►
From YouTube: Harbor - Enterprise Cloud Native Artifact... Alex Xu, Wang Yan, Steven Zou, Deng Qian & Ziming Zhang
Description
Don’t miss out! Join us at our next event: KubeCon + CloudNativeCon Europe 2022 in Valencia, Spain from May 17-20. Learn more at https://kubecon.io The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.
Harbor - Enterprise Cloud Native Artifact Registry - Alex Xu, Wang Yan, Steven Zou, Deng Qian & Ziming Zhang, VMware
Harbor is a CNCF graduated project, which help enterprises distribute and manage cloud native artifacts. We’ll use this session to give the audience an overview of the Harbor project and the community we built around it. We’ll talk about Harbor’s key features and use cases, and updates introduced in the most recent release. In addition to that, we’ll give a sneak peek into the development that is in progress. We’ll also use this session to discuss with the users regarding the challenges the project is facing and share our thoughts on how to tackle them.
A
Hi,
everyone
welcome
to
the
harper
maintainer
track
talk.
So
today
we
have
the
harper
maintainers.
Here
we
have
quite
a
few
more
than
our
usual
session,
one
of
the
benefits
of
a
virtual
session.
So
just
a
quick
round
of
introductions.
First,
my
name
is
alex
chu.
I
am
a
product
manager
at
vmware
in
the
modern
application
business
unit,
and
I've
worked
on
harvard
for
about
two
years
I'll
pass
over
to
you,
stephen.
B
A
A
You
can
sign
these
signatures
or
signed
images,
and
we
really
we've
been
around
for
you
know
a
couple
years
now
we
are
a
graduate
project
within
cncf
and
we're
just
you
know,
still
aiming
to
be
the
best
container
registry
for
the
cloud
native
world.
So
you
know
it's
an
open
source
project,
so
everything
is
on
github
if
you're
interested
in
the
things
that
are
being
worked
on
right
now
and
issues
discussions
designs,
things
like
that,
you
can
all
you
know
you
can
always
go
to
the
github
project.
A
Page
there's
also
go
harvard.io
website
that
has
you
know,
deployment
guides.
Installation
guides
lots
of
documentation,
so
you
know
start
with
the
website
or
start
with
the
the
github
issue
site,
and
if
you
have
any
questions
or
any
comments,
you
know
you'll
find
ways
to
reach
out
to
the
team
here
next
slide.
Please.
A
So
you
know,
harbor
is
a
container
registry
built
on
docker
distribution.
We
offer
a
lot
of
different
features
right,
and
so
here
are
some
of
the
key
categories
for
key
themes.
So
you
know
you
can
have
multi-tenancy
with
using
harvard
project.
As
a
union
of
tenancy,
you
can
have
a
role-based
access
control
with
various
roles
within
harbor
today
and
and
then
you
can
control
these
with
again.
You
can
control
these
with
authentication,
backhand
speed,
local
db
or
oidc
or
ldap.
A
You
can
hook
these
up
against
harper,
and
so
you
can
onboard
your
users
and
they're
automatically
permissioned
into
the
projects
based
on
how
they're
configured
on
the
oitc
or
ldap
identity
provider,
lots
of
policies
available
in
harvard
for
managing
your
artifacts,
so
you
can
set
quotas
on
different
projects.
You
can
set
retention
policies
would
control
how
long
the
projects
are
kept
in
the
project
before
they're
deleted.
You
can
lock
down
projects
and
repositories
using
immutability
policies,
so
that
images
are
not
accidentally
overwritten.
A
You
know
with
pushes
or
re-tags,
and
things
like
that,
you
know.
Artifact
distribution
is
referring
to
the
ability
to
move
these
artifacts
from
one
registry.
To
another,
be
it
you
know,
the
target
registry
could
be
another
heart
instance
or
some
third
party
registry
or
cloud
registry,
so
you
can
set
replication
policies
for
those.
You
can
act
as
a
proxy
for
another
third
party
registry
and
there's
a
big
theme
around
security
and
compliance
right.
So
we
allowed
signing
images
without
scanning
images
you
can
set
cv.
Allow
lists
next
slide.
Please.
A
A
A
So
you
know
this
is
like
a
road
map
or
preview
of
things
to
come,
either
in
the
next
release
coming
out
at
the
end
of
october
or
the
one
after
that.
So
a
couple
of
themes
here.
The
first
one
is
that
we've
added
open
telemetry
to
the
harbor
stack
for
distributed
tracing.
So
you
know
we
have
logging.
Today
we
have
telemetry
via
prometheus
that
you
can.
A
A
Components
so
it
can
help
with
identifying
bottlenecks
and
performance
issues.
