From d66a2602cca2c2b245ae4c27c974800eb4c88d75 Mon Sep 17 00:00:00 2001
From: Marcos Estevez <marcos.stvz@gmail.com>
Date: Mon, 17 Feb 2020 18:40:46 +0100
Subject: [PATCH 1/9] [bitnami/harbor] Store passwords of redis, clair and
 notary in secrets

Reconciling with:
https://github.com/goharbor/harbor-helm/commit/cb8c71d73aadf3c6c7fc796dbb87c2802d400eb9

Signed-off-by: Marcos Estevez <marcos.stvz@gmail.com>
---
 bitnami/harbor/Chart.yaml                     |  2 +-
 bitnami/harbor/conf/clair.yaml                | 21 ++++++
 bitnami/harbor/conf/notary-server.json        | 32 ++++++++
 bitnami/harbor/conf/notary-signer.json        | 20 +++++
 bitnami/harbor/templates/clair/clair-cm.yaml  | 34 ---------
 bitnami/harbor/templates/clair/clair-dpl.yaml | 13 ++--
 .../harbor/templates/clair/clair-secret.yaml  | 11 +++
 .../templates/core/core-cm-envvars.yaml       |  2 -
 .../templates/core/core-secret-envvars.yaml   |  2 +
 .../harbor/templates/notary/notary-cm.yaml    | 73 -------------------
 .../templates/notary/notary-secret.yaml       | 18 +++++
 .../templates/notary/notary-server.yaml       | 33 +++++----
 .../templates/notary/notary-signer.yaml       | 38 +++++-----
 bitnami/harbor/values-production.yaml         |  4 +-
 bitnami/harbor/values.yaml                    | 14 +++-
 15 files changed, 160 insertions(+), 157 deletions(-)
 create mode 100644 bitnami/harbor/conf/clair.yaml
 create mode 100644 bitnami/harbor/conf/notary-server.json
 create mode 100644 bitnami/harbor/conf/notary-signer.json
 delete mode 100644 bitnami/harbor/templates/clair/clair-cm.yaml
 create mode 100644 bitnami/harbor/templates/clair/clair-secret.yaml
 delete mode 100644 bitnami/harbor/templates/notary/notary-cm.yaml
 create mode 100644 bitnami/harbor/templates/notary/notary-secret.yaml

