fix:Update config file

playbook.yml

@@ -2,6 +2,9 @@
 - hosts: registry
   remote_user: root
   gather_facts: false
+  vars:
+    harbor:
+      version: v2.8.1
   roles:
     - dockerhost
     - registry

roles/dockerhost/tasks/main.yml

@@ -37,30 +37,28 @@
     repo: deb [arch=amd64] https://download.docker.com/linux/ubuntu {{ releasename.stdout }} stable
     state: present
 
-# Pinning versions due to odd DNS issue in 20.x
+# # Pinning versions due to odd DNS issue in 20.x
-- name: Pin Docker engine to specific version
+# - name: Pin Docker engine to specific version
-  copy:
+#   copy:
-    dest: "{{ item.dest }}"
+#     dest: "{{ item.dest }}"
-    content: "{{ item.content }}"
+#     content: "{{ item.content }}"
-  with_items:
+#   with_items:
-    - dest: /etc/apt/preferences.d/docker-ce
+#     - dest: /etc/apt/preferences.d/docker-ce
-      content: |
+#       content: |
-        Package: docker-ce
+#         Package: docker-ce
-        Pin: version 5:19.03.13~3-0~ubuntu-focal
+#         Pin: version 5:19.03.13~3-0~ubuntu-{{ releasename.stdout }}
-        Pin-Priority: 1001
+#         Pin-Priority: 1001
-    - dest: /etc/apt/preferences.d/docker-ce-cli
+#     - dest: /etc/apt/preferences.d/docker-ce-cli
-      content: |
+#       content: |
-        Package: docker-ce-cli
+#         Package: docker-ce-cli
-        Pin: version 5:19.03.13~3-0~ubuntu-focal
+#         Pin: version 5:19.03.13~3-0~ubuntu-{{ releasename.stdout }}
-        Pin-Priority: 1001
+#         Pin-Priority: 1001
 
 - name: Install Docker engine
   apt:
     update_cache: yes
     allow_unauthenticated: yes
     name:
-    # - docker-ce=5:19.03.13~3-0~ubuntu-focal
-    # - docker-ce-cli=5:19.03.13~3-0~ubuntu-focal
       - docker-ce
       - docker-ce-cli
       - containerd.io

roles/registry/files/harbor.yml

@@ -14,8 +14,8 @@ https:
   # https port for harbor, default is 443
   port: 443
   # The path of cert and key files for nginx
-  certificate: /tmp/harbor/certificate.crt
+  certificate: /opt/harbor/certificate.crt
-  private_key: /tmp/harbor/privatekey.key
+  private_key: /opt/harbor/privatekey.key
 
 # # Uncomment following will enable tls communication between all harbor components
 # internal_tls:
@@ -38,10 +38,16 @@ database:
   # The password for the root user of Harbor DB. Change this before any production use.
   password: ccU3AQjwZ5yLEFE26p6YZFWj2jp5jq89
   # The maximum number of connections in the idle connection pool. If it <=0, no idle connections are retained.
-  max_idle_conns: 50
+  max_idle_conns: 100
   # The maximum number of open connections to the database. If it <= 0, then there is no limit on the number of open connections.
   # Note: the default number of connections is 1024 for postgres of harbor.
-  max_open_conns: 1000
+  max_open_conns: 900
+  # The maximum amount of time a connection may be reused. Expired connections may be closed lazily before reuse. If it <= 0, connections are not closed due to a connection's age.
+  # The value is a duration string. A duration string is a possibly signed sequence of decimal numbers, each with optional fraction and a unit suffix, such as "300ms", "-1.5h" or "2h45m". Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".
+  conn_max_lifetime: 5m
+  # The maximum amount of time a connection may be idle. Expired connections may be closed lazily before reuse. If it <= 0, connections are not closed due to a connection's idle time.
+  # The value is a duration string. A duration string is a possibly signed sequence of decimal numbers, each with optional fraction and a unit suffix, such as "300ms", "-1.5h" or "2h45m". Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".
+  conn_max_idle_time: 0
 
 # The default data volume
 data_volume: /data
@@ -50,7 +56,7 @@ data_volume: /data
 # Uncomment storage_service setting If you want to using external storage
 # storage_service:
 #   # ca_bundle is the path to the custom root ca certificate, which will be injected into the truststore
-#   # of registry's and chart repository's containers.  This is usually needed when the user hosts a internal storage with self signed certificate.
+#   # of registry's containers.  This is usually needed when the user hosts a internal storage with self signed certificate.
 #   ca_bundle:
 