So
you
know
we
have
logging
and
and
prometheus
from
telemetry,
but
tracing
is
really
sort
of
the
last
pillar
of
observability.
I
think
we
evaluated
several
options
in
zipkin,
jaeger,
open
senses
and
one
with
open
telemetry
in
the
end.
E
A
Just
as
sort
of
a
first
step-
and
you
know
we'll
talk
about
that
in
greater
detail
later
in
the
deck,
the
next
thing
is
we're
working
on
supporting
cosine
and
longhand.
We'll
talk
about
that
in
greater
detail.
Cosine
is
an
image
scanner
or
image
signing
software.
I'm
sorry,
and
it's
really
designed
for
the
multi-registry
world,
where
you
need
to
be
able
to
relocate
an
image
along
with
this
signature
from
one
registry
to
another
right.
So
you
need
that
relationship
between
the
parent
image
and
the
the
signature
to
persist.
A
As
you
move
these
about-
and
you
know,
the
the
basis
for
cosine
is-
is
that
the
is
the
signature
is
produced
as
a
special
oci
image
with
its
own
schema.
So
when
you
push
the
image
it
pushes
the
signature
as
well-
and
you
know,
however,
being
that
it's
a
compatible
registry
is
fully
capable
of
hosting
these
and
managing
these
as
well.
So
this
is
still
very
much
in
flight.
The
you
know
our
thinking
here
is
that
you
know
we're
very
seriously
considering
it,
but
we
don't
have
a
specific
release.
A
You
know
in
mind
for
for
for
supporting
cosign,
but
it
is
a
design
proposal
you
can.
You
can
find
in
the
community
repo,
if
you
have
any
experience
here
or
any
comments,
definitely
feel
free
to
add
comments
to
to
design
doc
and
or
reach
out
to
us-
and
you
can,
you
know,
come
to
the
community
meeting
and
hear
us
discuss
this,
and
the
last
thing
I
want
to
touch
on
is
that
there's
a
new
version
of
the
hardware
operator,
the
the
hardware
operator
1.1,
that
that
corresponds
to
hardware
version
2.3.
A
So
so
it's
it
is
101
with
a
particular
version
of
harper,
and
you
know
the
harbor
operator
has
has
been
worked
on
by
so
many
different
community
members.
Just
a
tremendous
effort.
This
really
started
as
a
partnership
with
ovh
cloud,
but
we've
seen
so
much
interest
from
other
little
community
members
needing
an
operator
deployment
of
harper
right.
So,
if
you're
not
familiar
with
what
the
operator
is
as
a
pattern,
you
can
start
with
taking
a
look
at
the
the
repository.
A
You
can
choose
to
do
everything
in
in
a
single
full
stack
deployment
right,
leveraging
all
the
different
things
that
are
already
packaged
in
the
release
that
we
put
out
or
you
can
you
can
externalize
components?
Maybe
you
have
you
know
a
database
or
a
redis
cache
running
as
a
service
in
your
private
cloud.
You
can
certainly
use
those
as
well,
so
the
the
1.1
is,
I
think
it's
a
lot
more
mature
than
the
1.0.
We
made
a
lot
of
improvements
to
the
the
crd
based
configuration
and
we
updated.
A
You
know
the
versions
of
the
underlying
operators
for
pe
sequel
and
redis
and
midnight
utilities
versions.
So
this
is
really
you
know.
We've
used
that
as
this
the
future
of
the
kubernetes
deployment
right
today,
I
think
most
people
are
still
using
helm,
but
the
operator
is,
I
think,
is
getting
more
traction
and
we
are,
you
know,
seriously,
putting
a
lot
of
effort
into
it.
So
the
helm
is
not
going
away.
D
As
you
can
see,
the
hubble
core
enable
the
well
tracing
every
http
request
and
it
also
can
trace
in
the
transaction
and
the
database
transaction
means
every
every
time
you
commit
a
transaction
with
a
database.
It
will
record
the
time
span
of
that
and
it
also
will
link
the
log
id
to
the
span.
If
you
find
some
span
is
slow
or
you
find
some
arrow
in
the
span,
you
can
finding
the
no
no
check
the
logo
with
the
id
and
the
job
service
well
trigger.
D
Also,
it
will
track
the
http
request
and
also
it
will
track
the
test
task
states
and
arrows,
because
when
we
run
in
the
job
service-
and
it
is
running
that
the
tasks
are
running
in
the
background
and
with
the
tracing
and
we
you
will
see
the
states
of
jobs
running
and
the
reason
control
will
are
also
tracing
the
http
requests
and
the
g6.
