►
From YouTube: Webinar: Security and Day 2 Operations with Harbor
Description
Join us for Kubernetes Forums Seoul, Sydney, Bengaluru and Delhi - learn more at kubecon.io
Don't miss KubeCon + CloudNativeCon 2020 events in Amsterdam March 30 - April 2, Shanghai July 28-30 and Boston November 17-20! Learn more at kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects
Widespread container adoption leads to an old problem - security and day 2 operations. Harbor is a CNCF incubating open source registry that stores, signs, and scans container images for vulnerabilities. Harbor solves common registry challenges by delivering trust, compliance, performance, and interoperability, helping organizations deliver a consistent image management solution across a variety of cloud native compute platforms like Kubernetes and Docker.
In this webinar, you will get an in-depth analysis of Harbor features and find out how to securely manage container images and Helm Charts using Harbor, creating a container strategy that helps alleviate the security and compliance burden and satisfies InfoSec needs.
A
We
would
like
to
welcome
our
presenter
today,
Michael
Michael,
director
of
product
management
at
VMware
and
a
core
maintainer
with
Harbour,
so
just
a
few
housekeeping
items
before
we
get
started
during
the
webinar
you'll,
not
you
will
not
be
able
to
talk
as
an
attendee
there's
a
Q&A
box
at
the
bottom
of
the
screen.
Please
feel
free
to
drop
your
questions
in
there
and
we'll
get
to
as
many
of
them
as
we
can.
I
do
believe
that
Michael
wants
us
to
be
interactive,
so
he
will
be
answering
your
questions
throughout
his
presentation.
A
B
A
B
A
little
bit
of
an
over
harbor
and
I'm
gonna
focus
a
lot
on
a
demo,
so
you
can
actually
see
hands
on
all
the
capabilities
of
harbor.
If
you
have
a
question,
please
ask
it:
I
have
the
Q&A
window
open
so
I'll
see
if
I
can
answer
at
that
time,
I
will
otherwise
I'll
push
your
question
to
later
on
all
right.
So,
let's
start
talking
a
little
bit
about
harbor.
So
if
you're
not
familiar
with
harbor,
we
are
a
cloud
native
computing
foundation
incubating
project
and
we
just
passed
8,000
stars
on
github.
B
B
So
in
a
nutshell,
Harbor
is
an
open
source
cloud
native
registry,
the
stores,
science
and
scans
container
container
images
of
vulnerabilities.
Our
mission
as
a
project
is
to
provide
users
with
the
ability
to
completely
manage
and
surf
container
images.
So
our
goal
is
to
become
the
repository
for
all
your
cloud
native
assets.
That
means
container
images
today
it
means
hunkers
today,
but
tomorrow,
as
you
start
using
other
cloud
native
artifacts,
we
will
be
able
to
store
them
as
well,
so
you
can
think
of
Sinope,
bundles
and
operators,
or
even
other
things
like
scripts.
B
So
let
me
kind
of
look
at
some
of
the
key
features
of
harbor
and
we
kind
of
split
them
into
two
categories.
The
first
category
is
security,
and
this
is
really
where
cardboard
shines.
We
do
a
really
good
job
at
isolating
your
projects
where
you
get
to
define
policy
and
configuration
on
a
per
project
basis.
That
means
users
you
get
to
put
the
repositories
they're,
your
home,
trust
you
get
to
define
your
scanning
policy,
you
get
to
define
the
vulnerability
policy.
All
of
that
is
isolated
into
a
project.
B
We
also
do
a
really
good
job
around
security
and
vulnerability
analysis,
so
we
use
Claire
under
the
covers
to
do
static
analysis
of
all
your
container
images
and
produce
to
you
and
list
of
all
the
vulnerabilities
that
you
have
found
and
even
will
allow
you
to
define
a
policy
like
don't
allow
me
to
pull
any
image
that
has
a
high
vulnerability
found
like
a
high
CDE,
also
the
content
signing,
and
we
use
Madhuri
for
that.
So
you
can
do
validation
of
your
images,
so
you
can
trust
where
they're
coming
from.
B
On
the
management
front,
we
do
identity,
integration
and
role
based
access
control.
So,
if
you're
incorporating
harbor
into
existing
investments
and
assets
in
your
organization,
it
can
integrate
very
well.
You
can
have
a
single
identity
across
both
hardboard
in
other
cloud.
Many
tools
that
you
using
and
you
can
define
role
based
access
control,
so
different
users
have
different
security
privileges
within
Harbor.
B
Something
that
you've
been
also
making
a
lot
of
progress
in
the
last
release
of
hardboard
is
around
image
replication.
So,
when
you
put
cardboard
within
your
enterprise,
we
also
understand
that
you
have
a
lot
of
other
areas
or
regions
where
you
might
want
to
have
your
images
replicated
to
either,
because
you
have
branch
offices
that
you
run
a
container
platform
on,
or
maybe
you're
replicating
from
the
United
States
to
Europe
or
to
Asia.
B
So
harbor
now
allows
you
to
replicate
between
one
or
more
instances
of
hardboard
the
allows
you
to
replicate
across
other
registries
and
I'm,
going
to
mention
those
specifically
in
a
couple
of
minutes
also
have
a
fairly
extensible
API
and
web
UI,
where
everything
is
backed
by
a
REST
API.
