Add Harbor/Ceph runbooks and align single-node Ceph docs with abr deployment.

Document registry ingress split, image mirroring, loop OSD setup, and platform integration paths.
2026-07-01 00:22:06 +03:30
parent 8d1855b89c
commit ee5bd0a291
21 changed files with 2124 additions and 2 deletions
@@ -0,0 +1,48 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Replaces registry.abrban.com docker distribution with Harbor.
+# WARNING: This will delete the existing `Ingress/registry` routing. The old
+# `Deployment/registry` and its PVC are left in place for rollback.
+
+VALUES_FILE="${1:-/Users/keyhan/Documents/keyhan-project/cloud-host/backend/helm/cloudhost-harbor/values-registry.abrban.com.yaml}"
+
+echo "==> Ensuring harbor repo"
+helm repo add harbor https://helm.goharbor.io 2>/dev/null || true
+helm repo update harbor
+
+echo "==> [0/4] Preflight"
+kubectl -n cloudhost get secret abrban-wildcard-tls >/dev/null
+kubectl -n cloudhost get secret registry-egress-proxy >/dev/null
+
+echo "==> [1/4] Disabling old registry ingress (host registry.abrban.com)"
+kubectl -n cloudhost delete ingress registry --ignore-not-found
+
+echo "==> [2/4] Scaling old registry deployment down (rollback-friendly)"
+kubectl -n cloudhost scale deploy/registry --replicas=0 || true
+
+echo "==> [3/4] Installing Harbor"
+HTTP_PROXY="$(kubectl -n cloudhost get secret registry-egress-proxy -o jsonpath='{.data.HTTP_PROXY}' | base64 -d)"
+HTTPS_PROXY="$(kubectl -n cloudhost get secret registry-egress-proxy -o jsonpath='{.data.HTTPS_PROXY}' | base64 -d)"
+NO_PROXY="$(kubectl -n cloudhost get secret registry-egress-proxy -o jsonpath='{.data.NO_PROXY}' | base64 -d)"
+
+TMP_PROXY_VALUES="$(mktemp)"
+cat > "${TMP_PROXY_VALUES}" <<EOF
+proxy:
+  httpProxy: "${HTTP_PROXY}"
+  httpsProxy: "${HTTPS_PROXY}"
+  noProxy: "${NO_PROXY}"
+EOF
+
+helm upgrade --install harbor harbor/harbor \
+  -n cloudhost \
+  -f "$VALUES_FILE" \
+  -f "${TMP_PROXY_VALUES}" \
+  --wait \
+  --timeout 20m
+
+rm -f "${TMP_PROXY_VALUES}" || true
+
+echo "==> [4/4] Done"
+kubectl -n cloudhost get ingress | grep -n registry || true
+
@@ -0,0 +1,75 @@
+## Harbor values to REPLACE registry.abrban.com
+## Ingress controller on this cluster is Traefik (k3s).
+##
+## Install:
+##   helm upgrade --install harbor harbor/harbor -n cloudhost -f backend/helm/cloudhost-harbor/values-registry.abrban.com.yaml
+##
+externalURL: https://registry.abrban.com
+
+proxy:
+  # Values are injected by install script from `cloudhost/registry-egress-proxy`.
+  httpProxy: ""
+  httpsProxy: ""
+  noProxy: ""
+
+expose:
+  type: ingress
+  tls:
+    enabled: true
+    certSource: secret
+    secret:
+      secretName: abrban-wildcard-tls
+  ingress:
+    className: traefik
+    hosts:
+      core: registry.abrban.com
+    annotations:
+      traefik.ingress.kubernetes.io/router.entrypoints: websecure
+      # Increase timeouts for large pushes (skopeo/registry blobs)
+      traefik.ingress.kubernetes.io/router.tls: "true"
+
+# Disable components we don't need for now to reduce resources
+trivy:
+  enabled: false
+notary:
+  enabled: false
+chartmuseum:
+  enabled: false
+
+# Single-node staging: keep resource usage modest
+core:
+  replicas: 1
+jobservice:
+  replicas: 1
+registry:
+  replicas: 1
+
+persistence:
+  enabled: true
+  persistentVolumeClaim:
+    # Use existing default storage (local-path) until Ceph is ready.
+    # After Ceph, switch to rook-ceph-block for Harbor's PVCs.
+    registry:
+      storageClass: local-path
+      size: 50Gi
+    jobservice:
+      storageClass: local-path
+      size: 5Gi
+    database:
+      storageClass: local-path
+      size: 10Gi
+    redis:
+      storageClass: local-path
+      size: 5Gi
+
+database:
+  type: internal
+
+redis:
+  type: internal
+
+portal:
+  replicas: 1
+
+# We will create proxy-cache projects after install (todo: configure-proxy-cache)
+