_REGISTRY_TYPES_FOR_PROXY_CACHE: "docker-hub,harbor,azure-acr,aws-ecr,google-gcr,quay,docker-registry,github-ghcr,jfrog-artifactory"

templates/core/core-dpl.yaml

@@ -94,6 +94,10 @@ spec:
             name: "{{ template "harbor.core" . }}"
         - secretRef:
             name: "{{ template "harbor.core" . }}"
+        {{- if .Values.proxy.existingSecret }}
+        - secretRef:
+            name: "{{ .Values.proxy.existingSecret }}"
+        {{- end }}
         env:
           - name: CORE_SECRET
             valueFrom:

templates/exporter/exporter-cm-env.yaml

@@ -6,9 +6,11 @@ metadata:
   labels:
 {{ include "harbor.labels" . | indent 4 }}
 data:
-  {{- if has "jobservice" .Values.proxy.components }}
+  {{- if and (has "jobservice" .Values.proxy.components) (not .Values.proxy.existingSecret) }}
   HTTP_PROXY: "{{ .Values.proxy.httpProxy }}"
   HTTPS_PROXY: "{{ .Values.proxy.httpsProxy }}"
+  {{- end }}
+  {{- if has "jobservice" .Values.proxy.components }}
   NO_PROXY: "{{ template "harbor.noProxy" . }}"
   {{- end }}
   LOG_LEVEL: "{{ .Values.logLevel }}"

templates/exporter/exporter-dpl.yaml

@@ -78,6 +78,10 @@ spec:
             name: "{{ template "harbor.exporter" . }}-env"
         - secretRef:
             name: "{{ template "harbor.exporter" . }}"
+        {{- if .Values.proxy.existingSecret }}
+        - secretRef:
+            name: "{{ .Values.proxy.existingSecret }}"
+        {{- end }}
         env:
         {{- if .Values.database.external.existingSecret }}
         - name: HARBOR_DATABASE_PASSWORD

templates/jobservice/jobservice-cm-env.yaml

@@ -14,9 +14,11 @@ data:
   JOBSERVICE_WEBHOOK_JOB_MAX_RETRY: "{{ .Values.jobservice.notification.webhook_job_max_retry }}"
   JOBSERVICE_WEBHOOK_JOB_HTTP_CLIENT_TIMEOUT: "{{ .Values.jobservice.notification.webhook_job_http_client_timeout }}"
 
-  {{- if has "jobservice" .Values.proxy.components }}
+  {{- if and (has "jobservice" .Values.proxy.components) (not .Values.proxy.existingSecret) }}
   HTTP_PROXY: "{{ .Values.proxy.httpProxy }}"
   HTTPS_PROXY: "{{ .Values.proxy.httpsProxy }}"
+  {{- end }}
+  {{- if has "jobservice" .Values.proxy.components }}
   NO_PROXY: "{{ template "harbor.noProxy" . }}"
   {{- end }}
   {{- if .Values.metrics.enabled}}

templates/jobservice/jobservice-dpl.yaml

@@ -130,6 +130,10 @@ spec:
             name: "{{ template "harbor.jobservice" . }}-env"
         - secretRef:
             name: "{{ template "harbor.jobservice" . }}"
+        {{- if .Values.proxy.existingSecret }}
+        - secretRef:
+            name: "{{ .Values.proxy.existingSecret }}"
+        {{- end }}
         ports:
         - containerPort: {{ template "harbor.jobservice.containerPort" . }}
         volumeMounts:

templates/registry/registry-dpl.yaml

@@ -111,11 +111,13 @@ spec:
               name: {{ .Values.registry.existingSecret }}
               key: {{ .Values.registry.existingSecretKey }}
         {{- end }}
-        {{- if has "registry" .Values.proxy.components }}
+        {{- if and (has "registry" .Values.proxy.components) (not .Values.proxy.existingSecret) }}
         - name: HTTP_PROXY
           value: "{{ .Values.proxy.httpProxy }}"
         - name: HTTPS_PROXY
           value: "{{ .Values.proxy.httpsProxy }}"
+        {{- end }}
+        {{- if has "registry" .Values.proxy.components }}
         - name: NO_PROXY
           value: "{{ template "harbor.noProxy" . }}"
         {{- end }}
@@ -245,6 +247,10 @@ spec:
         - secretRef:
             name: {{ .Values.persistence.imageChartStorage.s3.existingSecret }}
         {{- end }}
+        {{- if .Values.proxy.existingSecret }}
+        - secretRef:
+            name: "{{ .Values.proxy.existingSecret }}"
+        {{- end }}
         env:
         {{- if .Values.registry.existingSecret }}
         - name: REGISTRY_HTTP_SECRET

