►
From YouTube: Deep Dive: Harbor - Tan Jiang & Jia Zou, VMware
Description
Join us for Kubernetes Forums Seoul, Sydney, Bengaluru and Delhi - learn more at kubecon.io
Don't miss KubeCon + CloudNativeCon 2020 events in Amsterdam March 30 - April 2, Shanghai July 28-30 and Boston November 17-20! Learn more at kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects
Deep Dive: Harbor - Tan Jiang & Jia Zou, VMware
Harbor is an open source trusted cloud native registry project that stores, signs, and scans content. It has been widely used by organizations large and small around the world to resolve the image management challenges. In this session, we will cover some advanced features of using Harbor, such as image replication with label filtering, image management in a cloud environment, unified management of Helm chart and container images, and highly-available deployments. Furthermore, the team would love to get feedback from users and contributors about current features and future roadmap.
To learn more: https://sched.co/Gre7
A
Okay,
that's
a
good
time
to
start
hello,
everyone
sex
for
coming
here
to
join
our
session.
I
know
this
is
the
last
test
shed
and
you
may
be
tired,
so
really
appreciate
it
to
be
here
and
today
to
turn
our
session.
This
is
a
deep
dive,
Harbor
session
I'm
Steven
from
VMware
I'm,
an
engineer
of
harbor
and
this
session.
We
have
another
speaker
tenure.
He
is
also
engineer
from
harbor
team.
Okay.
Today
we
like
we
do
like
to
use
this
session
to
explore
some
insights
of
harbor
some
possible
potential
direction
of
harbor
in
the
future.
A
A
A
Yeah
right
before
to
you
exploration,
I,
do
like
to
repeat
the
revisit
what
the
capability
harbor
provides
and
how
does
the
harbor
architecture
look
like
with
you
care
to
Kaiser
as
the
background
of
the
second
exploration
part,
so
I
know
you
make
a
choice,
the
introduction
section
already
you
know
you
may
be
familiar
with
harbor
already
so
today
this
is
a
quick
part
and
the
today's
session.
The
main
part,
is
the
second
section
to
explore.
Asia,
okay,
harbor,
yeah,
Obon
sauce
see
the
quality
of
radical
project
yeah
it's
open
source.
A
A
Okay,
our
quickly
go
stroll
what
capable
competitor
Harbor
has:
okay,
the
first
access
control
yeah,
we
able
role
paste
row
based
access
control
in
Harbor,
and
we
also
support
eighty
or
tempo
integration.
The
content
harbour
is
isolated
by
project
and
the
UK
applies
our
back
to
restrict
the
content
accessing
okay
and
another
is
a
replication
yeah.
We
can
support,
replicate
to
your
emitter
from
the
sauce
harbor
to
the
target.
Harbor
you
set
of
filters.
You
can
set
a
different
trigger
that
meets
schedule,
a
meteor
to
add
manual
next,
one
also,
you
know
vulnerabilities.
A
Can
you
Amiga?
Is
a
software
package
collection
along
with
OS
their
metal
vulnerability?
They're
meant
to
be
vulnerable,
eighty
as
their
to
make
holes
risk
to
your
ear
meta.
So
in
Harbor
we
leverage
the
oversaw
the
project
Claire
to
a
provider
of
an
appellee
scanning
capability
to
make
sure
your
image
is
secure
that
meets
all
the
vulnerability
you
will
be
aware.
A
Next
part
is
the
content,
trust
yeah
when
you're
putting
a
major
from
the
registry
you'll
want
to
make
sure
the
image
you're.
Putting
is
the
wire
published
by
the
Creator?
And
it's
not
you
know
it's
not
a
tempered,
so
battle
set
a
image
away,
leverage
or
another
open
soda,
protracted
notary
to
support
is
a
Content
trust
when
the
imagery
will
be
setting
the
wind
pushing
and
the
signature
will
be
very
afraid
when
podium.
This
can
be
defended
in
a
control
policy.
A
Okay,
next
part,
her
McCarter
support,
yeah.
In
addition,
no
to
image
amendment
we
are
now
support
herb
chart
measurement.
