From 79d55148ec50785ac928dccd5890bdeec408e2ff Mon Sep 17 00:00:00 2001 From: Trey Dockendorf Date: Fri, 30 Jun 2023 10:49:41 -0400 Subject: [PATCH 1/9] Support v2.8.x Remove support for versions before v2.8.x to keep code from being overly complicated --- Gemfile | 30 +++++---- data/common.yaml | 31 +++++----- manifests/config.pp | 36 +++++------ manifests/init.pp | 104 ++++++++++++------------------- manifests/prepare.pp | 42 ++----------- manifests/service.pp | 40 +++--------- spec/classes/config_spec.rb | 14 +---- spec/classes/harbor_spec.rb | 8 +-- spec/spec_helper.rb | 1 + templates/harbor.yml.epp | 119 ++++++++++++++++++++++++++---------- 10 files changed, 195 insertions(+), 230 deletions(-) diff --git a/Gemfile b/Gemfile index 0e395e7..4bc7150 100644 --- a/Gemfile +++ b/Gemfile @@ -17,18 +17,22 @@ ruby_version_segments = Gem::Version.new(RUBY_VERSION.dup).segments minor_version = ruby_version_segments[0..1].join('.') group :development do - gem "fast_gettext", '1.1.0', require: false if Gem::Version.new(RUBY_VERSION.dup) < Gem::Version.new('2.1.0') - gem "fast_gettext", require: false if Gem::Version.new(RUBY_VERSION.dup) >= Gem::Version.new('2.1.0') - gem "json_pure", '<= 2.0.1', require: false if Gem::Version.new(RUBY_VERSION.dup) < Gem::Version.new('2.0.0') - gem "json", '= 1.8.1', require: false if Gem::Version.new(RUBY_VERSION.dup) == Gem::Version.new('2.1.9') - gem "json", '= 2.0.4', require: false if Gem::Requirement.create('~> 2.4.2').satisfied_by?(Gem::Version.new(RUBY_VERSION.dup)) - gem "json", '= 2.1.0', require: false if Gem::Requirement.create(['>= 2.5.0', '< 2.7.0']).satisfied_by?(Gem::Version.new(RUBY_VERSION.dup)) - gem "rb-readline", '= 0.5.5', require: false, platforms: [:mswin, :mingw, :x64_mingw] - gem "puppet-module-posix-default-r#{minor_version}", '~> 0.3', require: false, platforms: [:ruby] - gem "puppet-module-posix-dev-r#{minor_version}", '~> 0.3', require: false, platforms: [:ruby] - gem "puppet-module-win-default-r#{minor_version}", '~> 0.3', require: false, platforms: [:mswin, :mingw, :x64_mingw] - gem "puppet-module-win-dev-r#{minor_version}", '~> 0.3', require: false, platforms: [:mswin, :mingw, :x64_mingw] - gem "github_changelog_generator", require: false, git: 'https://github.com/skywinder/github-changelog-generator', ref: '20ee04ba1234e9e83eb2ffb5056e23d641c7a018' if Gem::Version.new(RUBY_VERSION.dup) >= Gem::Version.new('2.2.2') + gem "voxpupuli-test", '5.4.1', require: false + gem "faraday", '~> 1.0', require: false + gem "github_changelog_generator", require: false + gem "puppet-blacksmith", require: false + gem "puppet-strings", require: false +end +group :system_tests do + gem "beaker", *location_for(ENV['BEAKER_VERSION'] || '~> 4.29') + gem "beaker-abs", *location_for(ENV['BEAKER_ABS_VERSION'] || '~> 0.1') + gem "beaker-pe", require: false + gem "beaker-hostgenerator" + gem "beaker-rspec" + gem "beaker-docker" + gem "beaker-puppet" + gem "beaker-puppet_install_helper", require: false + gem "beaker-module_install_helper", require: false end puppet_version = ENV['PUPPET_GEM_VERSION'] @@ -37,6 +41,8 @@ hiera_version = ENV['HIERA_GEM_VERSION'] gems = {} +gems['rake'] = [require: false] +gems['puppetlabs_spec_helper'] = [require: false] gems['puppet'] = location_for(puppet_version) # If facter or hiera versions have been specified via the environment diff --git a/data/common.yaml b/data/common.yaml index f96405c..aa32986 100644 --- a/data/common.yaml +++ b/data/common.yaml @@ -1,17 +1,14 @@ --- -harbor::version: '2.1.2' -harbor::release: '2.1.0' -harbor::checksum: '37a84e078504546c24e6fb99f80f6d05' +harbor::version: '2.8.2' +harbor::release: '2.8.0' +harbor::checksum: 'dadf773143dcdcfa05a54a8826835d6d' harbor::installer: 'offline' harbor::with_notary: false harbor::with_trivy: false -harbor::with_clair: false -harbor::with_chartmuseum: false -harbor::harbor_ha: false harbor::hostname: "%{facts.fqdn}" harbor::ui_url_protocol: 'http' harbor::max_job_workers: 10 -harbor::absolute_url: 'disabled' +harbor::logger_sweeper_duration: 1 harbor::customize_crt: 'on' harbor::ssl_cert: '/data/cert/server.crt' harbor::ssl_cert_key: '/data/cert/server.key' @@ -37,25 +34,19 @@ harbor::db_host: 'postgresql' harbor::db_password: 'root123' harbor::db_port: 5432 harbor::db_user: 'postgres' -harbor::db_max_idle_connections: 50 -harbor::db_max_open_conns: 100 +harbor::db_max_idle_connections: 100 +harbor::db_max_open_conns: 900 harbor::external_redis: false harbor::redis_host: 'redis' harbor::redis_port: 6379 harbor::redis_password: '' harbor::redis_registry_db_index: 1 harbor::redis_jobservice_db_index: 2 -harbor::redis_chartmuseum_db_index: 3 -harbor::redis_clair_db_index: 4 +harbor::redis_trivy_db_index: 5 harbor::trivy_ignore_unfixed: false harbor::trivy_skip_update: false +harbor::trivy_offline_scan: false harbor::trivy_insecure: false -harbor::clair_db_host: 'postgresql' -harbor::clair_db_password: 'root123' -harbor::clair_db_port: 5432 -harbor::clair_db_username: 'postgres' -harbor::clair_db: 'postgres' -harbor::clair_updaters_interval: 12 harbor::uaa_ca_cert: '' harbor::registry_storage_provider_name: 'filesystem' harbor::registry_storage_provider_config: '' @@ -66,5 +57,11 @@ harbor::webhook_job_max_retry: 10 harbor::metrics: false harbor::metrics_port: 9090 harbor::metrics_path: /metrics +harbor::upload_purging_enabled: true +harbor::upload_purging_age: 168h +harbor::upload_purging_interval: 24h +harbor::upload_purging_dryrun: false +harbor::cache_enabled: false +harbor::cache_expire_hours: 24 harbor::backup_enabled: false harbor::backup_directory: '/tmp' diff --git a/manifests/config.pp b/manifests/config.pp index 239b470..3ce53c9 100644 --- a/manifests/config.pp +++ b/manifests/config.pp @@ -5,7 +5,7 @@ $hostname, $ui_url_protocol, $max_job_workers, - $absolute_url, + $logger_sweeper_duration, $customize_crt, $ssl_cert, $ssl_cert_key, @@ -38,18 +38,12 @@ $redis_password, $redis_registry_db_index, $redis_jobservice_db_index, - $redis_chartmuseum_db_index, - $redis_clair_db_index, + $redis_trivy_db_index, $trivy_ignore_unfixed, $trivy_skip_update, + $trivy_offline_scan, $trivy_insecure, $trivy_github_token, - $clair_db_host, - $clair_db_password, - $clair_db_port, - $clair_db_username, - $clair_db, - $clair_updaters_interval, $uaa_ca_cert, $registry_storage_provider_name, $registry_storage_provider_config, @@ -60,6 +54,12 @@ $metrics, $metrics_port, $metrics_path, + $upload_purging_enabled, + $upload_purging_age, + $upload_purging_interval, + $upload_purging_dryrun, + $cache_enabled, + $cache_expire_hours, ){ assert_private() @@ -69,7 +69,7 @@ 'hostname' => $hostname, 'ui_url_protocol' => $ui_url_protocol, 'max_job_workers' => $max_job_workers, - 'absolute_url' => $absolute_url, + 'logger_sweeper_duration' => $logger_sweeper_duration, 'customize_crt' => $customize_crt, 'ssl_cert' => $ssl_cert, 'ssl_cert_key' => $ssl_cert_key, @@ -95,14 +95,9 @@ 'redis_password' => $redis_password, 'trivy_ignore_unfixed' => $trivy_ignore_unfixed, 'trivy_skip_update' => $trivy_skip_update, + 'trivy_offline_scan' => $trivy_offline_scan, 'trivy_insecure' => $trivy_insecure, 'trivy_github_token' => $trivy_github_token, - 'clair_db_host' => $clair_db_host, - 'clair_db_password' => $clair_db_password, - 'clair_db_port' => $clair_db_port, - 'clair_db_username' => $clair_db_username, - 'clair_db' => $clair_db, - 'clair_updaters_interval' => $clair_updaters_interval, 'uaa_ca_cert' => $uaa_ca_cert, 'registry_storage_provider_name' => $registry_storage_provider_name, 'registry_storage_provider_config' => $registry_storage_provider_config, @@ -118,12 +113,17 @@ 'external_redis' => $external_redis, 'redis_registry_db_index' => $redis_registry_db_index, 'redis_jobservice_db_index' => $redis_jobservice_db_index, - 'redis_chartmuseum_db_index' => $redis_chartmuseum_db_index, - 'redis_clair_db_index' => $redis_clair_db_index, + 'redis_trivy_db_index' => $redis_trivy_db_index, 'webhook_job_max_retry' => $webhook_job_max_retry, 'metrics' => $metrics, 'metrics_port' => $metrics_port, 'metrics_path' => $metrics_path, + 'upload_purging_enabled' => $upload_purging_enabled, + 'upload_purging_age' => $upload_purging_age, + 'upload_purging_interval' => $upload_purging_interval, + 'upload_purging_dryrun' => $upload_purging_dryrun, + 'cache_enabled' => $cache_enabled, + 'cache_expire_hours' => $cache_expire_hours, } file { '/opt/harbor/harbor.yml': diff --git a/manifests/init.pp b/manifests/init.pp index ffa0f10..7cade95 100644 --- a/manifests/init.pp +++ b/manifests/init.pp @@ -21,18 +21,6 @@ # Specifies whether to include Trivy functionality in the deployment. # Defaults to false # -# @param with_clair -# Specifies whether to include Clair functionality in the deployment. -# Defaults to false -# -# @param with_chartmuseum -# Specifies whether to include Helm Chart repository functionality in the deployment. -# Defaults to false -# -# @param harbor_ha -# Specifies whether to include high availability functionality in the deployment. -# Defaults to false -# # @param download_source # Specifies download location for the Harbor installation tar file. # @@ -52,9 +40,9 @@ # The maximum number of replication workers in job service # Defaults to 10 # -# @param absolute_url -# Change the value of absolute_url to enabled can enable absolute url in chart -# Defaults to disabled +# @param logger_sweeper_duration +# The jobLogger sweeper duration +# Defaults to 1 (days) # # @param customize_crt # When this attribute is on, the prepare script creates private key and root certificate @@ -154,35 +142,18 @@ # # @param redis_jobservice_db_index # -# @param redis_chartmuseum_db_index -# -# @param redis_clair_db_index +# @param redis_trivy_db_index # # @param trivy_ignore_unfixed # # @param trivy_skip_update # +# @param trivy_offline_scan +# # @param trivy_insecure # # @param trivy_github_token # -# @param clair_db_host -# Defaults to postgresql -# -# @param clair_db_password -# Defaults to root123 -# -# @param clair_db_port -# Defaults to 5432 -# -# @param clair_db_username -# Defaults to postgres -# -# @param clair_db -# Defaults to postgres -# -# @param clair_updaters_interval -# # @param uaa_ca_cert # # @param registry_storage_provider_name @@ -206,6 +177,18 @@ # @param metrics_path # Metrics path # +# @param upload_purging_enabled +# +# @param upload_purging_age +# +# @param upload_purging_interval +# +# @param upload_purging_dryrun +# +# @param cache_enabled +# +# @param cache_expire_hours +# # @param backup_enabled # Specifies whether to create a backup tar file of the Harbor database if an upgrade is detected # Defaults to false @@ -221,13 +204,10 @@ Boolean $external_redis, Boolean $with_notary, Boolean $with_trivy, - Boolean $with_clair, - Boolean $with_chartmuseum, - Boolean $harbor_ha, Stdlib::Host $hostname, Enum['http','https'] $ui_url_protocol, Integer $max_job_workers, - Enum['enabled','disabled'] $absolute_url, + Integer $logger_sweeper_duration, Enum['on','off'] $customize_crt, Stdlib::Absolutepath $ssl_cert, Stdlib::Absolutepath $ssl_cert_key, @@ -260,17 +240,11 @@ String $redis_password, Integer $redis_registry_db_index, Integer $redis_jobservice_db_index, - Integer $redis_chartmuseum_db_index, - Integer $redis_clair_db_index, + Integer $redis_trivy_db_index, Boolean $trivy_ignore_unfixed, Boolean $trivy_skip_update, + Boolean $trivy_offline_scan, Boolean $trivy_insecure, - Stdlib::Host $clair_db_host, - String $clair_db_password, - Stdlib::Port $clair_db_port, - String $clair_db_username, - String $clair_db, - Integer $clair_updaters_interval, String $uaa_ca_cert, Enum['filesystem','s3','gcs','azure','swift','oss'] $registry_storage_provider_name, String $registry_storage_provider_config, @@ -281,6 +255,12 @@ Boolean $metrics, Stdlib::Port $metrics_port, String $metrics_path, + Boolean $upload_purging_enabled, + String $upload_purging_age, + String $upload_purging_interval, + Boolean $upload_purging_dryrun, + Boolean $cache_enabled, + Integer $cache_expire_hours, Boolean $backup_enabled, Stdlib::Absolutepath $backup_directory, Optional[String] $trivy_github_token = undef, @@ -348,7 +328,7 @@ hostname => $hostname, ui_url_protocol => $ui_url_protocol, max_job_workers => $max_job_workers, - absolute_url => $absolute_url, + logger_sweeper_duration => $logger_sweeper_duration, customize_crt => $customize_crt, ssl_cert => $ssl_cert, ssl_cert_key => $ssl_cert_key, @@ -381,18 +361,12 @@ redis_password => $redis_password, redis_registry_db_index => $redis_registry_db_index, redis_jobservice_db_index => $redis_jobservice_db_index, - redis_chartmuseum_db_index => $redis_chartmuseum_db_index, - redis_clair_db_index => $redis_clair_db_index, + redis_trivy_db_index => $redis_trivy_db_index, trivy_ignore_unfixed => $trivy_ignore_unfixed, trivy_skip_update => $trivy_skip_update, + trivy_offline_scan => $trivy_offline_scan, trivy_insecure => $trivy_insecure, trivy_github_token => $trivy_github_token, - clair_db_host => $clair_db_host, - clair_db_password => $clair_db_password, - clair_db_port => $clair_db_port, - clair_db_username => $clair_db_username, - clair_db => $clair_db, - clair_updaters_interval => $clair_updaters_interval, uaa_ca_cert => $uaa_ca_cert, registry_storage_provider_name => $registry_storage_provider_name, registry_storage_provider_config => $registry_storage_provider_config, @@ -403,25 +377,25 @@ metrics => $metrics, metrics_port => $metrics_port, metrics_path => $metrics_path, + upload_purging_enabled => $upload_purging_enabled, + upload_purging_age => $upload_purging_age, + upload_purging_interval => $upload_purging_interval, + upload_purging_dryrun => $upload_purging_dryrun, + cache_enabled => $cache_enabled, + cache_expire_hours => $cache_expire_hours, } contain 'harbor::config' class { 'harbor::prepare': - version => $version, - with_notary => $with_notary, - with_trivy => $with_trivy, - with_clair => $with_clair, - with_chartmuseum => $with_chartmuseum, - harbor_ha => $harbor_ha, + version => $version, + with_notary => $with_notary, + with_trivy => $with_trivy, } contain 'harbor::prepare' class { 'harbor::service': cfg_version => $_cfg_version, with_notary => $with_notary, - with_clair => $with_clair, - with_chartmuseum => $with_chartmuseum, - harbor_ha => $harbor_ha, compose_install_path => $docker::compose::install_path, } contain 'harbor::service' diff --git a/manifests/prepare.pp b/manifests/prepare.pp index eca4c81..705032b 100644 --- a/manifests/prepare.pp +++ b/manifests/prepare.pp @@ -4,48 +4,16 @@ $version, $with_notary, $with_trivy, - $with_clair, - $harbor_ha, - $with_chartmuseum, ){ assert_private() - if $with_notary and !$harbor_ha { - if versioncmp($version, '2.2.3') >= 0 { - $opts_hash = { - '--with-notary' => $with_notary, - '--with-trivy' => $with_trivy, - '--ha' => $harbor_ha, - '--with-chartmuseum' => $with_chartmuseum, - } - } else { - $opts_hash = { - '--with-notary' => $with_notary, - '--with-trivy' => $with_trivy, - '--with-clair' => $with_clair, - '--ha' => $harbor_ha, - '--with-chartmuseum' => $with_chartmuseum, - } - } - } else { - if versioncmp($version, '2.2.3') >= 0 { - $opts_hash = { - '--with-trivy' => $with_trivy, - '--ha' => $harbor_ha, - '--with-chartmuseum' => $with_chartmuseum, - } - } else { - $opts_hash = { - '--with-trivy' => $with_trivy, - '--with-clair' => $with_clair, - '--ha' => $harbor_ha, - '--with-chartmuseum' => $with_chartmuseum, - } - } - } + $opts_hash = { + '--with-notary' => $with_notary, + '--with-trivy' => $with_trivy, + }.filter |$key, $value| { $value } - $opts = join(keys($opts_hash.filter |$key, $value| { $value }), ' ') + $opts = join(keys($opts_hash), ' ') file { '/opt/harbor/prepare.sh': ensure => 'file', diff --git a/manifests/service.pp b/manifests/service.pp index 8d71111..e87b650 100644 --- a/manifests/service.pp +++ b/manifests/service.pp @@ -3,46 +3,20 @@ class harbor::service ( $cfg_version, $with_notary, - $with_clair, - $with_chartmuseum, - $harbor_ha, $compose_install_path, ){ assert_private() - if versioncmp($cfg_version, '2.0.0') >= 0 { - $_compose_files_final = '-f /opt/harbor/docker-compose.yml' - } elsif versioncmp($cfg_version, '1.8.0') >= 0 { - if $harbor_ha { - $_compose_files = '/opt/harbor/ha/docker-compose.yml' - } else { - $_compose_files = '/opt/harbor/docker-compose.yml' - } - $_compose_files_final = "-f ${_compose_files}" + $_default_ompose_files = '-f /opt/harbor/docker-compose.yml' + if $with_notary { + $_optional_compose_files = ' -f /opt/harbor/docker-compose.notary.yml' } else { - if $harbor_ha { - $_compose = '/opt/harbor/ha/docker-compose.yml' - $_clair_compose = '/opt/harbor/ha/docker-compose.clair.yml' - } else { - $_compose = '/opt/harbor/docker-compose.yml' - $_clair_compose = '/opt/harbor/docker-compose.clair.yml' - } - - $_optional_compose_files = { - 'clair' => $_clair_compose, - 'notary' => '/opt/harbor/docker-compose.notary.yml', - 'chartmuseum' => '/opt/harbor/docker-compose.chartmuseum.yml', - } - - $_extra_files = $_optional_compose_files.map |$key, $value| { - if getvar("with_${key}") { $value } - } - - $_compose_files = delete_undef_values([ $_compose ] + $_extra_files) - $_compose_files_final = join($_compose_files.map |$item| { "-f ${item}" }, ' ') + $_optional_compose_files = '' } + $_compose_files = "${_default_ompose_files}${_optional_compose_files}" + file { 'harbor_service_unit': ensure => file, path => '/etc/systemd/system/harbor.service', @@ -51,7 +25,7 @@ mode => '0644', content => epp('harbor/harbor.service.epp', { 'compose_install_path' => $compose_install_path, - 'compose_files' => $_compose_files_final, + 'compose_files' => $_compose_files, }), notify => Exec['harbor_systemd_daemon-reload'], } diff --git a/spec/classes/config_spec.rb b/spec/classes/config_spec.rb index 82f22ea..524628d 100644 --- a/spec/classes/config_spec.rb +++ b/spec/classes/config_spec.rb @@ -10,20 +10,10 @@ describe 'harbor::config' do context 'with init default params' do it do - is_expected.to contain_file('/opt/harbor/harbor.yml').with_content(/^_version: 2.1.0$/) + is_expected.to contain_file('/opt/harbor/harbor.yml').with_content(/^_version: 