►
From YouTube: Intro: Harbor - Henry Zhang & Steven Ren, VMware
Description
Join us for Kubernetes Forums Seoul, Sydney, Bengaluru and Delhi - learn more at kubecon.io
Don't miss KubeCon + CloudNativeCon 2020 events in Amsterdam March 30 - April 2, Shanghai July 28-30 and Boston November 17-20! Learn more at kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects
Intro: Harbor - Henry Zhang & Steven Ren, VMware
As container technology become widely adopted in the industry, how to manage containerized applications poses new challenges to platform engineers. One of the challenges is to securely and efficiently manage containerized application packages with either container image or Helm Chart format. Project Harbor is an open source trusted cloud-native registry project that stores, manages, signs, and scans content, thus resolving common image or Helm Chart management challenges. In this presentation, we will focus on the management of container images and Helm Charts through Harbor. We will review and provide solutions to the challenges faced by organizations, including RBAC (Role Based Access Control), vulnerability scanning, large scale content distribution, content replication, content trust (notary) and DevOps integrations etc.. Real world use cases will be discussed in the session. Of course, fantastic demos will be shown to let you easily understand the related use cases.
https://sched.co/MPhp
A
Okay,
hello,
hello,
everybody
welcome
to
the
hardware
session,
have
an
introduction
session.
Habra
is
a
CN
CF
project
and
it's
the
probably
the
first
time
that
the
harbour
introduction
talk
in
the
Europe
by
the
our
project
maintainers.
So
we
have
been
very
excited
to
be
here
today
when
I
was
working
in
the
in
the
hall,
I
made
a
quite
a
few
harbor
users
that
they
are
very
happy
about
a
project
so
I
don't
know
any
any
of
you
as
using
harbor
right
now.
A
We
can
you
raise
your
piece,
you
raise
your
hands
cool,
so
many
hands
right,
that's
good!
Also!
They
are
we
here,
I'm
based
in
Beijing
I'm
here,
to
share
the
latest
introduction
latest
update
of
Harbor
and
introduce
the
harbour
project
as
a
whole,
and
that's
introduced
most
speakers
here.
My
name
is
Henry
hurry
there
I'm
the
creator
for
the
project
harbour
and
right
now,
I'm,
a
chief
architect
of
VMware
trainer
and
the
based
in
Beijing.
B
A
Sure
joining
me
today
we
should
also
have
a
few
harbour
commentators
in
this
room,
Stephen
and
also
at
NU,
and
also
Michael.
They
will
help
us
answer
questions
and
also
help
some
of
explanation
of
the
proper
demo
later.
So,
let's
get
into
the
introduction
part
Havel
was
actually
a
small
project
that
we
did
about
four
years
ago.
So
today
you
see
many
logo
saying
that
community
is
a
five-year-old
right
and
harbour.
A
We
created
that,
like
in
2000
back
in
2014,
so
it's
roughly
a
4
plus
year,
it's
roughly
the
same
a
little
bit
order
than
kubernetes,
but
rob
was
the
same
age.
At
the
time.
I
was
leading
a
small
team
in
Beijing
IBM,
with
China
Rd,
helping
to
helping
the
user
for
their
workload
applications
and,
as
we
see
that
we
saw
that
many
users
having
challenges
managing
their
container
images.
So
we
went
ahead
and
create
a
tool
for
people
to
address
those
challenges
in
managing
container
images
so
just
to
gradually
use
inside.
A
A
A
Harbor
is
basically
is
a
trusted
cloud
native
registry
that
gets
through
its
eyes
and
skin
contents.
I
can
help
people
to
met
to
serve
or
manage
container
images
and
related
articles
artifacts
such
as
ham,
trust
right.
Here's,
the
community
status
right,
7,000,
something
stars:
2,000
plus
works
in
120,
plus
contributors
for
a
while,
and
we
have
a
lot
of
members
in
a
community
members
in
the
social
channels,
like
Twitter,
slack
and
so
on.
