⚙️ Installing Harbor

Helm Install

helm repo add harbor https://helm.goharbor.io
helm repo update

helm install harbor harbor/harbor \
  --namespace harbor \
  --create-namespace \
  --version 1.14.0 \
  --set expose.type=ingress \
  --set expose.ingress.hosts.core=harbor.example.com \
  --set expose.ingress.hosts.notary=notary.example.com \
  --set expose.tls.enabled=true \
  --set expose.tls.certSource=secret \
  --set expose.tls.secret.secretName=harbor-tls \
  --set externalURL=https://harbor.example.com \
  --set harborAdminPassword=StrongP@ssw0rd \
  --set persistence.persistentVolumeClaim.registry.size=100Gi \
  --set persistence.persistentVolumeClaim.database.size=10Gi

Projects and Repositories

Harbor organises images into Projects. A project can be public (no auth needed to pull) or private. Each project has independent RBAC, quotas, and scanning policies.

# After install, log in via CLI
docker login harbor.example.com -u admin -p StrongP@ssw0rd

# Tag and push an image to a project called "myteam"
docker tag myapp:latest harbor.example.com/myteam/myapp:latest
docker push harbor.example.com/myteam/myapp:latest

Robot Accounts for CI/CD

Robot accounts are non-human credentials for automated pipelines. They can be scoped to one project or system-wide.

# Create via Harbor REST API
curl -s -X POST \
  "https://harbor.example.com/api/v2.0/projects/myteam/robots" \
  -u "admin:StrongP@ssw0rd" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "ci-robot",
    "duration": 30,
    "description": "CI/CD pipeline robot",
    "permissions": [{
      "kind": "project",
      "namespace": "myteam",
      "access": [
        {"resource": "repository", "action": "push"},
        {"resource": "repository", "action": "pull"},
        {"resource": "artifact",   "action": "read"}
      ]
    }]
  }'

ImagePullSecret for Kubernetes

# Create a pull secret from robot account credentials
kubectl create secret docker-registry harbor-pull-secret \
  --docker-server=harbor.example.com \
  --docker-username="robot\$myteam+ci-robot" \
  --docker-password="<token-from-robot-creation>" \
  --namespace=my-app

# Reference in a ServiceAccount (apply to all pods in namespace)
kubectl patch serviceaccount default \
  -n my-app \
  -p '{"imagePullSecrets": [{"name": "harbor-pull-secret"}]}'

🔍 Vulnerability Scanning

Harbor integrates with Trivy (default) and Clair to scan OCI images for known CVEs. Scans can be triggered on push, scheduled, or manually.

Scan Policies

Scan Results in API

# Trigger a manual scan
curl -s -X POST \
  "https://harbor.example.com/api/v2.0/projects/myteam/repositories/myapp/artifacts/latest/scan" \
  -u "admin:StrongP@ssw0rd"

# Get scan report
curl -s \
  "https://harbor.example.com/api/v2.0/projects/myteam/repositories/myapp/artifacts/latest?with_scan_overview=true" \
  -u "admin:StrongP@ssw0rd" | jq '.scan_overview'

Replication Rules

Harbor can replicate images to/from remote registries on a schedule or triggered by push events.

# Create a replication rule via API (push to ECR on every push)
curl -s -X POST \
  "https://harbor.example.com/api/v2.0/replication/policies" \
  -u "admin:StrongP@ssw0rd" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "push-to-ecr",
    "src_registry": {"id": 0},
    "dest_registry": {"id": 2},
    "dest_namespace": "myteam",
    "filters": [{"type": "name", "value": "myteam/**"}],
    "trigger": {"type": "event_based", "trigger_settings": {}},
    "deletion": false,
    "override": true,
    "enabled": true
  }'

Proxy Cache Projects

A Proxy Cache project transparently forwards image pulls to an upstream registry and caches the result locally — eliminating DockerHub rate limits and reducing pull latency.

# Configure imagePullPolicy to use Harbor as proxy for docker.io
# In Harbor UI: New Project → Proxy Cache → set upstream = https://registry-1.docker.io

# Then pull via Harbor proxy:
docker pull harbor.example.com/dockerhub-proxy/library/nginx:alpine
# Harbor fetches from DockerHub on first pull, serves from cache on subsequent pulls

# In Kubernetes — use the proxy address in pod spec:
# image: harbor.example.com/dockerhub-proxy/library/nginx:alpine