►
Description
Join us for Kubernetes Forums Seoul, Sydney, Bengaluru and Delhi - learn more at kubecon.io
Don't miss KubeCon + CloudNativeCon 2020 events in Amsterdam March 30 - April 2, Shanghai July 28-30 and Boston November 17-20! Learn more at kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects
Harbor is an open source container image registry that secures images with role-based access control, scans images for vulnerabilities, and signs images as trusted. A CNCF Incubating project, Harbor delivers compliance, performance, and interoperability to help you consistently and securely manage images across cloud native compute platforms like Kubernetes and Docker.
In this webinar, Harbor Core Maintainer Michael Michael and CNCF TOC Chair Liz Rice will walk you through the benefits of running your own registry, concentrating on some of the new functionality that lets you extend Harbor with pluggable third-party scanners. The webinar will show you how to deploy cloud native apps with the confidence that Harbor’s scanning abilities help enforce compliance and protect you from vulnerable packages.
A
I'd
like
to
thank
everybody,
that's
joining
today,
welcome
to
today's
cncs
webinar
and
the
title
is
gain
confidence
in
compliance
advanced
image
scanning
with
harbor,
which
is
a
CN
CF
project,
I'm
Alex,
Ellis
I'm,
the
director
of
open
fires
and
I'm.
Also,
a
cloud
native
ambassador
in
the
Cambridge
area
in
the
UK
I'll
be
moderating
today's
webinar
and
would
just
like
to
welcome
our
presenters.
A
A
So
we've
got
a
few
housekeeping
items
before
we
get
started
so
during
the
webinar
you're
not
able
to
talk
as
an
attendee.
So
it's
a
little
bit
different
to
a
normal
zoom
call.
There
is
a
Q&A
box,
though,
and
we'd
like
you
to
use
that
to
drop
in
any
questions
that
you
have
and
we'll
try
and
answer
them
as
we
see
fit
throughout
the
talk.
Now
this
is
an
official
CN,
CF
webinar.
So
as
such,
we
are
abiding
by
the
CN
CF
code
of
conduct.
A
So
we
just
ask
you:
please
do
not
add
anything
in
the
chat
questions
that
would
be
in
violation
of
our
code
of
conduct.
Basically,
it
can
be
summed
up
like
this.
Please
be
respectful
of
all
your
fellow
participants
and
presenters
and
with
that
I'll
hand
over
to
Michael
and
Liz,
to
kick
off
each
presentation.
B
Absolutely
thank
you,
I
think
you
Alex
and
hello,
everybody
and
welcome
to
the
hub
of
webinar
I
know
that
it's
pretty
late
for
some
of
you
folks
in
European,
in
Asia
timezone,
so
thank
you
for
attending.
Today,
Liz
and
I
are
going
to
talk
a
little
bit
about
security
and
compliance
with
harbaugh,
as
it
reflects
to
the
images
that
you
guys
are
using
in
production
for
your
cloud
native
applications.
B
So
let's
get
started
so
you
know
one
of
the
most
important
things
that
I
want
everybody
to
be
aware
of
is
that
there
was
a
study
that
basically
outlined
that
the
top
ten
most
popular
doctor
images
each
contain
at
least
early
vulnerabilities.
Think
about
that
for
a
second.
That
number
is
astounding,
with
the
proliferation
of
docker
images
and
cloud
native
applications.
Today
that
means
that
you
are
producing
as
enterprises
and
as
users
more
and
more
images.
Every
day
more,
some
of
those
applications
are
running
in
production.
Some
of
them
are
running
in
public
clouds.
B
Some
of
them
are
running
at
the
edge
of
your
data
centers.
So
it
is
super
important
to
make
sure
that
the
applications
that
you're
running
they're
in
production
to
not
contain
any
vulnerabilities
and
that's
where
harbor
agua
an
uncle
coming
to
the
rescue
here
with
some
of
the
work
that
you're
gonna
showcase
today.
B
Why
do
you
want
to
run
your
own
registry?
There's?
Obviously
a
lot
of
registries
out
there
most
of
the
public
cloud
providers
to
provide
their
own?
You
could
also
use
anything
else
like
docker
engine,
for
example,
but
it's
very
important
to
think
about
what
are
they
key
capabilities
you're
looking
for
out
of
your
own
registry
and
why
a
tool
like
Hubble
might
really
fit
the
purpose.
So,
let's
get
started
here.
The
first
and
most
important
reason
why
you
might
want
to
run
your
own
registry
is
security
and
compliance.
B
You
want
a
comprehensive
policy
that
you
can
define
understand
and
we
also
be
able
to
apply
it
across
the
board.
You
may
have
registry
and
data
ownership
issues,
so
you
might
want
to
co-locate
your
data
near
your
applications
or
even
within
your
own
data
center
and,
most
importantly,
you
want
to
bring
in
the
identity
Federation
that
you're
already
using
within
your
organization,
so
that
you
don't
have
to
have
a
separate
identity
and
a
separate
user
store
for
your
registry.
B
So
where
some
of
the
features
that
come
out
of
this
umbrella,
you
could
have
things
like
vulnerability
scanning,
we'll
assess
your
images
for
vulnerabilities
and
give
you
a
report
back
saying
if
you're
vulnerable,
the
severity
of
those
vulnerabilities
and
if
there
any
possible
remediations,
you
might
want
to
see
the
exceptions.
So
there
are
certain
situations
where
there
may
be
a
vulnerability
and
there's
no
fix
for
it.
Yet.