A
Here
are
the
the
distribution
of
the
contributor
and
maintain
errs
well
Wow.
You
see
that
is
a
the
maintainer,
so
mostly
in
a
PJ
and
North
America,
and
also
we
have
126
contributor
guava
in
the
over
the
world.
Many
country,
including
that
Europe
here.
So
one
of
the
goal
here
I
was
trying
to
see.
If
then,
you
won
the
European
countries
that
interested
in
helping
us
are
contributing
to
the
project,
we
are
welcome
to
join
us
either
as
a
contributor
or
a
maintainer.
That's
a
welcome.
Just
just
talk
to
us
and
see
what
what?
A
A
I
also
can
support
the
docker
Klein,
a
notary
client,
so
we
can
serve
all
kinds
of
price
for
this
for
this
harbor
service
and
also
we
can
reduce
the
identity
map
provider
from
ad
out
app
or
any
oh
I
DC
providers
in
terms
of
packaging.
We
can
package
for
dr.
Campos
and
kubernetes
Hampshire
as
well
as
Coventry
both
release.
So
there
are
many
options
there
for
us
to
choose
from.
A
So
let
me
quickly
go
through
some
of
the
key
features
of
harbor,
so
the
first
one
and
many
people
like
most
is
the
access,
control
or
row
based
access.
Control
are
back
and
also
we
have
LDAP
ad
integration
and
or
IDC
recently,
and
also
robot
account.
So
the
idea
is
real
simple
if
you
familiar
with
all
the
objects
things.
Basically,
we
group
all
the
images
under
new
logical
entity
called
project.
So
all
the
images
belong
to
a
particular
project
and
users
will
be
assigned
or
associated
with
the
project.
A
A
In
addition
to
a
poor
push
image,
it
can
also
manage
the
member
for
the
for
a
particular
project
so
recently
in
the
so
it's
today
this
morning,
maybe
you
have
heard
of
the
announcement
of
Harbor
and
one
point
in
the
keynote
at
1.8.
Just
released
really
fresh
and
in
that
release
we
have
added
in
some
new
features
like
oh
I,
DC
supported
the
robot
account
support
the
uber
kind
for
oh
I.
Dc's
were
interrupts
with
other
systems
and
the
robot
accounts
was
the
ICD
system
integrations.
A
Initially,
when
we
did
this
feature,
we
are
trying
to
address
the
problem
for
many
users
that
are
having
operational
issues
with
copying
image
from
one
place
to
the
other
places.
So
this
feature
extra-soft
that
problem,
because
they
don't
need
to
manually
copy
the
image
around.
So
let
me
show
you
how
it
works.
So
first,
for
example,
you
have
a
registry,
you
have
a
few
images
inside
one
register,
sauce
industry,
and
then
you
can
set
up
a
replication
policy
between
the
two
instances
and
then
you
instantly
have
an
initial
replication.
A
All
the
images
across
the
line
across
the
network
to
the
other
instance,
and
then
you
can
have
incremental
replication,
which
means
that
any
additional
imagery
pushed
to
the
source
registry.
It
will
come
populated
to
the
other
one.
So
it
essentially,
you
are
maintaining
two
identical
instance
of
the
registry.
Even
regardless
is
on-prem
in
the
cloud
or
between
different
data
sentences
and
and
we
can
have
filtering
so
for
the
for
the
image
that
you
want
to
replicate
across
the
line
and
also
you
we
can
have
the
crown
base
catering.
A
It
means
that
you
can
define
when
every
week
or
every
day
or
what
time
so,
it's
like
rom-based,
if
any
operators
they
will
be
familiar
with
this.
So
foreign
based
scheduling
and
also
cleaning.
We
can
support
poo
and
Pushmo,
which
means
that
you
can
get
along
with
the
firewall.
There's
too
many
organization
that
usually
have
firewall
routes
that
blocking
you
all
the
access
going
out
and
going
in,
and
then
you
have
pool
Pushmo.
