►
From YouTube: Enterprise Cloud Native Artifact Registry - Yan Wang & Daojun Zhang & Chenyu Zhang, Vadim Bauer
Description
Don’t miss out! Join us at our upcoming event: KubeCon + CloudNativeCon Europe in Amsterdam, The Netherlands from April 17-21, 2023. Learn more at https://kubecon.io The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.
Enterprise Cloud Native Artifact Registry - Yan Wang & Daojun Zhang & Chenyu Zhang, VMware; Vadim Bauer, 8gears Container Registry
Speakers: Daojun Zhang, Yan Wang, Chenyu Zhang, Vadim Bauer
Project Harbor is an open source trusted cloud-native registry project that stores, manages, signs and scans content to solve common OCI artifact management challenges. It has been widely used by organizations large and small around the world to address container image and other OCI-compatible artifact management challenges. In this presentation, we will cover some advanced features using Harbor such as OCI artifact management in cloud environments, management of artifacts and their attachments (cosign, nydus), recommended settings for high concurrent use, and high availability deployments. In addition, the team would like to get feedback from users and contributors on current features and future roadmap.
B
C
A
A
A
It
is
so-called
different
authenticator,
such
as
local
user
management,
active
directory
dot
or
IDC
user
management,
and
also
support
robot.com
to
access
Hardware
resources.
Vermicond
is
widely
used
in
the
cicd
platform
as
a
service
account.
The
next
is
the
management
policy.
That
means
could
set
up
a
retention
policy
and
immutable
policies
on
different
projects.
It
helps
the
administrator
to
manage
the
artifact
and
storage
space,
and
next
is
the
artifact.
A
Replication
now
have
already
supported
most
of
the
public
Cloud
Registries
such
as
doc,
Hub,
GCR,
ECR
and
Asia
ACR
Etc,
and
it
could
help
to
replicate
energy
from
or
to
list
registries
and
also
can
podcast
these
registries.
Nowadays
they
are
more
and
more
concerned
on
the
area
of
the
security.
How
about
praise
and
important
role
in
the
security
of
the
cloud
native
software
supply
chain?
It
provides
the
foreign
features.
Standing
image
feature
could
help
to
secure
the
image
from
development
to
production,
make
sure
the
image
is
coming
from
The
Trusted
results.
A
A
A
Meanwhile
card
will
provide
a
set
of
integration
features
such
as
the
authentication
with
different
back-end,
adap
or
oidc,
and
also
provide
adapter
mechanism
which
allow
user
to
integrate
different
Unity
scanner
for
images
group
application
there
are
many
adapter
could
be
used
to
connect
to
different
registry
event.
Notification
makes
the
event-based
integration
more
easier.
A
Let
me
introduce
new
feature
in
this
release.
The
first
is
the
cash
flow.
We
are
adding
cash
layer
to
improve
the
performance
of
high
concerned,
poor
requests
and
the
second
is
the
audio
log
approach
and
the
forward
and
in
the
next
is
the
cve
export
feature
and
the
web
assembly
artifact
support
the
last
one
we
back
up.
I
use
the
last
one
feature
is
the
back
cover
restore
hover
with
Valero.
A
Meanwhile,
we
also
upgrade
some
component
in
2006..
We
bigger
version
and
upgrade
the
angular
version
in
the
UI
and
also
pump
up
the
colon
version
to
1.18
and
we're
compatible
with
the
docker
V2
Docker
compose
V2
version,
and
we
pump
up
the
TV
and
achieve
your
data
to
the
latest
version.
Okay,
let's
go
through
these
features.
First
Changi.
Could
you
please
introduce
the
test
layer
and
saving
installation.
B
Hi,
this
is
the
introduction
for
cache
layer
in
the
harbor
2.6.
Firstly,
I
want
to
introduce
the
background.
You
know
with
the
development
of
cloud
native,
related,
Technologies,
more
and
more
applications
and
cicd
in
pipelines
being
implemented.
However,
as
a
major
registry
needs
to
be
able
to
handle
thousands
or
more
requests
at
one
time
and
actually
in
the
real
world,
the
pull
requests,
often
more
than
push
hell,
a
big
challenge
is
sometimes
Harbor
needs
to
handle
the
high
congruent
pooling
requests.
