mirror of
https://github.com/goharbor/harbor
synced 2024-09-20 16:35:44 +00:00
Attempting to configure subsections correctly
This commit is contained in:
Stuart Clements
parent
9f1f214262
commit
00230832eb
|
|
@ -30,11 +30,11 @@ This section describes how to use and maintain Harbor after deployment. These da
|
|||
- [Configure Database Authentication](administration/configure-authentication/db-auth.md)
|
||||
- [Configure LDAP/Active Directory Authentication](administration/configure-authentication/ldap-auth.md)
|
||||
- [Configure OIDC Provider Authentication](administration/configure-authentication/oidc-auth.md)
|
||||
- [Role Based Access Control](administration/managing-users/rbac.md)
|
||||
- [Managing Users](administration/managing-users/_index.md)
|
||||
- [User Permissions By Role](administration/managing-users/user-permissions-by-role.md)
|
||||
- [Create User Accounts in Database Mode](administration/managing-users/create-users-db.md)
|
||||
- [Configure Global Settings](administration/general-settings.md)
|
||||
- [Configure Project Quotas](administration/configure-project-quotas.md)
|
||||
- [Configure Global Settings](administration/general-settings/_index.md)
|
||||
- [Configure Project Quotas](administration/configure-project-quotas/_index.md)
|
||||
- [Configuring Replication](administration/configuring-replication/_index.md)
|
||||
- [Create Replication Endpoints](administration/configuring-replication/create-replication-endpoints.md)
|
||||
- [Create Replication Rules](administration/configuring-replication/create-replication-rules.md)
|
||||
|
|
@ -46,7 +46,7 @@ This section describes how to use and maintain Harbor after deployment. These da
|
|||
- [Schedule Scans](administration/vulnerability-scanning/schedule-scans.md)
|
||||
- [Import Vulnerability Data to an Offline Harbor instance](administration/vulnerability-scanning/import-vulnerability-data.md)
|
||||
- [Configure System-Wide CVE Whitelists](administration/vulnerability-scanning/configure-system-whitelist.md)
|
||||
- [Garbage Collection](administration/garbage-collection.md)
|
||||
- [Garbage Collection](administration/garbage-collection/_index.md)
|
||||
- [Upgrade Harbor and Migrate Data](administration/upgrade/upgrade-migrate-data.md)
|
||||
- [Upgrading Harbor Deployed with Helm](administration/upgrade/helm-upgrade.md)
|
||||
- [Roll Back an Upgrade](administration/upgrade/roll-back-upgrade.md)
|
||||
|
|
@ -57,9 +57,9 @@ This section describes how to use and maintain Harbor after deployment. These da
|
|||
This section describes how users with the developer, master, and project administrator roles manage and participate in Harbor projects.
|
||||
|
||||
- [Introduction](working-with-projects/_index.md)
|
||||
- [Create Projects](working-with-projects/create-projects.md)
|
||||
- [Create Projects](working-with-projects/create-projects/_index.md)
|
||||
- [Assign Users to a Project](working-with-projects/add-users.md)
|
||||
- [Project Configuration](working-with-projects/project-configuration.md)
|
||||
- [Project Configuration](working-with-projects/project-configuration/_index.md)
|
||||
- [Access and Search Project Logs](working-with-projects/access-project-logs.md)
|
||||
- [Create Robot Accounts](working-with-projects/create-robot-accounts.md)
|
||||
- [Configure Webhook Notifications](working-with-projects/configure-webhooks.md)
|
||||
|
|
@ -72,6 +72,7 @@ This section describes how users with the developer, master, and project adminis
|
|||
- [Create Tag Retention Rules](working-with-projects/create-tag-retention-rules.md)
|
||||
- [Create Tag Immutability Rules](working-with-projects/create-tag-immutability-rules.md)
|
||||
- [Manage Kubernetes Packages with Helm Charts](working-with-projects/managing-helm-charts.md)
|
||||
- [Using API Explorer](working-with-projects/using-api-explorer/_index.md)
|
||||
|
||||
## Build, Customize, and Contribute to Harbor
|
||||
|
||||
|
|
|
|||
|
|
@ -8,15 +8,15 @@ This documentation includes the following sections:
