Harbor Registry Using a Harbor registry, you can host container images in a local, private Docker registry. Harbor is an extension of the basic Docker registry that implements access controls, identity connect to a Harbor Registry to retrieve container images on other systems. This chapter contains the following topic: • Using Harbor Registry in Tenant Clusters, on page 1 • Using Harbor Chartmuseum Chartmuseum in Tenant Clusters, on page 2 Using Harbor Registry in Tenant Clusters Follow these steps to create a new tenant cluster with access to the Harbor registry: Step 1 Obtain the Ingress Root CA Certificate

Harbor Deep Dive Open source trusted cloud native registry Henry Zhang, Chief Architect, VMware R&D China Steven Zou, Staff Engineer, VMware R&D China Nov. 2018 goharbor.io Initiated by VMware https://github.com/go harbor/harbor/ Apache 2.0 license An open source trusted cloud native registry project HARBOR More integrations in future Harbor Project History Harbor Community Harbor Users and Partners image and chart Harbor Architecture API Routing API Routing Core Service (API/Auth/GUI) Image Registry Trusted Content Vulnerability Scanning Job Service Admin Service Harbor components 3rd

1 Harbor James Zabala Maintainer Harbor Focus Harbor is a trusted cloud native registry that stores, signs, and scans content. The mission is to provide cloud native environments the ability to confidently 2 Introduction to Harbor 3 Image Consistency 4 Image Security 5 Image Distribution 6 Registry Robustness / High Availability 4 Agenda 1 Containers 101 2 Introduction to Harbor 3 Image Consistency Image Distribution 6 Registry Robustness / High Availability 5 6 Images Containers Stop Start Restart Run Commit Dockerfile Build tag tar archive Save Load Push Registry Images Pull Lifecycle

Containers Docker compatible interface Container management portal Enterprise-class container registry Familiarity of vSphere No new tooling or technologies Full enterprise-grade power of Software-Defined (PKS) 9 ©2018 VMware, Inc. Kubernetes Is Only One Layer of the Container Service Stack Image Registry Framework Lifecycle Management Security and Networking Persistence Virtual Infrastructure Physical Infrastructure vRealize Suite NSX-T BOSH (K8s LCM) BOSH (cluster LCM) Kubernetes Harbor P K S 10 ©2018 VMware, Inc. PKS on VMware SDDC Rapidly deliver and operationalize next-generation

monitoring system - prometheus • Alertmanager to invoke various alert and related actions docker registry Kubernetes Cluster Kubernetes Cluster CRD and Operator Design BuildJob DevOps Operator Job environment variables image information - volumes Storage Service rbd / nfs / glisters pvc pvc pvc registry credential using secret - resources Memory / CPU / GPU Data cache CI/CD Examples - Artifact Trigger with payload Sonar tool Image Jenkins API Image • Gitlab webhook • On schedule • Registry notification • Encapsulate API / SDK of third party tools to docker image • Pass events from

3 3 Centralized Audit 4 3 3 2 Cluster Self-Service Provisioning 4 4 4 1 Private Registry & Image Management 3 4 4 2 Cluster Upgrades & Version Management 4 4 2 2 Storage Support user cluster, end users can access it according to Kubernetes RBAC boundaries. 3.1.11 Private Registry and Image Management • SUSE Rancher: 3 • OpenShift: 4 • Tanzu: 4 • Anthos: 2 3.1 users can enter their registry credentials. These are saved as Kubernetes Secrets and used when pulling from private registries. SUSE Rancher does not provide its own registry solutions but partners

3 The Virtual Media Manager VirtualBox keeps an internal registry of all available hard disk, CD/DVD-ROM and floppy disk images. This registry can be viewed and changed in the Virtual Media Manager, which image files from your hard drive into VirtualBox using the “Add” button; • remove an image from the registry (and optionally delete the image file when doing so); • “release” an image, that is, detach it configuration file. This includes global configuration options and the media and virtual machine registry. The media registry links to all CD/DVD, floppy and disk images that have been added to the Virtual Media

currently attached to, if any. The Virtual Media Manager allows you to • remove an image from the registry (and optionally delete the image file when doing so); • “release” an image, that is, detach it VBoxManage closemedium This commands removes a hard disk, DVD or floppy image from a VirtualBox media registry.2 Optionally, you can request that the image be deleted. You will get appropriate diagnostics that attached to a virtual machine; that call “registered” the medium with the global VirtualBox media registry. With VirtualBox 4.0 this is no longer necessary; media are added to media registries automatically

currently attached to, if any. The Virtual Media Manager allows you to • remove an image from the registry (and optionally delete the image file when doing so); • “release” an image, that is, detach it VBoxManage closemedium This commands removes a hard disk, DVD or floppy image from a VirtualBox media registry.2 Optionally, you can request that the image be deleted. You will get appropriate diagnostics that attached to a virtual machine; that call “registered” the medium with the global VirtualBox media registry. With VirtualBox 4.0 this is no longer necessary; media are added to media registries automatically

currently attached to, if any. The Virtual Media Manager allows you to • remove an image from the registry (and optionally delete the image file when doing so); • “release” an image, that is, detach it VBoxManage closemedium This commands removes a hard disk, DVD or floppy image from a VirtualBox media registry.2 Optionally, you can request that the image be deleted. You will get appropriate diagnostics that attached to a virtual machine; that call “registered” the medium with the global VirtualBox media registry. With VirtualBox 4.0 this is no longer necessary; media are added to media registries automatically