You
can
help
in
flexibility
to
set
this
replication
up,
and
one
more
thing
is
that
hem
char
is
supported.
A
A
One
of
the
use
case
of
this
replication
is
the
helping
you
to
address
a
very
large
cluster
of
container
notes.
For
example,
if
a
container
one
hundred
or
thousand
canina
knows
if
all
these
notes
are
pulling
images
from
one
particular
registry,
you
will
instantly
have
a
problem
of
the
bottleneck
of
the
performance,
IO
and
networking
right.
A
So
the
solution
for
that
is
to
you
can
have
a
second
year
of
registry
instances
that
can
use
the
harbour
to
replicate
the
second
year
of
the
registry,
the
registry
and
all
the
notes
will
prove
on
the
second
year
on
the
registry,
so
that
even
now
the
workload
so
you
don't
have
to
you
can
you
can
avoid
the
a
bottle
net
by
this.
But
this
means
we
have
many
users
using
the
replication
for
the
for
the
introduction,
including
a
very
famous
bank
in
Spain
they're,
using
this
whoo
course.
A
The
line
course
the
continent
whole
line
network
to
be
to
replicate
the
imagery
across
the
different
offices
in
different
continents
continents.
So
you
essentially
have
identical
images
and
you
can.
You
can
serve
as
a
backup
instance
of
the
images
or
so
you
can
have
local
access
for
your
container
images.
A
A
If
the
civility
exceed
the
threshold,
we
can
plot
the
image
from
being
downloaded
being
food,
so
it
increased
the
security
in
the
new
organization.
The
third
one
is
content.
Trust
this
one
is
relative,
simple
and
easy
to
to
be
understood
to
be
understood,
as
that
we
leverage
the
another
CSF
project
called
no
three
to
help
us
to
sign
the
image.
So
when
we
are
pushing
image
to
the
registry,
we
create
a
signature
or
a
signature
for
that
image
and
store
it
into
a
notary
service.
A
Based
on
that,
when
we
try
to
put
image
again,
we'll
compare
that
compare
that
signature
with
the
the
image
to
verify
that
whether
it's
come
from
the
trusted
source
for
a
particular
image
by
that
means
that
we
can
ensure
that
the
image
images
always
come
from
the
trusted
places
or
cop
trusted
source
that
we
can
use
the
next
one
is
hard
char.
It
was
introduced
in
version
1.6.
Something
has
been
few
releases
right
now,
and
people
like
this
as
well,
because
they
don't
need
another
way,
another
repo
to
manage
hem
chart.
A
They
can
use
to
me
use
harbor
to
do
the
two
things.
So
basically,
we
have
a
unified
image,
management
and
hem
char
management
together
the
same
access
control
using
the
project
model
and
also
the
replication
that
I
just
mentioned,
and
you
can
upload
and
download
trusts
using
the
UI
in
addition
to
the
mobile,
the
hem
command
command
line.
You
can
also
use
the
UI
to
upload
and
download
your
your
your
hem
trusts
there.
A
Many
other
features
that,
in
the
interest
of
time,
I
won't
go
through
every
one,
every
every
point,
simply
piped,
so
basically
where
Pato
restful
api
and
then
are
used
by
many
at
the
mean
or
auto
for
automation
and
in
the
latest
1.8
release.
We
embedded
the
swagger
UI
inside
the
harbor
so
that
you
can
test
your
rest.
Api
using
the
UI
inside
the
harbor,
and
also
we
support
multiple
deployments
like
just
mention,
is
doc
hem
charting
Bosch.
A
So,
as
with
the
announcement
this
morning
in
the
community,
no
I
want
to
highlight
some
of
the
new
features
that,
in
this
release,
one
is
the
OID
C
I,
so
open
ID
Connect,
which
most
of
the
intro
popular
way
for
the
internet
website
to
interact
which
other
we
have
a
demo.
Shortly
and
also
the
robot
cam
is
for
integration
with
different
systems.