So
what
do
you
do?
B
And
last
but
not
least,
in
the
isolation,
a
multi-tenancy
space.
You
want
to
be
able
to
have
multiple
organizations
within
your
company.
They
have
their
own
access
to
the
registry
and
they're
isolated
from
each
other,
either
because
of
compliance
results
or
because
of
data
sovereignty
or
because
there's
simply
different
business
units
at
the
infrastructure
layer.
You
might
want
to
do.
You
might
want
to
be
able
to
deploy
in
an
infrastructure
where
that's
private
public
hosted
on
the
edge.
The
topic
of
data
locally
becomes
comes
back
again
here
and,
most
importantly,
you're.
B
These
registering
your
images
need
to
be
kubernetes
a
docker
compliant
because
that's
exactly
where
you're
gonna
run
your
complete
platform
on
a
scale
and
control
perspective.
You
know
you
want
to
be
able
to
have
not
only
control
access
to
artifacts.
This
is
where
you
get
authenticate
and
author
rise,
who
should
have
access
to
your
cloud
native
artifacts?
That
includes
your
docker
images
and
your
home
charts.
B
Is
we
allow
you
to
replicate
your
artifacts
to
a
multitude
of
other
tools
like
another
instance
of
harm
or
the
derocker
registry
docker
hub
huawei
cloud,
aw
years,
ru,
GCP,
Alibaba
cloud,
so
pretty
much
every
popular
public
cloud
out
there
Harper
can
integrate
with
you
can
replicate
resources
there
and
last
it's
all
about
automation,
extensibility,
as
enterprises
and
users.
You
have
made
a
ton
of
investments
in
products
and
services
within
your
own
datacenter.
B
You
want
a
register
that
will
come
in
and
be
able
to
be
plug
and
play
with
those
existing
investments
so
that
everything
just
works.
So
what
does
some
of
the
kick
ever
really
do?
Is
I
come
out
of
that?
You
want
integration
with
logging,
so
you
can
push
your
logs
to
an
elk
stock
or
Splunk.
For
example,
you
want
web
hooks,
so
your
CI
CD
pipelines
can
be
willing
to
get
into
the
registry
so
that,
as
images
are
built,
you
can
push
them
to
the
registry.
B
You
can
make
sure
they
get
scanned
and
for
vulnerabilities
and
then
maybe
notify
when
they're
ready
to
be
pushed
to
production
or
possibly
to
accompany
this
cluster.
You
want
a
REST
API,
so
everything
can
talk
with
each
other
in
a
unified
manner
and
last
but
not
least,
is
robot
accounts.
You
want
to
be
able
to
have
specialized
accounts
that
are
used
for
automation
to
basically
be
able
to
integrate
your
registry
with
with
these
other
tools.
B
So
what
is
harbor
harbor
is
a
cloud
native
computing
foundation
incubating
project.
Today
we
have
almost
nine
and
a
half
thousand
stars
on
github
and,
in
a
nutshell,
we're
an
open-source
container
image
registry,
the
secures
images
with
role-based
access
control
with
scary
just
for
vulnerabilities,
and
then
we
sign
images
as
trusted.
So
we
delivers
security
and
compliance
to
your
organization.
We
have
very
high
performance
and
scalability.
We
are
interoperable
with
some
of
the
other
existing
investments.
You
have
in
your
infrastructure
and
we
provide
you
the
consistent
image
management
for
kubernetes.
B
From
an
architecture
perspective,
some
things
I
mentioned
earlier
are
really
depicted
here
on
the
right.
We
have
all
our
replicated
registry
providers,
where
Harper
allows
you
to
replicate
both
in
and
out
to
all
of
the
public
cloud
providers
out
there.
We
have
multiple
storage
capabilities
at
the
data,
access
layer
and
the
entire
architecture
of
harbor's
to
componentize
such
that
you
were
able
to
scale
and
meet
the
demands
of
our
end
users,
while
at
the
same
time
giving
you
the
ability
to
work
and
interact
with
our
board
with
the
tools
of
your
choice.
B
So
you
can
interact
using
your
web
portal
or
a
API.
You
can
use
the
cubelet
in
a
kubernetes
environment
to
be
able
to
push
pull
down
your
artifacts
from
harbor.
Also,
the
home
client
works,
as
well
as
the
doctor,
not
reclined,
and
today
we're
also
going
to
concentrate
a
little
bit
about
this
green
box
right
here
on
the
right,
which
is
the
newly
created
scan
providers
that
allow
you
to
scan
your
images
they're
the
residing
in
harbor
using
third-party
pluggable
scanners.
B
B
We
had
an
image
retention,
so
now
you
can
go
into
a
project
and
specify
whether
certain
images
should
go
away
after
nine
months
or
after
three
months,
so
you
get
to
define
with
your
compliance
policies
and
allow
harbor
to
basically
implement
the
policy
in
the
form
of
attention
so
that
you
also
don't
get
filled
up
from
a
storage
perspective.
We
also
added
project
coders.
B
So
now
you
can
define
a
quota
across
a
single
project
that
will
take
into
account
the
sharing
of
resources
between
layers
and
different
repositories
and
allow
you
to
to
basically
implement
that
coder
so
that
your
end
user
teams
have
a
maximum
storage
capacity
for
harbor,
also
added
the
web
cook.
Events
for
CIC
the
integration
so
I
mentioned
that
earlier
as
well.
It's
very
important
to
have
a
tool
like
harbor
that
can
integrate
very
well
with
other
existing
investments
and
CIC.
