Cloud Native Computing Foundation KubeCon + CloudNativeCon Europe 2020 - Virtual, 4 Sep 2020

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Deep Dive: Harbor - Enterprise Cloud Native Artifact Registry - Steven Zou & Daniel Jiang, VMware

Description

Don’t miss out! Join us at our upcoming events: EnvoyCon Virtual on October 15 and KubeCon + CloudNativeCon North America 2020 Virtual from November 17-20. Learn more at https://kubecon.io. The conferences feature presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.

Deep Dive: Harbor - Enterprise Cloud Native Artifact Registry - Steven Zou & Daniel Jiang, VMware

Harbor is an open-source trusted cloud-native registry project that stores, signs, and scans content. It has been widely used by organizations large and small around the world to resolve both the container image and Helm Chart management challenges. In this session, the speakers would like to talk more details about the evolution of making Harbor support managing kinds of cloud-native artifacts like Image, Helm Chart, CNAB and OPA bundle, etc. with simple and unified user experiences and promoting Harbor to be the best OCI compatible cloud-native artifact registry then. At the same time, they're going to share the future roadmap of Harbor project and community with the attendees, including but not limited to non-blocking online GC, Proxy cache, P2P distribution, and EDGE computing support, etc. Additionally, they'd like to update the current status of the Harbor community and encourage more participation in the Harbor community. Furthermore, the team would love to get feedback from users and contributors to current features and future roadmap.

https://sched.co/Zexh

A

uh Let's get started hello. Everyone uh welcome to the deep dev session of cncf host of project harbor, I'm steven zu harber maintainer. Currently I'm working at vmware beijing rd center as a staff soft software engineer today in this session I could speak with another harvard maintainer daniel daniel.

B

Hey guys, this is daniel. I work in the same team with steven.

A

Okay, we are so glad to have this chance to share with you some of the latest updates and the related development plan of both harbour project and the harbour community.

A

Before formally start, I'm so glad to share with you the excited and the great achievement for the whole harbour community. We harbor graduate harbor becomes the 11 one graduate project. Obviously this achievement belongs to the whole harbour. Community belongs to all of you. Harbor users, partners and contributors really appreciate.

A

Graduation is now to the end, but to to the new starting point, the hardware community will work harder and continue to push the project forward more quickly and harshly.

A

Here is today's agenda: it merely has the following parts: first, I'll quickly update the latest states of the harbour community. Next daniel will give you a review of the key features changes we delivered in the latest major release, 2.0 and highlighted the anchor features that would be released in the upcoming middle release. 2.1, including non-blocking gc and the proxy cache later I'll, take over and continue to introduce some other toolbox. One released like a p2p prohibit and extended the processor.

A

These features are lead by the community work groups. Finally, I would like to share with you some of the long-term planning data actions, that is, our map, we'll leave several minutes for q and a after the presentation.

A

Let's take a look at the latest status of the harbour community. One little tip for the data showing in this slide are from the devastated website powered by the cncf and the inside page of github.

A

It can be clearly seen from the data that hubble community is thriving overall data, showing on the left side to mid of july. We have gained 12, 000 and 300 stars at github. Now we have more than 200 kilometers about our maintenance group. There are 14 retainers across five com companies located at the four countries, more details uh shown onto the right side. They can give us more insight of the community liveness.

A

We have more than 50 contributing companies. We have three more than 3000 contribution contributors. We also have more than 4000 folks, more than 12 000 commits okay. In the past two weeks there are 60 000 views to the github repo from more than 11 thousand visitors, and the related package have been downloaded more than 5000 times in the past two weeks.

A

The bottom curve growth shows the fact that the project is actively maintained and we can get many commits every day from different contributors.

A

Okay, I'll head over the time to daniel to talk about what we delivered in the 2.0 and what uh we have anchor features in the upcoming 2.1. I know.

B

Okay, thanks steven um guys as for now uh the harbour v2.0 has been released for some time.

B

But let me take a couple of minutes to recap: the key changes we brought in this release in v200, uh we extended harvard scope from managing container images or com charts to all oci artifacts, including the charts packaged by hand v3 in oci format, oppa bundle, synap, etc, etc, and these artifacts will be stored in the single registry instance coexist in the ripples of harbor and restricted by the same permission, rules as long as they can be pushed and put by the distribution d2 api, and this allowed us to use the same code path and workflow to manage all types of artifacts such that the policies we introduced to make to um manage container images such as replication tag, retention, immutability, will still be applicable to the new artifacts as well as well, because we now see the abstract artifacts as the objects for management.