A
That
way,
because
many
people
are
many
users
to
have
the
user
store
in
the
cloud
app
ad
organization
or
out
of
eighty,
but
they
usually
they
don't
need
a
physical
identity
to
be
for
the
CI
CD
system,
because
this
is
some
does
not
do
not
represent
any
real
person.
So
we
need
a
robo
account
for
that
for
that
system
to
work,
and
then
we
have
a
replication
enhancement
for
help.
How
have
checked
API
and
swagger
UI
from
based
scheduling.
So
all
these
I
had
mentioned
before.
A
So
the
next
part
will
come
to
the
demo.
I
mean
the
most
exciting,
so
he
was
seeing
is
believing.
So
let
me
introduce
Stephen
Stephen
right,
my
colleague
to
come
up
for
the
for
demo,
and
also
we
have
a
Michael.
We
can
also
help
with
is
also
a
maintainer
for
for
harbor
and
also
help
with
some
of
the
explanation.
Okay,
Steven.
B
C
So
a
couple
of
key
things
about
our
IDC
right
so
as
harbor
gets
integrated
to
an
environment
with
lots
of
other
tools
and
investments
that
you
guys
have
made
it's
important
to
be
able
to
integrate
with
it
and
bring
a
federated
identity,
and
also
to
allow
other
tools
to
be
able
to
integrate
into
harbor
as
well.
So
as
we're
looking
into
the
different
authentication
schemes,
it
was.
It
was
very
evident
that
we
needed
to
include
EDC
support,
and
that
was
one
of
our
main
features.
41.8.
B
First
as
admin,
and
once
we
log
into
the
hepato
and
we
have
a
configuration
tab
and
you
need
to
choose
the
Oz
Modelo,
IDC
and
I
also
need
to
input
all
the
parameters
required.
The
photo
IDs
provider
like
what
is
the
Odyssey
server
and
what
your?
What
is,
the
client,
ID
and
secrets,
and
once
you
have
configured
all
those
parameters
and
you
can
log
in
the
OID-
see
users
who
harbor
web
portal.
B
So
once
I'm
on
board
and
harbor,
we
automatically
create
a
user
which
start
in
hobble
of
local
database,
so
why
we
doing
this
user
creation
is
because
toka
client
doesn't
allow
you
to
forward
your
what
is
C
credentials
to
another
acidity
server.
So
we
have
created
a
harbor
user,
allow
you
to
using
talker
COI.
So
once
you
log
in
this
as
the
hardest
user,
you
can
do
all
the
operations,
as
you
did
in
local
TV
users
before
and
so.
B
I
have
created
a
project
called
test
one
and
then
I'm
going
to
log
in
a
log
in
to
get
my
talker
COI
secrets,
which
I'm
going
to
use
it
to
the
talker
COI
logging
and
push
and
pull
so
in
the
user
profile.
You
can
copy
your
CI
secrets
and
then
you
can
log-in
user
hubber
user
created
and
use
the
Civic
secrets
yeah.
Here
we
cannot
use
the
or
DC
user
password.
We
need
the
user.
V
news,
you
know,
see
our
secrets.
B
So
I
just
clean
all
the
image
locally
and
then
there's
a
very
nice
copy
icon
and
we
can
copy
the
command
to
to
pour
request.
So
and
then
you
can
abort
another
user
and
you
can
also
assign
the
previous
project
to
the
new
user
as
a
mean
to
manage
user.
If
you
required
for
the
two
people
to
share
projects.
B
C
So
essentially,
when,
when
we
start
doing
well,
he
Steven
is
sending
up
the
demo.
When
we
started
hardboard,
you
could
only
replicate
between
multiple
instances
of
harbor.
So
like
that
image
that
Henry
showed
earlier,
you
can
kind
of
scale
harbor
into
multiple
stamps
of
harbor,
but
as
we're
moving
along
there's
a
lot
of
interest
from
users
to
be
able
to
not
only
push
but
also
be
able
to
pull
images
from
between
harbor
and
other
registries.