That
means
the
harbor
is
not
only
a
image
registry,
but
also
I'm
chartered
repository
yeah.
You
can
manage
your
arm
charge
over
harbor,
okay,
yeah
keepers,
the
same
experience
with
the
image
amendment,
okay,
I.
Think
in
the
second
part,
we
explore
more.
The
monster
features
of
hermit
chart:
okay,
high
availability,
yeah
you
may
want
to
deploy
a
harbor
to
your
enterprise
production
environment.
So
in
next
recent
release
will
deliver
the
HJ
deployment
where
her
Harbor
chart.
A
That
means
there
will
be
a
harbor
harm,
chart,
suppose
H
a
deployment,
but
I
want
to
measure
that
the
H
a
database
that
emit
a
cheapest,
accurate
and
itchy
red
is
not
a
concern.
During
this
time.
Charter
deliver,
okay,
mal
features,
I
always
have
you
know
a
fancy
web
portal
yeah.
You
can
use
web
this
web
portal
to
to
manage
your
content
content
like
image
at
the
Heritage
easily,
and
the
batch
operation
is
a
building
in
the
web
portal
and
restful
api
yeah.
A
We
provide
a
red
force,
there
appear
for
integration
to
other
platform,
and
thus
one
group
here
is
provided
for
your
refers
to
check
the
EP,
a--
and
yeah
internationalisation.
We
support
english
repose,
a
chinese.
I
want
to
measure
mob.
We
have
three
other
languages,
Spanish,
France
and
I.
Don't
want
to
pronounce
the
name
as
as
those
astray
language
are
contributed
by
the
community
contributors
yeah
thanks.
Thank
you
thanks
them
and
all
these
a
log
yeah,
all
the
key
operation
will
be
recorded
and
the
yoke
audit
the
operation
in
in
filter.
In
some
case.
A
Ok,
if
you
need
the
auditing
and
the
label,
you
can
mark
label
to
image
at
the
chart
and
the
label
label
can
be
defended
in
projects
and
the
system
scope.
The
label
can
be
used
to
do
some
of
filter
all
can
be
filter,
source
image,
also
from
charts
in
the
replications
in
error.
Ok,
we
also
suppose
multiple
deployments.
A
You
can
use
the
toggle
composer
to
deploy
a
harbor
in
the
standalone
government
and
you
can
also
use
poverty's
to
deploy
a
harbor
to
the
cloud
foundry
in
ecosystem
platform
and
also
yeah
use
Harbor
chart
harbor
ham
chart
to
deploy
a
harbor
to
the
kubernetes
government,
ok
harbor
architecture.
So
let's
say
as
a
component
of
hopper
to
the
bottom:
oh
yeah,
the
top
one
is
a
PR
routine.
That's
a
certain
party
components
and
ngx
it'll
route
to
the
api
requested
to
the
core
service.
Yeah
cursor
is
it's
a
core
component
of
harbor.
A
You
know,
provide
api
all
set
occasion
and
also
tradition
and
the
vapor
service'
for
the
UI
and
extended
the
charter
service.
Also,
the
you
know
the
author
authentication
yeah
integration,
the
capability
integration
with
our
ID
and
our
depth.
In
this
course
waste
and
next
level,
yeah
drop
a
service.
It
will
help
along
some
a
larger
background.
Jobs
suffer
me
to
the
better
some
cosa
waste
and
miss
service.
We're
headed
a
chromebook
of
a
creation
over
harbor.
A
A
Light
to
light
a
green
box,
wine
is
a
key
value
storage.
We
use
readies
to
keep
cash
or
some
key
value
of
metadata,
and
we
use
a
secure
database
that
supposed
agree
to
install
some
metadata
of
harbor.
Okay
and
the
right
side
is
a
packaging
component.
That
means
that
if
several
packaged
ways
to
deploy
harbor
two
different,
a
targeting
environment
and
the
lowest
layer,
is
the
storage
layer
yeah
we
can't
deploy.
We
can
use
to
local
of
some
remote.
Sorry
like
the
s3,
okay,
that's
a
hopper!