B

We managed to introduce an extensible approach to process the requests to push the artifact harbor to extract and display different attributes based on the type of the artifacts, and this is an extensible framework, and you see later in this presentation that, in the version 2.1, our partners in community will leverage this framework to enable hardware to manage the machine learning model they developed and in addition to that, with the new artifact model, we fix the historical issues that hubble cannot manage manifest this correctly now the manifest list or image indexes can be pushed to harbor and served or managed as a special artifact, which has reference to other artifacts.

B

Last but not least, we also made other enhancements in version 2.0, for example, maintainers from aqua security introduced the integration with new scanning to tv, and you can enable pls communication for internal components during installation etc. So, with that said, if you haven't upgraded to 2.0, please go check it out and give us feedback.

B

There are lots of cool stuff there. Okay, now after the recap, we'd like to introduce a few interesting new features that will be provided into that one.

B

First, the new garbage collector, as we know in the registry, the layers or blobs- are shared across images. So when an image is removed, the storage taken by the blobs can be free because they may be referenced by other images. Even if the reference count of the blob is zero in concurrent scenario, an image referencing this blob may be being pushed to the registry. At the same time, you do the division.

B

Therefore, currently we need to put hover in read-only mode and trigger the distributions gc command to delete the blobs and free the storage. But there's this one disadvantage of this approach.

B

The distribution needs to work through all the images to find out which blobs can be garbage collected and when the number of the image is huge or the backend storage is relatively slow. Power will stay in read-only for a long time. Sometimes it's too long to be acceptable.

B

So we want to see what we can do to mitigate the problem. Considering in 1.9, when we introduce the quota management to calculate the storage usage, we keep track for all the blobs and the relationship with artifacts and products.

B

With these data, we can figure out the reference count of labs with a relatively low cost, so you don't need to work through all images in the storage. Additionally, we have the database. We can take advantage of this strong consistency.

B

We introduce a mark and sweep strategy to avoid the problem in concurrent scenario and in the gc job handler it will access the storage data directly to remove the blob instead of relying on the distribution command. So dc can continue without having to put the whole registry into read-only mode, so you can do push or deletion.

B

While the gc is running additionally leveraging the information we have in the db, we can provide estimation to administrator about how much storage will be freed after the gc is completely completed, which should be very helpful for admins to decide whether or not to apply for new storage or run a gc to free storage, and this feature has been demoed and reviewed in our community meetings.

B

The code has been merged to master brand as I'm doing this recording, but hopefully, by the time you see this video. There is an rc4 to that one. For you to try next page, please.

B

Another feature I want to mention is the proxy cache we noticed there have been asks from many users who want to set hardware to mirror to a mirror images from docker hub such that hardware can act like a proxy and the user can pull images from docker hub in air gap environment.

B

uh We know you can set distribution to mirror mode and but there's a limitation that the mirror mode distribution is read only you cannot push images to it and we cannot simply bring up two instances. One is mirror and one is readable because once the uris clash, the images will override each of one another and we used to think with the pool mode. Replication search requirement can be addressed, but the experience was not good enough, because the reputation is a async job and not not until the job is successfully finished.

B

Can the image be available for pulling additionally there's no guarantee that the images are up to date, because when it's updated on the docker hub side, hover can be notified.

B

So in 2.1 we introduce actual attributes at project level, so you can associate a project with a registry endpoint used for replication when you issue pokemon to the uri from under this project, a middleware will trigger part of the replication code so that the images will be pulled from the remote registry and the content will be served to the client at the same time, it's written to the storage.

B

It's just like the t command and like the regular project, you can apply tag retention, code management policy to control the storage usage for the proxy images, and you can even trigger scan to find out the image proxy.

B

Whether do they have any vulnerabilities, because the process image are local, so we will use the code coding replication adapters under the hood. So, theoretically, we can proxy images from all registries that we can do replication. But due to limited time for testing in 2.1, you only can proxy images from docker hub and other harbor instances.

B

When we have a solid framework to test all the replication adapters will enable processing other type of registries such as ecr, gcr, etc.

B

I think this feature will not only benefit the air gap scenario, but also in the edge scenarios. When you only push image to the central registry, um you can usually put command to the ad registry and it can work as a on-demand or lazy replication and at the time of recording. This feature has also been enabled in master branch, and uh it is available in the dev build already. It will for sure be part of 2.1.

B

Okay, that's my part. Let me hand it back to steven for other cool stuff, and uh you know work group in working 2.1.