|
|||
|
||||
## Harbor Installation and Configuration
|
||||
|
||||
This section describes how to install Harbor and perform the required initial configurations. These day 1 operations are performed by the Harbor Administrator. [Read more](install-config/_index.md)
|
||||
This section describes how to install Harbor and perform the required initial configuration. These day 1 operations are performed by the Harbor Administrator. [Read more](install-config/_index.md)
|
||||
|
||||
## Harbor Administration
|
||||
|
||||
This section describes how to use and maintain Harbor after deployment. These day 2 operations are performed by the Harbor Administrator. [Read more](administration/_index.md)
|
||||
This section describes how to use and maintain your Harbor registry instance after deployment. These day 2 operations are performed by the Harbor Administrator. [Read more](administration/_index.md)
|
||||
|
||||
## Working with Harbor Projects
|
||||
|
||||
This section describes how users with the developer, master, and project administrator roles manage and participate in Harbor projects. [Read more](working-with-projects/_index.md)
|
||||
This section describes how users with the developer, master, and project administrator roles manage users, and create, configure, and participate in Harbor projects. [Read more](working-with-projects/_index.md)
|
||||
|
||||
## Building, Customizing, and Contributing to Harbor
|
||||
|
||||
|
|
|
|||
|
|
@ -8,10 +8,10 @@ This section describes how to configure and maintain Harbor after deployment. Th
|
|||
The operations that are performed by the Harbor system administrator are the following.
|
||||
|
||||
- Select database, LDAP/Active Directory, or OIDC based authentication. For information, see [Configuring Authentication](configure-authentication).
|
||||
- Add users in database authentication mode and assign the system administrator role to other users. For information, see [Role Based Access Control](managing-users/rbac.md).
|
||||
- Configure global settings, such as configuring an email server, setting the registry to read-only mode, and restriction who can create projects. For information, see [Configure Global Settings](../general-settings.md).
|
||||
- Apply resource quotas to projects. For information, see [Configure Project Quotas](../configure-project-quotas.md).
|
||||
- Add users in database authentication mode and assign the system administrator role to other users. For information, see [Managing Users](managing-users).
|
||||
- Configure global settings, such as configuring an email server, setting the registry to read-only mode, and restriction who can create projects. For information, see [Configure Global Settings](general-settings).
|
||||
- Apply resource quotas to projects. For information, see [Configure Project Quotas](configure-project-quotas).
|
||||
- Set up replication of images between Harbor and another Harbor instance or a 3rd party replication target. For information, see [Configuring Replication](configuring-replication).
|
||||
- Set up vulnerability scanners to check the images in the registry for CVE vulnerabilities. For information, see [Vulnerability Scanning](vulnerability-scanning).
|
||||
- Perform garbage collection, to remove unnecessary data from Harbor. For information, see [Garbage Collection](../garbage-collection.md).
|
||||
- Perform garbage collection, to remove unnecessary data from Harbor. For information, see [Garbage Collection](garbage-collection).
|
||||
- Upgrade Harbor when a new version becomes available. For information, see [Upgrading Harbor](upgrade/upgrade-migrate-data.md).
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
---
|
||||
title: Configuring Authentication
|
||||
weight: 5
|
||||
weight: 10
|
||||
---
|
||||
|
||||
Harbor supports different modes for authenticating users and managing user accounts. You should select an authentication mode as soon as you deploy Harbor.