diff --git a/bitnami/harbor/Chart.yaml b/bitnami/harbor/Chart.yaml
index 48aafbc24a3151..83a29f91403bdd 100644
--- a/bitnami/harbor/Chart.yaml
+++ b/bitnami/harbor/Chart.yaml
@@ -1,6 +1,6 @@
 apiVersion: v1
 name: harbor
-version: 4.0.0
+version: 4.0.1
 appVersion: 1.10.1
 description: Harbor is an an open source trusted cloud native registry project that stores, signs, and scans content
 keywords:
diff --git a/bitnami/harbor/conf/clair.yaml b/bitnami/harbor/conf/clair.yaml
new file mode 100644
index 00000000000000..a01c543d9f4303
--- /dev/null
+++ b/bitnami/harbor/conf/clair.yaml
@@ -0,0 +1,21 @@
+clair:
+  database:
+    type: pgsql
+    options:
+      source: "{{ template "harbor.database.clair" . }}"
+      # Number of elements kept in the cache
+      # Values unlikely to change (e.g. namespaces) are cached in order to save prevent needless roundtrips to the database.
+      cachesize: 16384
+  api:
+    # API server port
+    port: 6060
+    healthport: 6061
+    # Deadline before an API request will respond with a 503
+    timeout: 300s
+  updater:
+    interval: {{ .Values.clair.updatersInterval }}h
+  notifier:
+    attempts: 3
+    renotifyinterval: 2h
+    http:
+      endpoint: "http://{{ template "harbor.core" . }}/service/notifications/clair"
diff --git a/bitnami/harbor/conf/notary-server.json b/bitnami/harbor/conf/notary-server.json
new file mode 100644
index 00000000000000..de1b75c372bbed
--- /dev/null
+++ b/bitnami/harbor/conf/notary-server.json
@@ -0,0 +1,32 @@
+{
+  "server": {
+    "http_addr": ":4443"
+  },
+  "trust_service": {
+    "type": "remote",
+    "hostname": "{{ template "harbor.notary-signer" . }}",
+    "port": "7899",
+{{- if not .Values.notary.secretName }}
+    "tls_ca_file": "./notary-signer-ca.crt",
+{{- else }}
+    "tls_ca_file": "/etc/ssl/notary/cert/notary-signer-ca.crt",
+{{- end }}
+    "key_algorithm": "ecdsa"
+  },
+  "logging": {
+    "level": "{{ .Values.logLevel }}"
+  },
+  "storage": {
+    "backend": "postgres",
+    "db_url": "{{ template "harbor.database.notaryServer" . }}"
+  },
+  "auth": {
+      "type": "token",
+      "options": {
+          "realm": "{{ template "harbor.externalUrl" . }}/service/token",
+          "service": "harbor-notary",
+          "issuer": "harbor-token-issuer",
+          "rootcertbundle": "/root.crt"
+      }
+  }
+}
diff --git a/bitnami/harbor/conf/notary-signer.json b/bitnami/harbor/conf/notary-signer.json
new file mode 100644
index 00000000000000..8d93847048f859
--- /dev/null
+++ b/bitnami/harbor/conf/notary-signer.json
@@ -0,0 +1,20 @@
+{
+  "server": {
+    "grpc_addr": ":7899",
+{{- if not .Values.notary.secretName }}
+    "tls_cert_file": "./notary-signer.crt",
+    "tls_key_file": "./notary-signer.key"
+{{- else }}
+    "tls_cert_file": "/etc/ssl/notary/cert/notary-signer.crt",
+    "tls_key_file": "/etc/ssl/notary/cert/notary-signer.key"
+{{- end }}
+  },
+  "logging": {
+    "level": "{{ .Values.logLevel }}"
+  },
+  "storage": {
+    "backend": "postgres",
+    "db_url": "{{ template "harbor.database.notarySigner" . }}",
+    "default_alias": "defaultalias"
+  }
+}
diff --git a/bitnami/harbor/templates/clair/clair-cm.yaml b/bitnami/harbor/templates/clair/clair-cm.yaml
deleted file mode 100644
index f4bb622eebf034..00000000000000
--- a/bitnami/harbor/templates/clair/clair-cm.yaml
+++ /dev/null
@@ -1,34 +0,0 @@
-{{- if .Values.clair.enabled }}
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: {{ include "harbor.clair" . }}
-  labels: {{- include "harbor.labels" . | nindent 4 }}
-    app.kubernetes.io/component: clair
-data:
-  config.yaml: |
-    clair:
-      database:
-        type: pgsql
-        options:
-          source: "{{ template "harbor.database.clair" . }}"
-          # Number of elements kept in the cache
-          # Values unlikely to change (e.g. namespaces) are cached in order to save prevent needless roundtrips to the database.
-          cachesize: 16384
-
-      api:
-        # API server port
-        port: 6060
-        healthport: 6061
-
-        # Deadline before an API request will respond with a 503
-        timeout: 300s
-      updater:
-        interval: {{ .Values.clair.updatersInterval }}h
-
-      notifier:
-        attempts: 3
-        renotifyinterval: 2h
-        http:
-          endpoint: "http://{{ template "harbor.core" . }}/service/notifications/clair"
-{{- end }}
diff --git a/bitnami/harbor/templates/clair/clair-dpl.yaml b/bitnami/harbor/templates/clair/clair-dpl.yaml
index 04aec007a500bc..313e7e8f74780b 100644
--- a/bitnami/harbor/templates/clair/clair-dpl.yaml
+++ b/bitnami/harbor/templates/clair/clair-dpl.yaml
@@ -15,7 +15,7 @@ spec:
       labels: {{- include "harbor.labels" . | nindent 8 }}
         app.kubernetes.io/component: clair
       annotations:
-        checksum/configmap: {{ include (print $.Template.BasePath "/clair/clair-cm.yaml") . | sha256sum }}
+        checksum/secret: {{ include (print $.Template.BasePath "/clair/clair-secret.yaml") . | sha256sum }}
         {{- if .Values.clair.podAnnotations }}
         {{- include "harbor.tplValue" (dict "value" .Values.clair.podAnnotations "context" $) | nindent 8 }}
         {{- end }}
@@ -75,7 +75,7 @@ spec:
           ports:
             - containerPort: 6060
           volumeMounts:
-            - name: clair-config
+            - name: config
               mountPath: /etc/clair/config.yaml
               subPath: config.yaml
         - name: adapter
@@ -119,10 +119,7 @@ spec:
           ports:
             - containerPort: 8080
       volumes:
-        - name: clair-config
-          configMap:
-            name: {{ include "harbor.clair" . }}
-            items:
-              - key: config.yaml
-                path: config.yaml
