#HARBOR
kubectl create namespace harbor

helm repo add harbor https://helm.goharbor.io
helm repo update

cat <<EOF | cat > harbor-cert.yaml -
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: harbor-tls
  namespace: harbor
spec:
  secretName: harbor-tls
  issuerRef:
    name: letsencrypt-prod
    kind: ClusterIssuer
  dnsNames:
  - harbor.italiadatacenter.com
  
EOF

kubectl apply -f harbor-cert.yaml




cat <<EOF | cat > harborvalues.yaml -
# -----------------------
# EXPOSURE
# -----------------------
expose:
  # Set how to expose the service. Set the type as "ingress", "clusterIP", "nodePort" or "loadBalancer"
  # and fill the information in the corresponding section
  type: clusterIP
externalURL: https://harbor.italiadatacenter.com

# -----------------------
# ADMIN
# -----------------------
harborAdminPassword: "KAYQE1QA7uwUZ8uI"

# -----------------------
# PERSISTENCE
# -----------------------
persistence:
  enabled: true
  persistentVolumeClaim:
    registry:
      storageClass: csi-rbdfs-sc
      size: 50Gi
    jobservice:
      storageClass: csi-rbdfs-sc
      size: 2Gi
    trivy:
      storageClass: csi-rbdfs-sc
      size: 2Gi

# -----------------------
# POSTGRESQL (EXTERNAL)
# -----------------------
database:
  type: external
  external:
    host: pg-devops-rw.devops.svc
    port: 5432
    username: harbor
    password: "KAYQE1QA7uwUZ8uI"
    database: registry
    sslmode: require

# -----------------------
# REDIS (EXTERNAL)
# -----------------------
redis:
  type: external
  external:
    addr: redis.redis.svc.cluster.local:6379
    password: "KAYQE1QA7uwUZ8uI"
    database: 0

# -----------------------
# DISABLE INTERNAL SERVICES
# -----------------------
postgresql:
  enabled: false

redisInternal:
  enabled: false

# -----------------------
# COMPONENTS
# -----------------------
trivy:
  enabled: true

metrics:
  enabled: false
EOF

kubectl cnpg psql pg-devops -n devops

CREATE DATABASE registry;
CREATE USER harbor WITH PASSWORD 'KAYQE1QA7uwUZ8uI';
GRANT ALL PRIVILEGES ON DATABASE registry TO harbor;
ALTER DATABASE registry OWNER TO harbor;
#test
kubectl run psql-test  --rm -it --image=postgres:16 -- psql  -h pg-prod-rw.database.svc  -U harbor
kubectl run redis-test --rm -it  --image=redis:7 -- redis-cli  -h redis.redis.svc.cluster.local  -a Japp0cam



helm install harbor harbor/harbor  -n harbor -f harborvalues.yaml



--- httproute & body setting nginx ----
kubectl apply -f - <<EOF
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: harbor
  namespace: harbor
spec:
  hostnames:
  - harbor.italiadatacenter.com
  parentRefs:
  - name: main-gateway
    namespace: nginx-gateway
  rules:
  - matches:
    - path:
        type: PathPrefix
        value: /
    backendRefs:
    - name: harbor
      port: 80
---
apiVersion: gateway.nginx.org/v1alpha1
kind: ClientSettingsPolicy
metadata:
  name: gateway-client-settings
spec:
  targetRef:
    group: gateway.networking.k8s.io
    kind: Gateway
    name: main-gateway
  body:
    maxSize: "0" 
EOF



#test
#Login UI:
https://harbor.pigreco66.it/  (admin(Japp0cam)

#push
docker login harbor.italiadatacenter.com
docker pull nginx:1.25
docker tag nginx:1.25 harbor.italiadatacenter.com/library/nginx:1.25
docker push harbor.italiadatacenter.com/library/nginx:1.25

#pull
docker rmi harbor.pigreco66.it/library/nginx:1.25
docker pull harbor.pigreco66.it/library/nginx:1.25

#pull da k8s

#STEP 1– Creare Robot Account in Harbor
#Harbor UI → Projects → (es. library o apps) → Robot Accounts
#Nome: k8s-pull
#Permessi:
#✔️ Repository → Pull


kubectl create secret docker-registry harbor-pull \
  -n default \
  --docker-server=harbor.italiadatacenter.com \
  --docker-username=robot$k8s-pull \
  --docker-password=ir0ELEJEFg804qljh2p32ALzIsMJepWt \
  --docker-email=harbor@italiadatacenter.com

#per namespace nuovi
kubectl patch serviceaccount default  -n default  -p '{"imagePullSecrets":[{"name":"harbor-pull"}]}'

#applicare per i vecchi:
kubectl patch serviceaccount default  -n primo-dev  -p '{"imagePullSecrets":[{"name":"harbor-pull"}]}'

#test
kubectl run test-nginx   --image=harbor.italiadatacenter.com/library/nginx:1.25   --restart=Never -n poc



kubectl -n primo-dev create secret docker-registry harbor-pull \
  --docker-server=harbor.italiadatacenter.com \
  --docker-username=robot\$primo+primo \
  --docker-password=agQLiKJ8K5qmBWhO1bHngzb9UorPLIw1 \
  --docker-email=harbor@italiadatacenter.com
  
kubectl patch serviceaccount default  -n primo-dev  -p '{"imagePullSecrets":[{"name":"harbor-pull"}]}'