Harbor

Helm-based Harbor install. Default exposure is Chart Ingress (nginx). Gateway API on eg-shared is opt-in.

Harbor 2.15.2 (Block 0.0.21)

Chart default is 1.19.2 (official pairing: Harbor 2.15.2). Harbor OSS images are pinned to v2.15.2.

Watch

Bundled internal PostgreSQL in 2.15.2 would jump 15 → 18 via pg_upgrade. This workspace uses external CNPG (database.type=external); that bundled upgrade does not run.
From Harbor 2.15.2 the chart Redis image becomes Valkey (goharbor/valkey-photon:v2.15.2), protocol-compatible. No new block keys.
Images (goharbor/*:v2.15.2) need registry/egress.

Release notes: https://github.com/goharbor/harbor/releases/tag/v2.15.2 Chart: https://github.com/goharbor/harbor-helm/releases/tag/v1.19.2

Key	Default	Meaning
`ingress.*`	as before	Chart Ingress when `gateway.enabled` is false
`ingress.endpoint_monitor.enabled`	`true`	Polycrate Operator annotations on the Ingress, or on the HTTPRoute when `gateway.enabled` is true. `false` omits them.
`gateway.enabled`	`false`	Certificate + Gateway + HTTPRoute on `eg-shared`
`gateway.create_gateway`	`true`	Own HTTPS-Terminate Gateway (mergeGateways → shared VIP)
`gateway.host`	empty	Falls back to `ingress.core.domain`
`gateway.service_name`	`harbor`	ClusterIP frontend after `expose.type=clusterIP`

When Gateway is on, TLS terminates at Envoy. Harbor serves HTTP on the nginx ClusterIP (:80). externalURL stays https://<host>.

Endpoint monitoring (default on) probes GET /api/v2.0/health and expects 200. GET / only hits the portal. GET /v2/ returns 401. The same annotations land on the chart Ingress or, when gateway.enabled is true, on the HTTPRoute. polycrate_k8sapp_name is the block instance name.

ingress:
  core:
    domain: registry.example.com
gateway:
  enabled: true
  create_gateway: true
  gateway_class_name: eg-shared
  tls:
    issuer: letsencrypt-production
    secret_name: harbor-gateway-tls

Workspaces with only ingress.* need no change.