A
B
Guys,
thanks
for
staying
with
us
again
and
yeah
since
harbor
became
an
incubator
prevalence
in
CF,
we
have
been
eagerly
trying
to
find
out
how
we
can
make
it
a
better
registry
for
cloud
native
users.
So
next
I'll
cover
a
few
areas
where
we
think
improvements
could
be
made
and
share
with
you
a
few
ideas
regarding
what
can
be
done.
Some
of
these
ideas
are
currently
feel
quite
immature
and
I
say
well.
We
wish
to
kick
off
some
discussion
within
the
community,
so
we
can
work
together
to
refine
them
and
make
some
real
progress.
B
Let's
get
started
so
the
first
topic
is
step
up
in
the
CI
CD
support.
So
since
the
early
days
of
docker,
the
registry
has
been
playing
an
important
role
in
the
developed
for
TV.
Totally,
the
developer
will
push
the
code
through
the
Cal
repo
and
the
CI
system.
Somehow
peel
the
images
push
it
to
the
registry,
then
the
other
side,
the
deployer
or
operator,
will
pull
the
image
from
registry
deployed
to
different
target
environments.
In
our
case,
many
harbor
users
are
using
it
in
their
own
CI
CD
pipeline.
B
So
we
think
the
issues
in
this
area
should
be
treated
with
higher
priority.
So
first
thing
the
robot
account.
This
is
a
requirement.
We
see
quite
a
few
times
released
by
the
community
users
in
harbor.
An
image
is
stored
in
a
project.
I
know
many
of
you
have
been
using
harbor,
so
you
must
be
familiar
with
this
to
access
an
image.
B
If
the
project
is
not
public,
you
need
to
authenticate
first,
so
many
users
configured
harbor
against
their
own
corporate
LDAP
and
if
they
want
to
push
or
Pro
images
to
harbour
in
their
pipeline,
they
have
to
put
the
credentials
of
their
type
user
somewhere
in
there
CI
system.
They
are
not
happy
with
this
situation.
So
to
solve
the
problem
you
introduce
robot
account.
This
account
is
not
interactive,
but
for
pushing
or
pulling
the
content.
B
Only
so
a
product
me
will
be
able
to
create
a
token
assign
permission
to
it
and
user
can
configure
it
in
there
CI
system
without
worrying
about
leaking
sensitive
account
information.
So
this
is
quite
clear
and
we
plan
to
provided
in
the
release
early
next
year.
Ok,
so
first
one
next
one
is
the
lab
hook.
So
web
hook
is
pretty
important
for
connecting
harbor
to
other
components
in
the
pipeline.
I
remember
the
other
day
in
the
introduction
session,
a
user
asked.
How
can
he
know
if
an
image
is
replicated
from
the
target
side?
B
This
is
a
typical
scenario
where
a
notification
mechanism
helps
ideally
hover
should
send
out
a
notification
to
this
in
point
when
the
image
is
replicated
in
the
hub
and
the
handler
of
this
notification
will
trigger
a
process
to
deploy
a
part
which
references
this
replicated
image,
but
so
far
we
don't
have
this
mechanism,
so
we
will
need
to
add
it,
and
so
far
any
user
will
need
to
pull.
You
know
keep
calling
the
API
to
see
if
the
image
is
ready.
B
Actually
hover
handles
the
notification
from
the
internal
registry
to
trigger
replication
or
image
scan
currently
so
now
we
just
need
to
send
event
out
to
the
outside
and
some
even
framework
to
match
the
you
know
handlers
to
the
event
in
etcetera,
okay,
so
that's
a
web
hook
and
the
third
one
is
the
metadata.
So
the
idea
is
as
a
repository.
It's
always
helpful
to
provide
more
information
to
the
user,
which
describes
the
asset
in
stores.
So
far
we
support
signature
of
vulnerabilities
and
I
think
they
can
all
be
considered
as
metadata
of
the
container
images.
B
So
we
think
it
would
be
interesting
if
we
allow
the
creator
of
the
asset
or
the
image
can
provide
richer
metadata
when
pushing
it,
and
this
will
provide
more
possibility
for
finer
grain,
final
query
and
policy
control.