A

Okay sextonia for the wonderful introduction. uh Besides the two anchor the features, the non-blocking and the proxy cache introduced by daniel jordano. Here, I'd like to highlight another two features I introduced in the 201 release. The first one is p2p preheat. As we know, p2p can harbor to accelerate the content distribution process.

A

The sensor for project dragonfly and the uber oss project kraken both use p2p technology to support the efficient container image distribution process.

A

Preheat will provide a lightweight way for user to leverage the capability of the p2p engines like a dragonfly and the cracker to accelerate the image distribution process with preheat users can register the api enterprise of their p2p engines into harbor and then targeting the register. P2Png.

A

A policy can be created to specify what image are qualified and ready to distribute into the p2p network cache in advance. Caching, the image content into p2p network in advance can make sure all the data pieces required by the p2v network has been there and no need to download those first copy data. You know from the source registry. This can reduce the latency when pulling requests that happened in the p2p network.

A

Multiple filter filters and the criteria can be cited in the policy use repository filter to narrow down the image. Repository use tag, a filter to narrow down the text of the matched image repository mark only send the image to only a low image, with the signature to be preheated, set a vulnerability, server bar to make sure only the secure image are accessible, provide the labels to limit only image with the specified labels can be selected.

A

The policy can be enforced by a precise schedule, all based on the related events like on push on label under scan complete. The feature is designed and developed by the p2p work group members of rome, vmware allotter, decent netize, alibaba and uber great thanks to them.

A

The next one is extender, extended, artifact processor and we re introduced in the previous slide. Harper supports managing and distributing the artifacts that are following the ocs spec from 2.0.

A

Besides, the basic infra of the ocean, artifact harper also defend a metadata processor interface to extract more metadata from the configure or content blob of the ocean artifact and retain those extra data in the hardware api. However, currently harper only handles some of the well-known standard, artifact kinds like harm this recharge or synapse, by implementing specified metadata processors for the non-standard, that is, the user defender of the artifact, can and no relevant processor. Existing most of the metadata cannot be extracted out. This shortage makes harder.

A

Lack of extensibility in 2.1 will extended the default processor to identify the non-standard artifact case, not the harm risk charge, not synapse and the not oppa handle and extract the related kv metadata from the config blob and other content blob. That's marked with specified annotations and also retains those extracted. The data in the hardware api.

A

What adonis, annotation we can use and what do they represent, will be defined into a simple metadata spec for user. To refer. This feature is the lead by the time cyclone team. With this feature, users can build their own specified, artifact management and distribution platform on top of harbor, for example, like a feature contributor tech cloud to ocr, compatible machine learning, model management platform.

A

Okay, after talking about the features of 201, let's see more long-term appliances in our router map. The plan items are grouped into three perspective: management, distribution and extensibility. The items highlighted with white color are the ones we have already been working on in 2.1 like a non-blocking prox, cache, p2p user, defend artifact processor and one more vulnerability. Scanner from systig about a hardware operator of each cloud team has contributed the fourth version of hub operator, the version 0.5.

A

Now they are working on the release. 1.0. That includes lots of excellent improvements. It should be ready recently, based on the hub operator. The operator work group of harvard community has studied the work to build a hard cluster operator. The goal of the hyper cluster operator is deploying harbor with all its dependent service database, redis storage in hd mode. The first version of 0.05 should be ready before end of august before search on growing items.

A

We are also looking at windows containers, improved support for windows, container layers, observability expose harbor matrix through promotions integration, networking support ip version, 6 only network for hardware ports in a coordinated cluster; okay, a backup and restore leverage very little to offer application aware. Hardware, backup, including database kubernetes objects and persistence, volumes, identity and access management and are back will do some research on serv service accounts with proper airbag and the definitive access permissions improved. The multiple tenants rule ability to manage teams of users and robot accounts through workspace.

A

Okay, welcome to do collaboration with harvard community. We have several ways for you to involve in the community. You can join the slack sensaf workspace and defend us in the dash harbor channel. That's for user and the dash harbour tv channel for development. Also in the mail to us all follow harbor in twitter we have bi-weekly community zoom meetings to update the latest, assist of harbour project and the community or to preview demos of the new features welcome to join.

A

There are two term stores, one for asian, pacific plus european and one for americans plus european. You can find the meeting details in the rhythm of harvard project and github. Furthermore, we have deployed a demo environment for you to have a try, just access demo.gohar.io.

A

So that's all the content of this partition. It's a cure and a type any question we are here and listening to you. Thank you.