B
In
the
same
time,
if,
as
an
Enterprise
registry,
it's
very
important
to
guarantee
the
performance
and
availability
in
anytime,
we
come
to
the
Enterprise
grade.
Registry
is
Harbor
school,
so
in
Harbor
2.6
around
the
scenario
of
high
congruent
pooling
images,
we
introduce
the
cache
layer
what
stores
some
mostly
used
resources
in
the
radius
from
that
Harbor
no
longer
need
to
query
from
PG
and
the
distribution
when
user
pulling
the
image
manifest,
because
now
they
can
raise
them
from
radius
directly,
so
it's
faster
than
before.
B
B
Next,
let's
do
a
quick
overview
about
the
performance
Improvement
our
test,
based
on
the
performance
of
pulling
image
manifest
because
our
design
is
around
this
scenario.
The
first
diagram
is
the
compilation
of
response
time.
The
blue
bar
represents
cache
disabled
and
the
green
bar
represents
cache
enabled,
and
the
x-axis
is
the
number
of
the
concrete
from
1000
to
20.
Thousands.
B
The
y-axis
is
the
time
of
response.
The
time
unit
is
second,
for
example,
when
the
concrete
is
1000.
Non-Enable
cache
needs
about
nine
seconds,
but
after
enable
cache,
the
time
is
only
less
than
half.
Second,
the
effect
is
very
obvious.
We
can
see
from
the
diagram
when
the
concurrency
less
than
8
000
cash
enabled
can
improve
about
10
to
30
times
and
when
the
concurrency
over
then
8
000,
the
Improvement
can
be
about
3
to
10
times
here.
B
B
Okay,
then,
let's
move
you
to
the
second
diagram.
The
second
diagram
is
the
compilation
of
the
TPS.
The
TPS
means
the
transaction
every
second.
This
metric
represents
the
number
of
requests
that
Harbor
can
handle
every
second
in
the
different
concurrency,
if
not
enable
cache
cover
can
only
handle
about
600
requests
every
second,
but
if
enable
cache
hover
can
process
over
4
000
requests.
The
Improvement
is
about
seven
times.
B
Okay,
let's
move
to
the
last
diagram.
Last
but
not
least,
the
last
diagram
is
the
success
rate.
This
metric
reflects
the
availability
of
Harbor
and
it's
very
valuable
from
the
chart
we
can
see,
if
not
enable
cache.
The
success
rate
will
continue
to
decrease
when
the
concurrency
over
than
8
thousands,
but
if
enable
cash,
even
with
the
20
000
concurrency,
however,
can
still
handle
all
these
requests
successfully,
but
in
the
same
condition
not
enable
cache
will
have
over
half
failed
requests,
because
the
success
rate
is
only
38.
B
This
result
can
also
reflect
to
first
two
diagrams.
The
rest
of
the
response,
time
and
TPS
seems
to
be
better
in
the
2010
congruency,
but
that's
not
the
truth,
because
the
mass
failed
request
in
improve
the
the
average
besides
above
Improvement,
the
database
connection,
also
less
than
before.
If
you
enable
cache,
as
well
as
the
CPU
usage
of
the
database
registry
and
the
call
have
also
have
the
obvious
Improvement.
B
B
The
demo
for
export
CV,
it's
a
new
feature,
introducing
the
harbor
2.6
and
this
feature
can
help
user
export
vulnerabilities
from
Project
to
a
CSV
file.
Here,
I
have
one
project
named
the
library
and
in
this
project,
I
have
pushed
two
artifacts.
One
is
ready
and
one
another
is
ngx
and
I
have
scanned
them
before.
So
you
can
find
some
vulnerabilities
in
the
radius
image
and
in
the
ngx
image
we
also
scanned
some
vulnerabilities
and
then
let's
go
back
to
the
project
page.
B
You
just
need
to
click
the
check
box
before
the
project
name
and
then
click
the
action
and
click
the
export
CV.
There
are
two
sections
for
set
exporting
conditions.
One
is
projects.