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
---
|
||||
title: Configure Project Quotas
|
||||
weight: 20
|
||||
weight: 25
|
||||
---
|
||||
|
||||
To exercise control over resource use, as a Harbor system administrator you can set quotas on projects. You can limit the number of tags that a project can contain and limit the amount of storage capacity that a project can consume. You can set default quotas that apply to all projects globally.
|
||||
|
|
@ -1,6 +1,6 @@
|
|||
---
|
||||
title: Configuring Replication
|
||||
weight: 15
|
||||
weight: 30
|
||||
---
|
||||
|
||||
Replication allows users to replicate resources, namely images and charts, between Harbor and non-Harbor registries, in both pull or push mode.
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
---
|
||||
title: Garbage Collection
|
||||
weight: 25
|
||||
weight: 40
|
||||
---
|
||||
|
||||
When you delete images from Harbor, space is not automatically freed up. You must run garbage collection to free up space by removing blobs that are no longer referenced by a manifest from the file system.
|
||||
|
|
@ -1,6 +1,6 @@
|
|||
---
|
||||
title: Configure Global Settings
|
||||
weight: 15
|
||||
weight: 20
|
||||
---
|
||||
|
||||
You can configure Harbor to connect to an email server, set the registry in read-only mode, and configure Harbor so that only system administrators can create projects.
|
||||
|
|
@ -1,4 +1,33 @@
|
|||
---
|
||||
title: Managing Users
|
||||
weight: 10
|
||||
weight: 15
|
||||
---
|
||||
|
||||
Harbor manages images through projects. You provide access to these images to users by including the users in projects and assigning one of the following roles to them.
|
||||
|
||||
|
||||
|
||||
* **Limited Guest**: A Limited Guest does not have full read privileges for a project. They can pull images but cannot push, and they cannot see logs or the other members of a project. For example, you can create limited guests for users from different organizations who share access to a project.
|
||||
* **Guest**: Guest has read-only privilege for a specified project. They can pull and retag images, but cannot push.
|
||||
* **Developer**: Developer has read and write privileges for a project.
|
||||
* **Master**: Master has elevated permissions beyond those of 'Developer' including the ability to scan images, view replications jobs, and delete images and helm charts.
|
||||
* **ProjectAdmin**: When creating a new project, you will be assigned the "ProjectAdmin" role to the project. Besides read-write privileges, the "ProjectAdmin" also has some management privileges, such as adding and removing members, starting a vulnerability scan.
|
||||
|
||||
Besides the above roles, there are two system-level roles:
|
||||
|
||||
* **Harbor system administrator**: "Harbor system administrator" has the most privileges. In addition to the privileges mentioned above, "Harbor system administrator" can also list all projects, set an ordinary user as administrator, delete users and set vulnerability scan policy for all images. The public project "library" is also owned by the administrator.
|
||||
* **Anonymous**: When a user is not logged in, the user is considered as an "Anonymous" user. An anonymous user has no access to private projects and has read-only access to public projects.
|
||||
|
||||
For full details of the permissions of the different roles, see [User Permissions By Role](../user-permissions-by-role.md).
|
||||
|
||||
If you run Harbor in database authentication mode, you create user accounts directly in the Harbor interface. For information about how to create local user accounts, see [Create User Accounts in Database Mode](../create-users-db.md).
|
||||
|
||||
If you run Harbor in LDAP/AD or OIDC authentication mode, you create and manage user accounts in your LDAP/AD or OIDC provider. Harbor obtains the users from the LDAP/AD or OIDC server and displays them in the **Users** tab of the Harbor interface.
|
||||
|
||||
## Assigning the Harbor System Administrator Role
|
||||
|
||||
Harbor system administrators can assign the Harbor system administrator role to other users by selecting usernames and clicking **Set as Administrator** in the **Users** tab.
|
||||
|
||||
|
||||
|
||||
To delete users, select a user and click `DELETE`. Deleting users is only supported under database authentication mode.
|
||||
|
|
|
|||
|
|
@ -3,31 +3,3 @@ title: Harbor Role Based Access Control (RBAC)
|
|||
weight: 15
|
||||
---
|
||||
|
||||
Harbor manages images through projects. You provide access to these images to users by including the users in projects and assigning one of the following roles to them.
