►
From YouTube: Harbor - Steven Zou & Wenkai Yin, VMware
Description
Join us for Kubernetes Forums Seoul, Sydney, Bengaluru and Delhi - learn more at kubecon.io
Don't miss KubeCon + CloudNativeCon 2020 events in Amsterdam March 30 - April 2, Shanghai July 28-30 and Boston November 17-20! Learn more at kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects
Harbor is an open source trusted cloud-native registry project that stores, signs, and scans content. It has been widely used by organizations large and small around the world to resolve both the container image and Helm Chart management challenges. In this session, we will cover some advanced features of using Harbor, such as OIDC support, improved content replication among Harbor and other non-Harbor registries, content management in a cloud environment, unified management of Helm Chart and container images, highly-available deployments and DevOps supporting etc.. Additionally, we'd like to share some Harbor community-related things like the governance model and contributing guide the Harbor community following with you in case you want to deeply participate in the regular contributing and/or maintaining activities of Harbor community in future. Furthermore, the team would love to get feedback from users and contributors to current features and future roadmap.
https://sched.co/Nrqn
B
B
B
A
A
A
B
A
A
A
Basically,
we
support
a
lot
of
commands
command
lines,
but
the
iteration
is
not
as
fast
as
itself
fundamental
for
operation.
Maybe
I
should
talk
about
security
first,
because
this
is
more
critical
in
the
enterprise
level
application.
This
is
quite
important
and
we
do
provide
a
lot
of
security
features,
for
example
the
vulnerability
scanning.
B
A
B
A
You
provide
a
summary
SME
list
and
also
we
have
the
content,
trust
and
an
artery
no
drink,
so
they
don't
get
sure
the
reliability
of
the
image
and
also
we
can
use
project
to
do
a
high
level
save
separation.
Also,
we
have
the
distribution
policy.
So
when
you
disagree
image
you
can
have
the
safety
strategy.
A
For
example,
you
can
just
distribute
the
content,
trust
enabled
and
the
ones
without
the
enable-
and
they
will
be
banned
and
also
for
the
vulnerability
of
only
the
low
vulnerability
will
be
distributed,
the
medium
ones
and
the
high
ones
the
vulnerability
will
be
stopped
and
also
we
have
the
our
back
the
access
control.
We
can
use
different
roles
to
manage
and
also
we
can
entrust
them
with
different
abilities
and
also
we
have
the
full.
A
We
have
the
access,
log
and
record
and
therefore
operation.
We
have
the
strong
feature
of
content
replication,
so
in
the
hub
hover,
we
can
put
it
into
another
harbor
and
in
the
1.8
release
from
Hubbard
to
other
than
our
harbor.
We
support
the
image
replication.
Also,
it's
two-way
from
local
to
the
for
end
and
also
we
can
go
the
other
way
around
and
also
we
have
the
GC.
So
we
have
some
of
the
dumb
the
dirty
detail.
We
can
use
online
GC
rather
than
use
a
very
complex
solution.
Also,
we
have
the
health
check.
B
A
That
we
can
get
the
health
status
of
the
hover
and
it
will
be
fed
back
to
you.
Then
you
can
integrate
with
the
platform.
The
other
important
thing
is
the
SDC
or
the
robot
account.
So
you
don't
need
to
use
the
root
account.
You
can
just
create
a
robot
account
on
the
stairs
to
see
and
then
for
the
deployment.
We
have
two
ways:
Ducker
environment.
This
is
online.
A
A
We
are
improving
it,
then.
The
typical
scenario
for
Hubbard
actually
for
harbor
when
will
it
be
used
so
I
will
introduce
to
you
some
of
the
typical
cases
here
and
when
you
submit
the
code,
you
would
trigger
the
CI.
Actually,
the
CI.
We
have
different
steps,
for
example,
dev,
QA
or
staging.
There
are
a
lot
of
trees,
but
when
the
build
is
out,
you
can
replicate
it
to
conduct
the
test.
A
B
A
Can
use
this
on
premise,
no
to
replicate
it
to
the
fitting
knows
registry
in
different
regions,
so
in
different
region,
the
run
when
we
install
it
in
one
time
when
we
setup
and
one
time
we
can
just
use
the
closest
one
so
that
we
can
save
the
traffic
save
the
cross
node
traffic.
This
is
a
very
typical
case,
so
on
the
left,
that
is
the
development
stage.
A
A
So
let
me
introduce
you,
so
this
is
pure
technology.
