Skip to content

Commit

Permalink
Update docker distribution to Distribution/Distribution
Browse files Browse the repository at this point in the history
Signed-off-by: Yang Jiao <yang.jiao@broadcom.com>
  • Loading branch information
YangJiao0817 committed Jan 17, 2024
1 parent ec8a9d2 commit ffb4e25
Show file tree
Hide file tree
Showing 13 changed files with 80 additions and 80 deletions.
30 changes: 15 additions & 15 deletions content/blog/harbor-1.10-release.md
Original file line number Diff line number Diff line change
Expand Up @@ -9,13 +9,13 @@ showPageInfo: true

We are excited to announce Harbor 1.10, a release that hardens security and adds security-related features, including a pluggable scanner framework that lets you pair Harbor with popular image scanners, such as Anchore Enterprise and Trivy by Aqua Security.

The Harbor project improved its security posture by identifying and fixing vulnerabilities after undergoing multiple internal and external penetration tests. We now also have a vulnerability [disclosure process](https://github.com/goharbor/harbor/security/policy) that allows the Harbor project to respond to threats in the future.
The Harbor project improved its security posture by identifying and fixing vulnerabilities after undergoing multiple internal and external penetration tests. We now also have a vulnerability [disclosure process](https://github.com/goharbor/harbor/security/policy) that allows the Harbor project to respond to threats in the future.

Let’s dive into some of the latest developments.

## Vulnerability Scanning with Pluggable Scanners

Harbor has long been able to scan images in your repositories for security vulnerabilities or exposures by using [Clair](https://github.com/quay/clair). Harbor now extends its scanning capabilities with its out-of-tree [pluggable scanners](https://github.com/goharbor/community/blob/master/proposals/pluggable-image-vulnerability-scanning_proposal.md).
Harbor has long been able to scan images in your repositories for security vulnerabilities or exposures by using [Clair](https://github.com/quay/clair). Harbor now extends its scanning capabilities with its out-of-tree [pluggable scanners](https://github.com/goharbor/community/blob/master/proposals/pluggable-image-vulnerability-scanning_proposal.md).

Any cloud native security vendor that has a container image scanner, be it open source or commercial software, can provide an adapter service that implements the [Harbor scanner API](https://editor.swagger.io/?url=https://raw.githubusercontent.com/goharbor/pluggable-scanner-spec/master/api/spec/scanner-adapter-openapi-v1.0.yaml) specification and integrate with Harbor’s scanning workflows. Once the adapter is deployed and mounted at a URL endpoint accessible to Harbor, you can create a corresponding scanner registration under the Interrogation Services settings to activate the underlying scanner.

Expand Down Expand Up @@ -43,13 +43,13 @@ You can also leverage your existing licenses for commercial scanners, such as An

## Immutable Tags

Harbor system and project administrators can now configure images as immutable, which means another image with matching tags cannot be pushed into the same project in Harbor, thus avoiding accidental overwrites. The Docker distribution does not natively enforce this image tag to image digest mapping, and this behavior can be undesirable for certain release tags that rarely if ever should be tampered with. For example, tags such as ‘rc’, ‘test’, ‘prod’, ‘nightly’ will, over the course of their lifetime, likely migrate across different images as new images are pushed to Harbor while version-specific tags, such as Harbor_v1.6.1, Harbor_v1.7.2, and Harbor_v1.8.3, should be immutable because they are meant to represent a point-in-time snapshot. Once released, a version such as ‘Harbor_v1.8.1’ should never be changed, and any changes should be reflected on the next version, such as ‘Harbor_v1.8.2’. This freezing mechanism provides image traceability and guarantees that an immutable image will always have the same behavior regardless of how subsequent images are pushed, tagged, or retagged. Image immutability can be configured for an entire project, specific repositories, specific tags, or any combination of these.
Harbor system and project administrators can now configure images as immutable, which means another image with matching tags cannot be pushed into the same project in Harbor, thus avoiding accidental overwrites. The Distribution/Distribution does not natively enforce this image tag to image digest mapping, and this behavior can be undesirable for certain release tags that rarely if ever should be tampered with. For example, tags such as ‘rc’, ‘test’, ‘prod’, ‘nightly’ will, over the course of their lifetime, likely migrate across different images as new images are pushed to Harbor while version-specific tags, such as Harbor_v1.6.1, Harbor_v1.7.2, and Harbor_v1.8.3, should be immutable because they are meant to represent a point-in-time snapshot. Once released, a version such as ‘Harbor_v1.8.1’ should never be changed, and any changes should be reflected on the next version, such as ‘Harbor_v1.8.2’. This freezing mechanism provides image traceability and guarantees that an immutable image will always have the same behavior regardless of how subsequent images are pushed, tagged, or retagged. Image immutability can be configured for an entire project, specific repositories, specific tags, or any combination of these.

