►
From YouTube: Deep Dive: Harbor - Enterprise Cloud-native Artifact Registry - Steven Zou & Daniel Jiang
Description
Join us for Kubernetes Forums Seoul, Sydney, Bengaluru and Delhi - learn more at kubecon.io
Don't miss KubeCon + CloudNativeCon 2020 events in Amsterdam March 30 - April 2, Shanghai July 28-30 and Boston November 17-20! Learn more at kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects
Deep Dive: Harbor - Enterprise Cloud-native Artifact Registry - Steven Zou, VMware & Daniel Jiang, VMware
Harbor is an open-source trusted cloud-native registry project that stores, signs, and scans content. It has been widely used by organizations large and small around the world to resolve both the container image and Helm Chart management challenges. In this session, we will cover some advanced features of using Harbor, such as OIDC support, improved content replication among Harbor and other non-Harbor registries, content management in a cloud environment, unified management of Helm Chart and container images, quota management, webhooks, tag retention, highly-available deployments and more. Our guest speaker and fellow Harbor maintainer, Daniel Pacak from Aqua Security, will show you how to utilize the pluggable scanning framework in Harbor to increase confidence in your compliance policies. Additionally, we'd like to share some Harbor community-related things like the governance model and contributing guide to encourage more participation in the Harbor community. Furthermore, the team would love to get feedback from users and contributors to current features and future roadmap.
https://sched.co/Uagp
A
Okay,
it's
time,
let's
get
started
hello.
Everyone
thank
you
for
coming
here
to
join
the
harbour
TB
test
session,
I'm
a
steam
until
stuff
engineer
from
amaura
a
harbour
commoner
in
today's
session,
we'd
like
to
talk
about
harbour
in
the
three
sections.
First
I'll
talk
about
some
key
features:
the
Witte
River,
the
in
the
a
posture
release
then
we'd
like
to
highlight
some
work.
We
are
doing
and
all
we
are
planning
to
do
in
this
section.
A
Now,
let's
say
what
a
key
feature:
the
harbor
bring
to
the
user.
The
in
the
recent
release,
the
first
one
at
the
ledge
to
measure
its
quota
management
quota
management
to
enhance
the
regular
registry
operation
capability
to
improve
the
efficiency
of
resource
allocation
assumption.
With
this
feature,
the
system
we
can
say
two
quarters
threshold
for
each
project
from
two
factors:
the
to
two
counts
of
the
artifacts,
including
boost
image
at
the
charts
and
the
storage
size
of
the
artifacts
for
the
storage
storage
size.
A
It's
true
sized
by
summing
the
Probus
test
and
the
monomer
site
together
when
most
an
highlight
here.
As
you
know,
the
ami
different
image
can
share
some
globus.
The
shared
probes
in
the
same
project
will
be
counted
on
us
when
the
quarter
is
site.
Was
the
quarter
reach
the
threshold?
The
follow-up
push
request
will
be
rejected.
Under
this
situation,
you
can
either
contact
your
demonstrator
to
request
more
quarter
or
delete
some
outdated
resources.
A
Ok,
the
next
one,
a
the
check
or
attrition
as
a
registry
Harbor
already
using
in
the
as
the
sed
pipelines
to
support
the
telework,
and
then
there
are
metope.
You
know
largest
gear
check,
the
generator
ability,
the
auto
TT,
the
weather
should
be
cleared
for
the
purpose
of
releasing
resource.
Tagger
attention
provides
an
you
know:
automatic
approach
of
clean
check
from
Harbor,
based
on
various
rules
for
the
project.
You
can
create
multiple
roles
for
each
of
the
jewel.
There
are
three
main
parts,
the
first
you
can
use
the
top
of
the
potatoes
to
pacify.
A
What's
a
repository,
the
rule
will
be
applied
to
in
then
cited
a
condition
in
several
ways.
First,
retain
oh,
it's.
That
means
you
can
reach
in
everything
all
based
on
the
pull
tab
into
different
of
from
it.
The
most
recent
report
number
artifacts
used
to
pacer
here.
This
is
for
me
to
focus
on
the
two
to
number
of
routine
artifacts.
For
example,
most
recently
put
it
here,
the
result
will
be
match.
A
A
Based
on
the
pushed
hammer,
it's
the
similar
case
to
the
put
have
used
the
push
time
as
a
criteria
to
calculate
the
reduce
and
the
last
AV
you
want
to.
You
can
use
the
check
a
filter
to
limit
the
Caddy
deter
scope
in
the
future.