|
||||
|
||||
|
||||
|
||||
* **Limited Guest**: A Limited Guest does not have full read privileges for a project. They can pull images but cannot push, and they cannot see logs or the other members of a project. For example, you can create limited guests for users from different organizations who share access to a project.
|
||||
* **Guest**: Guest has read-only privilege for a specified project. They can pull and retag images, but cannot push.
|
||||
* **Developer**: Developer has read and write privileges for a project.
|
||||
* **Master**: Master has elevated permissions beyond those of 'Developer' including the ability to scan images, view replications jobs, and delete images and helm charts.
|
||||
* **ProjectAdmin**: When creating a new project, you will be assigned the "ProjectAdmin" role to the project. Besides read-write privileges, the "ProjectAdmin" also has some management privileges, such as adding and removing members, starting a vulnerability scan.
|
||||
|
||||
Besides the above roles, there are two system-level roles:
|
||||
|
||||
* **Harbor system administrator**: "Harbor system administrator" has the most privileges. In addition to the privileges mentioned above, "Harbor system administrator" can also list all projects, set an ordinary user as administrator, delete users and set vulnerability scan policy for all images. The public project "library" is also owned by the administrator.
|
||||
* **Anonymous**: When a user is not logged in, the user is considered as an "Anonymous" user. An anonymous user has no access to private projects and has read-only access to public projects.
|
||||
|
||||
For full details of the permissions of the different roles, see [User Permissions By Role](../user-permissions-by-role.md).
|
||||
|
||||
If you run Harbor in database authentication mode, you create user accounts directly in the Harbor interface. For information about how to create local user accounts, see [Create User Accounts in Database Mode](../create-users-db.md).
|
||||
|
||||
If you run Harbor in LDAP/AD or OIDC authentication mode, you create and manage user accounts in your LDAP/AD or OIDC provider. Harbor obtains the users from the LDAP/AD or OIDC server and displays them in the **Users** tab of the Harbor interface.
|
||||
|
||||
## Assigning the Harbor System Administrator Role
|
||||
|
||||
Harbor system administrators can assign the Harbor system administrator role to other users by selecting usernames and clicking **Set as Administrator** in the **Users** tab.
|
||||
|
||||
|
||||
|
||||
To delete users, select a user and click `DELETE`. Deleting users is only supported under database authentication mode.
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
---
|
||||
title: Upgrade
|
||||
weight: 30
|
||||
weight: 45
|
||||
---
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
---
|
||||
title: Vulnerability Scanning
|
||||
weight: 20
|
||||
weight: 35
|
||||
---
|
||||
|
||||
Harbor provides static analysis of vulnerabilities in images through the open source [Clair](https://github.com/coreos/clair) project.
|
||||
|
|
|
|||
|
|
@ -161,7 +161,7 @@ You can use certificates that are signed by a trusted third-party CA, or you can
|
|||
</tr>
|
||||
</table>
|
||||
|
||||
### Optional parameters
|
||||
## Optional Parameters
|
||||
|
||||
The following table lists the additional, optional parameters that you can set to configure your Harbor deployment beyond the minimum required settings. To enable a setting, you must uncomment it in `harbor.yml` by deleting the leading `#` character.
|
||||
|
||||
|
|
@ -299,7 +299,7 @@ The following table lists the additional, optional parameters that you can set t
|
|||
The `harbor.yml` file includes options to configure a UAA CA certificate. This authentication mode is not recommended and is not documented.
|
||||
{{< /note >}}
|
||||
|
||||
### Configuring a Storage Backend {#backend}
|
||||
## Configuring a Storage Backend {#backend}
|
||||
|
||||
By default Harbor uses local storage for the registry, but you can optionally configure the `storage_service` setting so that Harbor uses external storage. For information about how to configure the storage backend of a registry for different storage providers, see the [Registry Configuration Reference](https://docs.docker.com/registry/configuration/#storage) in the Docker documentation. For example, if you use Openstack Swift as your storage backend, the parameters might resemble the following:
|
||||
|
||||
|
|
|
|||
|
|
@ -27,7 +27,7 @@ If you encounter any problems while using the demo server, open an [issue on Git
|
|||
1. Explore the default project, `library`.
|
||||
1. Click **New Project** to create your own project.
|
||||
|
||||
For information about how to create a project, see [Create a Project](../working-with-projects/create-projects.md).