So
if
you
want
to
build
integrations
into
cardboard
or
driven,
maybe
by
CI
CD
tools
or
other
tools
in
your
organization,
you
have
the
option
to
do
that.
Then
you
have
a
fully
configurable
and
fully
documented
REST,
API
and
last
but
not
least,
harbor
is
multi
tenant.
B
At
a
high
level,
the
architecture
of
harbor
is
fairly
simple.
We
have
on
the
top
our
users
coming
in
through
the
user
interfaces
or
the
API.
We
have
our
routing
components
who
have
the
core
services
of
harbor
that
do
everything
from
API
authentication
and
that's
what
we
allow
us
allows
us
to
federate
your
identity,
to
LDAP,
Active,
Directory
or
oh
I
DC,
and
then
we
have
multiple
services
that
are
really
specific
to
different
features
and
capabilities
of
harbor.
B
Our
image
registry,
which
is
where
were
serving
content
our
job
service,
our
administrator
service
of
the
vulnerability
scanning
using
player
from
a
trusted
content
using
notary,
our
sequel
database
that
contains
all
the
metadata
and
the
configuration
of
harbor
I,
think
I'm.
A
key
value
store
at
the
bottom
of
everything.
Harbour
is
backed
by
the
local
or
remote
storage.
So
we
support
block
file
or
object.
So
if
you
want
to
use
s
pretty
compatible
storage,
you
can
do
that.
If
you
want
to
use
NFS
storage,
you
can
do
that
as
well.
B
B
Now
at
Kubek
on,
we
announced
Harbor
version
one
today
that
was
our
most
significant
and
probably
our
longest-running
release,
and
it
was
also
the
release
that
we
had
had
the
highest
number
of
contributions
by
the
entire
community,
and
that
was
a
direct
result
of
the
fact
that
we've
been
into
CN
CF
for
quite
some
time
now
and
we
started
to
reap
the
benefits
of
the
entire
community.
Some
of
the
key
features
of
wonder
Dade
include
enhanced
automation,
security,
monitoring
and
cross
registry
support.
Take
a
look
at
those
really
quickly.
B
We've
added
the
concept
called
robot
accounts
to
allow
you
to
integrate
hard
work
into
any
CI
CD
tool.
So
today
you
can
authenticate
into
harbor
using
your
own
identity
as
a
user,
but
if
you
are
using
a
CI
CD
tool,
you
don't
want
to
use
user
accounts
that
will
drive
the
sea,
a
CD
actions
so
clear
that
this
robot
accounts,
the
doorknob,
a
specific
user
tied
to
a
give
you
a
username
and
a
password
that
you
can
use
liking
to
your
CI
CD
process
to
execute
actions
like
I
had
just
built
a
new
image.
B
Let
me
go
ahead
and
push
it
in
the
harbor
and
tag
it
with
the
ride
registry
tag
or
what
that
image
is
supposed
to
serve
with
one
to
date.
We
also
added
open
ID
connect
support.
So
now
you
can
have
a
single
identity
layer
within
your
organization
to
provide
authentication
and
basic
profile
information,
so
that
allows
us
to
integrate
with
things
like
ping,
identity
and
Google
and
tags.
So
now
you
can
have
a
simple
identity
across
all
the
tools
in
your
cloud
native
ecosystem,
whether
the
health
check
API.
B
You
can
monitor
the
api's
health
and
performance,
so
that
goes
along
with
the
full
api
that
you
have
on
our
UI
or
completely
revamping
our
extensibility
and
extending
it
to
everything
that
you
will
need
to
operate
harbor
in
production.
Last
but
not
least,
is
our
replication.
Our
replication
working
group
has
been
going
at
it
very
hard
to
provide
you
with
the
ability
to
replicate
hard
work
into
every
single
public
cloud
registry.
That's
out
there
and
we're
starting
with
threesome
with
three
key
ones.
B
So
with
one
today,
two
are
giving
you
a
replication
provider
model
that
allows
you
to
replicate
cardboard
into
any
other
hardware
repository
into
docker
hub
into
docker
registry
into
one
cloud
registry
as
well,
so
we're
starting
with
those
three.
But
you
can
see
in
a
roadmap
I'm
going
to
show
you
in
a
few
seconds.
The
Domino
continue
investing
replications,
who
will
have
replication
target
like
AWS
registry
and
Google,
Cloud
registry
and
agile
registry
and
others
as
well.
B
We
actually
have
a
question
on
IDC.
The
the
question
actually
says
the
implementation
of
why
this
is
greatly
appreciated,
but
it's
unclear
how
can
leverage
YDC
to
grant
access
to
users
specific
projects
without
manually,
assigning
them
in
harbor?
Does
Harbor
support
disability?
So
essentially
you
will
have
to
authenticate
using
OID
C,
add
the
user
into
cardboard
and
then
you
might
only
have
to
add
a
project.
So
there
is
no,
and
you
can
do
that
through
information,
or
you
can
do
that
in
the
UI
as
well.
B
So
there
is
no
way
to
come
into
Harbor
and
automatically
say
this,
why
this
user
will
login
at
some
point
in
time
and
be
assigned
to
a
project
they
have
to
authenticate.
They
have
to
be
assigned
into
harbor
and
once
they're
in
Harbor,
you
can
assign
them
to
a
specific
project,
but
you
can
do
that
through
the
API.
Obviously,.