We
also
introduced
to
the
label
future
to
harbor
your
limited
Acadia
scope.
Once
then,
I
want
to
measure
here.
A
The
tags
match
the
better
jewel
other
retain
the
West,
all
the
life
to
west,
all
the
other
left
West,
where
beautilities
that's
a
positive
approach
to
ways
for
you
to
start
the
retention
policy
wrong,
it
immediately
or
schedule
to
run
after
well
as
the
education
of
is
that
destroy
the
operation
that
the
lady,
the
resources
cannot
be
recovered.
So
we
strongly
recommend
you
try
wrong
before
doing
the
real
action
there
will
be.
A
A
Extensibility
harbor
can
plug
and
play
with
all
your
existing
investments
in
infrastructure
and
edit
e
and
the
container
security
replication
can
help.
You
transfer
your
account
into
a
Monti
for
the
red
street.
There
is
a
registry
adapter
interfaces
to
pack
for
ye
delay,
extending
harbor
to
support
the
replication
with
other
external
registries.
You
can
see
the
list
a
UNH,
we
support
talk,
harbour,
talkative,
tribution
and
away
clothes
registry
and
the
in
the
one
ton
and
most
of
the
public
registry
service
occurred
alike.
A
One
was
they
used
to
the
know.
Most
of
the
adapter
are
contributed
by
the
community.
The
next
808
is
the
integration
allows
harbor
to
leverage.
Oh,
a
TC
provider,
to
two
of
the
technician
for
Harper
technical
speaking
at
the
OIT
see
all
the
OIT
C
provided
follows
the
Ojeda
suspect.
Should
the
walk
aware
with
Harbor.
However,
we
steer
to
some
verification
work
to
mixture.
New
issues
are
there,
you
went
to
eight.
We
try
the
cocoa
at
edited
text
and
Ian
fette
rich
and
the
in
the
winter
time
we
tested.
A
Also
the
arrow
and
the
kick
look.
They
are
all
working
we're
with
Harbor
security
is
always
the
photo
Fox
for
users
to
care
about
you
1:10.
We
work
together
with
equal
security
and
the
anchor2
company
to
TfL
standard
their
scanners
back
to
light
harbor
integrator
other
scanner,
not
the
trust
declare
to
do
the
security
scanning
work
with
the
Flex
fog
Auto
betray
way.
For
this
part,
I
would
like
to
embed
our
cat
speaker,
harbor
maintainer,
tanio
practical
from
equals.
The
courtesy
to
talk
about
tomorrow
welcome
tenem.
B
Yep
thanks
so
what
I'd
like
to
say
so
I'm
working
as
an
open
source
software
engineer
at
maintainer,
and
we
spent
quite
some
time
to
make
the
scanners
available
for
you
in
1.10,
so
the
main
takeaway
from
this
slide
is,
you
know,
image
scanning
is
hard,
even
though
you
could
find
some
vulnerabilities
databases
and
there's
lots
of
Linux
distributions
and
every
day
there's
lots
of
new
vulnerabilities
found.
So
if
you
say
it's
easy,
I
would
tell
you
the
better
ways
to
spend
your
time.
B
B
You
could
also
reuse
existing
licenses
for
encore
or
you
could
you
know,
integrate
with
aqua
CSP
or
any
other
vulnerability
scanner
that
is
out
there
on
the
market
right.
In
order
to
do
that,
we
extended
the
architecture
of
harbor
API
and
we
introduced
like
abstraction
layer.
It's
called
a
scanner
adapter
API
right,
it's
very
simple,
like
three
endpoints
one
is
a
metadata.
This
is
where
you
advertise
that
the
scanner
vendor
has
to
implement
this,
this
endpoint
to
advertise.
What
are
the
capabilities
so
far?
B
We
do
support
docker
images
and
we
do
support
the
scan
report,
which
is
consumable
by
the
harbor
portal.
I
will
show
you
in
a
moment
how
it
looks
like.
Then
there
are
two
end
points.
One
is
a
scan
request.
This
is
a
synchronous,
so
hardboard
will
send
a
scan
request
to
the
so-called
scanner
adapter.
Then
the
scanner
adapter
is
caused.
The
you
know,
the
actual
scanner
and
hardware
then
is
polling
for
the
scan
report.
Once
we
do
that,
we
could
show
the
scan
report.
This
is
a
scanner
registration,
the
new
part
of
the
configuration.