+        - name: config
+          secret:
+            secretName: "{{ template "harbor.clair" . }}"
 {{- end }}
diff --git a/bitnami/harbor/templates/clair/clair-secret.yaml b/bitnami/harbor/templates/clair/clair-secret.yaml
new file mode 100644
index 00000000000000..f898d1632eb00f
--- /dev/null
+++ b/bitnami/harbor/templates/clair/clair-secret.yaml
@@ -0,0 +1,11 @@
+{{- if .Values.clair.enabled }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ template "harbor.clair" . }}
+  labels:
+{{ include "harbor.labels" . | indent 4 }}
+type: Opaque
+data:
+  config.yaml: {{ tpl (.Files.Get "conf/clair.yaml") . | b64enc }}
+{{- end }}
diff --git a/bitnami/harbor/templates/core/core-cm-envvars.yaml b/bitnami/harbor/templates/core/core-cm-envvars.yaml
index 2d07d1ceea4906..90854ea44cc840 100644
--- a/bitnami/harbor/templates/core/core-cm-envvars.yaml
+++ b/bitnami/harbor/templates/core/core-cm-envvars.yaml
@@ -34,8 +34,6 @@ data:
   CONFIG_PATH: "/etc/core/app.conf"
   SYNC_REGISTRY: "false"
   CHART_CACHE_DRIVER: "redis"
-  _REDIS_URL: "{{ template "harbor.redisForCore" . }}"
-  _REDIS_URL_REG: "{{ template "harbor.redisForGC" . }}"
   PORTAL_URL: "http://{{ template "harbor.portal" . }}"
   REGISTRYCTL_URL: "http://{{ template "harbor.registry" . }}:8080"
   CLAIR_HEALTH_CHECK_SERVER_URL: "http://{{ template "harbor.clair" . }}:6061"
diff --git a/bitnami/harbor/templates/core/core-secret-envvars.yaml b/bitnami/harbor/templates/core/core-secret-envvars.yaml
index 8096038ffe62c7..43c1a0b7e718e4 100644
--- a/bitnami/harbor/templates/core/core-secret-envvars.yaml
+++ b/bitnami/harbor/templates/core/core-secret-envvars.yaml
@@ -5,6 +5,8 @@ metadata:
   labels: {{- include "harbor.labels" . | nindent 4 }}
 type: Opaque
 data:
+  _REDIS_URL: "{{ template "harbor.redisForCore" . }}"
+  _REDIS_URL_REG: "{{ template "harbor.redisForGC" . }}"
   {{- if .Values.harborAdminPassword }}
   HARBOR_ADMIN_PASSWORD: {{ .Values.harborAdminPassword | b64enc | quote }}
   {{- else if (not .Values.forcePassword) }}
diff --git a/bitnami/harbor/templates/notary/notary-cm.yaml b/bitnami/harbor/templates/notary/notary-cm.yaml
deleted file mode 100644
index 64f5c82e0218d2..00000000000000
--- a/bitnami/harbor/templates/notary/notary-cm.yaml
+++ /dev/null
@@ -1,73 +0,0 @@
-{{- if .Values.notary.enabled }}
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: {{ include "harbor.notary-server" . }}
-  labels: {{- include "harbor.labels" . | nindent 4 }}
-    component: notary
-data:
-  {{ $ca := genCA "harbor-notary-ca" 365 }}
-  {{ $cert := genSignedCert (include "harbor.notary-signer" .) nil nil 365 $ca }}
-  {{- if not .Values.notary.secretName }}
-  notary-signer-ca.crt: |
-    {{ $ca.Cert | nindent 4 }}
-  notary-signer.crt: |
-    {{ $cert.Cert | nindent 4 }}
-  notary-signer.key: |
-    {{ $cert.Key | nindent 4 }}
-  {{- end }}
-  server-config.postgres.json: |
-    {
-      "server": {
-        "http_addr": ":4443"
-      },
-      "trust_service": {
-        "type": "remote",
-        "hostname": "{{ template "harbor.notary-signer" . }}",
-        "port": "7899",
-{{- if not .Values.notary.secretName }}
-        "tls_ca_file": "./notary-signer-ca.crt",
-{{- else }}
-        "tls_ca_file": "/etc/ssl/notary/cert/notary-signer-ca.crt",
-{{- end }}
-        "key_algorithm": "ecdsa"
-      },
-      "logging": {
-        "level": "{{ .Values.logLevel }}"
-      },
-      "storage": {
-        "backend": "postgres",
-        "db_url": "{{ template "harbor.database.notaryServer" . }}"
-      },
-      "auth": {
-          "type": "token",
-          "options": {
-              "realm": "{{ template "harbor.externalUrl" . }}/service/token",
-              "service": "harbor-notary",
-              "issuer": "harbor-token-issuer",
-              "rootcertbundle": "/root.crt"
-          }
-      }
-    }
-  signer-config.postgres.json: |
-    {
-      "server": {
-        "grpc_addr": ":7899",
-{{- if not .Values.notary.secretName }}
-        "tls_cert_file": "./notary-signer.crt",
-        "tls_key_file": "./notary-signer.key"
-{{- else }}
-        "tls_cert_file": "/etc/ssl/notary/cert/notary-signer.crt",
-        "tls_key_file": "/etc/ssl/notary/cert/notary-signer.key"
-{{- end }}
-      },
-      "logging": {
-        "level": "{{ .Values.logLevel }}"
-      },
-      "storage": {
-        "backend": "postgres",
-        "db_url": "{{ template "harbor.database.notarySigner" . }}",
-        "default_alias": "defaultalias"
-      }
-    }
-{{- end }}
diff --git a/bitnami/harbor/templates/notary/notary-secret.yaml b/bitnami/harbor/templates/notary/notary-secret.yaml
new file mode 100644
index 00000000000000..4329635fe72219
--- /dev/null
+++ b/bitnami/harbor/templates/notary/notary-secret.yaml
@@ -0,0 +1,18 @@
+{{- if .Values.notary.enabled }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "harbor.notary-server" . }}
+  labels: {{- include "harbor.labels" . | nindent 4 }}
+    component: notary
+data:
+  {{- if not .Values.notary.secretName }}
+  {{ $ca := genCA "harbor-notary-ca" 365 }}
+  {{ $cert := genSignedCert (include "harbor.notary-signer" .) nil nil 365 $ca }}
+  ca.crt: {{ $ca.Cert | b64enc | quote }}
+  tls.crt: {{ $cert.Cert | b64enc | quote }}
+  tls.key: {{ $cert.Key | b64enc | quote }}
+  {{- end }}
+  server.json: {{ tpl (.Files.Get "conf/notary-server.json") . | b64enc }}
+  signer.json: {{ tpl (.Files.Get "conf/notary-signer.json") . | b64enc }}
+{{- end }}
diff --git a/bitnami/harbor/templates/notary/notary-server.yaml b/bitnami/harbor/templates/notary/notary-server.yaml
index c810b76c305357..17c222318fa648 100644
--- a/bitnami/harbor/templates/notary/notary-server.yaml
+++ b/bitnami/harbor/templates/notary/notary-server.yaml
@@ -15,7 +15,7 @@ spec:
       labels: {{- include "harbor.labels" . | nindent 8 }}
         component: notary-server
       annotations:
-        checksum/configmap: {{ include (print $.Template.BasePath "/notary/notary-cm.yaml") . | sha256sum }}
+        checksum/secret: {{ include (print $.Template.BasePath "/notary/notary-secret.yaml") . | sha256sum }}
         checksum/secret-core: {{ include (print $.Template.BasePath "/core/core-secret.yaml") . | sha256sum }}
         {{- if .Values.notary.podAnnotations }}
         annotations: {{- include "harbor.tplValue" (dict "value" .Values.notary.podAnnotations "context" $) | nindent 8 }}
@@ -51,33 +51,34 @@ spec:
             - name: DB_URL
               value: {{ include "harbor.database.notaryServer" . }}
           volumeMounts:
-            - name: notary-config
-              mountPath: /etc/notary
+            - name: config
+              mountPath: /etc/notary/server-config.postgres.json
+              subPath: server.json
             - name: root-certificate
               mountPath: /root.crt
               subPath: tls.crt
-            {{- if .Values.notary.secretName }}
-            - name: notary-ca
-              mountPath: /etc/ssl/notary/cert/notary-signer-ca.crt
-              subPath: ca
-            {{- end }}
+            - name: signer-certificate
+              mountPath: /etc/ssl/notary/ca.crt
+              subPath: ca.crt
           ports:
             - containerPort: 4443
               name: notary-server
       volumes:
-        - name: notary-config
-          configMap:
-            name: {{ include "harbor.notary-server" . }}
-        - name: root-certificate
+        - name: config
+          secret:
+            secretName: {{ include "harbor.notary-server" . }}
+        - name: token-service-certificate
           secret:
             {{- if .Values.core.secretName }}
             secretName: {{ .Values.core.secretName }}
             {{- else }}
-            secretName: {{ include "harbor.core" . }}
+            secretName: {{ template "harbor.core" . }}
             {{- end }}
-        {{- if .Values.notary.secretName }}
-        - name: notary-ca
+        - name: signer-certificate
           secret:
+            {{- if .Values.notary.secretName }}
             secretName: {{ .Values.notary.secretName }}
-        {{- end }}
+            {{- else }}
+            secretName: {{ template "harbor.notary-server" . }}
+            {{- end }}
 {{- end }}
diff --git a/bitnami/harbor/templates/notary/notary-signer.yaml b/bitnami/harbor/templates/notary/notary-signer.yaml
index fd060afc0f45bf..85890eb0f92b71 100644
--- a/bitnami/harbor/templates/notary/notary-signer.yaml
+++ b/bitnami/harbor/templates/notary/notary-signer.yaml
@@ -15,7 +15,7 @@ spec:
       labels: {{- include "harbor.labels" . | nindent 8 }}
         component: notary-signer
       annotations:
-        checksum/configmap: {{ include (print $.Template.BasePath "/notary/notary-cm.yaml") . | sha256sum }}
+        checksum/secret: {{ include (print $.Template.BasePath "/notary/notary-secret.yaml") . | sha256sum }}
         {{- if .Values.notary.podAnnotations }}
         annotations: {{- include "harbor.tplValue" (dict "value" .Values.notary.podAnnotations "context" $) | nindent 8 }}
         {{- end }}
@@ -52,26 +52,24 @@ spec:
             - name: NOTARY_SIGNER_DEFAULTALIAS
               value: defaultalias
           volumeMounts:
-            - name: notary-config
-              mountPath: /etc/notary
-            {{- if .Values.notary.secretName }}
-            - name: notary-cert
-              mountPath: /etc/ssl/notary/cert/notary-signer-ca.crt
-              subPath: ca
-            - name: notary-cert
-              mountPath: /etc/ssl/notary/cert/notary-signer.crt
-              subPath: crt
-            - name: notary-cert
-              mountPath: /etc/ssl/notary/cert/notary-signer.key
-              subPath: key
-            {{- end }}
+            - name: config
+              mountPath: /etc/notary/signer-config.postgres.json
+              subPath: signer.json
+            - name: signer-certificate
+              mountPath: /etc/ssl/notary/tls.crt
+              subPath: tls.crt
+            - name: signer-certificate
+              mountPath: /etc/ssl/notary/tls.key
+              subPath: tls.key
       volumes:
-        - name: notary-config
-          configMap:
-            name: {{ include "harbor.notary-server" . }}
-        {{- if .Values.notary.secretName }}
-        - name: notary-cert
+        - name: config
+          secret:
+            secretName: "{{ template "harbor.notary-server" . }}"
+        - name: signer-certificate
           secret:
+            {{- if .Values.notary.secretName }}
             secretName: {{ .Values.notary.secretName }}
-        {{- end }}
+            {{- else }}
+            secretName: {{ template "harbor.notary-server" . }}
+            {{- end }}
 {{- end }}
diff --git a/bitnami/harbor/values-production.yaml b/bitnami/harbor/values-production.yaml
index f6bb46a8421fdb..59da6037c81a47 100644
--- a/bitnami/harbor/values-production.yaml
+++ b/bitnami/harbor/values-production.yaml
@@ -1075,8 +1075,8 @@ clair:
       #   memory: 1Gi
       requests: {}
       #   cpu: 250m
-      #   memory: 256Mi  
-      
+      #   memory: 256Mi
+
   replicas: 1
   # The http(s) proxy used to update vulnerabilities database from internet
   httpProxy:
diff --git a/bitnami/harbor/values.yaml b/bitnami/harbor/values.yaml
index 980f4b6155462d..0a48d84309beb5 100644
--- a/bitnami/harbor/values.yaml
+++ b/bitnami/harbor/values.yaml
@@ -1075,7 +1075,7 @@ clair:
       #   memory: 1Gi
       requests: {}
       #   cpu: 250m
-      #   memory: 256Mi  
+      #   memory: 256Mi
 