B
All
right,
let's
take
a
look
at
really
quickly.
Our
roadmap
in
in
hardware
as
well,
so,
like
I,
mentioned
earlier,
we're
kind
of
kind
of
like
splitting
things
into
different
groups,
and
our
roadmap
is
really
split
into
management
and
extensibility
and
I'm
going
to
touch
very
briefly
on
some
of
these
features.
But
if
you're
interested
in
learning
more
do
come
to
our
meetings
and
local
will
explain
some
of
this
in
detail
on
the
management
front,
we
do
want
to
create
a
kubernetes
afraid
of
our
board.
B
This
will
allow
us
to
add
support
of
hardboard
as
a
native
kubernetes
application,
so
you
can
do
things
from
scaling
hardboard
backing
up
hard
board,
starting
stopping
understanding
its
health.
All
of
those
things
we
want
to
make
available
to
an
operator.
We
want
to
add
project
coders.
That's
super
super
important
project
as
you're
upgrading
hardware,
it's
important
to
make
sure
that
users
stone
create
so
many
images
that
they
flood
your
disk
or
basically
run
out
of
hand.
B
So
it
is
important
to
be
able
to
add
others,
either
limit
the
number
of
repositories
in
a
project
or
limited
based
on
space
to
gigabytes,
5
gigabytes.
So
we'll
give
you
that
ability
now
to
control
how
many
resources
a
single
project
will
have,
more
importantly,
on
top
of
being
able
to
control
resources
is
also
being
able
to
control
the
retention
policy
of
those
images,
so
can
add,
features
like
time
to
leave
and
things
like
how
many
repository,
how
many
tags
do
you
wanna
keep
on
a
single
repository?
B
Possibly
do
a
few
things
around
metadata
management,
everything
from
searching
to
being
able
to
categorize
your
images
better
and
able
to
find
them
through
metadata
queries
and
labels
login
endpoints.
So
today
we
don't
have
a
sink
resource,
so
you
can
push
all
the
logs
from
hardware
and
key
things
like
elk
or
log
inside
or
Splunk
we're
going
to
deliver
that
and
open
basically
create
them
out
of
shipcompliant
logging
on
point
with
all
the
right
data
in
it.
B
So
that
you
can
ingest
all
the
logs
coming
from
harbor
and
to
data
intelligence
or
in
analytics
or
anything
else,
that's
important
to
your
organization.
Well,
obviously,
gonna
continue
investing
in
preference
scale
as
more
and
more
users
are
using
harbor.
We
want
to
make
sure
that
we
scale
in
terms
of
the
number
of
projects
available
in
harbor
the
number
of
images
in
a
project
as
well
as
the
number
of
concurrent
pulls
and
pushes,
and
then
things
of
that
nature
on
the
extensibility
front.
B
Web
hooks
was
something
that
we
wanted
to
deliver
with
one
to
date
being
at
a
community
driven
project
and
open
source,
different
priorities,
kind
of
came
into
play
and
we
were
not
able
to
deliver
that
work.
But
we're
working
on
web
hooks
right
now
and
we
plan
to
deliver
that
with
our
next
release.
1.9,
the
concept
of
an
interrogation
service
is
something
that's
near
and
dear
to
my
heart.
B
Today
we
do
a
lot
of
great
things
with
flair
and
vulnerability
scanning,
but
we
want
to
expand
on
that
concept
and
create
a
more
generic
interrogation
service
that
will
have
a
pluggable
architecture
with
interfaces
that
you
can
have.
Anyone
come
in
and
implement
so,
if
you're,
an
organization
that
wants
to
do
license,
verification,
for
example,
you
can
come
in
and
implement
a
plug
into
the
interrogation
service
and
do
license
checks
against
your
images.
B
Last
but
not
least,
is
harbor.
Today
does
a
very
good
job
with
container
images
and
home
charts.
We
want
to
become
a
repository
beyond
image
of
home
charts,
so
we
want
to
support
things
like
kubernetes
operators,
so
we
can
become
the
repository
for
operators
who
also
want
to
become
the
repository
for
things
like
Sina,
bundles
and
stuff,
as
that's
picking
up
steam
within
the
community.
B
You
so
I
have
a
question
here:
can
I
share?
What
features
would
be
in
the
next
harbour
version
1.9
and
when
our
goal
is
to
ship
1.9
late
this
summer,
I
think
of
late,
August,
2019
or
early
September.
Very
specifically,
in
that
release,
I
can
commit
that
we
will
have
the
project
coders
and
the
retention
will
have
the
log
in
endpoint.
We
have
perfect
scale.
Improvements
and
webhook
is
on
the
balance,
so
very
likely.
We
will
deliver
a
first
version
over
the
weapon
support.
B
Maybe
not
every
action
will
have
a
workbook
available,
but
it
would
be
a
minimal
Viable
Product
and
we
will
expand
on
that
as
we
show
here
as
actually
go
on
subsequent
releases.
So
that's
what
we
can
commit
to
but
we're
working
on,
and
if
we
have
the
ability
and
the
resources
to
add
more
features
in
1.9,
we
will
do
that
swap
you.
B
All
right
next
slide,
so
the
Harper
community
is
driving.
We
kind
of
mentioned
that
we've
reached
eight
thousand
stars
on
github
literally
a
couple
of
months
ago,
who
had
just
passed.