![Immutability rule](../img/immutability-rule.png)

## OIDC Support Enhancements

In large organizations, identity and permissions are controlled through membership in groups. This is important because permissions can be tied to a group, and different software solutions can leverage the same groups. As an administrator, you only have to add a new employee to the appropriate group to get the correct permissions rather than having to modify multiple software solutions individually. To achieve parity with LDAP and Active Directory group functionality, version 1.10 adds support for OIDC groups. As a project administrator, you can now authorize an OIDC group for a role in Harbor. Members of that group can log in through an OIDC identity provider and inherit the permissions of the groups to which they belong. After an OIDC group is added as a member to a project with a set of permissions associated with a Harbor role, such as that of developers, all users within the OIDC group inherit the same permissions for the project when they log in. Group membership facilitates login workflows for large groups and lets you manage project permissions directly in the registry.
In large organizations, identity and permissions are controlled through membership in groups. This is important because permissions can be tied to a group, and different software solutions can leverage the same groups. As an administrator, you only have to add a new employee to the appropriate group to get the correct permissions rather than having to modify multiple software solutions individually. To achieve parity with LDAP and Active Directory group functionality, version 1.10 adds support for OIDC groups. As a project administrator, you can now authorize an OIDC group for a role in Harbor. Members of that group can log in through an OIDC identity provider and inherit the permissions of the groups to which they belong. After an OIDC group is added as a member to a project with a set of permissions associated with a Harbor role, such as that of developers, all users within the OIDC group inherit the same permissions for the project when they log in. Group membership facilitates login workflows for large groups and lets you manage project permissions directly in the registry.

## Limited Guest

Expand All @@ -64,11 +64,11 @@ This release saw significant contributions from the community in vulnerability r

## Roadmap for Harbor 2.0

With [Harbor 2.0](https://github.com/orgs/goharbor/projects/1) aiming to transform itself into a fully OCI-compliant registry, Harbor hopes to be able to host new cloud native artifact types, such as operators, bundles, and RPMs, through supporting a common set of industry-favored APIs called [Open Container Initiative](https://www.opencontainers.org/). This also means that based on an artifact’s type, Harbor would correctly support all corresponding actions of these artifacts, such as when they need to be pushed, scanned, pulled, replicated, and so forth. A direct beneficiary of the proposed refactoring to support OCI would be the ability to delete a single tag off Harbor without deleting all other tags referenced by the same underlying manifest, a major improvement over the Docker distribution. Our plans would also deliver a major enhancement to the current online garbage collection by enabling a non-blocking mechanism that allows you to push images to the registry while garbage collection is taking place, boosting performance and making garbage collection virtually undetectable.
With [Harbor 2.0](https://github.com/orgs/goharbor/projects/1) aiming to transform itself into a fully OCI-compliant registry, Harbor hopes to be able to host new cloud native artifact types, such as operators, bundles, and RPMs, through supporting a common set of industry-favored APIs called [Open Container Initiative](https://www.opencontainers.org/). This also means that based on an artifact’s type, Harbor would correctly support all corresponding actions of these artifacts, such as when they need to be pushed, scanned, pulled, replicated, and so forth. A direct beneficiary of the proposed refactoring to support OCI would be the ability to delete a single tag off Harbor without deleting all other tags referenced by the same underlying manifest, a major improvement over the Distribution/Distribution. Our plans would also deliver a major enhancement to the current online garbage collection by enabling a non-blocking mechanism that allows you to push images to the registry while garbage collection is taking place, boosting performance and making garbage collection virtually undetectable.

