►
Description
Don’t miss out! Join us at our upcoming event: KubeCon + CloudNativeCon North America 2021 in Los Angeles, CA from October 12-15. Learn more at https://kubecon.io The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.
Harbor - Enterprise Cloud Native Artifact Registry - Daniel Jiang & Yan Wang, VMware
Harbor is a CNCF graduated project, which help enterprise distribute and manage cloud native artifacts. We’ll use this session to give audience an overview of this project and the community we built around it. We’ll talk about Harbor’s key features and use cases, the latest updates introduced in the most recent release. In addition to that, we’ll give a sneak peek about the development that is working in progress in this project. We’ll also use this session to discuss with the users regarding the challenges the project is facing and share our thoughts on how to tackle them.
A
Okay,
thank
you
now,
first,
because
we
only
have
one
maintainer
section
in
this
coupon
I'll
start
by
giving
an
introduction
to
this
product.
For
those
who
are
new
harbor
is
an
on-prem
cloud
native
registry.
We
started
the
project
by
adding
features
around
the
darker
distribution
to
provide
a
better
experience
for
managing
docker
images
and
later
with
the
growth
of
the
user
base,
more
management
features
were
added,
then
in
another,
in
a
major
upgrade.
A
A
Let's
take
a
look
at
the
key
features.
Harbour
provide
the
access
control
for
the
artifacts.
The
artifacts
are
isolated
within
projects
a
user
is
granted
the
permission
to
access
the
artifacts
by
being
added
as
members
to
a
project
project
is
also
a
unit
of
management.
Admin
can
assign
different
policies
to
products,
for
example,
there's
an
immutability
policy
to
prevent
artifacts
from
being
overridden
and
quota
policy
to
limit
the
storage
usage
of
a
product
and
the
retention
policy
which
can
help
you
remove
the
stale
artifacts.
So
you
don't
use
all
the
quota
too.
A
Fast,
however,
also
provides
powerful
features
to
help.
You
distribute
the
artifacts
across
different
registries
in
the
cloud
you
can
use
the
replication
to
transfer
artifacts
to
or
from
different
registries,
and
also
the
proxy
cache,
which
helps
you
configure
a
project
as
a
cache,
so
the
client
can
get
content
from
a
remote
registry.
Synchronously
security
has
also
I
mean
it
has
always
been
a
big
concern
for
enterprise
users
to
help
users
deal
with
that.
A
Hover
also
integrates
with
notary
to
support
image
signing
to
enhance
security
of
the
workload
admin
can
set
the
policies
in
harbor
to
prevent
image
with
you
know,
high
cve
scores
or
invalid
signature.
From
being
pulled
or
deployed,
last
but
not
least,
with
integration
with
id
managers
like
ldap
or
oidc
providers
and
mechanisms
like
web
hooks,
robot
accounts
harbor
can
work
smoothly
as
an
an
important
part
in
your
cicd
pipeline,
as
mentioned
before,
we
have
a
very
healthy
community.
A
Throughout
the
years
more
than
200
developers
working
for
more
than
50
companies
have
committed
code
to
the
repository
based
on
the
statistics
on
our
storage
service,
the
installer
of
harbor
has
been
downloaded
for
more
than
10
000
times,
which
is
a
really
big
number.
We
have
12
maintainers
coming
from
five
companies
and
geographically
distributed
in
different
countries.
A
I
feel
extremely
happy
seeing
people
with
different
backgrounds
actively
making
contributions
to
this
project.
Once
again,
I
want
to
say
thank
you
to
the
community.
You
guys
are
really
amazing.
Having
said
that,
I'm
going
to
pass
the
mic
to
yan,
to
give
us
a
recap
about
the
recent
version.
2.2
release.
B
Assets,
daniel
I'd
like
to
to
give
you
a
briefly
introduction
about
the
latest
major
release
of.
However,
that
is
the
2.2.
There
are
two
anchor
features
in
this
release:
system:
rubber
and
the
matrix.
The
system
level
rubber
is
targeted
to
manage
multiple
projects
with
one
robot
and
the
matrix
is
targeted
to
dispose
the
system
and
the
runtime
information
of
power
instance.
B
B
B
But
for
the
version
one
of
accounts,
it's
just
limited
in
into
one
single
project
and
the
second
one
is
the
permissions.
