[CBLT]

I also run Harbor. I use the official Helm chart; it's a little jank, doesn't support a couple of things we want. It only works with one of ArgoCD/ExternalSecretsOperator, and it doesn't support Redis TLS.

Contrary to the author of this post, we just run one (the "source of truth") and use caching proxies in other regions. Works fine for us.

[BlackjackCF]

What’s jank about it?

[CBLT]

I mentioned two things that were broken:

1. Doesn't work with ExternalSecretsOperator and ArgoCD, which I happen to use. This is because the author of the Harbor chart decided not to use k8s concepts like secretRef in a podTemplate. Instead, at Helm template time, it looks up the secret data and writes it into another secret, which is then included as a envFrom. This interacts poorly with ExternalSecretsOperator in general, because it breaks the lifecycle control that ESO has. It's completely broken with ArgoCD because ArgoCD disables secret lookups by charts for pretty valid security concerns. No other chart I've come across does secret lookups during helm template time. Even the helm docs tell you it's not correct.

2. Harbor requires redis, but the Helm chart doesn't correctly pipe in the connection configuration. Redis can't be behind TLS, or the chart won't work.

[dwroberts]

You could always put the helm chart in a Kustomize and change the things you don’t like.

—-enable-helm isn't supported everywhere but Argo definitely allows it

[lijok]

We just went through this whole Kustomize shenanigan in our company. Seems completely asinine. Why not just fork the chart, fix it yourself?

[p_l]

... or the quite common case, make helm write the template once, fix, port to your own process, delete helm, live happy

[benterix]

> live happy

Until the next major upgrade.

[MPSimmons]

Is there no Argo plugin for your secret store? In a previous life, we used Argo Vault Plugin to good effect.