B
D
is
one
of
the
major
investments
in
a
cloud
native
world
so
being
able
to
have
work.
Events
that
can
talk
to
CIC
D
system
is
super
super
critical
and
in
1.9
we
extend
them
on
our
replication
investments
that
you
had
with
harbor
1.8,
adding
replication
integration
with
AWS,
Azure,
GCP
and
Alibaba
cloud
in
the
last
major
features
we
added
in
1.9.
Is
this
concept
of
the
CV
exception
policy
that
I
mentioned
earlier?
B
Take
a
look
at
harbor
one,
the
tank,
that's
currently
in
progress.
Our
goal
is
to
actually
ship
one
to
ten
at
or
near
cubic
on
us.
Our
big
cloud
native
conference.
That's
coming
up
in
late
November
now.
Our
theme
here
is
about
security
and
compliance,
and
you
notice
that
most
of
the
features
were
creating
here
around
enabling
capabilities
around
security
and
compliance.
So
the
first
one
that
we're
creating
is
called
immutable
images
and
repositories.
This
gives
the
ability
to
a
project
administrator
to
define
certain
images
and
repositories
as
immutable.
B
What
that
does
is
it
allows
you
to,
for
example,
Reddy's
version
2.5
as
immutable,
so
that
no
other
user
can
go
and
update
that
image.
You
can
create
a
new
version
of
Reddy's.
You
can
go
to
3
dodo,
for
example,
or
you
can
create
a
new
tag,
but
the
actual
combination
of
repository
and
tag
is
immutable
so
that
you,
as
the
operator,
can
feel
confident
that
the
image
that
you
see
I
see
the
pipeline
created
is
also
the
same
image.
B
That's
signed
and
will
be
made
available
for
download
by
your
developers
as
the
imported
application
to
production.
We're
also
adding
open,
ID
connect
group
support
so
now
you'll
be
able
to
define
a
group
as
a
member
of
a
harbour
project
and
all
the
identities
that
belong
to
the
group
inherit
the
same
permissions
in
harbour.
So
that
makes
it
easier
for
you
to
manage
your
organization
within
harbour.
B
Also
adding
a
new
role
in
harbour
for
a
role
based
access
control
called
a
limited
cast,
and
this
is
a
role
that
super
popular
with
any
users
are
using
harbour
in
a
multi-tenant
environment
where
each
tenant
can
belong
to
a
different
organization,
and
you
sometimes
don't
want
each
tenant
to
know
about
each
other,
so
think
of
a
holster.
That's
basically
deployed
harbour
has
made
harbor
available
to
to
their
end
users,
and
they
don't
want
hep-c
the
company
to
know
that
coca-cola.
The
company
is
also
a
member
of
the
same
group.
B
So
a
limited
guest
role
allows
you
to
still
be
able
to
use
harbour
as
a
guest
and
not
be
able
to
see
any
other
guests
are
part
of
the
same
project.
We're
also
adding
some
more
features
around
the
CLI,
Sigrid
and
robot
accounts
to
give
them
a
little
bit
more
functionality,
but
now
we're
coming
to
the
diamond
door,
this
release
and
that's
the
implementation
of
what
they
call
the
interrogation
service.
B
Think
of
this
as
a
service
that
allows
an
end
user
to
Tara
gate
all
the
images
that
are
living
in
harbour
and
assess
their
security
posture.
The
first
implementation
of
that
is
the
pluggable
add
of
3
scanners
and
will
super
excited
that
both
aqua,
anchor
and
HP
all
of
them
came
in
and
are
contributing
in
this
effort
to
create
Oscars
scanners,
which
is
3
B
by
aqua
and
uncurl
Enterprise
anchor
engineer
Enterprise,
so
I'm
not
read
over
to
list
you
to
talk
a
little
bit
about
vulnerabilities
and
compliance
great.
C
Thank
you
very
much
Michael
yeah
so,
and
these
pluggable
scanners
are
all
about
helping
you
find
vulnerabilities
in
the
container
images
that
you're
using
or
planning
to
use.
So
I
thought
it
might
be
worth
just
diving
a
little
bit
into
what
we're
talking
about
here
with
these
vulnerabilities,
but
a
few
logos
here.
These
are
the
kind
of
rock
stars
of
something.
Can
we
go
back
one,
and
these
are
the
kind
of
rock
stars
of
and
the
vulnerability
world
things
like?
C
Hardly
shell-shocked,
dirty
cow
meltdown,
you've,
probably
heard
of
them
they're
critical
vulnerabilities
that
an
attacker
can
take
advantage
of
when
we're
talking
about
vulnerabilities.
These
are
software
flaws
that
attackers
know
how
to
exploit
and
they
can
use
them
to
do
something
bad,
unexpected
inside
your
deployment.
Now
these
are
the
kind
of
super
critical
ones
were
a
handful
of
super
critical
ones,
so
famous
they
get
their
own
logos,
but
these
are
just
the
tip
of
the
iceberg.
C
Thousands
of
vulnerabilities
get
discovered
every
year,
some
of
them
much
much
less
important,
but
nevertheless
you
want
to
use
a
scanner
to
find
out
what
is
inside
your
images
right.
If
we
go
to
the
next
slide,
when
we're
talking
about
a
container
image,
the
code
inside
it
kind
of
comes
in
three
parts,
there's
the
application
code
that
you're
writing
yourselves,
that
your
developers
are
writing
bespoke
code.