Now
we
have
different
areas:
for
example
consumer
we
have
different
clients
that
we
support
and
all
the
red
slashes
are
ourselves.
For
example,
we
provide
very
strong
web
page
based
management
capability
and
when
you
enter
the
core
the
front
of
your
service
wheezing
and
then
just
do
conduct
a
PR
routing.
Now
we
have
the
REST
API
that
is
just
about
it
by
Big,
O
and
also
we
have
the
authentication
and
authorization
module.
A
We
can
correct
or
connect
with
a
or
D
or
C,
and
we
have
the
core
configuration
management
in
the
past,
the
administer
to
cover
the
user
setting
and
so
on.
But
now,
in
one
point,
a
would
remove
that
now
the
configuration
management
is
in
the
cornea
and
therefore
namespace
project
management
is
here
and
also
replication,
charge,
service
scanner
and
trust
handle
all
of
the
integration.
Stuff
will
be
done
here
in
the
core.
A
This
chart,
service
scanner
and
trust
handler
will
have
an
underground
framework.
So
we
have
some
third-party
services,
for
example,
dr.
registry,
the
native
dentistry,
to
provide
the
storage
and
also
chart
museum
to
your
storage
chart
and
then
Claire
just
to
scan
notary
for
signature.
And
we
know
that
notary
is
and
also
other
things
are
one
of
the
projects
and
then
for
job
service
will
provide
the
asynchronous
execution
and
we
have
the
job
queue
and
also
the
GC
controller
thing
for
the
online
GC
and
also
we
have
logs.
Okay,
put
it
into
the.
A
Compatible
system
log
systems
and
also
we
have
the
bottom
layer
we
can
use
the
cache
and
also
we
can
use
the
local
and
remote
storage
to
use
it
for
the
block
file
on
objects,
and
so
they
ask
about
database,
so
that
is
the
overall.
So
let's
welcome
a
maintainer
maintainer
Kai
to
talk
about
the
1.8
feature
and
one
point
now
new
features.
A
A
One
point:
eight
point:
one:
we
fixed
some
of
the
existing
or
known
bugs
and
you
can
try
the
new
one
and
here
is
the
new
feature,
for
example
the
replication
it
can
be
used
in
different
registry
or
repository
to
synchronize
the
image
before
one
point:
eight
we
supported
already,
but
we
reshaped
this
function
and
in
code
85%
is
rewritten
and
the
feature
is
improved
in
three
ways.
First
in
the
past
would
just
support
the
synchronous
image.
A
Now
we
used,
we
support,
chart
the
synchronous
image
or
a
synchronous
chart
or
two
things
at
the
same
time,
and
the
third
thing
is
that
we
support
what
in
the
past.
We
only
allow,
however,
instances
to
be
synchronized,
but
now
we
support
the
synchronization
between
harbor
and
non
harbor
repository,
and
now
we
realize
three
drivers,
docker
hub
doctorate
registry
and
the
third
one
is
the
hallway
registry
for
Doppler
registry.
It's
fully
compatible.
A
Well,
it's
a
kind
of
implementation
of
dr
michio
api.
So
if
there's
a
repository
that
used
this
api,
they
can
use
this
driver
to
replicate
and
later
we
will
deliver.
Some
new
driver
implementations,
for
example,
the
ser
or
GCR
or
ACR,
and
also
the
early
registry
with
the
implementation
of
different
registry,
will
use
a
very
flexible
and
scalable
structure
and
if
you
have
to
need
for
other
drivers,
you
can
use
our
portal
and
the
method
is
very
easy
to
merge
that
into
the
framework
and
we
can
synchronize
for
different
instances.
A
This.
The
other
thing
is
OID
see
for
a
lot
of
companies.
They
have
their
own
authentication
system.
We
support
the
hover
or
adapt.
Now
we
added
the
OID
C
provider
integrations
and
authentications
and
we
support
we
obey
the
open
IDs
back.
So
if
the
provider
use
this
kind
of
spec,
then
it
can
seamlessly
integrate
with
harbor.
Then
during
use
the
administrator,
when
he
installs
pabre,
you
can
choose
the
can
choose
or
ADC,
then
on
the
web
UI.
They
can
realize
the
SSL.
B
We
provide
crl
secret
to
help
these
clients
integrate
with
a
IDC
and
internally
harbor
will
process
Ciara's
secret
and
its
relationship
with
a
token
for
verified
providers.