templates/trivy/trivy-sts.yaml

@@ -67,12 +67,19 @@ spec:
           {{- if not (empty .Values.containerSecurityContext) }}
           securityContext: {{ .Values.containerSecurityContext | toYaml | nindent 12 }}
           {{- end }}
+          {{- if .Values.proxy.existingSecret }}
+          envFrom:
+            - secretRef:
+                name: "{{ .Values.proxy.existingSecret }}"
+          {{- end }}
           env:
-          {{- if has "trivy" .Values.proxy.components }}
+          {{- if and (has "trivy" .Values.proxy.components) (not .Values.proxy.existingSecret) }}
             - name: HTTP_PROXY
               value: "{{ .Values.proxy.httpProxy }}"
             - name: HTTPS_PROXY
               value: "{{ .Values.proxy.httpsProxy }}"
+          {{- end }}
+          {{- if has "trivy" .Values.proxy.components }}
             - name: NO_PROXY
               value: "{{ template "harbor.noProxy" . }}"
           {{- end }}

test/e2e/Jenkinsfile

@@ -1,4 +1,4 @@
-@Library('harbor@main') _
+@Library('harbor@2.11') _
 import io.goharbor.*
 
 class HarborChartFreshInstallPipelineExecutor extends FreshInstallPipelineExecutor implements Serializable {

values.yaml

@@ -367,12 +367,19 @@ existingSecretSecretKey: ""
 proxy:
   httpProxy:
   httpsProxy:
+
+  # Fill in the name of an existing secret with HTTP_PROXY, HTTPS_PROXY keys.
+  # Setting existing secret will disable httpProxy, httpsProxy above.
+  existingSecret: ""
+
   noProxy: 127.0.0.1,localhost,.local,.internal
   components:
     - core
     - jobservice
     - trivy
 
+
+
 # Run the migration job via helm hook
 enableMigrateHelmHook: false
 
@@ -483,7 +490,7 @@ containerSecurityContext:
 nginx:
   image:
     repository: goharbor/nginx-photon
-    tag: dev
+    tag: v2.11.1
   # set the service account to be used, default if left empty
   serviceAccountName: ""
   # mount the service account token
@@ -514,7 +521,7 @@ nginx:
 portal:
   image:
     repository: goharbor/harbor-portal
-    tag: dev
+    tag: v2.11.1
   # set the service account to be used, default if left empty
   serviceAccountName: ""
   # mount the service account token
@@ -554,7 +561,7 @@ portal:
 core:
   image:
     repository: goharbor/harbor-core
-    tag: dev
+    tag: v2.11.1
   # set the service account to be used, default if left empty
   serviceAccountName: ""
   # mount the service account token
@@ -641,7 +648,7 @@ core:
 jobservice:
   image:
     repository: goharbor/harbor-jobservice
-    tag: dev
+    tag: v2.11.1
   # set the service account to be used, default if left empty
   serviceAccountName: ""
   # mount the service account token
@@ -704,7 +711,7 @@ registry:
   registry:
     image:
       repository: goharbor/registry-photon
-      tag: dev
+      tag: v2.11.1
     # resources:
     #  requests:
     #    memory: 256Mi
@@ -713,7 +720,7 @@ registry:
   controller:
     image:
       repository: goharbor/harbor-registryctl
-      tag: dev
+      tag: v2.11.1
     # resources:
     #  requests:
     #    memory: 256Mi
@@ -794,7 +801,7 @@ trivy:
     # repository the repository for Trivy adapter image
     repository: goharbor/trivy-adapter-photon
     # tag the tag for Trivy adapter image
-    tag: dev
+    tag: v2.11.1
   # set the service account to be used, default if left empty
   serviceAccountName: ""
   # mount the service account token
@@ -887,7 +894,7 @@ database:
   internal:
     image:
       repository: goharbor/harbor-db
-      tag: dev
+      tag: v2.11.1
     # set the service account to be used, default if left empty
     serviceAccountName: ""
     # mount the service account token
@@ -967,7 +974,7 @@ redis:
   internal:
     image:
       repository: goharbor/redis-photon
-      tag: dev
+      tag: v2.11.1
     # set the service account to be used, default if left empty
     serviceAccountName: ""
     # mount the service account token
@@ -1029,7 +1036,7 @@ redis:
 exporter:
   image:
     repository: goharbor/harbor-exporter
-    tag: dev
+    tag: v2.11.1
   serviceAccountName: ""
   # mount the service account token
   automountServiceAccountToken: false