C
Then
there
are
potentially
some
dependencies
that
you're
pulling
in
doing
something
like
at
get
install
as
parts
of
an
image
build.
These
dependencies
are
managed
by
package
managers.
The
package
manager
depends
on
the
distribution
of
the
for
links,
distribution
inside
the
image,
and
these
dependencies
can
have
fund
abilities
in
them
and
also
there's
the
base
image
itself.
So,
when
you're
running
your
docker
build,
it
starts
from
a
base
image
and
that
could
already
have
some
of
these
packages
contained
within
it.
C
So
the
image
scanner
is
looking
at
dependencies
wherever
they've
come
from
from
the
base
image
or
in
dependencies
that
have
been
added
through
a
package
manager.
What
these
won't
find
is
vulnerabilities
that
you
might
write.
You
know
to
bad
coding
practices
in
your
own
applications
scanners
know
about
publicly
what
published
vulnerabilities
that
exist
in
third-party
dependencies.
C
We're
mostly
talking
about
packages
operating
system
packages.
I
will
mention
application
language
packages
shortly
as
well
all
right,
so
not
all
scanners
will
give
you
the
same
result.
If
you
run
two
different
scanners
on
the
same
container
image,
there's
a
very
high
chance,
you'll
see
some
differences.
C
A
C
Particular
distribution
of
Linux
that
your
image
uses,
because
that
will
tell
you
whether
or
not
the
distribution
has
patched
that
particular
package
for
vulnerability,
so
a
version
that
looks
as
though
it
should
it
may
be
vulnerable.
According
to
the
NVD,
it's
actually
been
patched
by
the
distribution,
it's
not
actually
vulnerable,
and
if
the
scanner
doesn't
know
to
look
at
that
advisory,
it
would
give
you
a
false
positive.
C
Additionally,
there's
some
other
sources
like
vendors,
nginx
and
MongoDB,
for
example,
publish
their
own
security
advisory
information
and
the
more
of
these
sources
you
put
in
the
more
accurate
your
data
plus.
Some
scanners
will
have
feeds
from
direct
from
security
researchers,
adding
additional
accuracy
into
their
feeds.
C
So
basically
the
more
of
these
sources
that
our
scanner
is
using
and
the
more
up-to-date
the
data
is
that
it's
pulling
from
those
sources,
then
the
more
likely
it
is
that
the
scanner
is
accurate
and
that
it
will
reduce
the
number
of
false
positives,
which
is
a
real
problem
for
for
scanners.
In
addition,
some
scanners
will
have
different
functionality
available,
like,
for
example,
supporting
looking
for
vulnerabilities
in
language
packages,
things
like
node
or
Java,
or
Python,
or
Ruby,
or
published
security
advisories.
But
not
all
scanners
are
able
to
give
you
the
results.
C
You
have
options
in
terms
of
open
source
scanners
like
trivy
like
Angkor.
There
are
free
scanners
out
there.
There
are
commercial
scanners
out
there
and
you
may,
as
an
enterprise,
want
to
look
at
a
commercial
scanner
if
you're
interested
in
some
of
this
additional
and
charity.
Sometimes
additional
sources
are
only
available
commercially
in
some
of
these
additional
data
sources
and,
of
course,
you
might
want
to
be
paying
for
support.
So
there
are
differences
in
the
scanners
that
are
available.
C
Harbor
today
supports
scanning
with
the
Clair
vulnerability
scanner
and
we're
adding
in
support
for
both
ankle
and
aquas
commercial
and
open
source
scanner
options,
and
then
that's
gonna
API
that
we've
added
is
available
for
other
scanners
to
write
an
adapter.
So
this
is
a
generic
interface
that
any
scanner
can
plug
into
harbor.
C
As
you
can
see
from
the
diagram
the
harbor
over
here
I
can
initiate
a
scan.
It
can
use
the
configuration
to
pick
establish
which
scanner
it
should
be
using
based
on
the
project,
because
you
can
configure
a
different
scanner
for
different
projects.
It
launches
asynchronous
jobs,
which
will
then
communicate
over
the
scanner
API
with
the
appropriate
adapter,
which
will
kick
off
the
scan
and
retrieve
the
scan
results
later.
Those
scan
results.
We
defined
a
standard,
Harbor
format
for,
if
you
like,
so
that
scan
results
can
be
compared
and
displayed
in
the
Harvey
UI.
There's.
A
A
question
about
that
later:
I,
don't
know
if
you
can
take
it,
it's
Daniel
Mendez,
he
said,
will
app
scanning
from
trivy
still
working
harbor
in
terms
of
reporting
and
what
he's
specifically
asking
about
is
scanning
NPM
modules,
particularly
in
a
distro,
less
container
that
doesn't
have
packet
manager.
Yes,.
A
B
We're
using
notary
for
signing
images,
and
actually
one
of
the
things
that
were
working
on
is
figure
out
how
to
actually
sign
these
images
so
that
they
can
also
be
replicated
while
maintaining
their
signing
signature.
So
working
with
the
bigger
community
in
the
OCI
team
to
make
that
capability
a
reality
and.
A
C
All
right,
say,
I
think
the
last
thing
to
add
about
this
is
really
that
we've
defined
this
generic
scanner
API.
So
if
you
move
onto
the
next
slide,
you'll
see
how
very
simple
it
is.
It's
an
asynchronous
API
where
we
can
request
metadata
from
a
scanner
which
allows
how
to
find
out
what
capabilities
the
scanner
has.
That
kind
of
leads
into
some
of
the
future
roadmap.