|
||||
For information about how to create a project, see [Create a Project](../working-with-projects/create-projects/_index.md).
|
||||
|
||||
1. Open a Docker client and log in to Harbor with the credentials that you created above.
|
||||
|
||||
|
|
|
|||
|
|
@ -3,9 +3,7 @@ title: Deploying Harbor with High Availability via Helm
|
|||
weight: 40
|
||||
---
|
||||
|
||||
## Goal
|
||||
|
||||
Deploy Harbor on K8S via helm to make it highly available, that is, if one of node that has Harbor's container running becomes un accessible. Users does not experience interrupt of service of Harbor.
|
||||
You can deploy Harbor on Kubernetes via helm to make it highly available. In this way, if one of the nodes on which Harbor is running becomes unavailable, users do not experience interruptions of service.
|
||||
|
||||
## Prerequisites
|
||||
|
||||
|
|
@ -18,15 +16,13 @@ Deploy Harbor on K8S via helm to make it highly available, that is, if one of no
|
|||
|
||||
## Architecture
|
||||
|
||||
Most of Harbor's components are stateless now. So we can simply increase the replica of the pods to make sure the components are distributed to multiple worker nodes, and leverage the "Service" mechanism of K8S to ensure the connectivity across pods.
|
||||
Most of Harbor's components are stateless now. So we can simply increase the replica of the pods to make sure the components are distributed to multiple worker nodes, and leverage the "Service" mechanism of K8S to ensure the connectivity across pods.
|
||||
|
||||
As for storage layer, it is expected that the user provide high available PostgreSQL, Redis cluster for application data and PVCs or object storage for storing images and charts.
|
||||
|
||||
|
||||
|
||||
|
||||
## Usage
|
||||
|
||||
### Download Chart
|
||||
## Download Chart
|
||||
|
||||
Download Harbor helm chart:
|
||||
|
||||
|
|
@ -35,7 +31,7 @@ helm repo add harbor https://helm.goharbor.io
|
|||
helm fetch harbor/harbor --untar
|
||||
```
|
||||
|
||||
### Configuration
|
||||
## Configuration
|
||||
|
||||
Configure the followings items in `values.yaml`, you can also set them as parameters via `--set` flag during running `helm install`:
|
||||
|
||||
|
|
@ -65,7 +61,7 @@ Configure the followings items in `values.yaml`, you can also set them as parame
|
|||
- **Replica**
|
||||
Set `portal.replicas`, `core.replicas`, `jobservice.replicas`, `registry.replicas`, `chartmuseum.replicas`, `clair.replicas`, `notary.server.replicas` and `notary.signer.replicas` to `n`(`n`>=2).
|
||||
|
||||
### Installation
|
||||
## Installation
|
||||
|
||||
Install the Harbor helm chart with a release name `my-release`:
|
||||
|
||||
|
|
|
|||
|
|
@ -5,6 +5,6 @@ weight: 15
|
|||
|
||||
This section describes how users with the developer, master, and project administrator roles manage and participate in Harbor projects. The Harbor administrator can also perform all of these tasks.
|
||||
|
||||
- [Create Projects](create-projects.md)
|
||||
- [Project Configuration](project-configuration.md)
|
||||
- [Working with Images, Tags, and Helm Charts](working-with-images.md)
|
||||
- [Create Projects](create-projects)
|
||||
- [Project Configuration](project-configuration)
|
||||
- [Working with Images, Tags, and Helm Charts](working-with-images)
|
||||
|
|
|
|||
|
|
@ -11,13 +11,13 @@ After the initial creation of a project, you can configure or reconfigure its pr
|
|||
1. To make all repositories under the project accessible to everyone, select the `Public` checkbox, or deselect this checkbox to make the project private.