B
So
as
an
administrator,
you
could
register
new
scanners.
The
Clair
will
be
still
there
to
stay
backward-compatible.
If
you
choose
the
option
to
deploy
hardball
with
Claire,
you
will
have
a
default
clear
scanner
adapter.
But
then
you
can
your
add
your
own.
As
you
can
see
here,
the
capabilities,
sections
and
produce
data
just
shows
that
that
you
could,
you
know
plug
in
into
the
harbor.
It's
also
open
for
extensibility
because
we
plan
to
add
maybe
more
scan
reports
different
formats,
but
so
far
we
take
it
easy.
We
will
just
show
the
operating
system
vulnerabilities
right.
B
So
when
you
do
scan
in
Hardware,
you
will
see
a
little
bit
refreshed,
histogram
owner
abilities
and
the
list
of
CV
is.
This
is
not
many
changes
here,
but
the
thing
is,
you
know
the
results
come
from
pluggable
scanners
right
and
just
to
outline
how
simple
it
is
and
how
simple
it
is
to
implement
your
own.
Well.
I
said
before
that:
don't
do
this
on
your
own,
but
for
security
companies
and
image
scanner-
vendors,
it's
pretty
easy
to
plug
in
so
we
encourage
everyone
to
try
out
and
plug
in.
B
So
we
have
a
better
and
more
secure
images
in
the
harbor
registry.
This
was
a
joint
effort
of
multiple
companies.
It
started
with
the
laser
eyes
she
filed
an
issue.
Then
it
was
picked
up
thanks
about
Stephen,
so
for
orchestrating
these
lots
of
patient
learning,
teaching
us
how
to
contribute
and
yeah.
That
was
amazing.
Also
on
core
team
and
HP
team.
They
worked
a
lot
on
PLC.
So
thank
you.
B
C
Hey
guys,
I
think
a
good
sign
of
the
growth
of
to
indicate
a
girl's
health
communities
that
we
have
more
and
more
people
having
the
same
name
so
I'm,
the
other
Daniel
and
I
can
call
myself
here
and
that's
my
Chinese
name
so
I'm
a
I
work
for
VMware
and
for
maintainer
of
power
before
Michael
shows
you
the
whole
world
map.
Let
me
zoom
into
one
item.
We
plan
for
the
future,
which
is
the
crown
native
artifact
crown
native
artifact
registry,
because
it
will
bring
some
fundamental
change
to
harbor
and
I.
C
So,
let's
look
at
some
background.
First,
this
is
the
much
simplified
diagram
for
harbor
in
the
early
versions.
When
we
initiated
the
product
we
wanted
to
manage
darker
images.
Only
we
built
it
around
the
open
source
distribution
registry
headed
the
API
for
managing
organizing
the
images
and
allow
user
to
assign
permission
to
other
user
to
access
them.
If
that's
what
and
we
proxy
the
request
to
the
registry
v2
API,
so
that
we
can
apply
policies
by
intercepting
the
request,
so,
for
example,
when
the
other
issue
stalker
pod
and
the
Interceptor
will
do
chance
to
like.
C
We
added
the
helm
party
to
intercept
the
request
from
helm
added
the
adapter
in
the
cope
has
to
make.
We
have
a
consistent
permission
model
and
similar
similar
management
workflow.
So
in
the
UI
I'm
under
a
product,
there
is
a
tab
of
charts,
so
you
can
view
the
list
of
ham
charts
in
the
admin
can
assign
permissions
for
user
to
help,
pull
and
push
from
harbor.
C
This
approach
works,
but
we
observe
some
issues.
First,
when
there's
another
third-party
compressor
party
component,
there's
a
extra
work
to
manage
it.
We
need
to
worry
about
configurations
they
lower
and,
of
course,
although
our
Museum
is
a
fantastic
software,
it
has
buffs
and
we
need
to
handle
that
too.
Additionally
API.
Why?
It's
because
the
charming
then
has
a
quite
different
style
for
api's
from
the
docker
registry
v2.
C
We
have
to
do
the
translation
in
the
API
and
transformation
in
the
data
structure
so
that
we
have
a
relatively
consistent
API
in
harbor
and
due
to
a
lack
of
good
abstraction,
and
we
handle
the
images
and
charts
separately
when
we
add
new
management
features,
we
find
ourselves
also
find
ourselves
in
the
moment
like
way.
This
works
for
image,
but
the
date
worked
for
chart,
sometimes
the
answers-
here's
some
handy
under
snow.