That
I
think
Michael
will
be
talking
about
shortly
and
you
can
make
her
a
request
for
a
scan
with
it.
C
This
post
scan
to
say
which
artifact,
which
container
image
you
want
to
start
scanning,
and
then
you
use
a
get
request
to
retrieve
the
report
from
the
scanner
adapter
and
then
that
scanner
adapter
will
be
making
either
API
calls
or
executable
calls,
depending
on
the
particular
scanner
to
execute
that
scan
and
return.
The
results
to
harbor
in
this
standardized
format.
A
C
But
after
that,
every
time
you
run
trivia,
it
does
a
check
with
it.
Just
does
a
git
pull
to
update
the
latest
set
of
results,
I'm
sure
other
vulnerability
scanners
will
work
on
different
schedules.
That's
kind
of
one
of
the
things
to
look
at
and
interestingly,
some
of
the
data
sources
themselves
are
updated
on
different
frequencies.
So,
for
example,
Red
Hat
have
two
different
sources
of
security
advisory
information,
one
of
which
needs
information
about
unfixed
vulnerabilities,
in
other
words,
vulnerabilities
for
which
known
fix
is
yet
available,
and
that
is
updated.
C
It
seems
several
days
before
it
then
results
in
the
and
the
kind
of
official
data
source
called
ovale,
which
includes
only
the
information
about
the
fixed
or
won't
fix
vulnerabilities,
so
I've
gone
on
to
a
little
round
there,
but
my
my
aside
was
ready
to
say
it's
not
just
about
how
frequently
the
scanner
updates
say.
So
it's
also
about
how
up-to-date
the
data
is
that
it's
pulling
from
that's.
A
B
Excellent,
so
let's
take
a
look
at
the
demo
here:
let's
show
you
guys
some
some
items
but
feel
free
to
ask
questions
as
you
go
along
and
Alex.
Let
me
know
if
there's
something
that
folks
want
to
see.
So
the
first
thing
I'm
going
to
show
you
guys
is
this
concept
of
compliance
and
security
policy,
the
Harper
house,
and
how
that
can
be
defined
within
Harbor
and
applied
across
the
board
for
your
container
image
registry.
B
B
Sorry,
vulnerability
solution
doesn't
exist
or
you
want
to
wear
this
more
period
of
time
to
test
it
before
you
apply.
So
you
as
a
project
administrator,
you
get
to
define
the
level
of
risk
that
you'll
comfortable
for
the
cv
is,
and
the
images
that
your
organization
is
publishing
for
your
cloud
native
applications
and
harbor
allows
you
to
just
do
that.
So
I
can
come
in
very
easily
and
define
this
globally
at
the
harbor.
B
Configuration
or
I
can
be
find
this
at
the
project
level
and,
as
you
mentioned
earlier,
you
get
to
set
the
expiration
as
well.
The
next
thing
that
I
want
to
show
you
guys
is
the
formal
ability
database
here
it
indicates
when
the
database
was
last
updated,
and
this
is
for
Claire,
which
is
the
building
for
nobody's
coming,
that
comes
with
harbor,
and
you
also
get
to
define
a
schedule.
B
So
if
you
want
all
your
images
to
be
scanned
hourly
daily
weekly,
you
get
to
define
how
you
want
your
compliance
policy
to
be
set
and
harbor
will
execute
it.
Now,
if
you
go
to
an
individual
project
within
Harbor,
under
the
configuration
of
the
project,
you
get
to
define
how
you
want
this
project
to
behave
from
a
compliance
standpoint.
So
the
first
thing
is
you
get
to
define
when
you,
whether
you
want
content,
trust
to
be
applied,
so
that
means
only
verified.
Images
can
be
pulled
down.
B
So
if
an
image
is
not
signed,
no
user
will
be
able
to
pull
that
and
random
production.
You
can
also
define
whether
you're
vulnerable
images
two
to
one,
so
you
define
again
your
level
of
risk
and
your
level
of
comfort.
So
for
me,
I
could
say
that
if
any
image
has
medium
or
higher
severity,
vulnerability,
don't
allow
it
to
ever
be
deployed.
B
In
addition
to
that
schedule
that
harbor
can
dictate
around
scanning
your
images.
You
can
also
scan
images
on
demand
with
to
do
in
a
second,
but
you
can
also
set
it
so
that
images
can
be
scanned
automatically
every
time
they're
pushed
so
every
time.
There's
an
image
that
comes
into
harbor
from
UCSD
pipeline.
It
can
be
immediately
scanned
for
vulnerabilities
and
the
policies
above
can
be
set
immediately
and
again.
B
The
last
item
here
is
the
CD
whitelisted
I
mentioned
earlier,
so
I
can
either
choose
to
accept
the
system.
Whitelist
I
can
create
a
project
white
list
which
can
start
from
the
system.
One
I
can
even
add
my
own
CDs
or
have
a
CD
here
that
I
opened
and
I
can
without
and
enter
these
details
here
and
now.
B
B
So
let's
go
now
and
show
you
some
of
the
new
stuff
that
you
started,
creating
under
the
configuration
tab
of
the
main
project
settings
of
harbor
there's
a
new
page
called
scanners,
and
here
you
can
define
and
add
your
own
scanner
and
like
Liz
mentioned
earlier.
This
is
an
open
specification.
Anyone
any
company
that
has
their
own
scanner
and
they
would
like
to
extend
harbors
capabilities
by
adding
their
pluggable
scanner
into
Harbor.