   replicas: 1
   # The http(s) proxy used to update vulnerabilities database from internet
@@ -1207,6 +1207,18 @@ notary:
       timeoutSeconds: 5
       failureThreshold: 6
       successThreshold: 1
+  nodeSelector: {}
+  tolerations: []
+  affinity: {}
+  ## Additional deployment annotations
+  podAnnotations: {}
+  # Fill the name of a kubernetes secret if you want to use your own
+  # TLS certificate authority, certificate and private key for notary
+  # communications.
+  # The secret must contain keys named ca.crt, tls.crt and tls.key that
+  # contain the CA, certificate and private key.
+  # They will be generated if not set.
+  secretName: ""
 
 ## Redis chart configuration
 ## ref: https://github.com/helm/charts/blob/master/stable/redis/values.yaml

From 65f9102e8e33f6b3ad9b5c7273263d990d2b1e92 Mon Sep 17 00:00:00 2001
From: Marcos Estevez <marcos.stvz@gmail.com>
Date: Mon, 17 Feb 2020 19:08:09 +0100
Subject: [PATCH 2/9] Adds docs... fixes notary replicas

Signed-off-by: Marcos Estevez <marcos.stvz@gmail.com>
---
 bitnami/harbor/README.md              | 21 +++++++++++++++++++++
 bitnami/harbor/values-production.yaml |  3 ++-
 bitnami/harbor/values.yaml            |  3 ++-
 3 files changed, 25 insertions(+), 2 deletions(-)

diff --git a/bitnami/harbor/README.md b/bitnami/harbor/README.md
index 320249e83f39f3..be78a6ede5c0d5 100644
--- a/bitnami/harbor/README.md
+++ b/bitnami/harbor/README.md
@@ -255,6 +255,27 @@ The following table lists the configurable parameters of the Harbor chart and th
 | `clair.podAnnotations`                                                      | Annotations to add to the clair pod                                      | `{}`                                                    |
 | `clair.livenessProbe`                                                       | Liveness probe configuration                                             | `Check values.yaml file`                                |
 | `clair.readinessProbe`                                                      | Readiness probe configuration                                            | `Check values.yaml file`                                |
+| **Notary**                                                                  |
+| `notary.enabled`                                                            | Enable Notary?                                                           | `true`                                                  |
+| `notaryServerImage.registry`                                                | Registry for notary server image                                         | `docker.io`                                             |
+| `notaryServerImage.repository`                                              | Repository for notary server image                                       | `bitnami/harbor-notary-server`                          |
+| `notaryServerImage.tag`                                                     | Tag for notary server image                                              | `1.10.1-debian-10-r0`                                   |
+| `notaryServerImage.pullPolicy`                                              | Harbor notary server image pull policy                                   | `IfNotPresent`                                          |
+| `notarySignerImage.registry`                                                | Registry for notary signer images                                        | `docker.io`                                             |
+| `notarySignerImage.repository`                                              | Repository for notary signer image                                       | `bitnami/harbor-notary-signer`                          |
+| `notarySignerImage.tag`                                                     | Tag for notary signer image                                              | `1.10.1-debian-10-r0`                                   |
+| `notarySignerImage.pullPolicy`                                              | Harbor notary signer image pull policy                                   | `IfNotPresent`                                          |
+| `notary.server.replicas`                                                    | The replica count                                                        | `1`                                                     |
+| `notary.server.resources`                                                   | The [resources] to allocate for container                                | `{}`                                                    |
+| `notary.signer.image.repository`                                            | Repository for notary signer image                                       | `goharbor/notary-signer-photon`                         |
+| `notary.signer.image.tag`                                                   | Tag for notary signer image                                              | `dev`                                                   |
+| `notary.signer.replicas`                                                    | The replica count                                                        | `1`                                                     |
+| `notary.signer.resources`                                                   | The [resources] to allocate for container                                | `{}`                                                    |
+| `notary.nodeSelector`                                                       | Node labels for pod assignment                                           | `{}`                                                    |
+| `notary.tolerations`                                                        | Tolerations for pod assignment                                           | `[]`                                                    |
+| `notary.affinity`                                                           | Node/Pod affinities                                                      | `{}`                                                    |
+| `notary.podAnnotations`                                                     | Annotations to add to the notary pod                                     | `{}`                                                    |
+| `notary.secretName`                                                         | Fill the name of a kubernetes secret if you want to use your own TLS certificate authority, certificate and private key for notary communications. The secret must contain keys named `tls.ca`, `tls.crt` and `tls.key` that contain the CA, certificate and private key. They will be generated if not set. | `nil` |
 | **PostgreSQL**                                                              |
 | `posgresql.enabled`                                                          | If external database is used, set it to `false`                          | `true`                                                  |
 | `posgresql.postgresqlUsername`                                               | Postgresql username                                                      | `postgres`                                              |
diff --git a/bitnami/harbor/values-production.yaml b/bitnami/harbor/values-production.yaml
index 59da6037c81a47..548d68b345e12e 100644
--- a/bitnami/harbor/values-production.yaml
+++ b/bitnami/harbor/values-production.yaml
@@ -1142,8 +1142,8 @@ clair:
 ##
 notary:
   enabled: true
-  replicas: 1
   server:
+    replicas: 1
     ## Notary server containers' resource requests and limits
     ## ref: http://kubernetes.io/docs/user-guide/compute-resources/
     ##
@@ -1176,6 +1176,7 @@ notary:
       failureThreshold: 6
       successThreshold: 1
   signer:
+    replicas: 1
     ## Notary signer containers' resource requests and limits
     ## ref: http://kubernetes.io/docs/user-guide/compute-resources/
     ##
diff --git a/bitnami/harbor/values.yaml b/bitnami/harbor/values.yaml
index 0a48d84309beb5..f4373f479dd5ee 100644
--- a/bitnami/harbor/values.yaml
+++ b/bitnami/harbor/values.yaml
@@ -1142,8 +1142,8 @@ clair:
 ##
 notary:
   enabled: true
-  replicas: 1
   server:
+    replicas: 1
     ## Notary server containers' resource requests and limits
     ## ref: http://kubernetes.io/docs/user-guide/compute-resources/
     ##
@@ -1176,6 +1176,7 @@ notary:
       failureThreshold: 6
       successThreshold: 1
   signer:
+    replicas: 1
     ## Notary signer containers' resource requests and limits
     ## ref: http://kubernetes.io/docs/user-guide/compute-resources/
     ##