So
in
summary,
this
approach
doesn't
scale.
Well.
C
C
Fortunately,
earlier
this
year,
the
maintainer
of
char
museum,
Josh,
pinged
us
and
let
us
know
any
initiative
in
the
community.
The
idea
is
that
the
way
a
container
image
is
stored
is
essentially
a
manifest
with
a
bunch
of
pointers
to
the
plots.
This
was
designed
for
the
layer
file
system
for
the
docker
container
and
it
works
pretty
well,
but
at
the
same
time,
because
you
can
store
anything
in
the
blobs,
so
this
format
works
for
any
artifacts.
C
We
learned
it
also
from
the
blog
host
from
Steve
last,
in
which
he
points
out
that
you
know.
As
long
as
the
artifact
is
packet
in
the
OCI
image
format,
it
can
be
hosted
or
managed
in
an
image
registry,
and
meanwhile,
the
community
has
developed
a
tool
called
auras
with
that
user
can
package
and
push
anything
in
the
file
system
as
a
single
layer
now
see
our
image
and
push
it
to
the
registry.
This
is
also
been
used
as
a
library
in
Humvee
3.
So
now
you
can
push
a
ham
chart
to
registry
directly.
C
This
community
is
also
making
progress
to
define
the
scope
of
colonnade
of
artifacts
how
their
metadata
should
be
structured
in
literature.
We
have
some
communication
with
them
in
the
coop
comm
barthelona,
and
we
found
this
very
cool,
because
this
will
help
us
transform
harbor
from
this
to
this.
So
we
can
see
it's
much
more
simplified.
We
will
see
the
registry
as
a
single
storage
service.
This
will
be
less
components
to
a
managed
easier
for
deployment,
configuration
and
scaling
out,
and
we
can
have
an
abstraction
layer
for
different
artifact
types.
C
The
different
set
of
API
to
manage
images
and
charts
will
be
merged
into
one
set
of
ApS
for
artifacts,
so
the
compatibility
issue
along
existing
compatibility
usual
with
index
or
manifest
lists
in
docker
will
be
solved
by
this
change.
So
due
to
the
resource
model
change
in
the
API
on
the
UI,
the
charts
tab
will
be
removed.
It
will.
There
will
be
more
flexibility
so
that
different
artifacts
such
as
images
charts,
they
can
be
stored
and
managed
in
one
aggregated
view,
and
the
user
can
even
store.
C
Last
but
not
least,
we
also
see
this
as
an
opportunity
for
the
architecture
to
revolve,
because
there's
apt
one
abstraction
we
will
have
a
more
modulized
and
extensible
design
and
as
the
relationship
between
the
resource
and
metadata
are
greatly
simplified.
We
are
going
to
store
more
metadata
into
the
database
and
there
will
be
significant
improvement
in
performance,
especially
when
you
doing
pool
or
getting
the
tax
that
all
the
data
from
database.
C
So
it
will
be
much
much
faster
and
we've
been
discussing
it
for
a
while
and
there's
a
PRF
and
in
our
community
repo,
so
more
stuff
needs
to
be
added
soon.
The
please
have
a
look
stay
tuned
and
welcome
to
CH
I
mean
if
you
are
interested
in
this
part
that
our
intro
will
come
Michael
to
give
us
our
wheel
of
the
Roman.
D
Thank
You
Daniel,
so
you
know
the
this
OCI
register
and
the
ability
to
add
additional
artifacts
into
hardware
is
huge.
It
kind
of
enables
harbor
to
kind
of
transition
itself,
not
only
as
a
container
image
and
how
much
of
registry
by
the
cloud
native
registry,
so
everything
that
you
guys
need
to
host
and
build
your
cloud
native
apps
from
OPA
s,
to
operators
to
to
config
files.
Everything
that
you
need
will
actually
be
hosted
there.
D
So
that's
really
exciting
for
us
really
exciting
for
the
community
and
you
know
have
a
lot
of
people
that
are
looking
forward
to
that.
If
you
guys
are
really
passionate
about
that
coming
to
our
cig,
come
into
our
into
our
meetings
and
hubbas
kind
of
make
that
a
reality.
So
let's
take
a
look
at
the
harbor
roadmap
really
quickly.
D
So
so,
when
you
kind
of
think
about
harbor,
we
view
it
as
three
separate
stream
lanes.
We
view
it
as
a
stream
line
for
management,
one
for
image,
distribution
and
one
for
extensibility
and
Stephens.