The
details
of
the
gsa's
gravity,
garbage
collection
and
the
the
way
supports
the
tracing
back.
D
That
the
training
background
was
about
two
characters
with
the
one
is
geiger
and
the
other
one
is
otlp
and
you
can
explore
the
data
to
tiger
directly.
I
think
geiger
is
a
very
popular
tracing
background
service
and
the
otlp
is
a
protocol
defined
by
open
technology
community
and
which
used
to
transfer
the
tracing
transfer,
the
telemetry
data,
which
includes
the
metrics
and
the
tracing,
and
with
this
protocol
you
can
expose
the
tracing
data
to
every
service.
That's
the
party
service
or
cloud
service
which
supports
the
otlp.
D
If,
if
they,
if
they
are
not
supported,
you
can
use
this
protector
to
export
the
data
to
open
animation
collector
and
this
this
component
is
also
provided
of
open,
nanometric
community
and
which
can
which
supports
almost
all
the
tracing
services,
and
I
think
this
is
a
tracing
in
the
next
release.
Thank
you.
F
B
Okay,
sex
yeah
will
continue
to
talk
about
something
really
to
the
harbor
community.
The
success
of
an
open
source
project
is
inseparable
from
the
support
of
a
heritage
and
stable
community.
Harbor
is
no
exception.
The
harbor
community
has
been
committed
to
building
an
open,
healthy
and
transparent
community
to
promote
the
development
of
harbour
project.
B
B
Next,
I'd
like
to
share
something
about
the
work
groups
that
are
driven
by
the
harvard
community,
what
group
is
a
virtual
team
focusing
on
a
specified
topic
and
delivers
features
related
to
the
topic
by
aggregating
efforts
across
all
the
interested
parties?
Till
now,
harvard
community
has
seven
work
groups
already
some
early
firm.
The
work
groups
have
already
delivered
many
key
features,
including
replication
from
the
replication
work
group,
p2p
distribution
from
the
p2po
group
and
the
plugable
scanner
by
the
scanning
or
group.
B
Recently,
four
new
workgroups
were
set
up.
The
multiple
architectural
group
focused
on
enabling
hardware
to
support
multiple
cpu
architecture
like
arm
and
so
on.
The
performance
work
group
focus
on
continuously
improving
the
hardware
performance.
The
image
acceleration
group
focus
on
providing
a
solution
to
let
harper
support,
accelerate
image
from
it
like
linda's
start
dizzy
and
so
on.
B
Let's
dive
into
more
details
of
the
hub
operator,
this
is
the
overall
architecture
of
the
hub
operator.
It
describes
how
the
operator
works.
As
we
know,
harbor
registry
is
composed
of
multiple
components
and
also
requires
p-secure
database
redis,
cache
and
storage
service.
Each
hardware
component
is
defined
with
a
separate
cr
and
reconciled
independent.
B
These
component
crs
are
owned
by
the
operator.
Harbor
harbour
cr
represents
the
whole
harbour
registry.
A
top
cr
hardware
cluster
is
designed
to
let
users
describe
the
whole
hardware
stack
they
want
to
deploy,
including
the
harbor
retreat
itself
and
its
related
dependent
services
for
the
dependent
services.
B
You
can
configure
the
existing
service
you
have
deployed
or
invested
somewhere
all
require
the
hub
operator
to
deploy
them
into
your
cluster.
Together
with
the
hardware
registry,
hardware,
services
are
exposed
where
ingress
for
accessing
so
far
default.
Ndx
counter,
gce
and
ncp
ingress
controllers
are
supported.
B
The
latest
1.1
version
was
just
released
last
month.
You
can
have
a
try
and
the
feedback
is
welcomed.
Version
1.2
is
ongoing
in
1.2,
we'll
focus
on
support
of
the
hardware
version
2.4
and
support
kubernetes
1.22,
and
we
will
provide
a
multi-operations
like
circulator
injection
or
image
pathway,
ready
and
so
on.
B
C
C
C
E
C
C
C
C
C
C
C
C
B
Okay,
if
you
want
to
do
collaboration
with
the
harper
community,
there
are
several
ways
for
you
to
choose.
You
can
you
know
post
a
message
in
the
harvard
slack
channel
or
harvard
channel
you?
Can
you
know
contact
the
community
via
the
email
group
and
you
can
watch
the
twitter
of
harper
project
harbor
and
we
have
bi-weekly
zoom
meeting
community
meeting.
You
can
send
us
a
concrete
meeting
schedule
from
the
community
report
and
there
is
also
a
demo
environment
set
up
you.
If
you
want
to
have
a
try,
you
can
go
to
them.gohab.io.