harbor: mount vault entrypoint script
This commit is contained in:
parent
713fedfe73
commit
eeeb69fb7a
@ -112,7 +112,7 @@ spec:
|
||||
existingSecretSecretKey: harbor-core
|
||||
core:
|
||||
image:
|
||||
repository: registry.bstein.dev/infra/harbor-core-vault
|
||||
repository: registry.bstein.dev/infra/harbor-core
|
||||
tag: v2.14.1-arm64 # {"$imagepolicy": "harbor:harbor-core:tag"}
|
||||
nodeSelector:
|
||||
kubernetes.io/hostname: titan-05
|
||||
@ -175,7 +175,7 @@ spec:
|
||||
values: ["rpi4"]
|
||||
jobservice:
|
||||
image:
|
||||
repository: registry.bstein.dev/infra/harbor-jobservice-vault
|
||||
repository: registry.bstein.dev/infra/harbor-jobservice
|
||||
tag: v2.14.1-arm64 # {"$imagepolicy": "harbor:harbor-jobservice:tag"}
|
||||
nodeSelector:
|
||||
kubernetes.io/hostname: titan-05
|
||||
@ -245,11 +245,11 @@ spec:
|
||||
registry:
|
||||
registry:
|
||||
image:
|
||||
repository: registry.bstein.dev/infra/harbor-registry-vault
|
||||
repository: registry.bstein.dev/infra/harbor-registry
|
||||
tag: v2.14.1-arm64 # {"$imagepolicy": "harbor:harbor-registry:tag"}
|
||||
controller:
|
||||
image:
|
||||
repository: registry.bstein.dev/infra/harbor-registryctl-vault
|
||||
repository: registry.bstein.dev/infra/harbor-registryctl
|
||||
tag: v2.14.1-arm64 # {"$imagepolicy": "harbor:harbor-registryctl:tag"}
|
||||
serviceAccountName: harbor-vault-sync
|
||||
automountServiceAccountToken: true
|
||||
@ -354,6 +354,10 @@ spec:
|
||||
spec:
|
||||
containers:
|
||||
- name: core
|
||||
command:
|
||||
- /entrypoint.sh
|
||||
args:
|
||||
- /harbor/entrypoint.sh
|
||||
env:
|
||||
- $patch: replace
|
||||
- name: VAULT_ENV_FILE
|
||||
@ -365,6 +369,9 @@ spec:
|
||||
- configMapRef:
|
||||
name: harbor-core
|
||||
volumeMounts:
|
||||
- name: harbor-vault-entrypoint
|
||||
mountPath: /entrypoint.sh
|
||||
subPath: vault-entrypoint.sh
|
||||
- name: secret-key
|
||||
$patch: delete
|
||||
- name: token-service-private-key
|
||||
@ -372,6 +379,10 @@ spec:
|
||||
- name: core-writable
|
||||
mountPath: /etc/core
|
||||
volumes:
|
||||
- name: harbor-vault-entrypoint
|
||||
configMap:
|
||||
name: harbor-vault-entrypoint
|
||||
defaultMode: 493
|
||||
- name: secret-key
|
||||
$patch: delete
|
||||
- name: token-service-private-key
|
||||
@ -391,6 +402,10 @@ spec:
|
||||
spec:
|
||||
containers:
|
||||
- name: jobservice
|
||||
command:
|
||||
- /entrypoint.sh
|
||||
args:
|
||||
- /harbor/entrypoint.sh
|
||||
env:
|
||||
- $patch: replace
|
||||
- name: VAULT_ENV_FILE
|
||||
@ -399,6 +414,15 @@ spec:
|
||||
- $patch: replace
|
||||
- configMapRef:
|
||||
name: harbor-jobservice-env
|
||||
volumeMounts:
|
||||
- name: harbor-vault-entrypoint
|
||||
mountPath: /entrypoint.sh
|
||||
subPath: vault-entrypoint.sh
|
||||
volumes:
|
||||
- name: harbor-vault-entrypoint
|
||||
configMap:
|
||||
name: harbor-vault-entrypoint
|
||||
defaultMode: 493
|
||||
- target:
|
||||
kind: Deployment
|
||||
name: harbor-registry
|
||||
@ -412,6 +436,10 @@ spec:
|
||||
spec:
|
||||
containers:
|
||||
- name: registry
|
||||
command:
|
||||
- /entrypoint.sh
|
||||
args:
|
||||
- /home/harbor/entrypoint.sh
|
||||
env:
|
||||
- $patch: replace
|
||||
- name: VAULT_ENV_FILE
|
||||
@ -421,11 +449,18 @@ spec:
|
||||
envFrom:
|
||||
- $patch: replace
|
||||
volumeMounts:
|
||||
- name: harbor-vault-entrypoint
|
||||
mountPath: /entrypoint.sh
|
||||
subPath: vault-entrypoint.sh
|
||||
- name: registry-htpasswd
|
||||
$patch: delete
|
||||
- name: registry-writable
|
||||
mountPath: /etc/registry
|
||||
- name: registryctl
|
||||
command:
|
||||
- /entrypoint.sh
|
||||
args:
|
||||
- /home/harbor/start.sh
|
||||
env:
|
||||
- $patch: replace
|
||||
- name: VAULT_ENV_FILE
|
||||
@ -434,7 +469,15 @@ spec:
|
||||
- $patch: replace
|
||||
- configMapRef:
|
||||
name: harbor-registryctl
|
||||