## About Harbor

[Harbor](http://goharbor.io) is an open source trusted cloud native registry project that stores, signs, and scans container images and Helm charts. Harbor extends the open source Docker Distribution by adding key enterprise-level features in authentication and access control (LDAP and AD as well as OIDC support for RBAC), two-way replication to and from other third-party registries, advanced online non-blocking garbage collection, and authenticity and provenance capabilities through third-party image scanning and signing solutions. Harbor, which supports Docker Compose and Kubernetes, deploys in under 30 minutes. Harbor can be fully managed through a single web console and comes with a rich set of APIs managed withSwagger.
[Harbor](http://goharbor.io) is an open source trusted cloud native registry project that stores, signs, and scans container images and Helm charts. Harbor extends the open source Distribution/Distribution by adding key enterprise-level features in authentication and access control (LDAP and AD as well as OIDC support for RBAC), two-way replication to and from other third-party registries, advanced online non-blocking garbage collection, and authenticity and provenance capabilities through third-party image scanning and signing solutions. Harbor, which supports Docker Compose and Kubernetes, deploys in under 30 minutes. Harbor can be fully managed through a single web console and comes with a rich set of APIs managed withSwagger.

## Collaborate with the Harbor Community!

Expand All @@ -80,18 +80,18 @@ Collaborate with us on GitHub: [github.com/goharbor/harbor](https://github.com/g

---

Alex Xu
Harbor Contributor
Product Manager, VMware
github.com/xaleeks
Alex Xu
Harbor Contributor
Product Manager, VMware
github.com/xaleeks

Daniel Pacak
Harbor Maintainer
OSS Engineer, Aqua Security
github.com/danielpacak
Daniel Pacak
Harbor Maintainer
OSS Engineer, Aqua Security
github.com/danielpacak

[1]: https://github.com/anchore/harbor-scanner-adapter
[2]: https://github.com/aquasecurity/harbor-scanner-aqua
[3]: https://github.com/goharbor/harbor-scanner-clair
[4]: https://github.com/dosec-cn/harbor-scanner
[5]: https://github.com/aquasecurity/harbor-scanner-trivy
[5]: https://github.com/aquasecurity/harbor-scanner-trivy
30 changes: 15 additions & 15 deletions content/blog/harbor-1.9.md
Original file line number Diff line number Diff line change
Expand Up @@ -7,11 +7,11 @@ date: 2019-09-18T01:00:00+04:00
showPageInfo: true
---

We are excited to announce the release of Harbor version 1.9, arguably one of our biggest releases packed with several long-awaited features that the open source community has asked for. Thanks to all the members of the community who made contributions to these features, and special thanks in particular to 360 Total Security, Hyland Software, NetEase Cloud, and VMware. With this release, Harbor introduces some key new features:
1. Tag retention and project quotas that strengthen image lifecycle management and security
2. Webhook notifications that enable the integration of Harbor with CI/CD tools
3. Replication targets for the registry services of all the major cloud providers to let you replicate projects based on your business needs
4. CVE exception policies and syslog integration that bring an additional layer of management and security capabilities to Harbor operators
We are excited to announce the release of Harbor version 1.9, arguably one of our biggest releases packed with several long-awaited features that the open source community has asked for. Thanks to all the members of the community who made contributions to these features, and special thanks in particular to 360 Total Security, Hyland Software, NetEase Cloud, and VMware. With this release, Harbor introduces some key new features:
1. Tag retention and project quotas that strengthen image lifecycle management and security
2. Webhook notifications that enable the integration of Harbor with CI/CD tools
3. Replication targets for the registry services of all the major cloud providers to let you replicate projects based on your business needs
4. CVE exception policies and syslog integration that bring an additional layer of management and security capabilities to Harbor operators

Let’s deep dive into some of these features.

Expand Down Expand Up @@ -40,23 +40,23 @@ Harbor currently limits the ability to run certain images that have been scanned

## Replication Improvements

Following the announcement in version 1.8 of cross-registry artifact replication between Harbor and registries such as Docker Hub and Huawei Cloud, version 1.9 expands these capabilities to most major cloud provider registries, such as Amazon Elastic Container Registry, Azure Container Registry, Google Container Registry, and Alibaba Container Registry. Harbor enables seamless two-way replication to third-party registries to meet a multitude of needs and use cases.
Following the announcement in version 1.8 of cross-registry artifact replication between Harbor and registries such as Docker Hub and Huawei Cloud, version 1.9 expands these capabilities to most major cloud provider registries, such as Amazon Elastic Container Registry, Azure Container Registry, Google Container Registry, and Alibaba Container Registry. Harbor enables seamless two-way replication to third-party registries to meet a multitude of needs and use cases.