Euro
see
Google
identity,
Dax
and
a
pink
a
federated,
which
is
our
of
which
is
verify
power
and
the
user,
and
we
will
increase
more
providers
in
the
future.
For
example,
he
cloak
and
there
are
other
new
features.
Some
have
already
been
mentioned.
First,
this
Robert
account
user
can
set
up
Robert
account
and
empower
it
with
different
poor
push
Authority
so
as
to
better
integrate
with
the
CIC.
B
The
second
is
a
house
check
to
provide
uniform
API
to
check
the
status
of
the
harbor
system,
and
the
third
is
we
refactor
deployment
of
scripts
and
key
value
is
replaced
by
young
format,
which
can
describe
a
structure
data
in
a
better
way.
We
removed
misura
a
mid
server
and
put
it
in
the
core,
and
we
also
integrated
API,
Explorer
or
harbor
portal.
You
can
use
a
I
to
call
harbor
API
or
use
a
harbor
API.
B
Our
plan
is
1.9
will
be
as
say
in
early
August.
It
will
have.
The
four
main
features.
First
is
quota
per
project
many
times
we
have
the
needs.
That
is,
we
want
to
restrict
the
number
of
images
or
chart
under
one
project
version.
1.9
will
provide
you
metrics
one.
Is
the
image
or
chart
number?
For
example,
this
project
has
the
quota
for
a
thousand
images?
B
B
This
is
a
very
important
feature
for
integrating
with
the
CIC
dewetting
Harbor.
There
will
be
a
lot
of
events,
poor
pushy
delayed
image
or
chart
scanning
images
and
scanning
results.
Whether
image
has
a
loopholes
and
replication
information
through
webhook,
we
can
notify
harbor
other
systems
integrated
with
harbor
so
as
to
connect
all
workflows.
Third
is
retention
policy.
B
When
a
haba
integrated
with
the
CIC
everyday,
they
will
generate
a
lot
of
images,
and
a
lot
of
images
will
not
be
used
in
the
future,
but
they
tie
up
a
lot
of
storage
resources.
So
we
are
thinking.
Is
there
an
automatic
way
to
remove
unused
images?
A
retention
policy
is
a
feature
for
this:
user
can
define
policy
to
retain
images
they
want
to
use,
for
example,
they
want
to
retain
the
image
is
pushed
within
one
month,
so
unqualified
images
will
be
removed
and
the
last
feature
is
CVE.
Whitelist
steven
has
mentioned
about
that.
B
A
B
A
B
Mentor
wise
is
a
carbonate
operator
notice,
news
operator
to
deploy
harbor,
because
operator
is
popular
right
now,
so
we
consider
use
providing
Thuban
ease
operator.
Next
is
a
quota
for
project
in
the
future,
we're
going
to
provide
complete
cottham
mechanism
or
we've
talked
about
storage
or
charge
number
or
image
number,
but
in
the
future,
we're
going
to
provide
more
complex
matrix
next
is
advanced
access
control.
Currently
we
are
using
op-amp
to
do
access
control
in
the
future.
We'll
have
advanced
access,
control
based
on
ABC
or
resources,
to
realize
precise
control
and
locking
endpoint.
B
Our
silikal
will
is
simple.
We
will
use
to
configure
mechanism
to
lock
it
in
places
where
you
serve
on
and
then
is
scalability,
and
we
were
to
graphic
verification,
testing,
to
identify
vulnerabilities
and
to
improve
it
and
then
ensure
scalability
as
to
accessibility.
Yha
I
will
use
Harper.
You
know
that
Harbor
chart
support
actually
a
deployment,
but
there's
a
limitation
that
is
before
you
use
it.
B
You
need
to
prepare
an
alien's
in
a
future
we're
going
to
provide
a
total
package,
a
complete,
simple
edge,
a
solution
to
help
you
set
up
a
father,
and
then
our
security
service
will
be
further
enhanced.
One
direction
is
currently
it's
a
scanning
based
on
cloud
in
the
market.
There
will
be
fancy
scanner
engines
in
the
future,
we're
going
to
provide
pluggable
scanner
to
help
you
integrate
or
connect
different
scanners
to
provide
scanning
service.
There.
B
B
Larger-Scale
runtime
distribution,
it
will
put
pressure
register
through
p2p
distribution.