|
||||
1. To prevent un-signed images under the project from being pulled, select the `Enable content trust` checkbox.
|
||||
|
||||
|
||||
|
||||
|
||||
## Searching projects and repositories
|
||||
|
||||
Enter a keyword in the search field at the top to list all matching projects and repositories. The search result includes both public and private repositories you have access to.
|
||||
|
||||
|
||||
|
||||
|
||||
## Configure Vulnerability Settings in Projects
|
||||
|
||||
|
|
@ -28,16 +28,16 @@ You can configure projects so that images with vulnerabilities cannot be run, an
|
|||
1. Select the **Configuration** tab.
|
||||
1. To prevent vulnerable images under the project from being pulled, select the **Prevent vulnerable images from running** checkbox.
|
||||
|
||||
|
||||
|
||||
|
||||
1. Select the severity level of vulnerabilities to prevent images from running.
|
||||
|
||||
|
||||
|
||||
|
||||
Images cannot be pulled if their level is equal to or higher than the selected level of severity. Harbor does not prevent images with a vulnerability severity of `negligible` from running.
|
||||
1. To activate an immediate vulnerability scan on new images that are pushed to the project, select the **Automatically scan images on push** check box.
|
||||
|
||||
|
||||
|
||||
|
||||
## Build history
|
||||
|
||||
|
|
@ -45,4 +45,4 @@ Build history makes it easy to see the contents of a container image, find the c
|
|||
|
||||
In Harbor portal, enter your project, select the repository, click on the link of tag name you'd like to see its build history, the detail page will be opened. Then switch to `Build History` tab, you can see the build history information.
|
||||
|
||||
|
||||
|
||||
|
|
@ -1,13 +0,0 @@
|
|||
---
|
||||
title: Working with Images and Tags
|
||||
weight: 60
|
||||
---
|
||||
|
||||
This section describes how to work with images and tags in Harbor.
|
||||
|
||||
- [Pulling and Pushing Images](../pulling-pushing-images.md)
|
||||
- [Create Labels](../create-labels.md)
|
||||
- [Retag Images](../retagging-images.md)
|
||||
- [Create Tag Retention Rules](../create-tag-retention-rules.md)
|
||||
- [Create Tag Immutability Rules](../create-tag-immutability-rules.md)
|
||||
- [Manage Kubernetes Packages with Helm Charts](../managing-helm-charts.md)
|
||||
|
|
@ -0,0 +1,13 @@
|
|||
---
|
||||
title: Working with Images and Tags
|
||||
weight: 40
|
||||
---
|
||||
|
||||
This section describes how to work with images and tags in Harbor.
|
||||
|
||||
- [Pulling and Pushing Images](pulling-pushing-images.md)
|
||||
- [Create Labels](create-labels.md)
|
||||
- [Retag Images](retagging-images.md)
|
||||
- [Create Tag Retention Rules](create-tag-retention-rules.md)
|
||||
- [Create Tag Immutability Rules](create-tag-immutability-rules.md)
|
||||
- [Manage Kubernetes Packages with Helm Charts](managing-helm-charts.md)
|
||||
|
|
@ -37,7 +37,7 @@ You cannot pull an unsigned image if you have enabled content trust.
|
|||
|
||||
## Pushing Images
|
||||
|
||||
Before you can push an image to Harbor, you must create a corresponding project in the Harbor interface. For information about how to create a project, see [Create Projects](../create-projects.md).
|
||||
Before you can push an image to Harbor, you must create a corresponding project in the Harbor interface. For information about how to create a project, see [Create Projects](../create-projects/_index.md).
|
||||
|
||||
First, log in from Docker client:
|
||||
|
||||
Loading…
Reference in New Issue
Block a user