Role in the deployment¶
Harbor is the container registry for CyVerse service images and integrated tool images. The public CyVerse instance is at harbor.cyverse.org; a self-contained deployment runs its own so that image pulls do not depend on another site's registry.
Install it after storage — Harbor is stateful, and its registry and database volumes need a working storage class before the chart will come up.
Install¶
ansible-playbook -i /path/to/inventory --tags harbor kubernetes.yml
What consumes it¶
| Consumer | How it authenticates |
|---|---|
| DE services | harbor-registry-credentials secret in the DE namespace |
| VICE apps | vice-image-pull-secret in the vice-apps namespace |
| Image cache | Pre-pulls frequently used VICE images onto workers |
| Tool integration | Users and administrators push tool images |
Both pull secrets are created as part of
cluster resources and
VICE deployment. A missing pull secret shows up as
ImagePullBackOff on an image that exists and is readable by hand — check the
secret before the registry.
The deployment configuration also holds a Harbor robot account (the Harbor
section of the group variables: URL, robot name, robot secret) used by automated
image operations. Treat the robot secret like any other deployment secret.