To
some
extent
we
can
reduce
workload
at
a
registry
and
improve
distribution
efficiency,
especially
it
is
especially
applies
for
larger
scale,
so
we
have
done
some
groundwork
and
the
p2p
distribution
mechanism
will
be
completed
by
the
entire
community
and
then
repository
beyond
image
and
home.
Currently,
we
support
image
repository
and
charge
repository
in
the
future,
we're
going
to
provide
more
cognitive,
uniform
mechanism
under
the
same
user
experience
you
can
manage
different
cloud
native
contents
in
the
future,
we're
going
to
have
cognitive,
artifacts
and
registry.
B
A
B
A
A
A
B
A
B
A
B
A
B
A
B
A
B
A
B
B
B
A
A
B
A
B
A
B
B
Webhook
deliver
is
also
the
joint
results.
Are
several
companies
and
I'll
see,
include
repetition
and
also
p2p
distribution?
This
require
a
larger
worker
group.
You
may
be
interested
in
p2p
distribution
and
a
lot
of
colleagues
have
joined
this
project
and
they
are
more
ways
to
get
involved.
If
you
have
any
queries
or
questions
or
if
you
have
new
requirements
or
if
you
have
ideas
about
new
features,
if
you
want
to
discuss,
please
are
maintained,
as
you
are
more
than
welcome
to
do
so.
B
You
can
use
mailing
lists
slack
or
Twitter
to
talk
to
us
and
we
encourage
you.
If
you
have
the
ideas,
if
you
have
content
or
you
have,
if
you
have
the
good
experiences
or
ideas
to
share
with
us,
to
follow
our
community
meetings
and
in
addition,
we
have
a
set
up
a
demo.
If
you
want
to
try
harbour,
you
can
go
to
a
demo
environment.
A
Okay,
I
just
want
to
ask,
because
our
company
also
has
the
team
using
Harvard.
Now
in
most
of
their
environment,
the
version
is
1.6,
and
now
we
see
the
1.8
upgrade
and
also
for
the
repository,
a
synchronization
is
enhanced.
So
during
work
normally,
we
cannot
just
upgrade
everything
to
1.8.
So
when
we
upgrade
some
part
of
the
system,
can
it
be
compatible,
so
you
mean
the
replication
between
different
version
of
harbor
right.
A
certain
level
doesn't
have
problem,
but
we
cannot
guarantee
them
because
they
are
two
different
architectures
and
different
real
information.
A
Yeah.
We
followed
the
v2
portal,
so
technically
shouldn't
be
any
problems,
but
what
we
want
test?
Okay,
the
second
question
you
showed
us,
the
open
ID,
you
support
the
kick
lock
right,
so
is
it
in
1.9
order?
It's
not
any
1.9,
but
in
the
future,
will
all
support
that.
So
for
already
see,
we
follow
the
this
back
of
an
ID
spec.
So
if
the
provider
followed
the
spec
on
some
level,
it's
the
same,
it
should
connect,
but
we
didn't
verify.
A
So
we
hope
that,
if
you
put,
if
you
use
different
providers,
maybe
you
can
try
to
configure.
According
to
us,
and
it
may
be
able
to
communicate,
and
then
we
can
put
that
on
our
supported
list.
Sometimes
we
need
to
do
verification
to
know
that
if
it's
not
standard
open,
IDE
spec,
then
we
don't
support
it.
So
maybe
we
can
verify
and
then
communicate
with
the
community
yeah
the
P
cetera
to
the
user
in
the
community,
verify
that
and
then
they
list
it
in
the
community
yeah,
because
that
is
also
another
very
famous
management
platform.
A
A
So
there
is
no
suggested
approach,
because
the
scales
deferred,
if
you
can
use
the
project
to
reach
the
scale
and
it's
easy
to
manage.
Then
it's
fine,
but
if
your
team
is
very
big,
maybe
setting
up
a
independent,
our
harbor
instance
that
will
be
best
practice.
But
if
you
use
different
projects
and
you
can
reach
the
same
target,
then
it's
okay.
It
depends
on
your
own
scale
and
it
depends
on
your
own
demand.
A
B
A
B
A
A
Mean
it's
hard
to
answer.
There
is
no
plan
to
get
to
lose
weight,
but
we
have
that
roadmap,
but
of
course
you
can
have
your
own
build.
If
you
want
to
get
slimmer
because
it's
open
source,
you
can
refer
to
the
relevant
build,
you
can
build
it
to
a
more
lightweight
option.
Thank
you.
So
we
can
discuss
off
on.
Thank
you.