C
So
we
added
support
for
docker
registry
for
docker
hub
for
the
huawei
cloud
registry,
and
now
we're
also
going
to
add
support
for
additional
registries
in
the
future.
And
now
what
you
can
do
is
you
can
use
a
lot
of
the
our
bag,
the
policy,
the
enforcement
around
CVEs
and
vulnerability
scanning
in
harbor.
So
you
can
be
assured
that
your
images
are
secure
when
they're
in
harbor
and
then
you
can
push
those
images
to
the
edge
to
the
branch
office
to
another
data
center
using
the
replication
feature.
C
B
Thanks
Michael
and
so
in
this
demo.
What
I'm
going
to
do
demo
is
that,
as
you
can
see,
there
are
two
harbor
instances
and
there's
our
github
there's
the
talker
hub,
and
there
is
the
talker
natively
trees.
Tree
I
have
pretty
set
up
and
I'm
going
to
demo
replication
between
harbors
and
between
docker,
hub
and
harbor
and
and
between
the
talker
native
registry
and
harbor
in
Tamil.
B
B
And
in
this
replication
juice,
what
you
need
to
describe
is
that
we're
all
we're
from
where
you
want
to
replicate
your
images
and
we
also
support
user
to
come
set
up
a
resource
filter
like
what
kind
of
name
is
space
is
what
time
attack
is
you
want
to
replicate
and
we
also
spoiled
both
image
and
ham
charts.
So
here
I
choose
boost
to
replicate
both
resources
to
the
harbour
instance,
and
also
we
will
create
automatically
create
an
image
based
on
your
destination,
replication
and
point.
B
B
So
then,
if
you
have
images
in
your
talker
hub
and
you
want
to
pull
public
images
into
your
harbour
repo-
and
you
can
also
create
a
talker
hub
registry
and
set
up
replication
rules,
so
in
this
demo,
I
have
setup
application
rule
which
will
copy
all
the
visible
copy.
A
harbour
core
image
from
go
harbour
repo
into
my
local
Harbor,
repo.
B
Yeah
we
also
support,
we
also
spot
a
push-based
so
in
in
the
third
step.
So
we
have
a
config
talking,
Native
villages
tree
and
then
we
will
push
the
harbor
core
image
which
is
replicated
from
docker
hub
to
talk
innately
registry,
and
here
there
are
two
additional
options
wise.
So
you
can
also
configure
over
whether
you
would
like
to
override
your
previous
image
or
not.
B
A
A
Yeah,
so
basically,
that's
all
the
content
for
the
for
this
introduction.
I
think
it's
a
quick
that
we
do
have
a
deep
tie
sessions
that
you
can
have
more
in-depth
knowledge
of
a
harbor
with
more
complicated
scenario,
more
Cambria
setup,
and
also
we
have
the
maintainer
z--
here
and
for
the
CNF
answer
bar
you
just
go
to
the
exhibition
hall
in
the
seminal
center
will
be
there
for
these
these
days.
A
A
You
know
community
nur
just
come
to
us
and
talk
to
us
about
what
what
you
want
to
do
and
how
we
can
collaborate
together
and
also
we
were
likely
hear
from
you
what
about
use
case
and
what
you
we
want
to
have
and
whether
or
whether
you
think
that
it's
helpful
to
watch
us
use
case
or
not
so
that's
T
and
for
this
content
for
out
slice,
but
really
because
we
have
all
the
many
nurse
on
site.
So
we
want
to
see
if
they
have
any
questions
that
we
can
help
you
answer.
E
As
a
bank,
we
are
using
Azure
container
registry
currently
just
to
push
and
pull
images.
What
we're
looking
for
is
I
think
harbor.
We
have
the
Red
Hat
clear
in
it,
so
we
can
scan
and
check
on
vulnerabilities,
but
of
course
the
question
would
be.
We
want
to
use
harbor
as
a
primary
registry
and
then
for
failover
replicate
to
at
your
container
registry.
Is
this
something
that
you
will
be
able
to
do
in
the
future?