Currently
we
only
support
export
one
project
for
the
performance
concern,
but
maybe
we
will
do
some
improvement
and
open
for
more
projects.
B
B
Also,
you
can
use
double
star
for
the
match
and
the
next
is
text
you
can
specify
your
tag
name,
for
example,
V1,
V2
and
so
on,
and
the
next
one
is
labels.
You
can
just
choose
the
labels
which,
attached
to
your
artifacts,
for
example,
DV
and
the
last
filter,
is
cvid.
You
can
just
input
the
cve
ID
for
filter,
for
example,
cve
one
two,
three
four.
B
B
B
B
B
A
As
we
know,
the
audio
log,
we
are
logger
image,
push
poor
and
delete
operations
from
previous
user
feedback
in
GitHub
in
a
high
concurrent
environment,
it
will
unlock
huge
amount
of
audio
log
in
a
database
and
consume
disk
space.
In
order
to
save
the
disk
space,
the
administrators
have
to
manually
delete
the
list.
Look
at
the
periodically
in
2006,
we
introduced
a
new
feature
named
audio
log
and
project
forward.
It
helps
to
create
a
job
service
schedule
to
purge
the
audio
log.
A
A
A
A
A
A
A
A
A
A
A
A
A
C
All
right,
so
that's
good.
Let's
take
a
look.
What
we
can
expect
from
hover
2.7
and
on
the
agenda
for
2.7.
We
have
a
a
few
new
features
that
were
highly
demanded
from
our
community
and
one
of
the
big
chunk
in
two
seven.
It's
going
to
be
the
job
service
dashboard,
which
is
a
new
function,
completely
new
functionality
that
will
export
or
expose
the
metrics
that
we
currently
only
expose
in
primitos
and
that
are
not
actionable.
C
We're
going
to
expose
this
in
the
hardware
UI
and
making
them
not
only
visible
to
the
user
or
administrator,
but
also
actionable
means
that
you
can
overview
all
the
background
jobs
that
are
always
you
know
the
growing
so
we
have
which
is
released.
We
have
more
and
more
background
jobs,
so
you
can
now
monitor
the
background
job.
C
You
can
see
what
is
the
queue
size,
the
pool
size
and
you
can
kind
of
predict
and
manage
and
act
upon,
the
jobs
that
are
running
in
the
background,
so
you're
able
to
stop
jobs
and
and
oppose
jobs,
and
then
you
can
see
also
your
queue
and
predict
if
some
task
will
be
finished
at
a
certain
time.
So
this
this
allows
the
administrator
to
predict
the
workload
and
scale
accordingly
their
their
instance.
C
So
there's
going
to
be
a
major
Improvement
in
in
Harbor
management
for
the
administrators,
the
next
functionality
is
also
towards
the
management
of
Harbor,
and
it's
about
chunk,
replication
and
chunk.
Replication
means
that
we,
when
we
replicate
images
from
other
registries,
you
know
from
ECR
or
ACR
or
Docker
Hub.
We
currently
replicate
by
layers,
so
we
replicate
one
layer
after
each
other
and
if
there's
an
error
during
the
replication
and
it's
going
to
be
retried
and
so
far
this
has
the
problem.
C
If
we
see
you
know
ever
growing
image
layers,
you
know
for
for
Windows,
for
example,
those
layers
can
be
easily
in
one
gigabyte
of
size,
and
this
means
that
they're
going
to
be
often
a
retry.
If,
if
there
is
an
error
and
to
avoid
the
you
know,
retries
and
also
the
Q
length,
we
are
going
to
introduce
a
chunk
replication,
which
means
we
can
resume
resume
a
failed
replication
attempt
and
at
the
point
where
it
failed
and
not
the
whole
layer
and
the
next
step.
A
Thanks
everybody,
that's
all
updated
from
Harbor
project.
If
you
are
Hardware
developers
or
users,
there
are
a
lot
of
ways
to
participate
in
our
project.
Welcome
to
open
your
issues
for
requests
in
our
project,
ask
questions
in
our
slack
Channel
or
join
our
email
groups.
Thank
you
for
joining
this
meeting.