2.8.0$/) is_expected.to contain_exec('migrate_cfg').with( 'cwd' => '/opt/harbor', - 'command' => "/usr/bin/docker run --rm -v /:/hostfs goharbor/prepare:v2.1.2 migrate -i /opt/harbor-v2.1.2/harbor/harbor.yml" - ) - end - end - context 'with harbor version < 2.0.0' do - let(:params) { {'version' => '1.10.6'} } - it do - is_expected.to contain_file('/opt/harbor/harbor.yml').with_content(/^_version: 1.10.0$/) - is_expected.to contain_exec('migrate_cfg').with( - 'cwd' => '/opt/harbor', - 'command' => "/usr/bin/docker run --rm -v harbor.yml:/harbor-migration/harbor-cfg/harbor.yml -v harbor.yml:/harbor-migration/harbor-cfg-out/harbor.yml goharbor/harbor-migrator:v1.10.0 --cfg up" + 'command' => "/usr/bin/docker run --rm -v /:/hostfs goharbor/prepare:v2.8.2 migrate -i /opt/harbor-v2.8.2/harbor/harbor.yml" ) end end diff --git a/spec/classes/harbor_spec.rb b/spec/classes/harbor_spec.rb index d811db2..1173d25 100644 --- a/spec/classes/harbor_spec.rb +++ b/spec/classes/harbor_spec.rb @@ -17,11 +17,11 @@ describe 'harbor::install' do context 'with init default params' do it do - is_expected.to contain_archive('/tmp/harbor-offline-installer-v2.1.2.tgz').with( - 'source' => 'https://github.com/goharbor/harbor/releases/download/v2.1.2/harbor-offline-installer-v2.1.2.tgz' + is_expected.to contain_archive('/tmp/harbor-offline-installer-v2.8.2.tgz').with( + 'source' => 'https://github.com/goharbor/harbor/releases/download/v2.8.2/harbor-offline-installer-v2.8.2.tgz' ) end - it { is_expected.to contain_file('/opt/harbor-v2.1.2') } + it { is_expected.to contain_file('/opt/harbor-v2.8.2') } it { is_expected.to contain_file('/opt/harbor') } it { is_expected.to contain_docker__image('goharbor/harbor-log') } end @@ -47,7 +47,7 @@ describe 'harbor::service' do context 'with init default params' do it do - is_expected.to contain_file('harbor_service_unit') + is_expected.to contain_file('harbor_service_unit').with_content(%r{ExecStart=/usr/local/bin/docker-compose -f /opt/harbor/docker-compose.yml up --remove-orphans}) is_expected.to contain_service('harbor') end end diff --git a/spec/spec_helper.rb b/spec/spec_helper.rb index 35a1408..d3778ca 100644 --- a/spec/spec_helper.rb +++ b/spec/spec_helper.rb @@ -38,6 +38,7 @@ # set to strictest setting for testing # by default Puppet runs at warning level Puppet.settings[:strict] = :warning + Puppet.settings[:strict_variables] = true end c.filter_run_excluding(bolt: true) unless ENV['GEM_BOLT'] c.after(:suite) do diff --git a/templates/harbor.yml.epp b/templates/harbor.yml.epp index f24fade..672af78 100644 --- a/templates/harbor.yml.epp +++ b/templates/harbor.yml.epp @@ -3,7 +3,7 @@ $hostname, $ui_url_protocol, $max_job_workers, - $absolute_url, + $logger_sweeper_duration, $customize_crt, $ssl_cert, $ssl_cert_key, @@ -36,18 +36,12 @@ $redis_password, $redis_registry_db_index, $redis_jobservice_db_index, - $redis_chartmuseum_db_index, - $redis_clair_db_index, + $redis_trivy_db_index, $trivy_ignore_unfixed, $trivy_skip_update, + $trivy_offline_scan, $trivy_insecure, $trivy_github_token, - $clair_db_host, - $clair_db_password, - $clair_db_port, - $clair_db_username, - $clair_db, - $clair_updaters_interval, $uaa_ca_cert, $registry_storage_provider_name, $registry_storage_provider_config, @@ -58,6 +52,12 @@ $metrics, $metrics_port, $metrics_path, + $upload_purging_enabled, + $upload_purging_age, + $upload_purging_interval, + $upload_purging_dryrun, + $cache_enabled, + $cache_expire_hours, | -%> # Configuration file of Harbor @@ -109,6 +109,12 @@ database: # The maximum number of open connections to the database. If it <= 0, then there is no limit on the number of open connections. # Note: the default number of connections is 100 for postgres. max_open_conns: <%= $db_max_open_conns %> + # The maximum amount of time a connection may be reused. Expired connections may be closed lazily before reuse. If it <= 0, connections are not closed due to a connection's age. + # The value is a duration string. A duration string is a possibly signed sequence of decimal numbers, each with optional fraction and a unit suffix, such as "300ms", "-1.5h" or "2h45m". Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h". + conn_max_lifetime: 5m + # The maximum amount of time a connection may be idle. Expired connections may be closed lazily before reuse. If it <= 0, connections are not closed due to a connection's idle time. + # The value is a duration string. A duration string is a possibly signed sequence of decimal numbers, each with optional fraction and a unit suffix, such as "300ms", "-1.5h" or "2h45m". Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h". + conn_max_idle_time: 0 # The default data volume data_volume: <%= $data_volume %> @@ -117,7 +123,7 @@ data_volume: <%= $data_volume %> # Uncomment storage_service setting If you want to using external storage # storage_service: # # ca_bundle is the path to the custom root ca certificate, which will be injected into the truststore -# # of registry's and chart repository's containers. This is usually needed when the user hosts a internal storage with self signed certificate. +# # of registry's containers. This is usually needed when the user hosts a internal storage with self signed certificate. # ca_bundle: # # storage backend, default is filesystem, options include filesystem, azure, gcs, s3, swift and oss @@ -126,7 +132,7 @@ data_volume: <%= $data_volume %> # maxthreads: 100 # # set disable to true when you want to disable registry redirect # redirect: -# disabled: false +# disable: false # Trivy configuration # @@ -145,6 +151,14 @@ trivy: # `metadata.json` files and mount them in the `/home/scanner/.cache/trivy/db` path. skip_update: <%= $trivy_skip_update %> # + # The offline_scan option prevents Trivy from sending API requests to identify dependencies. + # Scanning JAR files and pom.xml may require Internet access for better detection, but this option tries to avoid it. + # For example, the offline mode will not try to resolve transitive dependencies in pom.xml when the dependency doesn't + # exist in the local repositories. It means a number of detected vulnerabilities might be fewer in offline mode. + # It would work if all the dependencies are in local. + # This option doesn't affect DB download. You need to specify "skip-update" as well as "offline-scan" in an air-gapped environment. + offline_scan: <%= $trivy_offline_scan %> + # # insecure The flag to skip verifying registry certificate insecure: <%= $trivy_insecure %> # github_token The GitHub access token to download Trivy DB @@ -161,21 +175,17 @@ trivy: github_token: <%= $trivy_github_token %> <%- } -%> -# Clair configuration -clair: - # The interval of clair updaters, the unit is hour, set to 0 to disable the updaters. - updaters_interval: <%= $clair_updaters_interval %> - jobservice: # Maximum number of job workers in job service max_job_workers: <%= $max_job_workers %> + # The jobLogger sweeper duration (ignored if `jobLogger` is `stdout`) + logger_sweeper_duration: <%= $logger_sweeper_duration %> #days notification: + # Maximum retry count for webhook job webhook_job_max_retry: <%= $webhook_job_max_retry %> - -chart: - # Change the value of absolute_url to enabled can enable absolute url in chart - absolute_url: <%= absolute_url %> + # HTTP client timeout for webhook job + webhook_job_http_client_timeout: 3 #seconds # Log configurations log: @@ -218,13 +228,6 @@ _version: <%= $cfg_version %> # username: harbor_db_username # password: harbor_db_password # ssl_mode: disable -# clair: -# host: clair_db_host -# port: clair_db_port -# db_name: clair_db_name -# username: clair_db_username -# password: clair_db_password -# ssl_mode: disable # notary_signer: # host: notary_signer_db_host # port: notary_signer_db_port @@ -243,14 +246,13 @@ _version: <%= $cfg_version %> <% if $external_redis == 'true' { -%> # Uncomment external_redis if using external Redis server external_redis: - host: <%= $redis_host %> - port: <%= $redis_port %> + host: <%= $redis_host %>:<%= $redis_port %> password: <%= $redis_password %> # db_index 0 is for core, it's unchangeable registry_db_index: <%= $redis_registry_db_index %> jobservice_db_index: <%= $redis_jobservice_db_index %> - chartmuseum_db_index: <%= $redis_chartmuseum_db_index %> - clair_db_index: <%= $redis_clair_db_index %> + trivy_db_index: <%= $redis_trivy_db_index %> + idle_timeout_seconds: 30 <% } %> <% if ! empty($uaa_ca_cert) { -%> @@ -275,10 +277,63 @@ proxy: components: - core - jobservice - - clair + - trivy <%- if $metrics { -%> metric: enabled: true port: <%= $metrics_port %> path: <%= $metrics_path %> <%- } -%> + +# Trace related config +# only can enable one trace provider(jaeger or otel) at the same time, +# and when using jaeger as provider, can only enable it with agent mode or collector mode. +# if using jaeger collector mode, uncomment endpoint and uncomment username, password if needed +# if using jaeger agetn mode uncomment agent_host and agent_port +# trace: +# enabled: true +# # set sample_rate to 1 if you wanna sampling 100% of trace data; set 0.5 if you wanna sampling 50% of trace data, and so forth +# sample_rate: 1 +# # # namespace used to differenciate different harbor services +# # namespace: +# # # attributes is a key value dict contains user defined attributes used to initialize trace provider +# # attributes: +# # application: harbor +# # # jaeger should be 1.26 or newer. +# # jaeger: +# # endpoint: http://hostname:14268/api/traces +# # username: +# # password: +# # agent_host: hostname +# # # export trace data by jaeger.thrift in compact mode +# # agent_port: 6831 +# # otel: +# # endpoint: hostname:4318 +# # url_path: /v1/traces +# # compression: false +# # insecure: true +# # timeout: 10s + +# Enable purge _upload directories +upload_purging: + enabled: <%= $upload_purging_enabled %> + # remove files in _upload directories which exist for a period of time, default is one week. + age: <%= $upload_purging_age %> + # the interval of the purge operations + interval: <%= $upload_purging_interval %> + dryrun: <%= $upload_purging_dryrun %> + +# Cache layer configurations +# If this feature enabled, harbor will cache the resource +# `project/project_metadata/repository/artifact/manifest` in the redis +# which can especially help to improve the performance of high concurrent +# manifest pulling. +# NOTICE +# If you are deploying Harbor in HA mode, make sure that all the harbor +# instances have the same behaviour, all with caching enabled or disabled, +# otherwise it can lead to potential data inconsistency. +cache: + # not enabled by default + enabled: <%= $cache_enabled %> + # keep cache for one day by default + expire_hours: <%= $cache_expire_hours %> From 0edd87cf183590fe8012feee5beb4aecb05ec720 Mon Sep 17 00:00:00 2001 From: Trey Dockendorf Date: Fri, 30 Jun 2023 10:58:35 -0400 Subject: [PATCH 2/9] Don't need harbor1_client for v2 API --- lib/puppet_x/walkamongus/harbor/client.rb | 1 - 1 file changed, 1 deletion(-) diff --git a/lib/puppet_x/walkamongus/harbor/client.rb b/lib/puppet_x/walkamongus/harbor/client.rb index 87f56d6..57b2ae8 100644 --- a/lib/puppet_x/walkamongus/harbor/client.rb +++ b/lib/puppet_x/walkamongus/harbor/client.rb @@ -15,7 +15,6 @@ def self.do_login end def self.do_login_api_v2(client_config) - require 'harbor1_client' require 'harbor2_client' require 'harbor2_legacy_client' Harbor2Client.configure do |config| From 5306d3315df171e4c0c2ab58d69412efdeb6ea6e Mon Sep 17 00:00:00 2001 From: Trey Dockendorf Date: Fri, 30 Jun 2023 11:59:51 -0400 Subject: [PATCH 3/9] Email settings removed in v2.7 --- .../provider/harbor_user_settings/swagger.rb | 140 ------------------ lib/puppet/type/harbor_user_settings.rb | 36 ----- 2 files changed, 176 deletions(-) diff --git a/lib/puppet/provider/harbor_user_settings/swagger.rb b/lib/puppet/provider/harbor_user_settings/swagger.rb index 9154f80..268ccb3 100644 --- a/lib/puppet/provider/harbor_user_settings/swagger.rb +++ b/lib/puppet/provider/harbor_user_settings/swagger.rb @@ -42,146 +42,6 @@ def auth_mode=(_value) end end - def email_from - api_instance = do_login - config = get_config(api_instance) - config.email_from.value - end - - def email_from=(_value) - api_instance = do_login - configurations = { - "email_from": resource[:email_from], - } - begin - api_instance[:legacy_client].configurations_put(configurations) - rescue Harbor2LegacyClient::ApiError => e - puts "Exception when calling ProductsApi->configurations_put for email_from: #{e}" - rescue Harbor1Client::ApiError => e - puts "Exception when calling ProductsApi->configurations_put for email_from: #{e}" - end - end - - def email_host - api_instance = do_login - config = get_config(api_instance) - config.email_host.value - end - - def email_host=(_value) - api_instance = do_login - configurations = { - "email_host": resource[:email_host], - } - begin - api_instance[:legacy_client].configurations_put(configurations) - rescue Harbor2LegacyClient::ApiError => e - puts "Exception when calling ProductsApi->configurations_put for email_host: #{e}" - rescue Harbor1Client::ApiError => e - puts "Exception when calling ProductsApi->configurations_put for email_host: #{e}" - end - end - - def email_port - api_instance = do_login - config = get_config(api_instance) - config.email_port.value - end - - def email_port=(_value) - api_instance = do_login - configurations = { - "email_port": resource[:email_port], - } - begin - api_instance[:legacy_client].configurations_put(configurations) - rescue Harbor2LegacyClient::ApiError => e - puts "Exception when calling ProductsApi->configurations_put for email_port: #{e}" - rescue Harbor1Client::ApiError => e - puts "Exception when calling ProductsApi->configurations_put for email_port: #{e}" - end - end - - def email_identity - api_instance = do_login - config = get_config(api_instance) - config.email_identity.value - end - - def email_identity=(_value) - api_instance = do_login - configurations = { - "email_identity": resource[:email_identity], - } - begin - api_instance[:legacy_client].configurations_put(configurations) - rescue Harbor2LegacyClient::ApiError => e - puts "Exception when calling ProductsApi->configurations_put for email_identity: #{e}" - rescue Harbor1Client::ApiError => e - puts "Exception when calling ProductsApi->configurations_put for email_identity: #{e}" - end - end - - def email_username - api_instance = do_login - config = get_config(api_instance) - config.email_username.value - end - - def email_username=(_value) - api_instance = do_login - configurations = { - "email_username": resource[:email_username], - } - begin - api_instance[:legacy_client].configurations_put(configurations) - rescue Harbor2LegacyClient::ApiError => e - puts "Exception when calling ProductsApi->configurations_put for email_username: #{e}" - rescue Harbor1Client::ApiError => e - puts "Exception when calling ProductsApi->configurations_put for email_username: #{e}" - end - end - - def email_ssl - api_instance = do_login - config = get_config(api_instance) - config.email_ssl.value - end - - def email_ssl=(_value) - api_instance = do_login - configurations = { - "email_ssl": resource[:email_ssl], - } - begin - api_instance[:legacy_client].configurations_put(configurations) - rescue Harbor2LegacyClient::ApiError => e - puts "Exception when calling ProductsApi->configurations_put for email_ssl: #{e}" - rescue Harbor1Client::ApiError => e - puts "Exception when calling ProductsApi->configurations_put for email_ssl: #{e}" - end - end - - def email_insecure - api_instance = do_login - config = get_config(api_instance) - config.email_insecure.value - end - - def email_insecure=(_value) - api_instance = do_login - configurations = { - "email_insecure": resource[:email_insecure], - } - begin - api_instance[:legacy_client].configurations_put(configurations) - rescue Harbor2LegacyClient::ApiError => e - puts "Exception when calling ProductsApi->configurations_put for email_insecure: #{e}" - rescue Harbor1Client::ApiError => e - puts "Exception when calling ProductsApi->configurations_put for email_insecure: #{e}" - end - end - def ldap_url api_instance = do_login config = get_config(api_instance) diff --git a/lib/puppet/type/harbor_user_settings.rb b/lib/puppet/type/harbor_user_settings.rb index d336e07..21c4389 100644 --- a/lib/puppet/type/harbor_user_settings.rb +++ b/lib/puppet/type/harbor_user_settings.rb @@ -23,42 +23,6 @@ newvalues('db_auth', 'ldap_auth', 'uaa_auth', 'oidc_auth') end - newproperty(:email_from) do - desc 'The sender name for Email notification' - defaultto 'admin ' - end - - newproperty(:email_host) do - desc 'The hostname of SMTP server that sends Email notification' - defaultto 'smtp.mydomain.com' - end - - newproperty(:email_port) do - desc 'The port of SMTP server' - defaultto 25 - end - - newproperty(:email_identity) do - desc 'By default it is empty so the email_username is picked' - end - - newproperty(:email_username) do - desc 'The username for authentication against SMTP server' - defaultto 'sample_admin@mydomain.com' - end - - newproperty(:email_ssl) do - desc 'When set to true the system will access Email server via TLS by default. If set to false, it still will handle "STARTTLS" from server side' - defaultto false - newvalues(true, false) - end - - newproperty(:email_insecure) do - desc 'Whether or not the certificate will be verified when Harbor tries to access the email server' - defaultto false - newvalues(true, false) - end - newproperty(:ldap_url) do desc 'The URL of LDAP server' end From 380e226739118b7ce18bbe7b2b0abc299eb94a75 Mon Sep 17 00:00:00 2001 From: Trey Dockendorf Date: Sat, 5 Oct 2024 10:16:38 -0400 Subject: [PATCH 4/9] Add config options supported by Harbor 2.11 --- data/common.yaml | 7 +++++++ manifests/config.pp | 10 +++++++++ manifests/init.pp | 20 ++++++++++++++++++ templates/harbor.yml.epp | 45 ++++++++++++++++++++++++++++++++++++++++ 4 files changed, 82 insertions(+) diff --git a/data/common.yaml b/data/common.yaml index aa32986..92dbbb7 