For
example,
if
we
can
include
a
test
coverage
in
the
metadata
of
an
image,
then
we
can
create
a
policy.
B
Next,
why
the
COI?
This
is
pretty
straightforward.
You
is
preferred
by
the
administrator,
but
for
automation
you
need
scripts
and
COI.
A
contributor
from
the
community
is
working
on.
Seo
is
called
harbor
cat.
All
this
provides
another
option
for
automation
in
addition
to
calling
the
API,
so
it
works
in
basic
scenarios
already
and
he's
adding
more
features
from
up
for
more
details.
You
can
also
refer
to
the
proposal
and
it
has
a
chat
list
about
what
features
are
supported
already.
B
So
it's
a
recap.
So,
as
for
the
DevOps,
these
are
the
ideas
and
items
we
are
working
on
or
for
the
better
supporters.
Generally
speaking
in
this
area,
I
think
the
focus
is
to
enhance
harbours,
to
make
it
more
accessible
and
easier
to
integrate,
with
other
components
in
the
pipeline
to
better
fit
in
the
workflow,
and
we
work
out
there.
Ok,
the
next
topic
is
replication.
B
Replication
is
a
widely
used
feature
in
harbor.
Some
users
use
it
to
back
up
their
image
data
to
the
slave
registry.
Some
users
use
it
to
distribute
the
image
to
remote
Harbor
instance,
targeting
different
stages
and
environments,
etcetera,
etcetera,
and
that's
why
we
kept
in
housing
it
in
the
previous
releases,
we've
added,
as
Steven
mentioned
in
the
earlier
we've
added
filter
schedules,
to
make
the
replication
more
flexible.
However,
there
are
still
some
limitations.
First,
the
replication
can
only
happen
between
harbor
instances.
Second
is
holy
push-based.
B
That
means
when
you
configure
the
replication
on
one
harbor
instance.
The
only
supports
putting
image
to
the
remote
instance,
but
we
find
it
a
common
scenario
that
user
may
use
both
public
registries
and
harbor
at
the
same
time,
and
there
has
been
requirements
asking
us
to
support
syncing
images
between
Harbury
and
public
registries
such
as
docker
hub
this
AR
etcetera.
B
So
we
made
a
decision
to
make
the
framework
more
extensible.
The
goal
is:
when
user
creates
replication
policy,
he
should
be
able
to
replicate.
The
remit
is
from
a
remote
instance
and
by
implementing
adapters
the
remote
instances
can
be
any
type
of
registry
or
even
better.
It
may
be
a
file
server
if
you
like.
B
Next
is
the
tendency
model
so,
as
harbor
became
more
and
more
popular,
we
started
to
hear
feedbacks
from
administrators
of
larger
organizations.
They
have
different
requirements
from
small
developer
team
or
single
developers,
and
they
are
mainly
related
I
mean
these
requirements
are
mainly
related
to
the
multi-tenancy.
The
next
I'll
share
with
you
guys.
B
Some
of
our
thinking
in
this
area
first
is
the
tendency
model
harbour
has
the
notion
called
project
and
it
is
essentially
the
folder
of
everything
so
far
it's
a
namespace
of
the
images,
so
you
can
approach
image
to
push
images
to
a
project.
It's
also
a
container
of
people,
so
you
can
add
members
to
a
project
and
manage
the
members
permission
to
the
images
by
assigning
different
roles
to
them.
B
Product
is
also
a
unit
of
management,
so
the
product
mean
can
can
add
control
policies
such
as
replication
or
vulnerability
scan
and
through
the
project,
so
it
can
control
the
images.
Early
users
of
harbor
are
really
like
this
simplicity,
but
I
mean
I
mean
the
administrator
of
larger
team
or
organization.
They
asked
for
more
flexibility,
some
of
them
one
another
layer
of
isolation
or
finer,
grained
control.
So
we
think
it's
worth
thinking
about
a
slightly
more
complicated
model
to
decouple
a
different
perspective
of
a
product
and
map
different
features
to
different
entities.