They
can
implement
our
API
interface,
we'll
work
with
them
and
then
you'll
be
able
to
add
the
scanner
to
your
hub,
or
instance.
B
Now
we
have
Claire,
which
is
the
default,
that
the
batteries
included
with
harbor,
but
you
also
have
introduced
trivia
non-coal
here
as
our
pluggable
scanner.
So,
if
I
actually
extend
this
here,
I
see
that
3d
is
developed
by
aqua
security.
I
see
the
endpoint
URL
for
for
3d
and
I
also
see
their
mind
and
types
that
and
that
tree
we
can
consume
and
produce.
This
is
the
contract
between
Harbor
and
the
pluggable
scanner
that
please
mentioned
earlier.
That
kind
of
identifies.
How
do
we
talk
to
the
scanner
we
give
it
an
OCI
image.
B
So
I'm
going
to
tell
you
about
something
cool
that
I
set
up
here.
So
a
lot
of
you
have
images
up
during
public
clouds.
Maybe
there
are
in
any
of
the
big
public
cloud
providers,
maybe
they're
in
Decorah,
and
maybe
you
want
to
have
horrible,
bring
those
images
into
harbor
and
be
able
to
apply
these
compliance
and
policy
that
we
talked
about
in
terms
of
scanning
and
remediation
and
policy,
and
then
your
developers
can
actually
start
utilizing
those
images
to
run
them
in
production.
B
So
having
that
extra
set
of
control
and
having
horrible
kind
of
bring
these
images
into
hard
work
apply,
your
compliance
needs
is
super
important.
So
what
I
did
is
I
went
ahead
and
set
up
some
replications,
so
I
have
a
docker
hub
at
town
and
I,
went
ahead
and
pulled
down
images
from
my
daughter
hub
and
put
them
into
different
projects
that
I
have
set
up
for
Claire
anchor
in
3b.
So
now
I
get
to.
B
Pull
the
images
on
a
periodic
schedule
or
manually
and
then
have
Harper,
do
its
theme
by
basically
going
ahead
and
scanning
these
images
for
vulnerabilities
as
go
ahead
now
and
see
what
our
projects
look
like.
So
I
have
my
HR
business
department
here
and
the
same
images
are
scanned
by
anchor
Claire
and
really
just
to
show
you
the
differences.
So,
like
liz
mentioned,
other
scanners
are
created
equal.
B
Some
scanners
pay
specific
attention
to
different
areas,
so
this
up
to
you
and
your
own
vision
is
amides
and
your
compliance
needs
to
identify
the
right
scanner
based
on
the
workloads
that
you
have
and
you
can
apply
that
scanner
on
a
per
project
basis.
Actually,
in
the
future,
we
will
enable
you
to
run
multiple
scanners
in
the
same
project,
so
you
can
get
consolidated
results
from
multiple
entry
paths,
so.
B
At
the
HR
business
team
for
Angkor,
if
I
take
a
look
at
that
and
look
at
this
new
scanner
tab
that
we
have
here,
you'll
notice
that
the
default
scanner
here
is
uncovered.
It
is
really
healthy
state.
We
have
some
of
the
same
details.
I
showed
you
earlier
in
the
scanner
API.
So
when
we
go
back
to
our
repository,
I
can
go
into
any
of
these
images
that
have
created
in
this
organizational
unit
and
I
can
see
here
all
the
different
vulnerabilities
that
have
been
discovered
by
encoding
this
case.
B
So
I
can
click
on
the
actual
tag
and
I
can
both
see
graphical
view
of
my
images
and
when
I
see
this
I'm
saying.
Oh,
my
god,
this
image
is
super
super
vulnerable.
Look
at
how
many
CVS
exist
for
my
application,
so
I
can
scan
it
again
on
demand,
so
I
can
instruct
the
anchor
engine
in
this
case
to
go
ahead
and
risk
on
my
image
just
in
case
something
has
changed.
Obviously,
nothing
has
changed
here,
so
I'm
getting
back
the
same
results,
so
I
wanna
show
you
guys
now
some
of
the
differences.
B
B
If
we
allow
eventually
to
run
the
combination
of
all
the
scanners,
you're
gonna
get
this
comprehensive
view
of
your
scanning
results.
Now,
one
of
the
things
at
least
mentioned
earlier
was
this
way
that
you
build
your
images
with
dependencies
and
packages
to
be
identical
to
the
build
history.
Hero
harp,
you'll
notice
here
that
we
give
you
a
rundown
of
what
happened
in
the
docker
commands
in
the
docker
file
that
basically
build
your
image.
B
So
you
can
see,
but
actually
someone
tried
to
do
apt-get,
update
or
yeah,
install
and
update
everything
that
they
have
in
their
image,
and
when
did
that
happen?
So
look
at
the
dates
here.
The
dates
are
important
because
it
tells
you
you
know
how
the
history
of
both
the
creation
of
these
packages,
but
also
you
know
how
the
probabilistic
have
existed
since
then,
and
similarly,
when
I
do
get
the
result.
B
Now,
let's
talk
about
one
final
thing
here
in
our
demo,
in
many
situations
you
have
kubernetes
clusters
or
docker
or
compute
instances
running
at
the
edge
or
in
various
smaller
parts
of
your
data
center
and
in
some
of
those
situations
you
may
not
have
the
compute
bandwidth
to
go
and
implement
a
solution
that
includes
full-blown
scanning
either
because
you
don't
have
the
computer,
the
memory
or
the
storage
resources.