From 359583ae186e2e06fcac6bbfdf44584fc24ab75a Mon Sep 17 00:00:00 2001
From: Marcos Estevez <marcos.stvz@gmail.com>
Date: Tue, 18 Feb 2020 09:56:56 +0100
Subject: [PATCH 3/9] Bumps minor version

---
 bitnami/harbor/Chart.yaml | 2 +-
 bitnami/harbor/README.md  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/bitnami/harbor/Chart.yaml b/bitnami/harbor/Chart.yaml
index 83a29f91403bdd..f32958741ace02 100644
--- a/bitnami/harbor/Chart.yaml
+++ b/bitnami/harbor/Chart.yaml
@@ -1,6 +1,6 @@
 apiVersion: v1
 name: harbor
-version: 4.0.1
+version: 4.1.0
 appVersion: 1.10.1
 description: Harbor is an an open source trusted cloud native registry project that stores, signs, and scans content
 keywords:
diff --git a/bitnami/harbor/README.md b/bitnami/harbor/README.md
index be78a6ede5c0d5..9aa6bc00e3fc7a 100644
--- a/bitnami/harbor/README.md
+++ b/bitnami/harbor/README.md
@@ -256,7 +256,7 @@ The following table lists the configurable parameters of the Harbor chart and th
 | `clair.livenessProbe`                                                       | Liveness probe configuration                                             | `Check values.yaml file`                                |
 | `clair.readinessProbe`                                                      | Readiness probe configuration                                            | `Check values.yaml file`                                |
 | **Notary**                                                                  |
-| `notary.enabled`                                                            | Enable Notary?                                                           | `true`                                                  |
+| `notary.enabled`                                                            | Enable Notary                                                            | `true`                                                  |
 | `notaryServerImage.registry`                                                | Registry for notary server image                                         | `docker.io`                                             |
 | `notaryServerImage.repository`                                              | Repository for notary server image                                       | `bitnami/harbor-notary-server`                          |
 | `notaryServerImage.tag`                                                     | Tag for notary server image                                              | `1.10.1-debian-10-r0`                                   |

From fb56e374b2c35085095e23402889c42a10bd1801 Mon Sep 17 00:00:00 2001
From: Marcos Estevez <marcos.stvz@gmail.com>
Date: Thu, 20 Feb 2020 16:12:22 +0100
Subject: [PATCH 4/9] Fixes secret

---
 bitnami/harbor/templates/core/core-secret-envvars.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/bitnami/harbor/templates/core/core-secret-envvars.yaml b/bitnami/harbor/templates/core/core-secret-envvars.yaml
index 43c1a0b7e718e4..3d936a1d0567c1 100644
--- a/bitnami/harbor/templates/core/core-secret-envvars.yaml
+++ b/bitnami/harbor/templates/core/core-secret-envvars.yaml
@@ -5,8 +5,8 @@ metadata:
   labels: {{- include "harbor.labels" . | nindent 4 }}
 type: Opaque
 data:
-  _REDIS_URL: "{{ template "harbor.redisForCore" . }}"
-  _REDIS_URL_REG: "{{ template "harbor.redisForGC" . }}"
+  _REDIS_URL: "{{ include "harbor.redisForCore" . | b64enc }}"
+  _REDIS_URL_REG: "{{ include "harbor.redisForGC" . | b64enc }}"
   {{- if .Values.harborAdminPassword }}
   HARBOR_ADMIN_PASSWORD: {{ .Values.harborAdminPassword | b64enc | quote }}
   {{- else if (not .Values.forcePassword) }}

From 68fe70b1265920042d94f946bcaf1a9d37425cc7 Mon Sep 17 00:00:00 2001
From: Marcos Estevez <marcos.stvz@gmail.com>
Date: Mon, 24 Feb 2020 20:02:59 +0100
Subject: [PATCH 5/9] Fix notary certs

Signed-off-by: Marcos Estevez <marcos.stvz@gmail.com>
---
 bitnami/harbor/templates/notary/notary-server.yaml | 4 ++--
 bitnami/harbor/templates/notary/notary-signer.yaml | 7 +++++--
 2 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/bitnami/harbor/templates/notary/notary-server.yaml b/bitnami/harbor/templates/notary/notary-server.yaml
index 17c222318fa648..097b256a75a9e9 100644
--- a/bitnami/harbor/templates/notary/notary-server.yaml
+++ b/bitnami/harbor/templates/notary/notary-server.yaml
@@ -54,11 +54,11 @@ spec:
             - name: config
               mountPath: /etc/notary/server-config.postgres.json
               subPath: server.json
-            - name: root-certificate
+            - name: signer-certificate
               mountPath: /root.crt
               subPath: tls.crt
             - name: signer-certificate
-              mountPath: /etc/ssl/notary/ca.crt
+              mountPath: /etc/notary/notary-signer-ca.crt
               subPath: ca.crt
           ports:
             - containerPort: 4443
diff --git a/bitnami/harbor/templates/notary/notary-signer.yaml b/bitnami/harbor/templates/notary/notary-signer.yaml
index 85890eb0f92b71..a420fe53556b82 100644
--- a/bitnami/harbor/templates/notary/notary-signer.yaml
+++ b/bitnami/harbor/templates/notary/notary-signer.yaml
@@ -56,10 +56,13 @@ spec:
               mountPath: /etc/notary/signer-config.postgres.json
               subPath: signer.json
             - name: signer-certificate
-              mountPath: /etc/ssl/notary/tls.crt
+              mountPath: /etc/notary/notary-signer-ca.crt
+              subPath: ca.crt
+            - name: signer-certificate
+              mountPath: /etc/notary/notary-signer.crt
               subPath: tls.crt
             - name: signer-certificate
-              mountPath: /etc/ssl/notary/tls.key
+              mountPath: /etc/notary/notary-signer.key
               subPath: tls.key
       volumes:
         - name: config