B
For
example,
we
may
introduce
the
org
as
an
isolation
level
of
a
tenant
and
users
and
him
to
the
ark
and
create
namespace
or
folders
within
the
Oracle
product
to
assign
roles
and
policies
to
the
namespace,
but
I
know
some
even
some
of
our
internal
team
hates
this
idea.
We
are
still
in
early
discussion
regarding
the
chain
in
a
tenancy
model,
so
the
plan
is
now
finalized
yet,
but
we
should
definitely
do
something
to
you
know,
provide
more
flexibility.
That's
the
point.
B
So
within
the
product
there
is
a
guest
role
who
can
only
read
or
pull
the
developer,
who
can
write
or
push
and
the
protein
mineral
who
can
manage
the
members
and
other
policies
problem
emerges
when
and
enterprise
user
come
to
us
and
asking
for
a
user
who
can
create
project
but
not
adding
members
to
it
or
user?
Who
can
poach
images
to
a
project
but
not
deleting
any
of
them?
It
became
an
issue
because
we
don't
have
such
roles.
The
permission
of
the
roles
are
hard-coded
now,
so
we
are
considering
to
DeCarlo
the
rows.
Informations.
B
Row
will
be
mapped
to
a
set
of
permissions,
and
the
admin
can
create
custom
roles
who
satisfy
a
wider
range
of
requirements.
Additionally,
search
deep
coupling
will
make
it
easier
for
harder
to
integrate
with
third-party
I,
am
services
and
provide
a
more
consistent
model
with
other
components
in
a
larger
platform.
B
Another
another
requirement
we
hear
from
the
initiator
is
coda
when
the
enemy
is
create
for
their
for
their
teams.
They
want
to
control
the
usage
they
want
to
apply
some
policies
such
that
when
the
usage
exceeds
the
limitation
in
the
policy,
the
action
should
be
blocked.
This
is
a
pretty
reasonable
requirement.
I
must
say
we
have
introduced
a
mechanism
to
conditionally
block
users
requests
when
introducing
the
policy
to
prevent,
pulling
vulnerable
images.
B
It
will
be
very
inaccurate
and
it
became
trickier
when
you
consider
the
layers
are
shared
across
different
teams
or
tendons
and
so
far
on
how
to
how
do
we
calculate
the
storage
used
by
at
handle?
We
don't
still
don't
have
a
good
answer
to
that.
Additionally,
to
track
different
usage,
data
will
potentially
need
to
need
a
help
from
external
metering
system
so
that
another
integration
point
we
need
to
decouple
when
implementing
it.
So
that's
the
coda.
This
is
what
been
thinking
about
it
and
in
terms
of
multi-tenant
support.
B
We
found
out
whatever
models
we
choose,
it
will
be
quite
subjective
and
any
change
we
introduced
will
require
user
data
migration.
So
we
need
to
be
careful
here
and
again.
Your
opinion
will
be
appreciated
to
let
us
know
which
direction
is
better
for
you.
So
last,
but
not
least
that
helped
our
repo
a
couple
of
months
ago,
we
introduced
it
to
harbor.
So
with
this
move,
we
hope
to
extend
harbors
capability
to
better
serve
the
kubernetes
users
and
embrace
the
cloud
native
world.
B
Currently,
by
integrating
with
our
museum
user,
can
push
pull
helm,
charts
to
a
product
and
access
the
child
according
to
the
same
set
of
our
actual
our
back
rule,
as
we
done
for
the
images
so
quite
naturally,
given
what
we
implemented
the
advance
features
through
the
images
such
as
replication
content,
truss,
vulnerability,
scale.
We
want
to
bring
them
to
home
jars,
and
actually
we
have
made
some
progress.
B
We've
supported,
uploading
and
managing
the
provenance
file
of
a
chart,
so
that
covers
part
of
the
signature,
and
we
have
done
some
groundwork
for
chart
replication,
but
a
big
gap
for
a
very
good
end-to-end
story,
which
is
the
relationship
between
a
chart
and
the
images
currently
that
chart
only
references
to
images
in
the
Yunel
template
files.