Besides,
double
helm,
trapper
push
and
rubber
version.
2
has
six
more
permissions
like
grid
and
dvd
type
scan
image,
and
so
on
and
system
admin
can
assign
any
combination
of
these
permissions
to
a
system
of
account
to
perform
your
desired
task
through
the
oci
client
or
the
hardware.
Api
next
is
the
id
in
the
rubber
version.
B
However,
in
the
rubber
version
2
is
that,
instead
of
the
gw
token
harbor
uses
the
secret
and
the
password
install
the
access
scope,
permission
based
expiration
date
into
the
database,
so
that
the
user
can
edit
them
in
your
eye.
This
is
totally
not
supported.
You
know
your
opportunity,
and
next
is
the
security
monitor
in
the
rubber
version
2,
you
can
refresh
a
weapons
secrets
after
it
created
in
the
event
that
you
need
a
new
one.
B
This
is
another
hot
topic
in
the
community.
A
user
wants
hardware
to
have
a
ve
to
define
the
rubber
prefix
harbor
uses
this
prefix
to
distinguish
user
account
from
a
web
account
from
the
user,
but
in
rubber
version.
One.
The
prefix
is
hard
coded
to
rubber
dollar
and
some
users
can
one
night
it
had
to
escape
the
dollar
character
in
their
automation
script.
So
in
version
2,
however,
opens
a
prefix
configuration.
B
For
the
matrix,
it
becomes
complexity
as
the
number
of
hardware
components
grow
and
with
that
also
grow,
the
need
to
monitor
this
service
around
the
park.
To
maintain
the
healthy
functionality
of
harvard
our
stability
is
a
key
feature
for
operating
a
service
in
production,
so
in
2.2
harbor
provides
a
wealthy
of
mattress
exposed
were
permissive
endpoints
and
the
opposibility
can
give
a
much
more
in-depth
view
of
what
your
hardware
is
doing.
You
can
either
gain
insight
into
system
performance
or
identify
anomalies
during
long
time.
B
B
As
you
can
see,
there
is
new
tag
named
the
web
accounts
and
let
me
create
a
you:
have
a
system
level
of
the
first
thing:
if
you
want
to
this
driver
to
only
cover
certain
projects
or
be
grounded
certain
permissions
use
the
project
table
to
select
projects
and
permissions
you
want
to
assign
to
the
system
level
account
here.
I
just
select,
which
I
want,
and
after
I
copy
the
secret,
I
will
do
a
docker
login
with
the
newly
created.
B
B
B
Yes,
the
last
case
is
to
create
attack.
I
wish
you
I
had
attacked
with
the
robot.
We
have
already
pushed
a
hello
world
in
project
one.
So
now
let
me
use
this
rubber
to
add
a
new
tag
made
dyno
for
the
hello
world
and
let
me
try
to
specify
the
secret
at
the
authentication,
router
and
then
post
the
http
test
and
that's
back
for
harbor
to
check
the
the
attacks
are
created
by
the
level
account
yeah.
B
Next,
I
will
show
the
secret
refresh
on
the
prefix
by
default,
hardware
will
generate
a
new
secret
randomly
or
you
can
choose
to
enable
manually,
resizing
the
secret
or
entering
the
music.
Here
I
just
specified
the
hardware
one
two,
three
four,
five,
as
the
new
sequel
of
this
of
this
level,
and
then
I
will
try
to
update
the
prefix
of
the
rubber
to
harbor.
Add.
B
And
one
last
minor
thing
is
about
the
legacy
robots
for
the
rubber
slots
created
before
2.2,
however,
will
add
a
lux
label
to
them?
You
can
still
use
them
as
normal,
but
to
without
any
new
functionality.
So
we
get
user
to
duplicate
this
bloxy
rubbers
and
use
the
rubber
version
one
for
this
time.
Okay,
that's!
This
is
the
dyno
for
rubber
and
let's
try
to
let's
jump
to
the
mattress
center
before
demo.
A
Next,
I'm
gonna
give
you
some
update
about
the
operator.
I
recall
we
gave
an
introduction
in
the
previous
coupon.
We
want
to
provide
a
relatively
simple
way
for
the
user
to
deploy
a
high
available
full
stack
cover
by
footstep,
I
mean
all
the
dependent
resources
like
certificates,
storage
services
database
can
be
deployed
with
one
kukkoto
command.