Seven
thousand
stars,
so
you
know
we
graduated
to
an
incubating
project
and
since
EF
in
November
2018
and
ever
since
then
our
popularity
and
the
impact
of
Harvard
in
the
community
has
skyrocketed.
We
have
300,
plus
community
members,
80
plus
contributing
organizations,
and
we
have
20
plus
product
implementations
work.
Different
products
are
either
incorporating
using
or
recommending
harbor
within
their
solutions.
B
If
you
look
at
the
community
growth,
the
red
line
is
one
who
donated
Harvard
to
CN.
Cf
VMware
was
the
original
creator
of
harbor,
and
you
can
see
that
were
this
upward
trajectory
of
contributions
and
usage
and
kind
of
the
last
slide
here
is.
How
do
you
reach
us?
You
can
always
get
started
to
go
Harbor
the
diode.
We
also
have
mailing
lists
in
the
list
of
CNC.
After
diode
we
are
on
the
CNC
of
slack
channel
under
hardware
and
hardware
dev.
You
can
tweet
with
us
under
project
underscore
Harbor.
B
We
do
have
record
every
single
one
of
our
community
meetings
that
happen
every
two
weeks
in
two
time
zones,
one
that's
friendly
to
Asia,
Pacific
and
European
time
zones,
which
is
our
than
19
p.m.
UTC
+
8,
and
we
have
a
United
States
friendly
time,
which
is
at
1
p.m.
Pacific
time
zone.
If
you
want
to
get
started
and
try
out
harbor,
you
can
always
go
to
demo
Togo
Harbor
today,
all
if
you
can
create
an
account
there.
B
B
So
we
want
to
basically
make
sure
that
if
you
are
creating
operators
that
basically
that
you
want
to
deploy
the
kubernetes
and
you
want
to
package
them
and
put
them
into
harbor
so
that
you
can
take
advantage
of
things
like
our
bug
version
control,
authentication,
you'll
be
able
to
do
that.
We
want
automatically
deploy.
Them
will
just
become
a
horse
to
matter.
B
B
Close
the
slides
here
and
move
on
to
our
demo,
if
there's
any
other
question
right
now,
I'll
answer
it
otherwise
Allah
or
go
straight
into
the
demo,
okay
cool.
So
what
you're
looking
here
is
the
same
website
I
mentioned
earlier
demo:
dot
Co
Harbor
today,
oh
so
you
can
come
in
here.
You
can
create
your
own
account
and
start
playing
with
Hubble.
Be
aware
that
this
environment
gets
refreshed
every
few
days.
We
can
play
this
Harbor,
so
happy
ICD
process.
That
does
that.
B
So
what
you're
looking
here
is
the
user
interface
of
Harper
when
I
logged
in
I
get
to
see
here.
My
different
projects,
I
know
that
I
have
a
few
private
and
public
projects
and
have
a
few
repositories
under
management.
I
get
to
see
some
of
my
storage
specific
events
here,
there's
an
event
have
that
shows
me
different
actions.
I
have
taken
lately
into
harbor
and
I
get
to
see
all
the
different
projects
that
I
have
here
in
harbor.
B
So
let's
go
through
a
few
different
user
interface
screen
here
for
harbor
and
I'll:
explain
what
they
do.
We
have
our
users
here
and
be
aware
that
the
integration
scheme
for
this
specific
installation
of
Harper
is
set
to
database.
So
Harper
is
managing
the
user
store
in
this
case.
So
you
have
a
lot
of
users
that
have
created
their
own
accounts
here
and
you
can
set
any
one
of
them
as
an
administrator.
If
you
want
to
elevate
the
permissions
and
user
or
you
can
do,
actions
like
reset
the
password
sporty.
B
Registries
have
created
connectivity
of
this
instance
of
hardboard
with
other
register
instances
more
specifically,
I've
created
a
connectivity
to
another
hardware
instance
that
deployed
on
AWS
and
I've
also
created
connectivity
into
the
public
docker
hub
registry
as
well,
so
both
of
them
are
healthy,
I've,
given
them
the
privileges
that
I
had
in
both
of
these
instances.
So
if
I
hit
edit
here,
I
get
to
see
its
hub
calm,
it's
like
provided
my
Access
ID
and
my
secrets
and
I
can
test
the
connection
and
see
that
the
connection
is
successful.
B
So
I
can
validate
the
language
able
to
connect
this
instant
of
our
board
into
other
team
of
this
as
chaining
of
registries
across
the
board,
and
now
that
I've
configured
the
connection
to
different
registries.
I
can
also
create
replications.
Think
of
this
as
a
rule
that
defines
a
policy
or
when
to
replicate
certain
assets
from
one
hardware
instance
to
another
entity
where
that's
another
Hardware
installation,
docker
hub
or
one
way
cloud
or
or
docker
registry.
B
So
in
this
case,
the
first
one
is
replicated
to
half
so
I've
actually
defined
that
so
go
to
HR
team
project
find
all
the
images
that
are
tagged
with
production
and
replicate
them
to
docker
hub,
and
my
second
policy
says:
go
to
HR
team
and
find
the
head
tracks,
image
and
populated
to
my
sincere
face
project
in
another,
for
instance.
So
it's
a
couple
of
different
policies
that
I
have
set
up
so
I
can
show
you
guys
how
all
this
is
working.
