dvirlabs/dev-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Phase 1: Configure Harbor with Cloudflare Origin Certificate

Browse Source 
- Remove cert-manager annotation (manual TLS secret)
- Reference harbor-ingress secret (Cloudflare Origin CA)
- Keep stable resource names for clean March 23 switchover
- Cloudflare-trusted certificate enables proxy mode

Phase 2 (March 23): Add cert-manager annotation back for Let's Encrypt
This commit is contained in:
dvirlabs 2026-03-22 01:01:10 +02:00
parent a76c330d32
commit 07797d7618
1 changed files with 6 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
manifests/harbor/values.yaml
View File

@ -1,19 +1,19 @@
expose: expose:
type: ingress type: ingress
tls: tls:
# Enable TLS - cert-manager will manage the certificate # Enable TLS with external secret (Cloudflare Origin Certificate for now)
enabled: true enabled: true
# Use "secret" to reference an existing/external secret managed by cert-manager # Use "secret" to reference pre-created TLS secret
# DO NOT use "auto" (Harbor's self-signed CA conflicts with cert-manager)
certSource: secret certSource: secret
secret: secret:
# This secret will be created and managed by cert-manager via the ingress annotation # Secret created manually with Cloudflare Origin Certificate
# Will be managed by cert-manager after March 23
secretName: "harbor-ingress" secretName: "harbor-ingress"
ingress: ingress:
className: traefik className: traefik
annotations: annotations:
# TEMPORARY: Using staging to avoid rate limits (switch back to 'letsencrypt' after March 23, 2026) # NO cert-manager annotation during Phase 1 (manual certificate)
cert-manager.io/cluster-issuer: letsencrypt-staging # Add back on March 23 for automatic Let's Encrypt management
# Traefik specific annotations for HTTPS routing # Traefik specific annotations for HTTPS routing
traefik.ingress.kubernetes.io/router.entrypoints: websecure traefik.ingress.kubernetes.io/router.entrypoints: websecure
traefik.ingress.kubernetes.io/router.tls: "true" traefik.ingress.kubernetes.io/router.tls: "true"