linode / apl-core

Akamai App Platform for LKE
https://apl-docs.net
Apache License 2.0
2.22k stars 169 forks source link

Harbor restarts upon team creation #1398

Closed j-zimnowoda closed 1 year ago

j-zimnowoda commented 1 year ago

Describe the bug: (a clear and concise description of what the bug is)

To Reproduce Steps to reproduce the behavior:

  1. Deploy otomi :
    helm install otomi otomi/otomi \
    --set cluster.name=dev \
    --set cluster.provider=scaleway
  2. Login to Otomi console and enable harbor and deploy changes
  3. Observe that after successful deployment there is not secret apps.harbor.registry.credentials.htpasswd
  4. Create a team
  5. Observes that the harbor-registry restarts
  6. See deployment log

    
    2023-11-27T11:29:22.895Z otomi:cmd:apply:applyAll:log team-ns-dev   team-dev    1           2023-11-27 11:29:16.644358424 +0000 UTC deployed    team-ns-0.1.0
    2023-11-27T11:29:25.733Z otomi:cmd:apply:applyAll:log Release "tekton-dashboard-dev" does not exist. Installing it now.
    NAME: tekton-dashboard-dev
    LAST DEPLOYED: Mon Nov 27 11:29:16 2023
    NAMESPACE: team-dev
    STATUS: deployed
    REVISION: 1
    TEST SUITE: None
    2023-11-27T11:29:25.798Z otomi:cmd:apply:applyAll:log tekton-dashboard-dev  team-dev    1           2023-11-27 11:29:16.679493194 +0000 UTC deployed    tekton-dashboard-v0.40.1    v0.40.1
    2023-11-27T11:29:32.639Z otomi:cmd:apply:applyAll:log Comparing release=harbor, chart=../charts/harbor
    harbor, harbor-registry, Deployment (apps) has changed:
    # Source: harbor/templates/registry/registry-dpl.yaml
    apiVersion: apps/v1
    kind: Deployment
    metadata:
    name: "harbor-registry"
    labels:
      heritage: Helm
      release: harbor
      chart: harbor
      app: "harbor"
      component: registry
    spec:
    replicas: 1
    revisionHistoryLimit: 10
    strategy:
      type: Recreate
      rollingUpdate: null
    selector:
      matchLabels:
        release: harbor
        app: "harbor"
        component: registry
    template:
      metadata:
        labels:
          heritage: Helm
          release: harbor
          chart: harbor
          app: "harbor"
          component: registry
        annotations:
          checksum/configmap: 50286eeadbf67602d451d5f2fffdc7b561a471affcc3cc26ef1315b82546fa43
    -         checksum/secret: 4b5b547884c04b42d3afaf8508baa9a7522efd92accef0184db5fa6483c80d28
    +         checksum/secret: 1b8c97996026fb659584e129f7ef7cf919a6a8cedd7600203d0171e06d43dfd9
          checksum/secret-jobservice: 7a16eb8d1564c48cc8177d75a54c299ae373d419c55b05eb3474128c318779e6
          checksum/secret-core: 363ce791b21f5b248bd0d44a35907a8d3ba4ae56847dfd877a610d071775ffa6
          policy.otomi.io/ignore: psp-allowed-users
      spec:
        securityContext:
          runAsUser: 10000
          fsGroup: 10000
          fsGroupChangePolicy: OnRootMismatch
        automountServiceAccountToken: false
        terminationGracePeriodSeconds: 120
        containers:
        - name: registry
          image: goharbor/registry-photon:v2.6.4
          imagePullPolicy: IfNotPresent
          livenessProbe:
            httpGet:
              path: /
              scheme: HTTP
              port: 5000
            initialDelaySeconds: 300
            periodSeconds: 10
          readinessProbe:
            httpGet:
              path: /
              scheme: HTTP
              port: 5000
            initialDelaySeconds: 1
            periodSeconds: 10
          resources:
            limits:
              cpu: 100m
              memory: 128Mi
            requests:
              cpu: 50m
              memory: 64Mi
          args: ["serve", "/etc/registry/config.yml"]
          envFrom:
          - secretRef:
              name: "harbor-registry"
          env:
          ports:
          - containerPort: 5000
          - containerPort: 5001
          volumeMounts:
          - name: registry-data
            mountPath: /storage
            subPath: 
          - name: registry-htpasswd
            mountPath: /etc/registry/passwd
            subPath: passwd
          - name: registry-config
            mountPath: /etc/registry/config.yml
            subPath: config.yml
        - name: registryctl
          image: goharbor/harbor-registryctl:v2.6.4
          imagePullPolicy: IfNotPresent
          livenessProbe:
            httpGet:
              path: /api/health
              scheme: HTTP
              port: 8080
            initialDelaySeconds: 300
            periodSeconds: 10
          readinessProbe:
            httpGet:
              path: /api/health
              scheme: HTTP
              port: 8080
            initialDelaySeconds: 1
            periodSeconds: 10
          resources:
            limits:
              cpu: 100m
              memory: 512Mi
            requests:
              cpu: 50m
              memory: 256Mi
          envFrom:
          - configMapRef:
              name: "harbor-registryctl"
          - secretRef:
              name: "harbor-registry"
          - secretRef:
              name: "harbor-registryctl"
          env:
          - name: CORE_SECRET
            valueFrom:
              secretKeyRef:
                name: harbor-core
                key: secret
          - name: JOBSERVICE_SECRET
            valueFrom:
              secretKeyRef:
                name: harbor-jobservice
                key: JOBSERVICE_SECRET
          ports:
          - containerPort: 8080
          volumeMounts:
          - name: registry-data
            mountPath: /storage
            subPath: 
          - name: registry-config
            mountPath: /etc/registry/config.yml
            subPath: config.yml
          - name: registry-config
            mountPath: /etc/registryctl/config.yml
            subPath: ctl-config.yml
        volumes:
        - name: registry-htpasswd
          secret:
            secretName: harbor-registry-htpasswd
    
            items:
              - key: REGISTRY_HTPASSWD
                path: passwd
        - name: registry-config
          configMap:
            name: "harbor-registry"
        - name: registry-data
          persistentVolumeClaim:
            claimName: harbor-registry
        priorityClassName: otomi-critical
    harbor, harbor-registry-htpasswd, Secret (v1) has changed:
    # Source: harbor/templates/registry/registry-secret.yaml
    apiVersion: v1
    kind: Secret
    metadata:
    labels:
      app: harbor
      chart: harbor
      heritage: Helm
      release: harbor
    name: harbor-registry-htpasswd
    data:
    -   REGISTRY_HTPASSWD: '-------- # (66 bytes)'
    +   REGISTRY_HTPASSWD: '++++++++ # (66 bytes)'
    type: Opaque

**Versions:** (seen in console's `/settings`)

- Core Version 2.0.3
j-zimnowoda commented 1 year ago

I observed that when deployed with SOPS then the expected secrets are generated.