B
So,
let's
go
and
look
at
one
of
the
projects
that
I've
created
here
and
it's
called
HR
team.
That's
for
my
Human
Resources
team
within
my
organization.
So
I
have
a
couple
of
images
here:
I
have
my
Santos
base
image
ahead,
tracks,
image
and
a
sequel
image
for
the
health
facts
application
so
I
can
go
into
any
one
of
these
images
and
look
at
the
size.
B
Look
at
the
tag
that
it
has
I
couldn't
copy
the
pull
command
if
I
want
so
I
can
give
me
some
flexibility
and
ease
of
using
sort
of
running
that
within
my
file,
see
the
vulnerability,
analysis
and
I
see
here
that
this
image,
the
Santos
base
image,
has
four
packages.
We
have
our
abilities,
one
with
medium
and
141
pike,
adjusted
or
anything.
So,
if
I,
actually
deep
dive
into
the
image
here,
I
can
actually
see
that
CV
is
that
apply
to
this
high
and
medium
severity.
B
We
have
not
only
the
repositories,
but
we
have
hung
charts
and
you
can
upload
home
chores
directly
from
the
UI
or
you
can
upload
them
using
their
home
client
have
the
membership
to
my
account,
and
this
is
where
I
can
create
as
many
users
as
I
want
to
give
them
specific
privileges.
Within
my
projects,
our
country
project,
ID
means
developers,
guests
and
so
on
and
so
forth
of
labels
and
I've
created
one.
They
both
here
called
production
and
I'll,
show
you
how
I
applied
it
in
a
second.
B
B
That
means
that
only
images
that
were
signed
come
before
I
can
define
a
quality
of
run,
vulnerability,
saying
that
I
want
you
to
prevent
images
with
high
severity
vulnerabilities
from
being
deployed
and
I
can
also
set
a
policy
saying
any
Thomas
push
an
image,
quite
an
automatic
scan
it.
So
you
can
identify
vulnerabilities
at
that
point
in
time,
so
earlier
I
showed
you
this
label
that
allows
you
to
do
metadata
management.
Now,
I,
don't
I
hadn't
applied
it
here.
B
So
if
I
go
to
my
head,
fax,
equal
image,
I've
labeled
it
as
production,
so
now
you
can
come
in
and
add
specific
metadata
that
I
defined
on
a
project
basis
that
allow
you
to
do
management
of
your
images
repository
and
we're
gonna
do
more
and
more
things
with
metadata
management,
like
I
mentioned
earlier
in
future
releases
everything
from
being
able
to
search
being
able
to
apply
policies
based
on
metadata
management.
We're
gonna
see
a
lot
more
capabilities
built
on
top
of
this
metadata.
B
Now,
let's
go
ahead
and
try
something
and
I'm
gonna
go
ahead
and
try
to
pull
this
Santos
image
that
the
had
some
vulnerabilities,
so
I'm
gonna
go
here
to
my
trusty
shell
and
one
of
the
dr.
Poole
and
pulled
this
image
and
what
happened
there.
Harvard
did
not.
Let
me
pull.
It
told
me
that
the
severity
of
our
ability
of
the
image
is
high
is
equal
or
higher
than
the
threshold
in
the
project
setting
high.
So
now
Harvard
did
not.
Let
me
pull
this
image
and
for
good
reason.
B
So
let's
say
we
purge
this
image
now.
So,
if
I
do
it
docker
images
here,
I
will
notice
that
I
have
a
new
version
of
the
Santos
image.
2.1
that
I
run
earlier
and
I
actually
did
a
patching
on
that
image
so
that
I
make
sure
that
it
can
pass
the
vulnerability
scanning
of
harbor.
So,
let's
kind
of
push
it
into
cardboard,
so
I'm
going
to
look
up
docker
push
here,
I'm
gonna
push
this
new
image
and
look
at
another
error
here:
request
access
to
the
resource
is
denied.
That's
because
the
project
is
not
public.
B
So
now
I
have
to
login
before
I
can
push
my
image,
so
I
have
a
few
options
that
that
I
can
do
in
order
to
be
able
to
bypass
this.
The
first
option
is
I
could
make
my
repository
public,
which
I
could
do
that,
so
everybody
its
access
and
they
can
do
anything
and
everything.
The
second
option
is
I
can
do
a
doctor
lording.
As
my
account
here.
The
admin
account
be
able
to
push,
pull
or
third
option.
B
B
B
A
B
I'm
gonna
log
in
as
admin
just
because
it's
simpler
right
now
for
me,
but
I
could
have
used
a
robot
account
as
well
and
let's
go
ahead
and
push
the
image
again
and
look
at
this
now
that
I've
logged
in
about
20
Gilligan's,
Harbor
I
was
able
to
push
my
image.
Let's
go
back
to
our
projects,
go
to
the
HR
team
and
the
CentOS
image
now
has
two
tags
available
to
it:
2.1,
which
we
just
pushed
and
look
at
that
there's
zero
vulnerabilities.
B
So
if
I
actually
go
into
the
tag,
one
of
the
things
I'll
say
and
if
I
look
at
my
build
history,
I
did
a
yum
update
and
young.
You
know
so
that
make
sure
that
all
the
latest
packages
were
deployed
into
my
image
and
it
resulted
with
zero
vulnerabilities
in
hard
work.
So
now,
let's
try
again
that
pool
commander
diamond
that
I
did
earlier.