Our
earlier
showed
you
that
extensibility
charge,
which
was
powerful.
We
allow
harbor
to
replicate
to
anything
and
everything
we
have
multiple
security
scanners
that
can
actually
enforce
your
compliance
needs
as
an
organization.
So
those
are
really
really
big
aspects,
the
harbor
enabled
and
then
the
YDC
part
enables
you
to
federate
your
identity
with
the
provider
that
makes
sense
for
your
organization.
D
So
all
of
those
that
extensibility
has
been
a
key
part
of
harbor
right
from
the
beginning.
We
view
harbor
as
a
tool
that
you
take
into
your
data
center.
You
install
it
and
you
plug
and
play
with
everything
that
you
have
in
there
so
kind
of
going
forward
in
that
extensibility
route.
The
OCI
work
that
daniel
mentioned
earlier
is
front
and
center.
D
That's
one
of
our
top
priorities
for
the
next
release
of
harbor
is
making
that
a
reality
then,
obviously,
when
I
may
continue
making
enhancements
into
web
hooks
web
hooks
is
what
allows
harbor
to
integrate
well
with
your
CI
CD
system,
with
configuration
management
databases,
as
well
as
with
other
workflows
for
service
approvals
or
anything
else
that
your
organization
needs
to
have.
So
today
we
have
a
lot
of
web
hooks
already
available
and
as
we're
adding
new
capabilities
into
harbor
you're
gonna
sing,
an
enhancement
in
twelve
books
as
well.
D
So
now
we're
also
adding
web
hooks
that
will
actually
drive
the
results
from
the
scanning
bugging
to
some
automated
fashion,
so
you
can
consume
them
in
any
way
that
you
want
and
then
obviously
the
pluggable
scanners
that
that
was
a
first
phase
of
our
interrogation
service
when
we
kind
of
started
going
down
the
path-
and
it
was
very
timely,
I'll
go
and
anchor
were
ready
to
talk
about
this
almost
at
the
same
time.
The
duo
were
also
ready
to
talk
about
this,
because
I
was
a
key
part
of
our
of
our
vision.
D
But
the
way
we
view
it
is
pluggable
scanners
is
phase
one.
Now
that
we
actually
have
an
interface,
we
want
to
actually
see
some
of
the
vendors
start.
Doing
additional
things
like
license,
checking
the
ability
to
figure
out
all
the
libraries
that
all
your
applications
are
using
and
catalog
them
and
put
them
in
a
configuration
management
database
or
the
ability
to
do
any
type
of
enforcement
that
any
corporation
wants.
The
API
is
open.
D
Anyone
can
write
against
it,
whether
you're,
a
company
or
a
vendor,
and
we're
gonna
look
to
some
of
our
partners
here,
like
aqua
and
Ankle,
to
enhance
that
their
capabilities
to
add
additional
features
here
now
on
the
image
distribution.
You
know
we
know
it,
you
know,
as
the
images
are
getting
larger
and
larger
and
as
the
number
of
developers
are
building
cloud
native
apps
is
getting
bigger.
We
have
customers
that
have
2
5,
10,
20,
terabytes
of
storage
and
harbor.
Imagine
every
time
you
are
the
new
data
center.
Every
time
you
add
an
edge
location.
D
How
hard
will
it
be
to
actually
push
a
certain
amount
or
certain
percentage
of
those
images
of
those
locations?
Harbor
application
hops
a
lot
but
you're
gonna
enhance
that
with
proxy
cache
capabilities,
as
well
as
p2
distribution,
starting
likely
with
Kraken
from
uber
and
dragonfly
from
Alibaba
as
the
first
two
technologies
that,
when
I
look
to
integrate
so
I'll,
make
it
easier
for
you
to
distribute
your
images
well,
as
at
the
edge
or
in
a
secondary
data
center
location
and
going
up
top
on
management.
D
None
of
this
happens
if
we
don't
make
it
easy
for
you
to
manage,
operate
harbor,
and
that
starts
from
observability.
That
starts
from
having
better
performance
and
better
scale
on
harbor
it.
It's
all
about
creating
you
know
things
like
metadata
management.
That
makes
it
easier
for
you
to
you
know
both
create
your
policies,
be
able
to
search
and
find
things
in
harbor
and,
more
importantly,
you
know
a
lot
of
you
guys
are
asking
us.
D
How
do
I
deploy
a
harbor
and
highly
available
function
today
we
have
a
home
chart,
but
that
ham
chart
only
deploys
the
harbor
pods
itself
doesn't
help
you
in
red.