So
what
can
hardwood
do
for
you?
B
So
now
you
can
have
a
cache
of
your
images
available
locally
to
where
your
compute
applications
are
running
and
you
don't
have
to
scan
them
there,
because
you
trust
the
harbor
scan
them
up
in
your
main
data
center.
So
now,
if
links
go
down
because
links
always
go
down,
you
know
this.
You
don't
always
have
100%
Internet
of
the
edge.
Your
applications
are
not
impacted
because
you
have
a
cache
of
your
images
locally
in
the
harbor
instance.
So
that's
a
good
way
to
implement
your
security
policy
and
have
hard
board
basically
establish
is
compliance
so.
A
Michael
we
have
question
about
how
this
all
sort
of
fits
into
the
bigger
picture,
so
somebody's
asking
what
if
you
had
different
environments-
and
you
wanted
to
promote
images
through
from
dev,
where
you're
a
cave,
the
vulnerabilities
to
staging
where
it
gets
a
bit
tighter
than
in
production.
You
want
zero
zero
highs.
Let's
say:
can
you
do
that?
Yes,.
B
Absolutely
and
that's
actually
one
of
the
the
major
reasons
why,
if
you
look
at
the
project's
each
configuration
of
the
policy
is
on
a
per
project
basis,
so
you
could
have
a
project
for
your
dev
test,
a
project
for
your
sandbox
and
a
project
for
your
production
and
each
of
them
who
have
a
different
level
of
risk
and
a
different
threshold
for
the
vulnerabilities.
So
you
could
set
up
your
your
dev
test
as
low
and
your
sandbox
as
medium
and
your
production.
B
A
B
Absolutely
so
so
Harper
can
be
integrated
very
well
in
CIC
the
pipeline
as
the
target
repository
for
your
images.
So
as
you
build
your
images,
you
start
from
source
code
and
you
build
some
continuing
edges.
Harbor
can
become
the
target
and
the
repository
where
you
store
them,
and
then
you
can
use
some
of
the
key
capabilities
of
harbor
to
both.
Not
only
hide
your
images,
but
you
know
define
domestic
mutable
or
or
basically
define
the
policy
based
on
you
know
the
project
and
your
organizational
needs
and
then
on
the
back
end.
B
Harper
has
this
concept
of
web
hooks
that
we
mentioned
earlier.
That
allows
you
to
get
call
bugs
when
certain
actions
happening
harbour.
So,
for
example,
when
you
get
a
new
scan
and
you
get
some
new
vulnerabilities,
you
can
get
back
or
what
I
think
you
webhook.
Now,
when
your
storage
code
has
exceeded
you're
gonna
get
back
at
work
hook,
that's
going
to
tell
you
hey,
you're,
an
out
of
storage.
That's
why
you
push
to
the
harbor
repositories.
Failing
see
now
you
can
integrate
your
CD
pipeline
with
some
of
these
workbooks,
which
can
drive
additional
actions.
B
One
action
example
for
that
I
can
think
of
is
let's
say
you
start
from
source
code.
You
build
an
image.
You
see
as
the
pipeline
push
that
image
into
harbor.
Once
harbor
has
verified
its
security
posture
you
can
send
by
the
web
Putin
letting
you
know
that
your
image
is
free
and
clear.
It's
clean
go
ahead
and
leap
right
into
production
and
your
CSV
pipeline
can
execute
the
last
step,
which
is
push
that
image
to
kubernetes.
A
A
B
You
you
need
to
have
to
query
Harbor
to
know
or
listen
for
the
weapon
to
identify
what
the
scanning
results
were.
In
that
case,
if
you
have
like
a
singular
job,
but
what
actually
adding
actually
brings
up
a
cool
topic
in
the
future,
one
of
the
things
that
we
want
to
do
is
we
want
to
integrate
this
like
some
sonobuoy,
so
that
you
can
actually
establish
and
assess
the
images
that
you're
running
in
production
even
have
boner
abilities.
B
So
an
image
that
you
put
yesterday
today,
my
new
CV
might
come
up,
and
but
you
don't
know
about
it,
because
your
image
is
already
running
in
production.
So
you
want
to
basically
integrate
with
additional
tools
to
be
able
to
assess
the
security
posture
of
your
running
images
and
that
actually
were
additional
tools
like
aqua
and
uncork
I
mean
that
can
actually
help
you
that
so
Liz.
Do
you
wanna
talk
a
little
bit
about
how
a
quark
can
help.
You
maintain
your
security
posture
for
your
images
running
in
production,
yeah.
C
C
Would
typically
want
to
rebuild
the
image
with
the
fixed
version
of
whatever
the
package
is
this
been
affected
and
then
deploy
new
versions,
but
tools
like
aqua
and
I'm
sure
other
security
tools
as
well?
That
can
help
you
identify
whether
you
have
running
containers
that
were
instantiated
from
vulnerable
images.
One
thing
you
want
to
avoid
doing,
because
I
have
seen
well
at
least
one
company
that
was
trying
an
approach
where
they
were
saying
we're
going
to
vulnerability,
scan
inside
your
running
containers,
which
is
a
pretty
inefficient
way
of
going
about
it.
You.
A
B
B
All
right
going
back
to
the
deck
so
you've
seen
the
demo.
Now
you
have
told
you
that
you're
gonna
have
a
lot
of
images
that,
in
your
production,
pre-production
you're
producing
more
and
more
images
as
enterprises
as
they're
gonna,
have
a
lot
of
fun
abilities
so
coming
use
harbor,
because
we
can
help
you,
in
addition,
with
our
pluggable
scanners,
to
assess
your
security
posture,
but
the
journey
doesn't
end
there.