## Community Call to Action

The 1.9 release saw more input and contributions from the community than ever before whether they be feature testing and bug reporting, sharing requirements and best practices needed for an enterprise registry, or putting forth quality code contributions in a timely fashion. As of this posting, we’re already hard at work on the 1.10 release. Key features include creating a plug-n-play experience for third-party image scanners including supporting Aqua and Anchore, creating a Harbor operator for smarter deployments, and creating image tag immutability. Hop over to the [Harbor project board](http://github.com/orgs/goharbor/projects/1) for the most up-to-date status of the ongoing release and identify areas of interest for contribution. Contributions can be in the form of providing scenario requirements, testing, documentation, bug fixing, or introducing new features to Harbor.

## About Harbor

[Harbor](http://github.com/goharbor/harbor) is an open source trusted cloud native registry project that stores, signs, and scans container images and Helm charts. Harbor extends the open source Docker Distribution by adding key enterprise-level features in authentication and access control (LDAP/AD as well as OIDC support with RBAC), two-way replication to other third-party registries, advanced online garbage collection, and authenticity and provenance capabilities through image scanning and signing. Harbor deploys in under 30 minutes, can be fully managed through a single web console, and comes with a rich set of APIs.
[Harbor](http://github.com/goharbor/harbor) is an open source trusted cloud native registry project that stores, signs, and scans container images and Helm charts. Harbor extends the open source Distribution/Distribution by adding key enterprise-level features in authentication and access control (LDAP/AD as well as OIDC support with RBAC), two-way replication to other third-party registries, advanced online garbage collection, and authenticity and provenance capabilities through image scanning and signing. Harbor deploys in under 30 minutes, can be fully managed through a single web console, and comes with a rich set of APIs.

## Collaborate with the Harbor Community!

Get updates on Twitter ([@project_harbor](https://twitter.com/project_harbor))
Chat with us on Slack ([#harbor](https://cloud-native.slack.com/messages/harbor) on the [CNCF Slack](https://slack.cncf.io/))
Collaborate with us on GitHub: [github.com/goharbor/harbor](https://github.com/goharbor/harbor)
Alex Xu
Harbor Contributor
Product Manager, VMware
[github.com/xaleeks](http://github.com/xaleeks)
Get updates on Twitter ([@project_harbor](https://twitter.com/project_harbor))
Chat with us on Slack ([#harbor](https://cloud-native.slack.com/messages/harbor) on the [CNCF Slack](https://slack.cncf.io/))
Collaborate with us on GitHub: [github.com/goharbor/harbor](https://github.com/goharbor/harbor)

Alex Xu
Harbor Contributor
Product Manager, VMware
[github.com/xaleeks](http://github.com/xaleeks)
8 changes: 4 additions & 4 deletions content/blog/harbor-2.0.md
Original file line number Diff line number Diff line change
Expand Up @@ -166,7 +166,7 @@ Webinar on Harbor v2.0 on May 28, 2020 at 10:00am PDT by registering
[Harbor](http://github.com/goharbor/harbor) is an open source, trusted
cloud native registry project that stores, signs, and scans container
images, Helm charts, and any other OCI-compliant artifacts. Harbor
extends the open-source Docker Distribution by adding key
extends the open-source Distribution/Distribution by adding key
enterprise-level features in authentication and access control (LDAP and
AD as well as OIDC support for RBAC), two-way replication to and from
other third-party registries, advanced garbage collection, and
Expand All @@ -192,7 +192,7 @@ github.com/goharbor/harbor](https://github.com/goharbor/harbor)
Attend the community meetings:
[https://github.com/goharbor/community/wiki/Harbor-Community-Meetings](https://github.com/goharbor/community/wiki/Harbor-Community-Meetings)

Alex Xu
Harbor Contributor
Senior Product Manager, VMware
Alex Xu
Harbor Contributor
Senior Product Manager, VMware
[@xaleeks](https://github.com/xaleeks)

0 comments on commit ffb4e25

Please sign in to comment.