 #   # storage backend, default is filesystem, options include filesystem, azure, gcs, s3, swift and oss
@@ -59,12 +65,7 @@ data_volume: /data
 #     maxthreads: 100
 #   # set disable to true when you want to disable registry redirect
 #   redirect:
-#     disabled: false
+#     disable: false
-
-# Clair configuration
-clair:
-  # The interval of clair updaters, the unit is hour, set to 0 to disable the updaters.
-  updaters_interval: 6
 
 # Trivy configuration
 #
@@ -83,31 +84,40 @@ trivy:
   # `metadata.json` files and mount them in the `/home/scanner/.cache/trivy/db` path.
   skip_update: false
   #
+  # The offline_scan option prevents Trivy from sending API requests to identify dependencies.
+  # Scanning JAR files and pom.xml may require Internet access for better detection, but this option tries to avoid it.
+  # For example, the offline mode will not try to resolve transitive dependencies in pom.xml when the dependency doesn't  # exist in the local repositories. It means a number of detected vulnerabilities might be fewer in offline mode.
+  # It would work if all the dependencies are in local.
+  # This option doesn't affect DB download. You need to specify "skip-update" as well as "offline-scan" in an air-gapped environment.
+  offline_scan: false
+  #
+  # Comma-separated list of what security issues to detect. Possible values are `vuln`, `config` and `secret`. Defaults to `vuln`.
+  security_check: vuln
+  #
   # insecure The flag to skip verifying registry certificate
   insecure: false
   # github_token The GitHub access token to download Trivy DB
   #
-  # Anonymous downloads from GitHub are subject to the limit of 60 requests per hour. Normally such rate limit is enough
+  # Anonymous downloads from GitHub are subject to the limit of 60 requests per hour. Normally such rate limit is enough  # for production operations. If, for any reason, it's not enough, you could increase the rate limit to 5000
-  # for production operations. If, for any reason, it's not enough, you could increase the rate limit to 5000
   # requests per hour by specifying the GitHub access token. For more details on GitHub rate limiting please consult
   # https://developer.github.com/v3/#rate-limiting
   #
   # You can create a GitHub token by following the instructions in
   # https://help.github.com/en/github/authenticating-to-github/creating-a-personal-access-token-for-the-command-line
   #
-  github_token: cf7da8f07d2dc9f63ad45f07b74f1162c82a99fa 
+  github_token: cf7da8f07d2dc9f63ad45f07b74f1162c82a99fa
 
 jobservice:
   # Maximum number of job workers in job service
   max_job_workers: 10
+  # The jobLogger sweeper duration (ignored if `jobLogger` is `stdout`)
+  logger_sweeper_duration: 1 #days
 
 notification:
   # Maximum retry count for webhook job
-  webhook_job_max_retry: 10
+  webhook_job_max_retry: 3
-
+  # HTTP client timeout for webhook job
-chart:
+  webhook_job_http_client_timeout: 3 #seconds
-  # Change the value of absolute_url to enabled can enable absolute url in chart
-  absolute_url: disabled
 
 # Log configurations
 log:
@@ -134,7 +144,7 @@ log:
   #   port: 5140
 
 #This attribute is for migrator to detect the version of the .cfg file, DO NOT MODIFY!
-_version: 2.0.0
+_version: 2.8.0
 
 # Uncomment external_database if using external database.
 # external_database:
@@ -147,13 +157,6 @@ _version: 2.0.0
 #     ssl_mode: disable
 #     max_idle_conns: 2
 #     max_open_conns: 0
-#   clair:
-#     host: clair_db_host
-#     port: clair_db_port
-#     db_name: clair_db_name
-#     username: clair_db_username
-#     password: clair_db_password
-#     ssl_mode: disable
 #   notary_signer:
 #     host: notary_signer_db_host
 #     port: notary_signer_db_port
@@ -177,13 +180,13 @@ _version: 2.0.0
 #   #  <host_sentinel1>:<port_sentinel1>,<host_sentinel2>:<port_sentinel2>,<host_sentinel3>:<port_sentinel3>
 #   host: redis:6379
 #   password:
+#   # Redis AUTH command was extended in Redis 6, it is possible to use it in the two-arguments AUTH <username> <password> form.
+#   # username:
 #   # sentinel_master_set must be set to support redis+sentinel
 #   #sentinel_master_set:
 #   # db_index 0 is for core, it's unchangeable
 #   registry_db_index: 1
 #   jobservice_db_index: 2
-#   chartmuseum_db_index: 3
-#   clair_db_index: 4
 #   trivy_db_index: 5
 #   idle_timeout_seconds: 30
 