So
let's
do
a
docker
pool.
1.0
will
fail
again,
as
expected.
B
2.1
should
be
able
to
pull
it.
Just
fine,
so
I
was
able
to
pull
it.
Obviously
this,
since
this
image
is
already
available
locally,
then
I
got
the
notification
that
the
image
is
already
up
to
date
and
on
sending
questions
here
so
I
will
I
will
keep
going
here
now.
I
pull
this
image
now
hardboard.
It's
gonna
keep
some
statistics
for
me
and
if
I
come
here,
I
will
notice
here
that
my
CentOS
based
image
had
some
polls,
so
there
were
two
pools
here
available
for
the
project.
So
if
I
do
another
poll
here.
B
The
full
count
will
increase
as
well
so
now
you're,
seeing
some
specific
statistics.
If
you
have
an
image
that,
for
example,
became
vulnerable
of
a
second
and
you
want
to
make
sure
to
know.
Did
anybody
pull
this
image?
What
is
it
out
there?
You
can
at
least
know
if
you
was
in
the
future,
who
plan
to
do
some
more
advanced
things
around
finding
out
what
your
images
poured
and
maybe
do
some
cool
things
with
kubernetes
and
some
of
we
but
stay
tuned
for
that.
B
There's
no
time
to
leave
for
the
robot
account
talking,
but
we
plan
to
add
some
more
specific
exploration.
So
exploration
here
is
one
month,
but
we
want
to
add
more
more
explicit
exploration
where
you
could
actually
set
the
time
to
leave.
So
you
cannot
set
it
today,
but
in
the
future
we'll
be
able
to
do
that
for
you
and
you
could
always
disable
that
account
delete
it.
B
Excellent
yeah
there
I
think
that
it's
very
important
when
you're
in
an
organization
where
you
have
some
strict
security
requirements
to
be
able
to
make
sure
that
you
can
set
the
time
to
leave
or
for
some
of
these
accounts
all
right.
Let's
go
ahead
and
show
some
of
the
replication
stuff
going
on
here.
So
if
I
go
to
docker
hub
here
and
have
two
depositories,
one
of
them
is
called
Mitch
my
headlights
and
that's
the
one
I'm
replicating
from
hardboard.
There's
no
tags
right
now
in
there.
B
And
I'm
gonna
just
one
of
my
existing
images,
just
because
that's
simple
and
easy
and
I'm
going
to
do
something
small,
so
dr.
Clyde
and
one
below
it
image.
And
if
you
remember
one
of
the
things
that
I
didn't
hear
was
ice
created
that
application
robust
says,
look
for
a
tag
called
fraud
and
go
ahead
and
execute
actions.
It
that's
what
scared
him
to
a
doctor
push
and
push
output
production
image
into
harbor.
So
if
you
go
back
into
Harbor
and
we
refresh
our
repositories,
the
head
tracks,
image
has
a
new
image
called
prod.
B
It
is
clear,
there's
no
vulnerabilities
in
it
and
let's
see
if
this
was
already
pushed
into
docker
hub
and
there
it
is
who
have
a
Prada
match.
That
was
just
pushed
a
few
seconds
ago
and
that's
the
tag.
So
now
you
saw
the
replication
in
action.
Not
only
did
I
get
an
image
from
cardboard,
I
pushed
it.
B
B
What
other
authentication
systems
harbor
support,
so
support?
Elda
we
support
YDC
today,
I
know
also
support.
Our
own
building
database
education
system
is
what
were
harbor
controls,
the
entire
authentication
authorization,
as
well
as
user
store
in
the
future.
We
can
add
more
if
something
is
like
that
is
important
to
you
guys.
B
All
right,
so
my
second
replication
was
to
another
instance
of
hardboard
some
elect.
Let
me
go
look
in
there.
So
in
this
case
this
instance
of
harbor
was
configured
using
an
OID
C
provider,
so
I
can
go
ahead
and
log
in
using
the
Google
or
ITC
account
already
set
up.
So
in
this
case,
I
picked
up.
One
of
my
Google
accounts
here
and
I
can
come
in,
and
here
have
another
instance
of
hardboard
that's
deployed
on
AWS
and
again
I
see
the
same
familiar
interface.
Telling
me
all
the
projects
I
have
storage
is
being
used.
B
There's
another
cool
thing
here,
because
I
logged
in
using
OID
see
if
I'm,
using
any
tools
like
docker,
client
or
even
the
home
client.
They
don't
know
how
to
do
the
Federation
Vance.
All
the
authentication
does
so
the
Confederate
my
identity,
using
my
PC,
so
I
can't
really
sign
me
for
any
of
those
clients.
So
what
are
my
options?
I
can
either
use
a
robot
account.
That's
a
generic
known
user
based
account
on
a
project
basis
to
push
and
pull
my
images,
but
that's
not
user
specific.
B
That's
not
great
I
want
to
be
able
to
use
my
identity
that
I
had
logged
in
right
now
to
be
able
to
do
push
and
pull
based
on
the
access
I
have
into
individual
projects.
So
in
this
case,
if
I
click
on
my
name
here
and
look
at
my
user
profile,
we
added
a
new
feature
for
CLI
secrets.
Think
of
this
as
a
username
and
a
password
that
I
can
use
to
authenticate
my
account
to
harbor
using
clients
like
docker
client
and
to
blend
in
kubernetes
and
the
helm
client
as
well.