volumeMounts:
|
||||
- name: harbor-vault-entrypoint
|
||||
mountPath: /entrypoint.sh
|
||||
subPath: vault-entrypoint.sh
|
||||
volumes:
|
||||
- name: harbor-vault-entrypoint
|
||||
configMap:
|
||||
name: harbor-vault-entrypoint
|
||||
defaultMode: 493
|
||||
- name: registry-htpasswd
|
||||
$patch: delete
|
||||
- name: registry-writable
|
||||
@ -484,6 +527,11 @@ spec:
|
||||
automountServiceAccountToken: true
|
||||
containers:
|
||||
- name: core-job
|
||||
command:
|
||||
- /entrypoint.sh
|
||||
args:
|
||||
- /harbor/harbor_core
|
||||
- -mode=migrate
|
||||
env:
|
||||
- $patch: replace
|
||||
- name: VAULT_ENV_FILE
|
||||
@ -492,6 +540,15 @@ spec:
|
||||
- $patch: replace
|
||||
- configMapRef:
|
||||
name: harbor-core
|
||||
volumeMounts:
|
||||
- name: harbor-vault-entrypoint
|
||||
mountPath: /entrypoint.sh
|
||||
subPath: vault-entrypoint.sh
|
||||
volumes:
|
||||
- name: harbor-vault-entrypoint
|
||||
configMap:
|
||||
name: harbor-vault-entrypoint
|
||||
defaultMode: 493
|
||||
- target:
|
||||
kind: Secret
|
||||
name: harbor-core
|
||||
|
||||
@ -5,7 +5,7 @@ metadata:
|
||||
name: harbor-core
|
||||
namespace: harbor
|
||||
spec:
|
||||
image: registry.bstein.dev/infra/harbor-core-vault
|
||||
image: registry.bstein.dev/infra/harbor-core
|
||||
interval: 5m0s
|
||||
---
|
||||
apiVersion: image.toolkit.fluxcd.io/v1beta2
|
||||
@ -29,7 +29,7 @@ metadata:
|
||||
name: harbor-jobservice
|
||||
namespace: harbor
|
||||
spec:
|
||||
image: registry.bstein.dev/infra/harbor-jobservice-vault
|
||||
image: registry.bstein.dev/infra/harbor-jobservice
|
||||
interval: 5m0s
|
||||
---
|
||||
apiVersion: image.toolkit.fluxcd.io/v1beta2
|
||||
@ -77,7 +77,7 @@ metadata:
|
||||
name: harbor-registry
|
||||
namespace: harbor
|
||||
spec:
|
||||
image: registry.bstein.dev/infra/harbor-registry-vault
|
||||
image: registry.bstein.dev/infra/harbor-registry
|
||||
interval: 5m0s
|
||||
---
|
||||
apiVersion: image.toolkit.fluxcd.io/v1beta2
|
||||
@ -101,7 +101,7 @@ metadata:
|
||||
name: harbor-registryctl
|
||||
namespace: harbor
|
||||
spec:
|
||||
image: registry.bstein.dev/infra/harbor-registryctl-vault
|
||||
image: registry.bstein.dev/infra/harbor-registryctl
|
||||
interval: 5m0s
|
||||
---
|
||||
apiVersion: image.toolkit.fluxcd.io/v1beta2
|
||||
|
||||
@ -2,6 +2,8 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: harbor
|
||||
generatorOptions:
|
||||
disableNameSuffixHash: true
|
||||
resources:
|
||||
- namespace.yaml
|
||||
- serviceaccount.yaml
|
||||
@ -11,3 +13,7 @@ resources:
|
||||
- helmrelease.yaml
|
||||
- vault-sync-deployment.yaml
|
||||
- image.yaml
|
||||
configMapGenerator:
|
||||
- name: harbor-vault-entrypoint
|
||||
files:
|
||||
- scripts/vault-entrypoint.sh
|
||||
|
||||
35
services/harbor/scripts/vault-entrypoint.sh
Normal file
35
services/harbor/scripts/vault-entrypoint.sh
Normal file
@ -0,0 +1,35 @@
|
||||
#!/bin/sh
|
||||
set -eu
|
||||
|
||||
if [ -n "${VAULT_ENV_FILE:-}" ]; then
|
||||
if [ -f "${VAULT_ENV_FILE}" ]; then
|
||||
# shellcheck disable=SC1090
|
||||
. "${VAULT_ENV_FILE}"
|
||||
else
|
||||
echo "Vault env file not found: ${VAULT_ENV_FILE}" >&2
|
||||
exit 1
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ -n "${VAULT_COPY_FILES:-}" ]; then
|
||||
old_ifs="$IFS"
|
||||
IFS=','
|
||||
set -- ${VAULT_COPY_FILES}
|
||||
IFS="$old_ifs"
|
||||
for pair in "$@"; do
|
||||
src="${pair%%:*}"
|
||||
dest="${pair#*:}"
|
||||
if [ -z "${src}" ] || [ -z "${dest}" ]; then
|
||||
echo "Vault copy entry malformed: ${pair}" >&2
|
||||
exit 1
|
||||
fi
|
||||
if [ ! -f "${src}" ]; then
|
||||
echo "Vault file not found: ${src}" >&2
|
||||
exit 1
|
||||
fi
|
||||
mkdir -p "$(dirname "${dest}")"
|
||||
cp "${src}" "${dest}"
|
||||
done
|
||||
fi
|
||||
|
||||
exec "$@"
|
||||
Loading…
x
Reference in New Issue
Block a user