Switch from Dockerhub to public VMware Harbor registry (projects.registry.vmware.com)

[antoninbas]

Describe what you are trying to solve
Docker recently introduced rate limiting for pull requests on DockerHub (https://docs.docker.com/docker-hub/download-rate-limit/), and the rate limiting is only supposed to get more stringent in the future. To avoid rate limiting, users can upgrade to a paid account.

Because Antrea is supported by VMware, we have access to a public Harbor registry hosted by VMware. Images cannot be pushed to the registry from outside of the VMware corporate network. However, the registry supports a Dockerhub mirroring functionality, which we have already enabled for the antrea Docker organization. So we continue pushing images to Dockerhub and they will be available in Harbor after ~15 minutes.

This means that all the antrea images from Dockerhub (antrea/*) can be pulled from the Harbor registry instead (projects.registry.vmware.com/antrea/*).

However, all our manifests / scripts / source code still use the default Docker registry (Dockerhub). This means that developers & users will keep running into rate limiting issues, unless for each image, they 1) pull the image manually from Harbor and 2) re-tag the pulled image so that it matches the name we expect. This is essentially what we started doing for CI jobs (#1521).

Describe the solution you have in mind
We should update all our manifests / scripts / source code to use projects.registry.vmware.com to avoid rate limiting altogether.

• Move to projects.registry.vmware.com for user-facing image pulls (update manifests) - v0.12.0
• Move everything to projects.registry.vmware.com if needed (for devs and CI)

Describe how your solution impacts user flows
May be a bit surprising to users at first to see that we do not use the default Docker registry. But the Harbor registry is public so from a user experience perspective there should be no difference at all. There is a small delay (15 minutes) before new tags are actually available in Harbor (periodic sync with Dockerhub) but it should also not be an issue for users.

Alternative solutions that you considered
Paid account for the antrea organization on Dockerhub, but I believe it would only help for organization members. It would not remove rate limiting restrictions for Antrea users:

Rate limits for Docker image pulls are based on the account type of the user requesting the image - not the account type of the image’s owner.

Test plan
N/A

[antoninbas]

Something to keep an eye on if we run into any issue / limitation with the VMware Harbor registry: https://aws.amazon.com/about-aws/whats-new/2020/12/announcing-amazon-ecr-public-and-amazon-ecr-public-gallery/

[antoninbas]

All "user-facing" images (antrea/antrea-ubuntu, antrea/antrea-windows, antrea/octant-antrea-ubuntu) are now pulled from projects.registry.vmware.com, and the YAML manifests have been updated.

Keeping this issue open as we are still pulling images from Dockerhub as part of the build process, so devs may run into rate-limiting issues when building. Github Actions CI jobs are not affected at this stage.

[github-actions]

This issue is stale because it has been open 180 days with no activity. Remove stale label or comment, or this will be closed in 180 days