Or
you
mean
H
a.
C
So
there's
a
couple
of
things
that
come
with
that
right.
So
there's
the
content,
which
is
your
data,
your
your
images,
your
ham,
charts
and
there's
the
arbok
configuration
so
as
a
first
step,
we'll
definitely
in
a
future
release
of
harbor
in
the
near
term
will
support
for
replicating
towards
the
Asha
registry
and
go
cloud
and
AWS
all
add
support
for
all
of
them.
The
second
part
we'll
use
around
the
config
will
work
on
that.
There
might
be
something
that
initially,
you
might
have
to
do
manually
or
create
some
form
of
scripting.
C
A
D
So
in
the
one
dollar
in
released,
we
categorize
the
configuration
into
like
system
setting
and
user
setting.
As
for
the
user
setting
you
have
to
set,
if
we
have
the
REST
API
to
do
this.
The
reason
for
that
is
in
some
fellow
or
scenario
the
configuration
value
will
be
remained
so
as
an
example
for
the
OID
C
setting.
D
If
you
want
to
automate
that
you
will
need
to
lunch
harbor
after
its
start,
you
call
the
REST
API
to
do
the
setting
there's
a
way
to
do
that.
You
cannot
do
that
in
environment
arrival,
because
that
will
you
will
have
to
way
to
set
the
same
configuration
value
and
when
there's
confliction
there
will
be
trouble.
That's
the
reason
behind
it.
G
So
can
we
integrate
Harper
with
communities
to
scan
images
in
the
pots
or
like
deployments
before
catching
them?
In
the
pub
images
like,
for
example,
there
is,
there
is
an
encore,
for
example,
they
have
ignition
controller,
so
you
can
use
it
and
using
validating
rope
hooks.
We
can
actually
do
this.
So
just
wonder
if
we
can
do
the
same.
C
If
someone
were
to
create
an
admission,
workbook
and
validating
webhook,
they
could
do
that
and
you
know
get
the
image
if
it's
not
already
in
harbor,
then
push
it
to
harbor,
scan
it,
get
back
data
and
then
approve
or
deny
that
takes
a
while,
though
so,
if
you're
gonna
go
through
all
the
process,
why
not
use
harbor
as
your
registry,
where
you
can
be
guaranteed
that
before
you
push
an
image
or
before
you
pull
an
image?
You're
always
have
a
clean
image.
C
So
one
of
the
policy
features
that
you
have
in
Harbor
is
that
on
a
per
project
basis,
you
can
define
what
your
threshold
for
vulnerabilities
is
in
images.
So
let's
say
we
scan
images.
Every
night
you
can
say:
don't
allow
anybody
to
pull
an
image
if
it
has
medium
severity.
Cds
present,
so
harbor
itself
can
help.
You
enforce
a
policy.
Well,
you
don't
have
to
create
a
web.
Who
can
do
that.
H
D
I
didn't
hear
your
complete
question,
but
basically
we
elaborate
without
her
distribution.
It
runs
as
the
separate
process.
We
said
it
to
the
read-only
mode.
After
that
we
run
the
GC
command
and
it
will
no
check
with
manifest
and
account
the
reference
number.
So
when
the
layest
reference
number
is
zero,
it
get
written.
That's
yeah
overall,
how
it
works,
did
I
answer
your
question.
D
D
A
I
mean
we
are
running
out
of
time,
but
one
more
minute
is
that
we
have
a
community
meeting
here
you
can
see
here
is
that
we
have
bi-weekly
meeting
in
this
zoom
call
it's
on
Wednesday
every
Wednesday
bi-weekly
wednesday.
I
saw
vailable
on
our
community
here
kid
hub.
If
you're
interested
you
can
join
our
zoom
call
every
two
months
at
every
two
weeks
so
that
you
can
talk
to
us.
We
are.
We
are
they're
so
easy
to
find.
You
can
email
us
all
the
channels,
okay,
yeah.
Thank
you.
Thank
you
very
much
for
this.