This
doesn't
help
you
on
Postgres,
so
we
want
to
actually
continue
following
the
model
of
kubernetes
and
give
you
a
truly
highly
available
installation
of
hardware
using
an
operator
that
will
include
installing
not
only
harbor
but
all
of
our
dependent
components
as
well.
So,
for
example,
bitNami
has
a
ham
chart
for
for
Postgres.
D
So
the
signature
and
the
ability
to
sign
an
image
can
travel
with
the
image
as
it
gets
replicated
from
one
instance
of
hardboard
to
another.
So
these
are
some
of
the
investments
that
were
looking
into.
Obviously,
you
know
we're
not
gonna
do
all
of
those
in
the
next
six
months,
but
we're
prioritizing
them
starting
from
OCI
some
of
the
image
distribution
capabilities
and
we're
gonna
continue
working
on
them.
D
If
any
of
you
guys
are
using
hardware
in
our
community
repo,
we
have
an
issue
called
how
am
I
using
harbour,
go
ahead
and
come
and
give
us
your
testimonial.
If
you
have
requests
for
features
of
harbour,
go
file
a
ticket
because
other
people
will
pile
on
and
that
elevate
is
priority
in
our
minds
and
obviously,
if
you
feel
passionate
about
something
come
to
help
us
develop
it.
D
So
from
the
community
standpoint
you
know,
the
community
of
harbor
has
been
thriving.
We
have
almost
10,000
github
stars
over
200
contributors
are
contributing
to
harbor.
Some
of
them
are
even
doing
something
as
simple
as
creating
a
PR
or
fixing
a
documentation
issue
or
filing
filing
a
request.
So
you
can
get
involved
in
any
way
that
you
feel
comfortable.
D
We
have
maintained
errs
across
six
organizations
are
globally
located
daniel
is
our
latest
maintainer,
so
he
did
a
lot
of
great
work
in
our
integration
and
started
contributing
more
and
more
into
harbor,
and
now
he's
actually
the
technical
lead
in
one
of
our
featured
areas
around
security.
And
then
you
know
you
can
see
here
that
we
have
20
plus
product
implementations,
a
lot
of
contributing
organizations
as
well
as
community
members,
are
either
using
harbor
or
distributing
Hardware
themselves
and
the
levels
of
participation
like
I
mention
early.
D
You
can
start
from
the
bare
minimum
participate
in
our
user
groups,
come
into
our
community
meetings.
As
you
start
learning
more
about
the
harbour
and
you
can
get
more
familiar
with
it,
you
can
fix
a
simple
bug
and
then,
as
you
get
better
and
better
at
it,
we're
always
looking
for
more
maintenance,
more
more
folks
that
are
willing
to
take
ownership
of
of
Harbor
and
harbors
taken
to
to
to
new
levels.
D
All
right,
then,
Stephens
out
credit
is
really
snazzy
slide
about
collaborating
with
the
team.
So
you
know
we're
available
anywhere
and
everywhere.
So
you
can
find
out
some
slack.
You
can
find
us
on
Twitter.
We
have
to
zoom
meetings
to
accommodate
folks
in
different
time
zones
so
have
one
that's
very
specific
to
to
Asia
as
well
as
European
time
zones,
and
you
have
a
u.s.
friendly
time
zone
as
well.
D
So
if
you
want
to
come
and
talk
to
us,
we
meet
every
other
week
on
Wednesdays
and
we
have
also
a
mailing
list
on
the
CNC
F
list
that
you
can
come
and
post
your
issues.
If
you're
distributing
harbour,
we
also
have
a
distributors
list
that
they
get
advanced
a
notification
of
security
issues.
So
if
that's
something
that's
important
to
you
that
something
that
you
can
subscribe
as
well
and
then
their
mode
of
Go
harbor
that
I
always
a
hosted
offering
of
harbor,
it
gets
refreshed
every
couple
of
days.
D
All
right
so
before
I,
open
it
up
to
for
Q&A
I
want
to
mention
one
more
thing:
Harbor
is
up
for
graduation
within
CN
CF,
so
we're
actually
undergoing
an
active
graduation
review.
That's
that's
a
really
big
thing
for
us.
It's
a
testament
of
the
work
that
the
team
has
been
doing.
It's
a
testament
of
the
of
the
effort
and
the
contribution
of
our
users
in
terms
of
taking
Harbor
and
deploying
it
in
their
environment.