@@ -206,6 +209,62 @@ proxy:
   components:
     - core
     - jobservice
-    - clair
     - trivy
 
+# metric:
+#   enabled: false
+#   port: 9090
+#   path: /metrics
+
+# Trace related config
+# only can enable one trace provider(jaeger or otel) at the same time,
+# and when using jaeger as provider, can only enable it with agent mode or collector mode.
+# if using jaeger collector mode, uncomment endpoint and uncomment username, password if needed
+# if using jaeger agetn mode uncomment agent_host and agent_port
+# trace:
+#   enabled: true
+#   # set sample_rate to 1 if you wanna sampling 100% of trace data; set 0.5 if you wanna sampling 50% of trace data, and so forth
+#   sample_rate: 1
+#   # # namespace used to differenciate different harbor services
+#   # namespace:
+#   # # attributes is a key value dict contains user defined attributes used to initialize trace provider
+#   # attributes:
+#   #   application: harbor
+#   # # jaeger should be 1.26 or newer.
+#   # jaeger:
+#   #   endpoint: http://hostname:14268/api/traces
+#   #   username:
+#   #   password:
+#   #   agent_host: hostname
+#   #   # export trace data by jaeger.thrift in compact mode
+#   #   agent_port: 6831
+#   # otel:
+#   #   endpoint: hostname:4318
+#   #   url_path: /v1/traces
+#   #   compression: false
+#   #   insecure: true
+#   #   timeout: 10s
+
+# Enable purge _upload directories
+upload_purging:
+  enabled: true
+  # remove files in _upload directories which exist for a period of time, default is one week.
+  age: 168h
+  # the interval of the purge operations
+  interval: 24h
+  dryrun: false
+
+# Cache layer configurations
+# If this feature enabled, harbor will cache the resource
+# `project/project_metadata/repository/artifact/manifest` in the redis
+# which can especially help to improve the performance of high concurrent
+# manifest pulling.
+# NOTICE
+# If you are deploying Harbor in HA mode, make sure that all the harbor
+# instances have the same behaviour, all with caching enabled or disabled,
+# otherwise it can lead to potential data inconsistency.
+cache:
+  # not enabled by default
+  enabled: false
+  # keep cache for one day by default
+  expire_hours: 24

roles/registry/tasks/main.yml

@@ -1,13 +1,15 @@
 - name: Download Harbor installer
   get_url:
-    url: https://github.com/goharbor/harbor/releases/download/v2.2.0/harbor-online-installer-v2.2.0.tgz
+    url: https://github.com/goharbor/harbor/releases/download/{{ harbor.version }}/harbor-online-installer-{{ harbor.version }}.tgz
     dest: /tmp/harbor-installer.tgz
     mode: '0777'
+
 - name: Extract installer
   unarchive:
     src: /tmp/harbor-installer.tgz
-    dest: /tmp
+    dest: /opt
     remote_src: yes
+
 - name: Copy Harbor configuration file and public/private keys
   copy:
     src: "{{ item.src }}"
@@ -15,16 +17,21 @@
     backup: "{{ item.backup }}"
   with_items:
     - src: harbor.yml
-      dest: /tmp/harbor
+      dest: /opt/harbor
       backup: yes
     - src: /certificates/*.bessems.eu/certificate.crt
-      dest: /tmp/harbor
+      dest: /opt/harbor
       backup: no
     - src: /certificates/*.bessems.eu/privatekey.key
-      dest: /tmp/harbor
+      dest: /opt/harbor
       backup: no
+
 - name: Install Harbor
-  command: /tmp/harbor/install.sh --with-trivy
+  command:
+    cmd: /opt/harbor/install.sh --with-trivy
+  environment:
+    TERM: dumb
+
 - name: Delete temporary files
   file:
     path: /tmp/harbor-installer.tgz