Helm Chart v2.0.0

Released 2026-08-18.

The first release of the dedicated harbor-next Helm chart at deploy/chart — a ground-up redesign, published to oci://8gears.container-registry.com/8gcr/charts/harbor-next (#56).

Breaking Changes

The chart is not values-compatible with goharbor/harbor-helm or with earlier chart layouts. Typed per-setting values are replaced by generic config/secret passthrough, secret pinning moves to the existingSecret family, and image and tag defaults follow the release version. See deploy/chart/docs/MIGRATION.md for the migration path.

Features

Future-proof values surface

Every component takes a generic config/secret passthrough, env- or file-shaped to match what the process consumes, so a new application config key never requires a chart change. Three customization tiers — chart defaults, inline values, an externally-owned existingConfigMap — with chart-managed wiring injected as env overrides, so required plumbing cannot be broken.

Pick your image source

image.source: 8gcr (Harbor Next builds, the default) or upstream (docker.io/goharbor/*) switches every component’s registry and repository in one setting, including the upstream registry-photon and trivy-adapter-photon renames. Per-component image.registry, repository and digest overrides layer on top, and global.imageRegistry repoints every image at an air-gapped mirror in one place, preserving the repository path.

Run only the components you need

The portal, Trivy scanner, metrics exporter and bundled Valkey each toggle through <component>.enabled. An API-only install drops the portal and the / route falls back to core; point externalRedis at your own Redis to drop the bundled Valkey. A disabled component leaves behind no Deployment, Service, PodDisruptionBudget, ServiceAccount or dangling route.

GitOps rendering

Output is byte-for-byte deterministic once secrets are pinned, and autoGenSecrets: false turns every would-be generated secret into a render-time failure naming the value to pin. A FluxCD example ships with drift detection and pinned identity secrets; the same values work unchanged in Argo CD.

OCI distribution

The chart is published on every release, including maintenance patches, cosign-signed for both chart and images, with Artifact Hub repository metadata and per-release image annotations.

Fail-fast validation

values.schema.json rejects unknown top-level keys, and render-time guards for storage-driver conflicts, HPA, PDB and unpinned secrets fail helm template rather than the cluster.

Probes as data

Full Kubernetes probe specifications live in values, with a measured killed-pod recovery of about three seconds against the 10–20 second fixed-delay floors of the legacy chart.

Database pool settings behave as written

database.minConns: 0 renders "0", not "2". Zero is pgxpool’s own default: no warm floor, connections opened on demand and left to age out, which matters when many releases share one PostgreSQL server. Only null falls back to 2. An env name claimed in exporter.config or exporter.secret now wins over the chart’s own entry for that name, so the exporter can be tuned independently of core, and env order is preserved.

Migration tooling

A migration guide, a value-by-value reference, and the harbor-migrate.ys translator (task helm:migrate -- old-values.yaml new-values.yaml).