100644 --- a/data/common.yaml +++ b/data/common.yaml @@ -8,6 +8,9 @@ harbor::with_trivy: false harbor::hostname: "%{facts.fqdn}" harbor::ui_url_protocol: 'http' harbor::max_job_workers: 10 +harbor::job_logger: + - STD_OUTPUT + - FILE harbor::logger_sweeper_duration: 1 harbor::customize_crt: 'on' harbor::ssl_cert: '/data/cert/server.crt' @@ -43,10 +46,13 @@ harbor::redis_password: '' harbor::redis_registry_db_index: 1 harbor::redis_jobservice_db_index: 2 harbor::redis_trivy_db_index: 5 +harbor::redis_harbor_db_index: ~ +harbor::redis_cache_layer_db_index: ~ harbor::trivy_ignore_unfixed: false harbor::trivy_skip_update: false harbor::trivy_offline_scan: false harbor::trivy_insecure: false +harbor::trivy_timeout: '5m0s' harbor::uaa_ca_cert: '' harbor::registry_storage_provider_name: 'filesystem' harbor::registry_storage_provider_config: '' @@ -63,5 +69,6 @@ harbor::upload_purging_interval: 24h harbor::upload_purging_dryrun: false harbor::cache_enabled: false harbor::cache_expire_hours: 24 +harbor::quota_update_provider: db harbor::backup_enabled: false harbor::backup_directory: '/tmp' diff --git a/manifests/config.pp b/manifests/config.pp index 3ce53c9..c076d9e 100644 --- a/manifests/config.pp +++ b/manifests/config.pp @@ -5,6 +5,7 @@ $hostname, $ui_url_protocol, $max_job_workers, + $job_logger, $logger_sweeper_duration, $customize_crt, $ssl_cert, @@ -39,10 +40,13 @@ $redis_registry_db_index, $redis_jobservice_db_index, $redis_trivy_db_index, + $redis_harbor_db_index, + $redis_cache_layer_db_index, $trivy_ignore_unfixed, $trivy_skip_update, $trivy_offline_scan, $trivy_insecure, + $trivy_timeout, $trivy_github_token, $uaa_ca_cert, $registry_storage_provider_name, @@ -60,6 +64,7 @@ $upload_purging_dryrun, $cache_enabled, $cache_expire_hours, + $quota_update_provider, ){ assert_private() @@ -69,6 +74,7 @@ 'hostname' => $hostname, 'ui_url_protocol' => $ui_url_protocol, 'max_job_workers' => $max_job_workers, + 'job_logger' => $job_logger, 'logger_sweeper_duration' => $logger_sweeper_duration, 'customize_crt' => $customize_crt, 'ssl_cert' => $ssl_cert, @@ -97,6 +103,7 @@ 'trivy_skip_update' => $trivy_skip_update, 'trivy_offline_scan' => $trivy_offline_scan, 'trivy_insecure' => $trivy_insecure, + 'trivy_timeout' => $trivy_timeout, 'trivy_github_token' => $trivy_github_token, 'uaa_ca_cert' => $uaa_ca_cert, 'registry_storage_provider_name' => $registry_storage_provider_name, @@ -114,6 +121,8 @@ 'redis_registry_db_index' => $redis_registry_db_index, 'redis_jobservice_db_index' => $redis_jobservice_db_index, 'redis_trivy_db_index' => $redis_trivy_db_index, + 'redis_harbor_db_index' => $redis_harbor_db_index, + 'redis_cache_layer_db_index' => $redis_cache_layer_db_index, 'webhook_job_max_retry' => $webhook_job_max_retry, 'metrics' => $metrics, 'metrics_port' => $metrics_port, @@ -124,6 +133,7 @@ 'upload_purging_dryrun' => $upload_purging_dryrun, 'cache_enabled' => $cache_enabled, 'cache_expire_hours' => $cache_expire_hours, + 'quota_update_provider' => $quota_update_provider, } file { '/opt/harbor/harbor.yml': diff --git a/manifests/init.pp b/manifests/init.pp index 7cade95..0faedb5 100644 --- a/manifests/init.pp +++ b/manifests/init.pp @@ -40,6 +40,8 @@ # The maximum number of replication workers in job service # Defaults to 10 # +# @param job_logger +# # @param logger_sweeper_duration # The jobLogger sweeper duration # Defaults to 1 (days) @@ -144,6 +146,10 @@ # # @param redis_trivy_db_index # +# @param redis_harbor_db_index +# +# @param redis_cache_layer_db_index +# # @param trivy_ignore_unfixed # # @param trivy_skip_update @@ -152,6 +158,8 @@ # # @param trivy_insecure # +# @param trivy_timeout +# # @param trivy_github_token # # @param uaa_ca_cert @@ -189,6 +197,8 @@ # # @param cache_expire_hours # +# @param quota_update_provider +# # @param backup_enabled # Specifies whether to create a backup tar file of the Harbor database if an upgrade is detected # Defaults to false @@ -207,6 +217,7 @@ Stdlib::Host $hostname, Enum['http','https'] $ui_url_protocol, Integer $max_job_workers, + Enum['STD_OUTPUT', 'FILE', 'DB'] $job_logger, Integer $logger_sweeper_duration, Enum['on','off'] $customize_crt, Stdlib::Absolutepath $ssl_cert, @@ -241,10 +252,13 @@ Integer $redis_registry_db_index, Integer $redis_jobservice_db_index, Integer $redis_trivy_db_index, + Optional[Integer] $redis_harbor_db_index, + Optional[Integer] $redis_cache_layer_db_index, Boolean $trivy_ignore_unfixed, Boolean $trivy_skip_update, Boolean $trivy_offline_scan, Boolean $trivy_insecure, + String $trivy_timeout, String $uaa_ca_cert, Enum['filesystem','s3','gcs','azure','swift','oss'] $registry_storage_provider_name, String $registry_storage_provider_config, @@ -261,6 +275,7 @@ Boolean $upload_purging_dryrun, Boolean $cache_enabled, Integer $cache_expire_hours, + Enum['db', 'redis'] $quota_update_provider, Boolean $backup_enabled, Stdlib::Absolutepath $backup_directory, Optional[String] $trivy_github_token = undef, @@ -328,6 +343,7 @@ hostname => $hostname, ui_url_protocol => $ui_url_protocol, max_job_workers => $max_job_workers, + job_logger => $job_logger, logger_sweeper_duration => $logger_sweeper_duration, customize_crt => $customize_crt, ssl_cert => $ssl_cert, @@ -362,10 +378,13 @@ redis_registry_db_index => $redis_registry_db_index, redis_jobservice_db_index => $redis_jobservice_db_index, redis_trivy_db_index => $redis_trivy_db_index, + redis_harbor_db_index => $redis_harbor_db_index, + redis_cache_layer_db_index => $redis_cache_layer_db_index, trivy_ignore_unfixed => $trivy_ignore_unfixed, trivy_skip_update => $trivy_skip_update, trivy_offline_scan => $trivy_offline_scan, trivy_insecure => $trivy_insecure, + trivy_timeout => $trivy_timeout, trivy_github_token => $trivy_github_token, uaa_ca_cert => $uaa_ca_cert, registry_storage_provider_name => $registry_storage_provider_name, @@ -383,6 +402,7 @@ upload_purging_dryrun => $upload_purging_dryrun, cache_enabled => $cache_enabled, cache_expire_hours => $cache_expire_hours, + quota_update_provider => $quota_update_provider, } contain 'harbor::config' diff --git a/templates/harbor.yml.epp b/templates/harbor.yml.epp index 672af78..b0010b4 100644 --- a/templates/harbor.yml.epp +++ b/templates/harbor.yml.epp @@ -3,6 +3,7 @@ $hostname, $ui_url_protocol, $max_job_workers, + $job_logger, $logger_sweeper_duration, $customize_crt, $ssl_cert, @@ -37,10 +38,13 @@ $redis_registry_db_index, $redis_jobservice_db_index, $redis_trivy_db_index, + $redis_harbor_db_index, + $redis_cache_layer_db_index, $trivy_ignore_unfixed, $trivy_skip_update, $trivy_offline_scan, $trivy_insecure, + $trivy_timeout, $trivy_github_token, $uaa_ca_cert, $registry_storage_provider_name, @@ -58,6 +62,7 @@ $upload_purging_dryrun, $cache_enabled, $cache_expire_hours, + $quota_update_provider, | -%> # Configuration file of Harbor @@ -161,6 +166,10 @@ trivy: # # insecure The flag to skip verifying registry certificate insecure: <%= $trivy_insecure %> + # timeout The duration to wait for scan completion. + # There is upper bound of 30 minutes defined in scan job. So if this `timeout` is larger than 30m0s, it will also timeout at 30m0s. + timeout: <%= $trivy_timeout %> + # # github_token The GitHub access token to download Trivy DB # # Anonymous downloads from GitHub are subject to the limit of 60 requests per hour. Normally such rate limit is enough @@ -178,6 +187,11 @@ trivy: jobservice: # Maximum number of job workers in job service max_job_workers: <%= $max_job_workers %> + # The jobLoggers backend name, only support "STD_OUTPUT", "FILE" and/or "DB" + job_loggers: + <%- $job_loggers.each |$job_logger| { -%> + - <%= $job_logger %> + <%- } -%> # The jobLogger sweeper duration (ignored if `jobLogger` is `stdout`) logger_sweeper_duration: <%= $logger_sweeper_duration %> #days @@ -255,6 +269,25 @@ external_redis: idle_timeout_seconds: 30 <% } %> +# Uncomment redis if need to customize redis db +redis: + # db_index 0 is for core, it's unchangeable + registry_db_index: <%= $redis_registry_db_index %> + jobservice_db_index: <%= $redis_jobservice_db_index %> + trivy_db_index: <%= $redis_trivy_db_index %> + # it's optional, the db for harbor business misc, by default is 0, uncomment it if you want to change it. + <%- if $redis_harbor_db_index { -%> + harbor_db_index: <%= $redis_harbor_db_index %> + <%- } else { -%> + # harbor_db_index: 6 + <%- } -%> + # it's optional, the db for harbor cache layer, by default is 0, uncomment it if you want to change it. + <%- if $redis_cache_layer_db_index { -%> + cache_layer_db_index: <%= $redis_cache_layer_db_index %> + <%- } else { -%> + # cache_layer_db_index: 7 + <%- } -%> + <% if ! empty($uaa_ca_cert) { -%> # Uncomment uaa for trusting the certificate of uaa instance that is hosted via self-signed cert. uaa: @@ -337,3 +370,15 @@ cache: enabled: <%= $cache_enabled %> # keep cache for one day by default expire_hours: <%= $cache_expire_hours %> + +# Harbor core configurations +# Uncomment to enable the following harbor core related configuration items. +core: + # The provider for