Harbor Operator

ATTENTIONS: THE MASTER BRANCH MAY BE IN AN UNSTABLE OR EVEN BROKEN STATE DURING DEVELOPMENT.

Harbor is a CNCF hosted open source trusted cloud-native registry project that stores, signs, and scans content. Harbor is composed on numerous stateful and stateless components and dependencies that may be deployed, updated, healed, backuped or scaled respecting some constraints.

The Harbor Operator provides an easy and solid solution to deploy and manage a full Harbor service stack including both the harbor service components and its relevant dependent services such as database, cache and storage services to the target Kubernetes clusters in a scalable and high-available way. The Harbor Operator defines a set of Harbor-related custom resources on top of Kubernetes Custom Resources. The Kubernetes API can then be used in a declarative way to manage Harbor deployment stack and ensure its scalability and high-availability operation, thanks to the Kubernetes control loop. The project harbor-operator aims to cover both Day1 and Day2 operations of an enterprise-grade Harbor deployment.

Features

Harbor deployment stack is controlled by a custom Harbor resource HarborCluster. HarborCluster owns the custom resource Harbor that represents the Harbor own service stack, and the custom resources of the related dependent services (PostgreSQL, Redis and MinIO) that are required when deploying the full Harbor deployment stack.

• Provides strong flexibility to deploy different stacks of Harbor cluster (identified by HarborCluster CR)
  • Minimal stack: only required Harbor components Core, Registry, Registry Controller, Job Service and Portal are provisioned.
  • Standard stack: the optional Harbor components Notary, Trivy, ChartMuseum and Metrics Exporter can be selected to enable.
  • Full stack: both the Harbor components (required+optional) and also the related dependent services including the database (PostgreSQL), cache (Redis) and storage (MinIO) can be deployed into the Kubernetes cluster together with a scalable and high-available way.
• Supports configuring either external or in-cluster deployed dependent services
• Supports a variety of backend storage configurations
  • filesystem: A storage driver configured to use a directory tree in the a kubernetes volume.
  • s3: A driver storing objects in an Amazon Simple Storage Service (S3) bucket.
  • swift: A driver storing objects in Openstack Swift.
  • azure: A driver storing objects in Microsoft Azure Blob Storage.
  • gcs: A driver storing objects in a Google Cloud Storage bucket.
• Supports updating the deployed Harbor cluster
  • Adjust replicas of components
  • Add/remove the optional Harbor components
• Supports upgrading the managed Harbor registry version
• Deletes all the linked resources when deleting the Harbor cluster
• Support services exposed with ingress: nginx(default), gce, contour and ncp
• Support Day2 operations
  • Configures Harbor system settings with configuration CRD (recommend) or labeled ConfigMap (deprecated)

Future features

• Support Day2 operations
  • Image pulling secret auto-injection
    • Auto mapping Kubernetes namespaces to the Harbor project
  • Image pulling path auto-rewriting
    • Transparent proxy cache settings
  • Certification auto injection
  • Manage Harbor resources with the declaration way
    • Robot account
    • Project
    • and more
• Auto-scaling for each component.
• Backup/restore data (registry layer, chartmuseum data, databases content).
• Support services exposed with LoadBalancer

Release plans

• Release 1.3
• Release 1.4

Getting started

For a quick first try follow the instructions of this tutorial.

Versioning

Versions of the underlying components are listed below:

Components	Harbor	MinIO operator	PostgreSQL operator	Redis operator
Versions	2.4.x [1]	4.4.9	1.6.3	1.1.1

NOTES:

[1] .x means all the patch releases of Harbor can be naturally supported in one operator version.

Compatibility

Applicative Kubernetes versions

Harbor operator supports two extra Kubernetes versions besides the current latest version (n-2 pattern):

Versions	1.20	1.21	1.22
Compatibility	✔️	✔️	✔️

Cert manager versions

Harbor operator relies on cert manager to manage kinds of certificates used by Harbor cluster components. Table shown below lists the compatibilities of cert manager versions:

Versions	1.4[.4]	1.5[.3]	1.6[.1]
Compatibility	✔️	✔️	✔️

Ingress controller types

Harbor operator exposes the frontend service with ingress (CRD version: v1beta1). Table shown below lists the ingress controller types supported.

Ingress Controller	Compatibility	Description
default	✔️	Default ingress controller like NGINX
gce	✔️	Google Cloud Engine ingress controller
ncp	✔️	NSX-T Container plugin ingress controller
contour	✔️	Ingress controller that works by deploying the Envoy proxy

NOTES:

✔️ : support ✖️ : not support ⭕ : not verified (probably support)

Documentation

• How it works
• Installation
• CRD references
• Manifests references
• Customize storage, database and cache services
• Customize images
• Day2 configurations
• Upgrade Harbor cluster
• Delete Harbor cluster
• Backup data
• Useful Makefile Targets
• Operator configurations
• Enable Minio console
• Performance comparison between fs & MinIO
• Monitor logs with grafana

Contributions

Harbor operator project is developed and maintained by the Harbor operator workgroup. If you're willing to join the group and do contributions to operator project, welcome to contact us. Follow the Development guide to start on the project.

Special thanks to the contributors who did significant contributions (see feature area).

Community

• Slack: channel #harbor-operator-dev at CNCF Workspace
• Mail group: send mail to Harbor dev mail group: [email protected]
• Twitter: @project_harbor
• Community meeting: attend bi-weekly community meeting for Q&A

Additional references

• cert-manager
• Underlying postgreSQL operator
• Underlying redis operator
• Underlying minio operator
• Kubernetes operator
• Custom Resource Definition
• Kubebuilder

Related links

• Contribute: https://github.com/goharbor/harbor-operator/blob/master/CONTRIBUTING
• Report bugs: https://github.com/goharbor/harbor-operator/issues
• Get latest version: https://hub.docker.com/r/goharbor/harbor-operator

Recognition

The operator was initially developed by OVHcloud and donated to the Harbor community as one of its governing projects in March 2020, becoming the basis of the official Harbor Operator.

OVHcloud uses the operator at scale to operate part of its private registry service. But the operator was designed in an agnostic way and it's continuing to evolve into a more pervasive architecture to bring values to any companies in search of deploying and managing one or multiple Harbor.

License

See LICENSE for licensing details.