In
most
cases
they
are
defining
the
values
toyou
know,
but
theoretically
it
can
be
quite
any
dynamic
or
even
random
it,
because
it's
rendered
based
on
the
code,
hem
called
Hamlet
language.
B
So
from
a
content
management
perspective,
we
cannot
have
the
complete
knowledge
of
a
package
if
the
if
the
dependency
is
unknown,
for
example,
without
knowing
the
vulnerabilities
of
all
the
images
of
a
chart,
we
cannot
provide
reliable
information
of
vulnerability
to
the
helm
user,
who
is
to
deploy.
The
chart
were
a
very
important
raster
so
for,
however,
potentially
some
of
the
solution,
we
can
think
of
so
far.
The
first
one
and
two,
the
asked
best
effort
to
correlate
the
chart
and
images
we
can
render.
B
The
template
of
a
chart
I
mean
doing
that
healers
job
with
the
default
values
to
provide
an
incomplete,
aggregated
view
of
a
chart,
because
a
chart
may
reference
images
from
different
sources
and
to
the
best
effort
to
provide
the
information
of
both
of
them
to
the
user
and
the
second
one.
When
the
pull
based
replication
is
done.
We
may
pull
the
images
required
by
a
chart
to
hover
and
generate
a
new
chart
such
that
all
the
images
referenced
by
the
chart
are
also
in
hover.
B
So
we
can
provide
a
better
aggregated
view
of
at
heart
and
when
replicating
at
heart,
for
example,
we
can
replicate
all
the
images
to
the
remote
instance,
including
the
chart
and
handling
it
as
an
O
in
one
package.
So
we
have
some
brief
introduction.
I
mean
discussion
internally,
so
we
found
either
of
these
options
will
bring
new
issues.
So
again,
if
you
have
thoughts
about
this
problem,
please
also
share
with
us,
so
we
can
provide
better
support
for
this
area.
So
I
think
that's
pretty
much
everything
we
wanted
these
class
today
and
try
do
this.
A
Cuda
Sheree
thanks
tenure
and
the
you
guys
excited.
Maybe
you
have
a
question
Amanda.
How
should
I
do
if
I
want
to
a
young
wolf
in
Harbor
community
right?
We
have
many
ways.
First,
we
welcome
to
draw
our
bi-weekly
meeting
yeah.
You
can
find
the
meeting
schedule
in
the
go.
/
co'
harbour
search
community
repo
and
if
the
term
is
not
suitable
for
you,
you
can
check.
A
You
know:
email
groups,
you
can
subscriber
the
immigrants
and
Emer
to
the
numeral
group
and
also
we
have
slack
channels
harbor
and
a
harbor
d/deaf
you
needed
to
access
a
CSF
slack
to
catch
a
yummy,
tisha
I
am
tisha
and
also
encourage
you
to
follow
us
in
twitter.
Our
account
it
project,
hover,
okay,
and
thank
you
and
sink
it's
time
to
you
know
to
have
discussion
about
the
explore
Alisha
point.
B
It's
done
by
integrating
with
Madhuri.
So
essentially
when
you
push
the
image
you
set,
the
darker
content.
Truster
is
implanting
it'll
harbour,
you
know,
there's
a
non-dairy
running
within
harbor
with
the
same
set
of
rules,
the
articles
and
it
can
parse
that
whole
consign
the
harbor
the
same
way.
The
registry
does,
and
you
can
push
the
signature
to
the
codis
in
the
total
client
log
kind,
will
push
the
signature
tune.
Audrey
and
harbor
can
communicate
with
Natalie
when
you're
pulling
the
imagery
to
verify
this
signature.
A
B
Our
list
yeah
yeah.
If
you
are
interesting,
you
can
try
to
write
a
proposal
in
the
we
can
explore
together.
But
now
on
the
way
to
deploy
harbor
to
kubernetes
is
we
are
helped
her
like
an
operator
worth
really
worth
exploring,
because
we
find
the
upgrade
or
migration
experience
near
ham.
Chart
is
quite
limited,
so
far,
yeah.