B
We
have
a
very
long
road
map
with
harbor
in
terms
of
the
investment
areas
that
we
want
to
make,
and
some
of
the
key
capabilities
that
you
wanna
print.
Ori
users
see
you
guys
so
from
a
management
perspective.
We
want
to
build
a
kubernetes
operator
that
allows
you
to
create
an
aje
installation
of
Hubble
on
top
of
kubernetes.
That
includes
everything
in
color
dependent
components.
B
A
very
scalable
hardware
instance
I
mentioned
earlier-
that
we
want
to
do
some
signing
policy
replication
because
signed
images
today
cannot
be
replicated
because
the
signature
of
the
signed
image
is
tied
to
the
instance
of
the
registry
that
you're
deploying
them
from
other
additional
investments
into
metadata
management.
So
it
can
make
it
easier
for
you
to
manage
your
hardware
registry.
Obviously,
reference
scale
is
something
to
do
continuously
improving
and
you
have
fewer
customers
of
hardware.
There
have
been
thousands
and
thousands
of
images
in
production
today
consuming
terabytes
of
storage
and
observability.
B
B
This
is
a
huge
initiative
of
us
we're
going
to
continue
enhancing
our
webhook
support
or
continue
enhancing
the
interrogation
service
you're,
going
to
see
more
scanners.
In
addition
to
aqua
and
uncle
come
in
to
harbor
giving
you
a
choice
and
freedom
to
pick
the
scanner
that
meets
your
needs
and,
lastly,
we're
going
to
be
very
engaged
and
already
started
with
the
OCI,
the
open
container
initiative
around
artifact
management
and
conformance,
so
that
harbor
will
be
able
to
store
more
than
container
images
and
home
charts.
B
B
If
you
wanna
get
in
contact
with
our
community,
when
I
tell
you
one
thing,
we're
thriving.
We
have
nine
and
a
half
thousand
github
stars
today
over
200
contributors,
30,000
plus
downloads
of
harbor
and
almost
3,000
Forks,
and
if
you
notice
here
on
the
bottom
left,
the
top
chart
is
a
contributing
developers
and
the
bottom
one
is
the
contributing
companies.
The
red
line
is
when
we
donated
harbour
to
the
CN
CF.
Ever
since
then,
you
have
experienced
explosive
growth,
both
from
a
contribution
perspective
of
companies
and
developers
who
have
twenty
plus
product
implementations.
B
B
The
different
ways
that
you
can
do
that
were
on
sincere
fleece,
we're
on
slack.
We
have
a
twitter
account
and
we
have
regularly
scheduled
zoom
meetings
that
are
both
friendly
for
Asia
and
E,
as
well
as
for
the
United
States,
and
we
have
a
demo
in
source
of
harbor
always
available
and
running.
If
the
Moscow
Harbor,
the
Deo,
feel
free
to
go
and
check
it
out
and
take
it
for
a
spin.
C
Think
Michael
is
coming
it
all
very
well
and
I'll
just
say
you
know:
we've
been
very
pleased
and
excited
to
be
able
to
contribute.
You
know
this
whole
pluggable
scanners
item
into
harbor,
so
I
think
it's
a
an
advantage,
for
you
know:
bass
the
open
source
community
and
end-users
and
vendors
to
be
able
to
collaborate
in
this
kind
of
way.
Yeah.
B
Huge
huge
shout
out
to
the
anchor
team,
the
HP
team
and
they
are
courting
for
kind
of
helping
us
bring
that
vision
to
reality
and
doing
a
lot
of
the
heavy
lifting
and
enabling
that
capability.
So
you
guys
have
been
great
and
we
will
have
a
huge
presence
at
cubicle.
So
we
will
have
a
lunch
and
learn
with
Jo
beta,
so
feel
free
to
sign
up
and
get
some
lunch
and
get
to
get.
The
real,
hands-on
experience
on
Harbor
creates.
A
A
thank
you
to
both
for
a
very
awesome
presentation.
We
have
had
questions
throughout
the
talk.
I
know
not.
Everybody
has
had
as
a
complete
answer
as
they'd
like
I
would
encourage
you.
I,
don't
know
Michael.
If
you
can
go
back
to
the
previous
slide
with
this
the
slack.
This
would
be
a
great
place
for
people
to
go
and
ask
really
technical
questions.
B
You
know
that
companies
would
not
be
quick.
Obviously,
Queisser
is
a
great
product
in
this
ecosystem
as
well.
There's
positives,
pluses
and
minuses
across
both
products
feel
free
to
come
and
find
us
on
the
CBF
slide
channel,
and
you
can
kind
of
give
you
based
on
your
needs.
Some
of
the
project
and
cons
of
each
of
the
different
tools
and
in
a
lot
of
ways
were
very
similar
to
Quay.
A
B
B
A
B
Can
only
authenticate
with
a
single
identity
Federation
for
so,
for
example,
if
you're
using
LDAP,
who
can
only
authenticated
LDAP.
But
if
you
want
to
have
a
multi-channel
environment
where
each
tenant
brings
their
own
identity.
Specifically,
you
basically
can
create
your
own
liability
and
then
have
that
federated.
Maybe
four
different
identity
providers
so
you're,
basically
creating
a
double
hop
or
in
your
identity.
Federation
tools
like,
for
example,
of
zero
anymore,
that
very
easy.