B
B
B
Again
same
familiar
interface
is
I've
been
having
earlier
and
in
this
specific
project.
I
haven't
deployed
mouth
on
charts
than
my
original
project,
so
maybe
this
location
does
use
from
a
lot.
Some
I
harbor,
half
child
I
have
mariadb
MongoDB
and
Ready's.
I
can
click
on
any
one
of
the
some
charts
and
get
details,
including
information
that
the
author
of
the
home
child
has
decided
to
publish
in
the
image
itself
and
another
question:
where
can
we
find
documentation
for
oh
I
EDC?
B
You
can
find
information
in
the
go
hard
border
dial
you
can
under
under
that
website.
There's
a
dark
section
and
this
you'll
be
able
to
look
at
everything
from
installation
and
configuration.
So
look
at
the
docs,
our
user
documents.
Well,
the
user
guide,
configuring,
HTTPS
harbor
upgrade
and
all
of
these
other
details
that,
but
you
will
need
kind
of
show
you
here
what
the
configuration
looks
like.
So,
if
I
click
on
config
under
authentication,
the
front
ocation
mod
is
quite
deceived.
B
All
right,
that's
the
the
presentation.
I
cannot
show
you
guys.
Container
images
should
be
home.
Chars
I
show
you
how
to
replicate
them,
how
to
do
more
ability
scanning
how
to
hack
yourself
from
enabling
your
developers
to
pull
vulnerable
images
within
your
enterprise
and
will
show
you
how
to
interact
with
harbor,
both
in
a
user
based
interaction
or
using
robot
accounts.
If
you
are
in
a
CI
CD
scenario,.
B
B
Specific
details
to
share,
but
we
will
we
can
look
into
this
and
push
out
a
comment
in
our
user
community
if
you
like,
Robert
you
come
in
and
and
have
a
discussion
on
that
with
us.
I
feel
free
to
join
our
CNCs
slack
I'll
have
a
question
about
signing
images.
Yes,
so
today
we
can
use
not
Tori,
so
you
can
sign
your
image,
just
I'll.
Think
of
this
as
it's
fairly
simple.
So
when
you
beep
right
before
you
pull
the
image,
you
can
run
a
command
like
enable
docker
content,
trust
equals
1.
B
You
just
specify
the
server
for
the
content
class
in
this
case
will
be
demo'd,
we'll
go
Harvard
but
I
all
and
then
once
you
tiger
image
and
push
it
into
harbor,
then
that
image
will
be
signed
and
available
with
a
physical
signature,
and
then
you
can
enforce
the
policy
of
not
being
able
to
pull
an
unsigned
image
from
harbor.
So
actually,
when
you
sign
an
image,
come
over
here,
click
on
any
of
these
projects.
B
Our
question
from
Steven:
what
are
the
advantages
of
deploying
to
kubernetes
versus
docker
and
most
customers
deploy
by
a
doctor
now
I
think
it's
a
it's
a
it's
a
mix
of
customers.
Some
of
our
customers
are
in
a
branch
office
and
don't
have
their
either
the
resources
or
the
operational
capability
to
run
a
full-blown
Orchestrator
platform
like
binaries.
So
in
those
cases
they
choose
to
deploy
Hardball
in
human
in
Dockery
itself
and
that
works
very
well
for
them.
And
then
we
have
the
users
that
really
are
kubernetes
focused.
B
In
those
cases,
the
deployed
dog
deployed
deployed
hardware
in
kubernetes.
Actually,
the
only
way
you
can
get
high
availability
of
harbour,
where
you
can
deploy
a
harbour
in
as
a
highly
available
component
with
failover
the
ability
for
a
node
to
go
down
without
an
impact
to
your
whole
ship
full
of
your
images,
in
that
case
unity,
kubernetes
and
our
help
you,
yes,
you
AAA
authentication
is
available
as
well.
B
How
would
you
compare
hardwood
and
respect
to
Nexus
or
j-rock
registries
from
features
perspective
and
what?
Rather,
if
we,
if
we
were
to
have
the
discussion,
who
can
have
it?
Probably
it
internally
on
on
on
slag
Hubble,
is
fairly
competitive
from
the
features
to
a
lot
of
the
registers
out
there
from
way
to
artifactory
Nexus.
B
There
are
obviously
certain
features
that
they
have,
that
we
don't
have
features
that
we
have
they
don't
or
on
a
detailed
comparison.
We
don't
have
something
like
that
in
the
overseas
community,
but
different
members
of
our
community
have
done
analysis
and
they
have
they
have
in
their
in
their
mind
and
in
their
thoughts,
different
things
that
you
want
to
be
able
to
kind
of
advance
our
vision.
B
So,
if
you're
interested
more
around
that
come
and
find
us
on
slag,
one
thing,
I
was
saying:
there's
a
specific
feature,
you're
looking
for
that
will
enable
your
organization
to
run
Harbor
within
it
successfully.
Do
let
us
know-
and
we'll
do
our
best
to
deliver
that,
for
you,
we
kind
of
were
very
community
and
customer
focus.
So
we
listened
to
our
users
and
things
that
they're
telling
us
about
features
that
they
want.
We
do
deliver
them
in
subsequent
releases.