D
So
thank
you
all
if
you're
using
harbor,
if
you're
not
please
start
using
it,
and
then
you
know
when
it
comes
point
when
it
comes
to
the
point
where
the
scene
CFTC
committee
is
gonna,
start
voting
on
Harbor,
we
look
forward
to
a
lot
of
you
guys,
providing
your
non-binding
vote
of
confidence
on
top
of
Harbor.
So,
let's
open
it
up
for
some
Q&A.
Thank
you.
D
So
absolutely
so
today
we
basically
made
the
requirement
that
you
can
only
have
one
scanner
per
project:
well,
that's
clear,
which
is
the
building
scanner
or
encoder
acqua,
but
with
probably
maybe
not
the
media
next
release,
but
the
release.
After
that
we
look
for
adding
the
abilities,
so
you
can
pick
three
or
four
scanners
in
a
project.
So
one
of
the
things
I
mentioned
earlier,
like
you,
can
do
a
scanner
that
will
do
security
and
vulnerability
testing.
Another
scanner
them
I
do
license.
D
C
Under
the
hood,
there's
a
process
triggering
dollar
registry
to
call
it
GC,
and
yet
ye
I
assume
you
have
some
experience
with
that.
You
have
to
pull
the
registry
into
the
read-only
mode,
otherwise
early
problem
in
the
concurrent
situation.
So
because
we
have
that
foxy,
so
we
can
put
harbor
into
the
read-only
mode
and
check
when
there's
no
right
actions,
we
start
the
DC
and
after
it's
done,
we
collect
the
logs
and
show
it
on
the
UI.
But
this
is
not
quite
perfect.
C
I
know
that
when
there
is
a
large
data
that
time
can
be
long,
we
are,
you
know,
actively
exploring
the
possibility
that
we
can
have
a
more
fine-grain
lock
to
lock
like
the
layer
level.
So
when
you
are
removing
a
certain
digest
of
layers,
you
cannot
push
this
layers,
but
you
can
issue
right
to
other
layers
and
yeah.
This
investigation
is
just
started
yeah.
We
probably
will
provide
that
in
the
future
releases.
D
B
D
On
the
licensure
King
we're
going
to
be
working
with
some
of
our
pluggable
scanner
partners
to
basically
create
that
they,
some
of
them,
have
Enterprise
versions
of
their
free
OSS
stuff
that
we
talked
about
that
kind
of
go
deep
into
each
of
the
containers
grabbing
on
the
libraries.
Basically
doing
all
the
checks,
they're
versioning
them
and
you
very
likely
you'll
be
able
to
see
that
light
up
from
a
vendor
like
aqua,
security
or
Ankur.
That
will
give
you
that
visibility
into
license
enforcement.
A
D
When
we
actually
will
have
multiple
scanners,
who
who
haven't
really
nailed
it
yet,
but
very
likely
will
actually
each
scanner
will
provide
the
metadata
back.
That
basically
indicates
you
know
different
levels
of
severity.
Pass/Fail
plus
you
know
severity,
so
we're
gonna
add
some
policy
that
allows
you
to
describe
what's
acceptable
to
your
organization
from
each
of
these
scanners.
So,
for
example,
today
for
security
vulnerabilities
very
easy
right.
We
say
you
know,
there's
different
levels
of
severity
like
critical,
high,
medium
low,
and
you
say
anything,
that's
high.
You
cannot
deploy
that
container.
D
D
If
they're,
both
the
same
type
of
scanner
very
likely
will
allow
you
to
enforce
policy,
if
you
say
if
I
find
a
high
vulnerability
or
neither
of
the
two
scanners,
then
that
container
image
will
not
be
able
to
be
deployed.
So
if
it's
the
same
type
of
scanner,
your
policy
applies
right,
you
say:
hey
anything
with
higher
above
tone
deployed,
so
Claire
might
not
find
one,
but
awkward
trivia
will.
So
at
that
point
your
image
will
not
be
deployed.
D
Okay,
so
I
understood
the
question,
so
there's
three
layers
of
things
that
actually
we
doing
that
in
that
process
and
I'll
try
to
outline
them
all
three.
The
first
one
is
when
you
actually
upload
an
image
into
harbor.
You
can
configure
a
policy
that
will
be
scanned
on
upload.
So
that's
the
bare
minimum
right,
so
you
get
scanned
once.