From fa68cc5e81786d178944d2a2e45576591b1874d4 Mon Sep 17 00:00:00 2001
From: Marcos Estevez <marcos.stvz@gmail.com>
Date: Mon, 24 Feb 2020 20:07:41 +0100
Subject: [PATCH 6/9] Bump major version

Signed-off-by: Marcos Estevez <marcos.stvz@gmail.com>
---
 bitnami/harbor/Chart.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/bitnami/harbor/Chart.yaml b/bitnami/harbor/Chart.yaml
index f32958741ace02..1abd618f3346be 100644
--- a/bitnami/harbor/Chart.yaml
+++ b/bitnami/harbor/Chart.yaml
@@ -1,6 +1,6 @@
 apiVersion: v1
 name: harbor
-version: 4.1.0
+version: 5.0.0
 appVersion: 1.10.1
 description: Harbor is an an open source trusted cloud native registry project that stores, signs, and scans content
 keywords:

From cc99143e2caab3efd6831b2435a334d061f8c67e Mon Sep 17 00:00:00 2001
From: Marcos Estevez <marcos.stvz@gmail.com>
Date: Wed, 26 Feb 2020 18:31:21 +0100
Subject: [PATCH 7/9] Restoring certificate names

Signed-off-by: Marcos Estevez <marcos.stvz@gmail.com>
---
 .../templates/notary/notary-secret.yaml       | 10 ++---
 .../templates/notary/notary-server.yaml       | 29 +++++++--------
 .../templates/notary/notary-signer.yaml       | 37 +++++++++----------
 3 files changed, 37 insertions(+), 39 deletions(-)

diff --git a/bitnami/harbor/templates/notary/notary-secret.yaml b/bitnami/harbor/templates/notary/notary-secret.yaml
index 4329635fe72219..d0ceef1beb758b 100644
--- a/bitnami/harbor/templates/notary/notary-secret.yaml
+++ b/bitnami/harbor/templates/notary/notary-secret.yaml
@@ -9,10 +9,10 @@ data:
   {{- if not .Values.notary.secretName }}
   {{ $ca := genCA "harbor-notary-ca" 365 }}
   {{ $cert := genSignedCert (include "harbor.notary-signer" .) nil nil 365 $ca }}
-  ca.crt: {{ $ca.Cert | b64enc | quote }}
-  tls.crt: {{ $cert.Cert | b64enc | quote }}
-  tls.key: {{ $cert.Key | b64enc | quote }}
+  notary-signer-ca.crt: {{ $ca.Cert | b64enc | quote }}
+  notary-signer.crt: {{ $cert.Cert | b64enc | quote }}
+  notary-signer.key: {{ $cert.Key | b64enc | quote }}
   {{- end }}
-  server.json: {{ tpl (.Files.Get "conf/notary-server.json") . | b64enc }}
-  signer.json: {{ tpl (.Files.Get "conf/notary-signer.json") . | b64enc }}
+  server-config.postgres.json: {{ tpl (.Files.Get "conf/notary-server.json") . | b64enc }}
+  signer-config.postgres.json: {{ tpl (.Files.Get "conf/notary-signer.json") . | b64enc }}
 {{- end }}
diff --git a/bitnami/harbor/templates/notary/notary-server.yaml b/bitnami/harbor/templates/notary/notary-server.yaml
index 097b256a75a9e9..23d2e80aee6009 100644
--- a/bitnami/harbor/templates/notary/notary-server.yaml
+++ b/bitnami/harbor/templates/notary/notary-server.yaml
@@ -51,34 +51,33 @@ spec:
             - name: DB_URL
               value: {{ include "harbor.database.notaryServer" . }}
           volumeMounts:
-            - name: config
-              mountPath: /etc/notary/server-config.postgres.json
-              subPath: server.json
-            - name: signer-certificate
+            - name: notary-config
+              mountPath: /etc/notary
+            - name: root-certificate
               mountPath: /root.crt
               subPath: tls.crt
-            - name: signer-certificate
-              mountPath: /etc/notary/notary-signer-ca.crt
-              subPath: ca.crt
+            {{- if .Values.notary.secretName }}
+            - name: notary-ca
+              mountPath: /etc/ssl/notary/cert/notary-signer-ca.crt
+              subPath: ca
+            {{- end }}
           ports:
             - containerPort: 4443
               name: notary-server
       volumes:
-        - name: config
+        - name: notary-config
           secret:
             secretName: {{ include "harbor.notary-server" . }}
-        - name: token-service-certificate
+        - name: root-certificate
           secret:
             {{- if .Values.core.secretName }}
             secretName: {{ .Values.core.secretName }}
             {{- else }}
-            secretName: {{ template "harbor.core" . }}
+            secretName: {{ include "harbor.core" . }}
             {{- end }}
-        - name: signer-certificate
+        {{- if .Values.notary.secretName }}
+        - name: notary-ca
           secret:
-            {{- if .Values.notary.secretName }}
             secretName: {{ .Values.notary.secretName }}
-            {{- else }}
-            secretName: {{ template "harbor.notary-server" . }}
-            {{- end }}
+        {{- end }}
 {{- end }}
diff --git a/bitnami/harbor/templates/notary/notary-signer.yaml b/bitnami/harbor/templates/notary/notary-signer.yaml
index a420fe53556b82..53d15538f786ef 100644
--- a/bitnami/harbor/templates/notary/notary-signer.yaml
+++ b/bitnami/harbor/templates/notary/notary-signer.yaml
@@ -52,27 +52,26 @@ spec:
             - name: NOTARY_SIGNER_DEFAULTALIAS
               value: defaultalias
           volumeMounts:
-            - name: config
-              mountPath: /etc/notary/signer-config.postgres.json
-              subPath: signer.json
-            - name: signer-certificate
-              mountPath: /etc/notary/notary-signer-ca.crt
-              subPath: ca.crt
-            - name: signer-certificate
-              mountPath: /etc/notary/notary-signer.crt
-              subPath: tls.crt
-            - name: signer-certificate
-              mountPath: /etc/notary/notary-signer.key
-              subPath: tls.key
+            - name: notary-config
+              mountPath: /etc/notary
+            {{- if .Values.notary.secretName }}
+            - name: notary-cert
+              mountPath: /etc/ssl/notary/cert/notary-signer-ca.crt
+              subPath: ca
+            - name: notary-cert
+              mountPath: /etc/ssl/notary/cert/notary-signer.crt
+              subPath: crt
+            - name: notary-cert
+              mountPath: /etc/ssl/notary/cert/notary-signer.key
+              subPath: key
+            {{- end }}
       volumes:
-        - name: config
+        - name: notary-config
           secret:
-            secretName: "{{ template "harbor.notary-server" . }}"
-        - name: signer-certificate
+            secretName: {{ include "harbor.notary-server" . }}
+        {{- if .Values.notary.secretName }}
+        - name: notary-cert
           secret:
-            {{- if .Values.notary.secretName }}
             secretName: {{ .Values.notary.secretName }}
-            {{- else }}
-            secretName: {{ template "harbor.notary-server" . }}
-            {{- end }}
+        {{- end }}
 {{- end }}