updating project quota(usage), there are 2 options, redis or db, + # by default is implemented by db but you can switch the updation via redis which + # can improve the performance of high concurrent pushing to the same project, + # and reduce the database connections spike and occupies. + # By redis will bring up some delay for quota usage updation for display, so only + # suggest switch provider to redis if you were ran into the db connections spike around + # the scenario of high concurrent pushing to same project, no improvement for other scenes. + quota_update_provider: <%= $quota_update_provider %> From 94af1387434813384278df8cacb065eb7b00b045 Mon Sep 17 00:00:00 2001 From: Trey Dockendorf Date: Mon, 7 Oct 2024 15:08:26 -0400 Subject: [PATCH 5/9] Use docker compose v2 plugin and newer docker module --- manifests/init.pp | 5 ++--- manifests/service.pp | 4 +--- metadata.json | 2 +- spec/classes/harbor_spec.rb | 2 +- templates/harbor.service.epp | 9 ++++----- 5 files changed, 9 insertions(+), 13 deletions(-) diff --git a/manifests/init.pp b/manifests/init.pp index 0faedb5..6c3eb7b 100644 --- a/manifests/init.pp +++ b/manifests/init.pp @@ -414,9 +414,8 @@ contain 'harbor::prepare' class { 'harbor::service': - cfg_version => $_cfg_version, - with_notary => $with_notary, - compose_install_path => $docker::compose::install_path, + cfg_version => $_cfg_version, + with_notary => $with_notary, } contain 'harbor::service' diff --git a/manifests/service.pp b/manifests/service.pp index e87b650..fe05b41 100644 --- a/manifests/service.pp +++ b/manifests/service.pp @@ -3,7 +3,6 @@ class harbor::service ( $cfg_version, $with_notary, - $compose_install_path, ){ assert_private() @@ -24,8 +23,7 @@ group => 'root', mode => '0644', content => epp('harbor/harbor.service.epp', { - 'compose_install_path' => $compose_install_path, - 'compose_files' => $_compose_files, + 'compose_files' => $_compose_files, }), notify => Exec['harbor_systemd_daemon-reload'], } diff --git a/metadata.json b/metadata.json index ff02055..452c280 100644 --- a/metadata.json +++ b/metadata.json @@ -18,7 +18,7 @@ }, { "name": "puppetlabs/docker", - "version_requirement": ">= 3.0.0 < 4.0.0" + "version_requirement": ">= 10.0.0 < 11.0.0" }, { "name": "puppetlabs/apt", diff --git a/spec/classes/harbor_spec.rb b/spec/classes/harbor_spec.rb index 1173d25..55a8173 100644 --- a/spec/classes/harbor_spec.rb +++ b/spec/classes/harbor_spec.rb @@ -47,7 +47,7 @@ describe 'harbor::service' do context 'with init default params' do it do - is_expected.to contain_file('harbor_service_unit').with_content(%r{ExecStart=/usr/local/bin/docker-compose -f /opt/harbor/docker-compose.yml up --remove-orphans}) + is_expected.to contain_file('harbor_service_unit').with_content(%r{ExecStart=/usr/bin/docker compose -f /opt/harbor/docker-compose.yml up --remove-orphans}) is_expected.to contain_service('harbor') end end diff --git a/templates/harbor.service.epp b/templates/harbor.service.epp index d49c003..d0bde2f 100644 --- a/templates/harbor.service.epp +++ b/templates/harbor.service.epp @@ -1,5 +1,4 @@ -<%- | String $compose_install_path, - String $compose_files | -%> +<%- | String $compose_files | -%> # This file is managed by Puppet and local changes # may be overwritten [Unit] @@ -9,8 +8,8 @@ After=docker.service [Service] Restart=always # Shutdown container (if running) when unit is stopped -ExecStartPre=<%= $compose_install_path %>/docker-compose <%= $compose_files %> down -v -ExecStart=<%= $compose_install_path %>/docker-compose <%= $compose_files %> up --remove-orphans -ExecStop=<%= $compose_install_path %>/docker-compose <%= $compose_files %> down -v +ExecStartPre=/usr/bin/docker compose <%= $compose_files %> down -v +ExecStart=/usr/bin/docker compose <%= $compose_files %> up --remove-orphans +ExecStop=/usr/bin/docker compose <%= $compose_files %> down -v [Install] WantedBy=multi-user.target From 74a4527bb742ae1ce77a47883c6497f25f7c3982 Mon Sep 17 00:00:00 2001 From: Trey Dockendorf Date: Mon, 7 Oct 2024 15:13:12 -0400 Subject: [PATCH 6/9] Fix job_logger data type --- manifests/init.pp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/manifests/init.pp b/manifests/init.pp index 0faedb5..c2103c8 100644 --- a/manifests/init.pp +++ b/manifests/init.pp @@ -217,7 +217,7 @@ Stdlib::Host $hostname, Enum['http','https'] $ui_url_protocol, Integer $max_job_workers, - Enum['STD_OUTPUT', 'FILE', 'DB'] $job_logger, + Array[Enum['STD_OUTPUT', 'FILE', 'DB']] $job_logger, Integer $logger_sweeper_duration, Enum['on','off'] $customize_crt, Stdlib::Absolutepath $ssl_cert, From b3cf1e58b59464d8e90c1980814033289a490c66 Mon Sep 17 00:00:00 2001 From: Trey Dockendorf Date: Mon, 7 Oct 2024 15:21:11 -0400 Subject: [PATCH 7/9] Fix job_loggers parameter --- data/common.yaml | 2 +- manifests/config.pp | 4 ++-- manifests/init.pp | 6 +++--- templates/harbor.yml.epp | 2 +- 4 files changed, 7 insertions(+), 7 deletions(-) diff --git a/data/common.yaml b/data/common.yaml index 92dbbb7..cb64af4 100644 --- a/data/common.yaml +++ b/data/common.yaml @@ -8,7 +8,7 @@ harbor::with_trivy: false harbor::hostname: "%{facts.fqdn}" harbor::ui_url_protocol: 'http' harbor::max_job_workers: 10 -harbor::job_logger: +harbor::job_loggers: - STD_OUTPUT - FILE harbor::logger_sweeper_duration: 1 diff --git a/manifests/config.pp b/manifests/config.pp index c076d9e..5f77981 100644 --- a/manifests/config.pp +++ b/manifests/config.pp @@ -5,7 +5,7 @@ $hostname, $ui_url_protocol, $max_job_workers, - $job_logger, + $job_loggers, $logger_sweeper_duration, $customize_crt, $ssl_cert, @@ -74,7 +74,7 @@ 'hostname' => $hostname, 'ui_url_protocol' => $ui_url_protocol, 'max_job_workers' => $max_job_workers, - 'job_logger' => $job_logger, + 'job_loggers' => $job_loggers, 'logger_sweeper_duration' => $logger_sweeper_duration, 'customize_crt' => $customize_crt, 'ssl_cert' => $ssl_cert, diff --git a/manifests/init.pp b/manifests/init.pp index c2103c8..396decb 100644 --- a/manifests/init.pp +++ b/manifests/init.pp @@ -40,7 +40,7 @@ # The maximum number of replication workers in job service # Defaults to 10 # -# @param job_logger +# @param job_loggers # # @param logger_sweeper_duration # The jobLogger sweeper duration @@ -217,7 +217,7 @@ Stdlib::Host $hostname, Enum['http','https'] $ui_url_protocol, Integer $max_job_workers, - Array[Enum['STD_OUTPUT', 'FILE', 'DB']] $job_logger, + Array[Enum['STD_OUTPUT', 'FILE', 'DB']] $job_loggers, Integer $logger_sweeper_duration, Enum['on','off'] $customize_crt, Stdlib::Absolutepath $ssl_cert, @@ -343,7 +343,7 @@ hostname => $hostname, ui_url_protocol => $ui_url_protocol, max_job_workers => $max_job_workers, - job_logger => $job_logger, + job_loggers => $job_loggers, logger_sweeper_duration => $logger_sweeper_duration, customize_crt => $customize_crt, ssl_cert => $ssl_cert, diff --git a/templates/harbor.yml.epp b/templates/harbor.yml.epp index b0010b4..30f0e89 100644 --- a/templates/harbor.yml.epp +++ b/templates/harbor.yml.epp @@ -3,7 +3,7 @@ $hostname, $ui_url_protocol, $max_job_workers, - $job_logger, + $job_loggers, $logger_sweeper_duration, $customize_crt, $ssl_cert, From 83d1637b52f2a563978183cabea9af4fc5a36abc Mon Sep 17 00:00:00 2001 From: Trey Dockendorf Date: Sat, 27 Jun 2026 10:53:35 -0400 Subject: [PATCH 8/9] Move to Harbor 2.15 --- Gemfile | 8 ++--- data/common.yaml | 13 +++++--- manifests/config.pp | 10 +++++++ manifests/init.pp | 20 +++++++++++++ metadata.json | 16 +++++----- spec/classes/config_spec.rb | 4 +-- spec/classes/harbor_spec.rb | 6 ++-- templates/harbor.yml.epp | 60 +++++++++++++++++++++++-------------- 8 files changed, 94 insertions(+), 43 deletions(-) diff --git a/Gemfile b/Gemfile index 4bc7150..024eb5c 100644 --- a/Gemfile +++ b/Gemfile @@ -17,20 +17,20 @@ ruby_version_segments = Gem::Version.new(RUBY_VERSION.dup).segments minor_version = ruby_version_segments[0..1].join('.') group :development do - gem "voxpupuli-test", '5.4.1', require: false + gem "voxpupuli-test", '9.2.1', require: false gem "faraday", '~> 1.0', require: false gem "github_changelog_generator", require: false gem "puppet-blacksmith", require: false gem "puppet-strings", require: false end group :system_tests do - gem "beaker", *location_for(ENV['BEAKER_VERSION'] || '~> 4.29') + gem "beaker", require: false gem "beaker-abs", *location_for(ENV['BEAKER_ABS_VERSION'] || '~> 0.1') gem "beaker-pe", require: false gem "beaker-hostgenerator" gem "beaker-rspec" - gem "beaker-docker" - gem "beaker-puppet" + gem "beaker-docker", '~> 2.2.0', require: false + gem "beaker-puppet", git: 'https://github.com/puppetlabs/beaker-puppet.git', ref: '6063d22b6c4449df795731f5853c3c75241240c4' gem "beaker-puppet_install_helper", require: false gem "beaker-module_install_helper", require: false end diff --git a/data/common.yaml b/data/common.yaml index cb64af4..2eae9eb 100644 --- a/data/common.yaml +++ b/data/common.yaml @@ -1,13 +1,13 @@ --- -harbor::version: '2.8.2' -harbor::release: '2.8.0' -harbor::checksum: 'dadf773143dcdcfa05a54a8826835d6d' +harbor::version: '2.15.1' +harbor::checksum: '4fa99304a404ba06c18424862ff37ffc' harbor::installer: 'offline' harbor::with_notary: false harbor::with_trivy: false harbor::hostname: "%{facts.fqdn}" harbor::ui_url_protocol: 'http' harbor::max_job_workers: 10 +harbor::max_job_duration_hours: 24 harbor::job_loggers: - STD_OUTPUT - FILE @@ -50,7 +50,12 @@ harbor::redis_harbor_db_index: ~ harbor::redis_cache_layer_db_index: ~ harbor::trivy_ignore_unfixed: false harbor::trivy_skip_update: false +harbor::trivy_skip_java_db_update: false +harbor::trivy_db_repository: ghcr.io/aquasecurity/trivy-db +harbor::trivy_java_db_repository: ghcr.io/aquasecurity/trivy-java-db harbor::trivy_offline_scan: false +harbor::trivy_security_check: + - vuln harbor::trivy_insecure: false harbor::trivy_timeout: '5m0s' harbor::uaa_ca_cert: '' @@ -59,7 +64,7 @@ harbor::registry_storage_provider_config: '' harbor::registry_custom_ca_bundle: '' harbor::reload_config: '' harbor::skip_reload_env_pattern: '' -harbor::webhook_job_max_retry: 10 +harbor::webhook_job_max_retry: 3 harbor::metrics: false harbor::metrics_port: 9090 harbor::metrics_path: /metrics diff --git a/manifests/config.pp b/manifests/config.pp index 5f77981..48438ef 100644 --- a/manifests/config.pp +++ b/manifests/config.pp @@ -5,6 +5,7 @@ $hostname, $ui_url_protocol, $max_job_workers, + $max_job_duration_hours, $job_loggers, $logger_sweeper_duration, $customize_crt, @@ -44,7 +45,11 @@ $redis_cache_layer_db_index, $trivy_ignore_unfixed, $trivy_skip_update, + $trivy_skip_java_db_update, + $trivy_db_repository, + $trivy_java_db_repository, $trivy_offline_scan, + $trivy_security_check, $trivy_insecure, $trivy_timeout, $trivy_github_token, @@ -74,6 +79,7 @@ 'hostname' => $hostname, 'ui_url_protocol' => $ui_url_protocol, 'max_job_workers' => $max_job_workers, + 'max_job_duration_hours' => $max_job_duration_hours, 'job_loggers' => $job_loggers, 'logger_sweeper_duration' => $logger_sweeper_duration, 'customize_crt' => $customize_crt, @@ -101,7 +107,11 @@ 'redis_password' => $redis_password, 'trivy_ignore_unfixed' => $trivy_ignore_unfixed, 'trivy_skip_update' => $trivy_skip_update, + 'trivy_skip_java_db_update' => $trivy_skip_java_db_update, + 'trivy_db_repository' => $trivy_db_repository, + 'trivy_java_db_repository' => $trivy_java_db_repository, 'trivy_offline_scan' => $trivy_offline_scan, + 'trivy_security_check' => $trivy_security_check, 'trivy_insecure' => $trivy_insecure, 'trivy_timeout' => $trivy_timeout, 'trivy_github_token' => $trivy_github_token, diff --git a/manifests/init.pp b/manifests/init.pp index 9698e64..4a6e14e 100644 --- a/manifests/init.pp +++ b/manifests/init.pp @@ -40,6 +40,8 @@ # The maximum number of replication workers in job service # Defaults to 10 # +# @param max_job_duration_hours +# # @param job_loggers # # @param logger_sweeper_duration @@ -154,8 +156,16 @@ # # @param trivy_skip_update # +# @param trivy_skip_java_db_update +# +# @param trivy_db_repository +# +# @param trivy_java_db_repository +# # @param trivy_offline_scan # +# @param trivy_security_check +# # @param trivy_insecure # # @param trivy_timeout @@ -217,6 +227,7 @@ Stdlib::Host $hostname, Enum['http','https'] $ui_url_protocol, Integer $max_job_workers, + Integer $max_job_duration_hours, Array[Enum['STD_OUTPUT', 'FILE', 'DB']] $job_loggers, Integer $logger_sweeper_duration, Enum['on','off'] $customize_crt, @@ -256,7 +267,11 @@ Optional[Integer] $redis_cache_layer_db_index, Boolean $trivy_ignore_unfixed, Boolean $trivy_skip_update, + Boolean $trivy_skip_java_db_update, + String $trivy_db_repository, + String $trivy_java_db_repository, Boolean $trivy_offline_scan, + Array[Enum['vuln', 'config', 'secret']] $trivy_security_check, Boolean $trivy_insecure, String $trivy_timeout, String $uaa_ca_cert, @@ -343,6 +358,7 @@ hostname => $hostname, ui_url_protocol => $ui_url_protocol, max_job_workers => $max_job_workers, + max_job_duration_hours => $max_job_duration_hours, job_loggers => $job_loggers, logger_sweeper_duration => $logger_sweeper_duration, customize_crt => $customize_crt, @@ -382,7 +398,11 @@ redis_cache_layer_db_index => $redis_cache_layer_db_index, trivy_ignore_unfixed => $trivy_ignore_unfixed, trivy_skip_update => $trivy_skip_update, + trivy_skip_java_db_update => $trivy_skip_java_db_update, + trivy_db_repository => $trivy_db_repository, + trivy_java_db_repository => $trivy_java_db_repository, trivy_offline_scan => $trivy_offline_scan, + trivy_security_check => $trivy_security_check, trivy_insecure => $trivy_insecure, trivy_timeout => $trivy_timeout, trivy_github_token => $trivy_github_token, diff --git a/metadata.json b/metadata.json index 452c280..481caeb 100644 --- a/metadata.json +++ b/metadata.json @@ -27,27 +27,27 @@ ], "operatingsystem_support": [ { - "operatingsystem": "CentOS", + "operatingsystem": "OracleLinux", "operatingsystemrelease": [ - "7" + "8" ] }, { - "operatingsystem": "OracleLinux", + "operatingsystem": "RedHat", "operatingsystemrelease": [ - "7" + "8" ] }, { - "operatingsystem": "RedHat", + "operatingsystem": "Rocky", "operatingsystemrelease": [ - "7" + "8" ] }, { - "operatingsystem": "Scientific", + "operatingsystem": "AlmaLinux", "operatingsystemrelease": [ - "7" + "8" ] }, { diff --git a/spec/classes/config_spec.rb b/spec/classes/config_spec.rb index 524628d..c2a919e 100644 --- a/spec/classes/config_spec.rb +++ b/spec/classes/config_spec.rb @@ -10,10 +10,10 @@ describe 'harbor::config' do context 'with init default params' do it do - is_expected.to contain_file('/opt/harbor/harbor.yml').with_content(/^_version: 2.8.0$/) + is_expected.to contain_file('/opt/harbor/harbor.yml').with_content(/^_version: 2.15.0$/) is_expected.to contain_exec('migrate_cfg').with( 'cwd' => '/opt/harbor', - 'command' => "/usr/bin/docker run --rm -v /:/hostfs goharbor/prepare:v2.8.2 migrate -i /opt/harbor-v2.8.2/harbor/harbor.yml" + 'command' => "/usr/bin/docker run --rm -v /:/hostfs goharbor/prepare:v2.15.1 migrate -i /opt/harbor-v2.15.1/harbor/harbor.yml" ) end end diff --git a/spec/classes/harbor_spec.rb b/spec/classes/harbor_spec.rb index 55a8173..fbfc9c9 100644 --- a/spec/classes/harbor_spec.rb +++ b/spec/classes/harbor_spec.rb @@ -17,11 +17,11 @@ describe 'harbor::install' do context 'with init default params' do it do - is_expected.to contain_archive('/tmp/harbor-offline-installer-v2.8.2.tgz').with( - 'source' => 'https://github.com/goharbor/harbor/releases/download/v2.8.2/harbor-offline-installer-v2.8.2.tgz' + is_expected.to contain_archive('/tmp/harbor-offline-installer-v2.15.1.tgz').with( + 'source' => 'https://github.com/goharbor/harbor/releases/download/v2.15.1/harbor-offline-installer-v2.15.1.tgz' ) end - it { is_expected.to contain_file('/opt/harbor-v2.8.2') } + it { is_expected.to contain_file('/opt/harbor-v2.15.1') } it { is_expected.to contain_file('/opt/harbor') } it { is_expected.to contain_docker__image('goharbor/harbor-log') } end diff --git a/templates/harbor.yml.epp b/templates/harbor.yml.epp index 30f0e89..b3906b0 100644 --- a/templates/harbor.yml.epp +++ b/templates/harbor.yml.epp @@ -3,6 +3,7 @@ $hostname, $ui_url_protocol, $max_job_workers, + $max_job_duration_hours, $job_loggers, $logger_sweeper_duration, $customize_crt, @@ -42,7 +43,11 @@ $redis_cache_layer_db_index, $trivy_ignore_unfixed, $trivy_skip_update, + $trivy_skip_java_db_update, + $trivy_db_repository, + $trivy_java_db_repository, $trivy_offline_scan, + $trivy_security_check, $trivy_insecure, $trivy_timeout, $trivy_github_token, @@ -83,8 +88,20 @@ https: # The path of cert and key files for nginx certificate: <%= $ssl_cert %> private_key: <%= $ssl_cert_key %> + # enable strong ssl ciphers (default: false) + strong_ssl_ciphers: false <% } %> +# # Harbor will set ipv4 enabled only by default if this block is not configured +# # Otherwise, please uncomment this block to configure your own ip_family stacks +# ip_family: +# # ipv6Enabled set to true if ipv6 is enabled in docker network, currently it affected the nginx related component +# ipv6: +# enabled: false +# # ipv4Enabled set to true by default, currently it affected the nginx related component +# ipv4: +# enabled: true + <%- if $internal_tls { -%> # # Uncomment following will enable tls communication between all harbor components internal_tls: @@ -107,12 +124,12 @@ harbor_admin_password: <%= $harbor_admin_password %> # Harbor DB configuration database: - # The password for the root user of Harbor DB. Change this before any production use. + # The password for the user('postgres' by default) of Harbor DB. Change this before any production use. password: <%= $db_password %> # The maximum number of connections in the idle connection pool. If it <=0, no idle connections are retained. max_idle_conns: <%= $db_max_idle_connections %> # The maximum number of open connections to the database. If it <= 0, then there is no limit on the number of open connections. - # Note: the default number of connections is 100 for postgres. + # Note: the default number of connections is 1024 for postgres of harbor. max_open_conns: <%= $db_max_open_conns %> # The maximum amount of time a connection may be reused. Expired connections may be closed lazily before reuse. If it <= 0, connections are not closed due to a connection's age. # The value is a duration string. A duration string is a possibly signed sequence of decimal numbers, each with optional fraction and a unit suffix, such as "300ms", "-1.5h" or "2h45m". Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h". @@ -156,6 +173,15 @@ trivy: # `metadata.json` files and mount them in the `/home/scanner/.cache/trivy/db` path. skip_update: <%= $trivy_skip_update %> # + # skipJavaDBUpdate If the flag is enabled you have to manually download the `trivy-java.db` file and mount it in the + # `/home/scanner/.cache/trivy/java-db/trivy-java.db` path + skip_java_db_update: <%= $trivy_skip_java_db_update %> + # + # OCI repository to retrieve the trivy vulnerability database from. + db_repository: <%= $trivy_db_repository %> + # OCI repository to retrieve the Java trivy vulnerability database from. + java_db_repository: <%= $trivy_java_db_repository %> + # # The offline_scan option prevents Trivy from sending API requests to identify dependencies. # Scanning JAR files and pom.xml may require Internet access for better detection, but this option tries to avoid it. # For example, the offline mode will not try to resolve transitive dependencies in pom.xml when the dependency doesn't @@ -164,8 +190,12 @@ trivy: # This option doesn't affect DB download. You need to specify "skip-update" as well as "offline-scan" in an air-gapped environment. offline_scan: <%= $trivy_offline_scan %> # + # Comma-separated list of what security issues to detect. Possible values are `vuln`, `config` and `secret`. Defaults to `vuln`. + security_check: <%= join($trivy_security_check, ',') %> + # # insecure The flag to skip verifying registry certificate insecure: <%= $trivy_insecure %> + # # timeout The duration to wait for scan completion. # There is upper bound of 30 minutes defined in scan job. So if this `timeout` is larger than 30m0s, it will also timeout at 30m0s. timeout: <%= $trivy_timeout %> @@ -187,6 +217,8 @@ trivy: jobservice: # Maximum number of job workers in job service max_job_workers: <%= $max_job_workers %> + # Maximum hours of task duration in job service, default 24 + max_job_duration_hours: <%= $max_job_duration_hours %> # The jobLoggers backend name, only support "STD_OUTPUT", "FILE" and/or "DB" job_loggers: <%- $job_loggers.each |$job_logger| { -%> @@ -230,10 +262,7 @@ log: #This attribute is for migrator to detect the version of the .cfg file, DO NOT MODIFY! _version: <%= $cfg_version %> -# Uncomment external_database if using external database. Currently only support POSTGRES. -# Four databases are needed to be create first by users for Harbor core, Clair, Notary server -# and Notary signer. And the tables will be generated automatically when Harbor starting up. -# NOTE: external_database is unable to custom attributes individually, you must do them in block. +# Uncomment external_database if using external database. # external_database: # harbor: # host: harbor_db_host @@ -242,20 +271,6 @@ _version: <%= $cfg_version %> # username: harbor_db_username # password: harbor_db_password # ssl_mode: disable -# notary_signer: -# host: notary_signer_db_host -# port: notary_signer_db_port -# db_name: notary_signer_db_name -# username: notary_signer_db_username -# password: notary_signer_db_password -# ssl_mode: disable -# notary_server: -# host: notary_server_db_host -# port: notary_server_db_port -# db_name: notary_server_db_name -# username: notary_server_db_username -# password: notary_server_db_password -# ssl_mode: disable <% if $external_redis == 'true' { -%> # Uncomment external_redis if using external Redis server @@ -327,7 +342,7 @@ metric: # enabled: true # # set sample_rate to 1 if you wanna sampling 100% of trace data; set 0.5 if you wanna sampling 50% of trace data, and so forth # sample_rate: 1 -# # # namespace used to differenciate different harbor services +# # # namespace used to differentiate different harbor services # # namespace: # # # attributes is a key value dict contains user defined attributes used to initialize trace provider # # attributes: @@ -345,7 +360,8 @@ metric: # # url_path: /v1/traces # # compression: false # # insecure: true -# # timeout: 10s +# # # timeout is in seconds +# # timeout: 10 # Enable purge _upload directories upload_purging: From ae063f0247b5c95d20cc7e579bd184f8277617dd Mon Sep 17 00:00:00 2001 From: Trey Dockendorf Date: Sat, 27 Jun 2026 11:17:36 -0400 Subject: [PATCH 9/9] Remove notary option, no longer supported, and remove some < 2.0 support --- data/common.yaml | 1 - manifests/config.pp | 12 ++++++------ manifests/init.pp | 12 ++---------- manifests/install.pp | 4 +--- manifests/prepare.pp | 2 -- manifests/service.pp | 12 +----------- 6 files changed, 10 insertions(+), 33 deletions(-) diff --git a/data/common.yaml b/data/common.yaml index 2eae9eb..39014bb 100644 --- a/data/common.yaml +++ b/data/common.yaml @@ -2,7 +2,6 @@ harbor::version: '2.15.1' harbor::checksum: '4fa99304a404ba06c18424862ff37ffc' harbor::installer: 'offline' -harbor::with_notary: false harbor::with_trivy: false harbor::hostname: "%{facts.fqdn}" harbor::ui_url_protocol: 'http' diff --git a/manifests/config.pp b/manifests/config.pp index 48438ef..b04e481 100644 --- a/manifests/config.pp +++ b/manifests/config.pp @@ -156,14 +156,14 @@ show_diff => false, } - $migrate_command = versioncmp($harbor::version, '2.0.0') < 0 ? { - true => "/usr/bin/docker run --rm -v harbor.yml:/harbor-migration/harbor-cfg/harbor.yml -v harbor.yml:/harbor-migration/harbor-cfg-out/harbor.yml goharbor/harbor-migrator:v${cfg_version} --cfg up", - default => "/usr/bin/docker run --rm -v /:/hostfs goharbor/prepare:v${harbor::version} migrate -i /opt/harbor-v${harbor::version}/harbor/harbor.yml", - } - + $migrate_cmd = [ + '/usr/bin/docker run --rm', + "-v /:/hostfs goharbor/prepare:v${harbor::version}", + "migrate -i /opt/harbor-v${harbor::version}/harbor/harbor.yml", + ] exec { 'migrate_cfg': cwd => '/opt/harbor', - command => $migrate_command, + command => $migrate_cmd.join(' '), environment => ['HOME=/root'], logoutput => true, refreshonly => true, diff --git a/manifests/init.pp b/manifests/init.pp index 4a6e14e..b10a7c1 100644 --- a/manifests/init.pp +++ b/manifests/init.pp @@ -13,10 +13,6 @@ # @param installer # Specifies which installer type to use. Note that not every release has both installer types available. # -# @param with_notary -# Specifies whether to include Notary functionality in the deployment. -# Defaults to false -# # @param with_trivy # Specifies whether to include Trivy functionality in the deployment. # Defaults to false @@ -222,7 +218,6 @@ Enum['offline','online'] $installer, String $checksum, Boolean $external_redis, - Boolean $with_notary, Boolean $with_trivy, Stdlib::Host $hostname, Enum['http','https'] $ui_url_protocol, @@ -427,15 +422,13 @@ contain 'harbor::config' class { 'harbor::prepare': - version => $version, - with_notary => $with_notary, - with_trivy => $with_trivy, + version => $version, + with_trivy => $with_trivy, } contain 'harbor::prepare' class { 'harbor::service': cfg_version => $_cfg_version, - with_notary => $with_notary, } contain 'harbor::service' @@ -445,5 +438,4 @@ ~> Class['harbor::config'] ~> Class['harbor::prepare'] ~> Class['harbor::service'] - } diff --git a/manifests/install.pp b/manifests/install.pp index 536b5e7..f3a8509 100644 --- a/manifests/install.pp +++ b/manifests/install.pp @@ -7,14 +7,13 @@ $download_source, $proxy_server = undef, ){ - assert_private() file { "/opt/harbor-v${version}": ensure => directory, owner => 'root', group => 'root', - mode => '0755', + mode => '0755', } archive { "/tmp/harbor-${installer}-installer-v${version}.tgz": @@ -47,5 +46,4 @@ subscribe => File['/opt/harbor'], } } - } diff --git a/manifests/prepare.pp b/manifests/prepare.pp index 705032b..4a01aa1 100644 --- a/manifests/prepare.pp +++ b/manifests/prepare.pp @@ -2,14 +2,12 @@ # @summary Runs the Harbor prepare script class harbor::prepare ( $version, - $with_notary, $with_trivy, ){ assert_private() $opts_hash = { - '--with-notary' => $with_notary, '--with-trivy' => $with_trivy, }.filter |$key, $value| { $value } diff --git a/manifests/service.pp b/manifests/service.pp index fe05b41..b647977 100644 --- a/manifests/service.pp +++ b/manifests/service.pp @@ -2,19 +2,10 @@ # @summary Sets up a systemd unit file and service for Harbor class harbor::service ( $cfg_version, - $with_notary, ){ - assert_private() - $_default_ompose_files = '-f /opt/harbor/docker-compose.yml' - if $with_notary { - $_optional_compose_files = ' -f /opt/harbor/docker-compose.notary.yml' - } else { - $_optional_compose_files = '' - } - - $_compose_files = "${_default_ompose_files}${_optional_compose_files}" + $_compose_files = '-f /opt/harbor/docker-compose.yml' file { 'harbor_service_unit': ensure => file, @@ -39,5 +30,4 @@ enable => true, subscribe => Exec['harbor_systemd_daemon-reload'], } - }