search

goharbor / harbor-helm

The helm chart to deploy Harbor
Apache License 2.0
1.19k stars 758 forks source link

Add feature - Support existing secret to configure http_proxy and https_proxy #1823

Open ClementJ35 opened 2 months ago

ClementJ35 commented 2 months ago

Hi,

Actually, all proxy settings are bond to values and deployed as env and envFrom configMaps. As we want to hide username and password in our gitlab instance, we would like to use an existing secret that we could sync from external tools (as external secret operator).

I will make a PR soon, working here : https://github.com/ClementJ35/harbor-helm/tree/add-existing-secret-to-proxy

But first i would discuss how to implement it. I see two options :

  1. Break the existent and pass the HTTP_PROXY in a secret, generated by helm or provided by user.
  2. Use the existent env values and adapt it.

I'd say that as we have secret information, it should be a secret. But it will break possible third party tools used by persons to tweak pod environment variable and/or configmaps holding the proxy configuration.

Any income is welcome.

ClementJ35 commented 2 months ago

After revision, it seems that no_proxy doesn't have to be secret. So I'm leaving it out of secret scope, notably because of insertion of local services made by helm charts helper : https://github.com/goharbor/harbor-helm/blob/main/templates/_helpers.tpl#L295

MinerYang commented 1 month ago

Could you give an example of your proxy url?

ClementJ35 commented 1 month ago

The proxy is setup as a secret like this : 

apiVersion: v1
kind: Secret
stringData:
  HTTP_PROXY: http://username:password@proxy.example.com
  HTTPS_PROXY: https://username:password@proxy.example.com