From c924e24000a1fc24b0295848ce09356c9a2ef789 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marcos=20Est=C3=A9vez=20Mart=C3=ADnez?=
 <marcos.stvz@gmail.com>
Date: Wed, 26 Feb 2020 18:37:51 +0100
Subject: [PATCH 8/9] Update README.md

---
 bitnami/harbor/README.md | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/bitnami/harbor/README.md b/bitnami/harbor/README.md
index 32e220d737228e..9c211c89a27e4f 100644
--- a/bitnami/harbor/README.md
+++ b/bitnami/harbor/README.md
@@ -420,9 +420,7 @@ You can enable this initContainer by setting `volumePermissions.enabled` to `tru
 
 PostgreSQL and Redis dependencies were updated to the use the latest major versions, `8.x.x` and `10.x.x`, respectively. These major versions do not include changes that should break backwards compatibilities, check the links below for more information:
 
-- [PostgreSQL Upgrade notes](https://github.com/bitnami/charts/blob/
-
-/upstreamed/postgresql/README.md#upgrade)
+- [PostgreSQL Upgrade notes](https://github.com/bitnami/charts/blob/master/upstreamed/postgresql/README.md#upgrade)
 - [Redis Upgrade notes](https://github.com/bitnami/charts/blob/master/upstreamed/redis/README.md#upgrading-an-existing-release-to-a-new-major-version)
 
 ## 3.0.0

From d01b72c066d3013932d9f7cd9d2a2a549b0b6f81 Mon Sep 17 00:00:00 2001
From: Marcos Estevez <marcos.stvz@gmail.com>
Date: Thu, 27 Feb 2020 11:20:13 +0100
Subject: [PATCH 9/9] removing unused doc

Signed-off-by: Marcos Estevez <marcos.stvz@gmail.com>
---
 bitnami/harbor/README.md | 2 --
 1 file changed, 2 deletions(-)

diff --git a/bitnami/harbor/README.md b/bitnami/harbor/README.md
index 9c211c89a27e4f..695a3dd4d8be76 100644
--- a/bitnami/harbor/README.md
+++ b/bitnami/harbor/README.md
@@ -267,8 +267,6 @@ The following table lists the configurable parameters of the Harbor chart and th
 | `notarySignerImage.pullPolicy`                                              | Harbor notary signer image pull policy                                   | `IfNotPresent`                                          |
 | `notary.server.replicas`                                                    | The replica count                                                        | `1`                                                     |
 | `notary.server.resources`                                                   | The [resources] to allocate for container                                | `{}`                                                    |
-| `notary.signer.image.repository`                                            | Repository for notary signer image                                       | `goharbor/notary-signer-photon`                         |
-| `notary.signer.image.tag`                                                   | Tag for notary signer image                                              | `dev`                                                   |
 | `notary.signer.replicas`                                                    | The replica count                                                        | `1`                                                     |
 | `notary.signer.resources`                                                   | The [resources] to allocate for container                                | `{}`                                                    |
 | `notary.nodeSelector`                                                       | Node labels for pod assignment                                           | `{}`                                                    |