D
The
second
thing
is
to
have
a
scheduled
policy
that
you
can
actually
indicate
you
can
have
harbor
scan
it
every
hour
every
day
of
the
six
hours
you
get
to
define
it,
and
you
tell
us
how
often
you
want
scanning
to
happen
on
a
per
project
basis,
and
the
third
thing
is,
you
may
have
already
deployed
that
image
and
then
scanning
comes
up
at
midnight
and
says:
oh
you
see,
we
came
up.
What
do
I
do
about
it,
then?
D
That's
where
the
power
of
of
security
tools
like
aqua
and
coral
and
others
comes
in,
where
they
have
admission
controllers
and
muted
in
workbooks
and
another
capability
to
kubernetes
itself.
To
understand
that
that
same
image,
that
you
found
a
vulnerability
you
already
have
deployed
and
they
can
help
you
enforce
compliance
within
the
kubernetes
cluster.
D
It's
something
that
I'm
thinking
about
it's
not
in
the
media
like
three
to
five
months
roadmap,
but
that,
as
you
know,
SOP
a
and
rego
and
those
you
see
more
and
more
users
use
that
for
enforcing.
Then
we
look
into
the
for
harbor
today.
A
lot
of
the
use
cases
are
all
around.
You
know
how
to
enforce
things
at
the
kubernetes
runtime
and
within
the
cluster.
C
Yeah,
actually,
a
few
months
ago,
I
talked
to
the
oppa
dice
and
there
seems
to
be
one
limitation
because
the
metal
that
met
her
language
that
they
used
to
write
a
agent.
They
cannot
grab
dynamic
data,
but
maybe
now
they
have
made
improvement.
But
in
that
heart
is
something
maybe
a
little
tricky
for
us
to
integrate
with
our,
because
they
can
only
read
from
I
think
they
tell
me
a
file
or
something
we
need
to
write
as
information
to
one
place
and
all
that
can
read
from
that
place,
and
that
is
a
little
tricky.
C
B
So
when
we
define
the
API,
we
said
we
don't
care
the
with
that
did
a
few
PLC
to
enable
you
as
a
hardware
users
to
use
like
whatever
is
available
on
the
market,
which
can
read
the
artifacts
from
the
registry.
Do
the
scanning
and
report
back
in
a
unified
format
so
now
depends
which
one
which
scanner
you
use?
Most
of
those
we
showed
right
now,
like
three
V,
for
example,
is,
is
doing
operate.
You
know,
OS
packages
scanning
and
application
dependence
is
scanning,
that's
it.
B
But
if
you
look
into
the
acquire
CSP
commercial
product,
it
does
more
checks
for
malware
and
stuff
like
that,
you
have
to
look
around
what
are
the
others
doing,
I'm
biased
by
the
company
logo,
but
you
could
find
others.
We
started
with
the
operating
system
packages,
but
it
can
be
extended.
The
API
is
ready
for
that.
D
And
I'm,
assuming
that
the
file
system,
layer,
you're,
really
looking
for
malware
or
binaries,
that
should
or
should
not
be
there
in
your
image
and
everything
else.
So
some
of
that
you
can
enforce
at
the
CIC
the
layer
again
using
security
tools
like
the
ones
that
daniel
mentioned.
But
if
you
also
wanna
enforce
it
at
the
image,
is
just
becoming
a
little
more
expensive
right,
but
definitely
possible,
and
I
think
we
have
time
for
one
more
question.
D
D
Okay,
so
the
only
way
you
can
deploy
cardboard
in
a
highly
available
scenario
today
is
using
the
home
chart
and
deploying
it
on
top
of
kubernetes.
So
essentially
you
everything
about
the
architecture
like
a
seed
in
four
layers
layer,
one
is
communities
itself,
your
your
hub
or
installation
all
the
different
services.
The
harbor
has
like
the
job
service,
the
API
service,
the
UI,
the
deploy
the
spots
in
kubernetes
with
a
service
abstraction,
so
there
that
basically
can
be
scaled
out.
D
Then
the
database
becomes
it's
a
highly
available
Postgres
database
that
you
can
deploy
in
the
same
kubernetes
cluster
outside
or
in
another
kubernetes
cluster.
Then
you
get
highly
available,
readies
cluster,
that
it
becomes
our
key
value
store
and
that
could
also
be
in
kubernetes
or
outside
then
for
storage.
This
is
what
we
actually
store:
the
files
like
the
docker
images
and
the
home
charts.
That
can
be
a
persistent
volume
that
can
be
replicated
and
made
highly
available
and
then
at
the
front.