B
B
Any
other
questions
or
concerns
anything
else
you
guys
would
like
to
see
Harper
is
kind
of
since
you
guys
know
asking
questions
I'll
keep
talking.
It,
however,
is
really
really
simple.
It's
fast,
it's
agile!
We
do
welcome
you
guys
to
give
it
a
shot,
and
you
know
if
any
of
you
guys
are
interested
in
adding
new
features,
come
and
join
our
community.
B
We
actually
had
a
few
of
the
features
that
came
out
of
hard
work
I'm
directly
from
users
that
started
using
harbor
found
a
lot
of
use
cases
for
it
and
said
you
know
what
I'll
go
in
and
contribute
to
the
open
source
community
and
make
this
better
about
Adger
with
harbor
with
kubernetes
Neil.
Can
you
elaborate
a
little
bit
on
what
that
means?
You
can't
deploy
harbor
in
a
cooperate,
medicine,
environment,
imager.
B
You
can
also
deploy
harbor
in
virtual
machines
in
either,
so
both
of
those
options
are
available
in
terms
of
replicating
harbor
images
to
of
your
registry.
That's
something
I
was
looking
into
as
part
of
our
replication
work.
Hope,
I
answer
your
question.
I
tried
to
capture
all
the
bases
there
for
vulnerability.
We
use
the
clear
database
to
have
multiple
content
servers
that
we
hit.
You
get
all
the
different
vulnerabilities
and
get
them
into
clear
and
do
the
static
analysis,
but
Claire
is
what
we're
using.
B
B
Is
their
ability
to
limit
access
to
repositories
within
projects
for
guests?
No,
it's
it's
easier
for
you
to
create
two
different
projects.
If
you
want
to
limit
that
capability,
one
way
that
I've
seen
that
get
created
is
that
they
have
an
application
of
one
project
to
another
and
then
then,
basically,
they
limit
access
to
the
second,
because
it
only
to
certain
users-
and
they
replicate
only
a
few
of
the
assets
into
that.
B
So
you
can
either
create
two
projects
in
a
single
hub,
for
instance,
or
use
two
hardboard
instances
and
replicate
the
project
from
one
to
the
other,
and
that's
how
you
can
limit
access.
But
our
access
control
list
is
on
a
per
project
basis,
so
you
don't
have
the
ability
to
limit.
So
once
you
create
your
membership
here,
this
is
it
lives
on
a
project
basis.
B
Obviously
tells
you
one
of
the
things
that
we
have:
we've
also
updated
our
player
database
on
a
frequent
schedule,
so
you
can
see
when
the
Claire
database
was
last
updated.
In
addition
to
seeing
when
the
last
scan
completed
on
your
image,
you
can
also
do
a
scan
on
demand.
So
if
I
click
on
an
image,
I
can
go
ahead
and
stand
it
at
that
same
period
of
time.
We
tagged
the
image
to
leave
it
at
labels
or
copy
the
digest.
B
So
what
you
can
do
today
is
declared
a
that
so
harbor
when
you
install
it
means
to
have
an
open,
pipe
or
an
internet
connection
to
be
able
to
connect
the
Internet
and
download
the
data
basin
or
for
vulnerability
scanning,
but
we
also
have
an
article
on
our
documentation.
That
shows
you
how
you
can
offline
update
layer.
If
you
need
to
save
you
in
on
aircraft
environment,
where
internet
access
is
not
available,
then
we
have
a
series
of
steps
that
allow
you
to
update
Claire
offline
in
that
air
gap
environment.
B
And
kind
of
to
do
a
follow
up
on
that,
so
I
actually
do
have
hardware
installed
on
this
computer
here
as
lost
at
the
docker
PS
I
got
to
see
the
different
images
here,
and
these
are
all
the
images
that
hardware
is
comprised
of.
So
these
are
the
different
author
images,
so
have
our
nginx
photon
image,
who
have
a
port
or
the
job
service
or
the
database
ready,
is
that
mr.
server
and
the
lab?
B
So
if
I
installed,
Claire
and
Nottoli,
you
can
see
additional
docker
images
here
for
those
as
well
so
I
remember
when
I
kind
of
showed
you
guys.
The
architecture
of
heart
will
show
these
different
components.
Each
of
those
components
almost
represents
a
docker
container
that
we
deploy
as
part
of
our
installation
of
harbor.
A
B
I'm,
sorry
and
so
yeah,
one
more
so
we'll
have
some
prune
functionality
from
the
UI.
That's
a
feature
that
that's
coming
up.
I
mentioned
earlier
project
coders
pain
time
to
leave.
That's
something
that
we
will
make
available
to
you,
so
you'll
be
able
to
control
both
the
size.
The
number
of
images
and
number
of
days
images
are
available
in
your
hardware,
installation
to
make
it
fit
your
compliance
needs
or
regulatory
needs
within
your
enterprise.
B
B
B
B
All
right,
I
think
we're
at
the
top
of
the
hour,
don't
see
any
other
questions
answer
the
last
one.
Thank
you
all
for
attending
really
appreciate
you
guys
spending
time
with
us
on
on
harbor.
Hopefully,
you
learned
a
little
bit
and
that
kind
of
a
tricks
if
you
go
and
download
Harper
and
try
it
yourself
join
our
community
come
in
either
contribute
as
a
user
of
hardboard
as
a
developer
of
harbor
or
even
help
us
write
documentation.