T12: Harbor onboarding root (iac) #27

New issue

Open

opened 2026-08-12 01:16:04 +00:00 by ginjiruu · 0 comments

ginjiruu commented

2026-08-12 01:16:04 +00:00

Owner

Context

Harbor at https://harbor.animeteamspeak.moe is already wired into the lab identity layer — kanidm/oauth2.tf:279 declares the OIDC app (kanidm_oauth2_basic.harbor) with groups harbor_admins / harbor_editors / harbor_superadmins / harbor_users — but its platform config (projects, robot accounts, members, registries, gc policies) is not yet declared in iac. Onboard it as a new tofu-managed root using goharbor/terraform-provider-harbor (registry.terraform.io/goharbor/harbor, latest v3.12.4; tested against Harbor 2.13–2.15, Terraform 1.12–1.14).

What to build

New top-level harbor/ root mirroring the kanidm/ / vault/ layout:

provider.tf:

terraform {
  required_providers {
    harbor = {
      source  = "registry.terraform.io/goharbor/harbor"
      version = "~> 3.12"
    }
  }
}

provider "harbor" {
  url      = var.harbor_url      # https://harbor.animeteamspeak.moe
  username = var.harbor_username
  password = var.harbor_password # or bearer_token
  insecure = false               # cert is valid; default is true, flip it
}

variables.tf, main.tf, modules/, scripts/import.sh per the kanidm/vault pattern
pilot resources: existing projects, project members, robot accounts — imported, not recreated (same import.sh approach as kanidm's groups/oauth2)
any registries / replication / gc / retention policy currently configured by hand, or explicitly deferred (see decisions)

Credentials

No credentials in git, same rule as kanidm/vault. Bootstrap once by hand with an admin account (or a robot account directly), then inject the runner token into tofu-controller via the Terraform object's varsFrom. Prefer a scoped robot account bearer_token over username/password. If the runner token is not admin, set robot_prefix explicitly (auto-detection calls the admin API).

Decisions to make

auth: robot account bearer_token vs admin username/password for bootstrap
first wave scope: projects + members + robot accounts; defer replication/gc/retention unless already configured
how the per-app projects map to the catalog capability groups (spec #2) — e.g. a robot account per group-<app>-<capability> consumer

Acceptance criteria

harbor/ root runs tofu plan clean with no drift vs existing Harbor state
existing projects/members/robot accounts imported, not recreated
no credentials in git; runner token via varsFrom
Terraform CR for the harbor root in flux-clusters (clusters/mini/iac/, per T10 pattern), reconciled Ready

Blocked by

T10: tofu-controller sync for provider roots (#25) — needed for in-cluster apply of the new root (and its own blocker T7 #9). Not required to author and plan the root locally.

## Context Harbor at `https://harbor.animeteamspeak.moe` is already wired into the lab identity layer — `kanidm/oauth2.tf:279` declares the OIDC app (`kanidm_oauth2_basic.harbor`) with groups `harbor_admins` / `harbor_editors` / `harbor_superadmins` / `harbor_users` — but its platform config (projects, robot accounts, members, registries, gc policies) is not yet declared in iac. Onboard it as a new tofu-managed root using [`goharbor/terraform-provider-harbor`](https://github.com/goharbor/terraform-provider-harbor) (`registry.terraform.io/goharbor/harbor`, latest v3.12.4; tested against Harbor 2.13–2.15, Terraform 1.12–1.14). ## What to build New top-level `harbor/` root mirroring the `kanidm/` / `vault/` layout: - `provider.tf`: ```hcl terraform { required_providers { harbor = { source = "registry.terraform.io/goharbor/harbor" version = "~> 3.12" } } } provider "harbor" { url = var.harbor_url # https://harbor.animeteamspeak.moe username = var.harbor_username password = var.harbor_password # or bearer_token insecure = false # cert is valid; default is true, flip it } ``` - `variables.tf`, `main.tf`, `modules/`, `scripts/import.sh` per the kanidm/vault pattern - pilot resources: existing projects, project members, robot accounts — **imported**, not recreated (same import.sh approach as kanidm's groups/oauth2) - any registries / replication / gc / retention policy currently configured by hand, or explicitly deferred (see decisions) ## Credentials No credentials in git, same rule as kanidm/vault. Bootstrap once by hand with an admin account (or a robot account directly), then inject the runner token into tofu-controller via the `Terraform` object's `varsFrom`. Prefer a scoped robot account `bearer_token` over username/password. If the runner token is not admin, set `robot_prefix` explicitly (auto-detection calls the admin API). ## Decisions to make - auth: robot account `bearer_token` vs admin username/password for bootstrap - first wave scope: projects + members + robot accounts; defer replication/gc/retention unless already configured - how the per-app projects map to the catalog capability groups (spec #2) — e.g. a robot account per `group-<app>-<capability>` consumer ## Acceptance criteria - [ ] `harbor/` root runs `tofu plan` clean with no drift vs existing Harbor state - [ ] existing projects/members/robot accounts imported, not recreated - [ ] no credentials in git; runner token via `varsFrom` - [ ] `Terraform` CR for the harbor root in flux-clusters (`clusters/mini/iac/`, per T10 pattern), reconciled Ready ## Blocked by T10: tofu-controller sync for provider roots (#25) — needed for in-cluster apply of the new root (and its own blocker T7 #9). Not required to author and plan the root locally.

ginjiruu added the

ready-for-agent

label

2026-08-12 01:16:08 +00:00