A
For
this
purpose,
we
wrap
the
minion
radius,
pd
circle
operators
and
the
resource
managed
by
these
operators,
along
with
the
harbor
cr,
will
be
owned
by
the
harbour
clusters
here.
So,
with
the
help
of
sir
manager
and
ingress
controller,
all
the
resources
can
be
managed
managed
via
the
harbor
cluster
cr
and,
of
course
it
has
the
flexibility
to
be
configured
to
use
existing
storage
services.
Also,
let
me
show
you
the
demo.
A
A
A
Which
will
be
managed
by
the
third
manager,
so
you
provide
dns,
name
and
surmender
will
generate
the
cert
and
in
the
stack
of
hardware
cluster
cr.
There
are
attributes
for
each
of
the
components,
including
database
and
internal
storage
services.
You
can
set
the
size
of
you,
know,
pv
or
the
repeat
class,
to
enable.
A
A
A
A
A
Yep,
so
at
the
time
the
session
is
recorded,
we
are
still
busy
ironing
out
the
box
and
bumping
up
versions.
Hopefully
by
the
time
you
see
this
session,
there's
a
release
candidate
for
the
hardware
operator,
and
we
are
also
working
with
community
user
to
add
more
custom
resources
for
day
two
operation,
which
will
be
included
in
the
future
release
of
the
operator
just
keep
an
eye
on
the
hardware
operator
ripple
for
the
latest
update.
A
Okay.
Now,
let's
go
to
the
version
2.3
previously
we
have
been
constantly
evolving
and
adding
new
features
to
harbor,
but
from
another
perspective,
as
users
have
been
using
harbor
for
a
relatively
long
time
and
as
user
data
such
as
artifacts
our
job
records
grow,
we
started
to
see
issues
in
performance,
stabilities,
etc.
A
We
want
to
invert
into
that.
We
want
to
refrain
from
adding
too
many
features,
really
step
back
and
deal
with
such
growing
pains
in
this
release
so
that
we
can,
you
know,
walk
longer
and
for
the
performance
we
have
teamed
up
with
the
community
users
to
set
up
a
performance
working
group.
We
are
working
together
to
provide
a
repeatable
way
to
continuously
measure
the
performance.
A
A
A
A
It
will
provide
their
separate,
build
and
verification
process
to
generate
the
package
of
hardware
for
different
environments,
and
each
of
them
will
provide
an
independent
release
cycle
such
that
they
will
not
block
each
other.
And
currently
there
are
different
groups
of
community
developers
working
on
arm
on
long-term
architectures.
Each
of
them
has
created
the
subripple
and
we
have
from
the
multi-arc
working
group
to
cover
the
work
in
this
area.
A
And,
of
course,
there
are
other
work
items
that
are
planned.
We
will
verify
hover
on
the
ipv6
environment,
provide
a
declarative
way
to
help
admin
configure
hardware
without
having
to
call
the
apis,
and
there
has
been
asked
for
this
for
quite
a
while.
I
have
to
say
it's
not
my
favorite
requirement
and
there
are
quite
a
few
corner
cases.
We
need
to
consider
that's
why
we
keep
holding
this.
A
A
You
will
be
able
to
monitor
the
jobs
and
the
number
of
drop
q
via
promise
use,
and
the
maintainers
in
scanning
group
are
working
out
a
design
to
extend
the
schema
of
scanning
reports
to
show
more
vulnerabilities
or
ice
bomb
information
in
addition
to
cves
yeah.
Hopefully
in
version
2.
there
will
be
a
very
concrete
design
and
you
know
for
future
implementation.
A
We
are
also
spending
substantial
effort
to
finish
the
api
refactor
to
make
sure
all
the
apis
are
generated
by
the
new
swagger
dock
and
paying
off
other
devs.
As
for
the
timeline,
2.3
will
be
released
on
june
july
time
frame
stay
tuned.
Okay,
that's
all
we
want
to
share
in
this
session.
If
you
want
to
know
more,
there
are
different
ways
to
be
part
of
the
community.
You
can
communicate
via
slack
mail
group
or
join
bi-weekly
community
meetings.
Where
you
see
you
know
more
information
and
latest
status
update.