Collect requirements for v2.3.0

[reasonerjt]

We are in the planning phase for v2.3.0

Please let us know what features you would like to see in the next version!
If there's an issue opened previously for that feature please reference the issue in this discussion!

[steven-zou]

Do enhancements to the scanning to let users access more security postures of their images. They can include:

• One click to export the overall scanning report with a rich format for the specified artifact (image) or whole project
• Render the overall security report metrics for the artifacts across the whole project on a separate page as a kanban, e.g: how many vulnerable images(critical ones, high ones, etc..)
• Support more scanning report mime types in pluggable scanner framework to cover different scanning cases, like misconfigure(e.g: Dockle - Container Image Linter for Security)/BOM/Package dependencies, etc.
  • Might be an end-end flow
• TBD

@danielpacak / @prahaladdarkin any further comments?

[prahaladdarkin]

one more requirement - get a unified view of vulnerabilities across a set of projects and scanners configured for the projects

[steven-zou]

@prahaladdarkin

A unified view across the whole system can be the next step. I think we should deliver the enhancements step by step.

[pengkang1991]

Hello, I have a question. When I don't know the TAG of the project image, how can I directly pull the latest TAG of the project image?
Can the latest pushed tag be automatically changed to the latest tag. (jdkimage v11.1--->jdkimage latest)

[steven-zou]

Introduce rate limitation to replication to handle some environments with limited network bandwidth.

• Set default rate as a system-level configuration
• Override default rate in replication policy setting

@ywk253100 @bitsf any further comments?

[pengkang1991]

Hello, I have a question. When I don't know the TAG of the project image, how can I directly pull the latest TAG of the project image?
Can the latest pushed tag be automatically changed to the latest tag. (jdkimage v11.1--->jdkimage latest)

[steven-zou]

So far, there are still many API handlers using the ORM transaction with legacy way, which may cause problems (even deadlock) when there are large scale concurrent requests coming in. To improve reliability and consistency, we need to migrate all the APIs using legacy transaction approach to the new model.

cc @heww

[steven-zou]

Provide one unique API swagger YAML, not two(two YMALs cause problems when automatically generate API clients).

cc @reasonerjt, @heww

[cd1989]

How about ship trivy image with a default offline vulnerabilites database. So that it can work in environment without network connection to github.

[prahaladdarkin]

@danielpacak this is inline with what we have discussed a few times. One major use case I can think about the requirement for this use case, is the fact that a large number of enterprise customers would work in dark environments - environments that are hosted in a DMZ and may not have internet access.
We can discuss this in detail. What do you think @danielpacak ?

[danielpacak]

We already provide instructions how to use Trivy / Trivy adapter in air gapped environment. Basically anyone can download DB file and mount it at the predefined path manually.

My main concern with shipping a Trivy DB with the installer is that we update the vulnerability database every 12 hours so in such air gapped environment Trivy won't show latest and greatest results. That said, we have to consider the DB update process for such environments and packaging structure. Do we want to embed this file in the Trivy adapter or download it at helm install time? Those requirements must be clarified.

[pengkang1991]

Hello, I have a question. When I don't know the TAG of the project image, how can I directly pull the latest TAG of the project image?
Can the latest pushed tag be automatically changed to the latest tag. (jdkimage v11.1--->jdkimage latest)

[prahaladdarkin]

@pengkang1991 to the best of my knowledge, image tags are required to uniquely identify a container image and hence hence jdk:v1.11.1 is not the same as jdk:latest.
Hence docker push jdk:v1.11 will not automatically create jdk:latest.

latest is simply a default label applied on images which are pushed in any of the following manner:
docker push jdk or docker push jdk:latest will push the jdk image and create the :latest tag automatically .
However a command like docker push jdk:v1.11 will not create a latest lag - instead an image would be pushed and the v1.11 tag would get created.

You can read this short and informative blog here : https://vsupalov.com/docker-latest-tag/

Note that :latest should be used very careful since it has the capability to introduce unwanted/undesired updates to the docker image.
On that note, I think it would be useful for Harbor UI to display a list of tags available for an image within the registry. @steven-zou does this functionality already exist? I was not able to easily find it in the latest 2.2.0 setup that I have deployed.

[cd1989]

@pengkang1991 I like this point, I think we can put this in another way, if image can have some logic tag like HEAD always points to the latest tag pushed, that would be helpful sometime, such as CD phase in CI/CD. Much like in Git, we have HEAD. In harbor, we may configure one special tag name. @prahaladdarkin how about it ?

[holyhope]

Hello all,
I am working hard on harbor-operator and I would love having the jobservice using an external job executor.
Is it possible to rework jobservice so it create kubernetes jobs to run asynchronous tasks? Other integration would be cadence or argo.
WDYT?
IMO k8s jobs match all requirements by running a task, getting its state and reading logs.

[steven-zou]

@holyhope

I think this is a long-term item and cannot do anything in V2,3. As we discussed, you can move it to the long-term requirements collection channel: #14119

[Vad1mo]

I like the idea, even if that can make to 2.3 having an alternative would be good. especially with k8s job service

[sluetze]

I would like too see some work on Log-Deletion.

#14007 proposed the deletion of audit-logs (Background: GDPR)

[steven-zou]

Maybe exporting the audit logs to disk is a better choice as some companies require a reasonable data maintenance time.

[mmpei]

it will cause that we have to set up a remote-disk when we want to make up a HA harbor if we put the logs in disk.
audit log is more like an operate record, leave it in DB is more reasonable.

[DASXCE]

1. Please improve the navigation on the Replications page.

• The default 5 items per page is annoying. Please set a bigger default and provide options to choose
• Browsing Back from the Executions page is not user friendly. The selected replication rule should persist
• When saving a replication rule change the table gets refreshed, selection lost, filter present but not applied. One must change a character to trigger the table filter
• Source/Destination registry select box could have a filter. Also the sorting seems not consistent.

2. It would be nice to have a replication execution perspective around a particular image or even project. Currently there is no easy way to tell where one image went if you have multiple destination to replicate to. For example after a image push that image needs to be replicated in 5 different environments (docker registries)

[vinnyzhaowenyu]

规范仓库命名

具体功能如下：

• 设置一个项目的权限，所有用户都无法创建仓库，只有指定的管理员可以创建。例如： harbor.mydomain.com/myproject/myimage
• 其他用户可以管理仓库的版本。例如：myimage:v1

使用场景：

• 在企业内部，可以统一规范镜像的名称。

可以规范镜像命名如下：

harbor.mydomain.com/myproject/myimage:v1
harbor.mydomain.com/myproject/myimage:v2
harbor.mydomain.com/myproject/myimage:v3

而不是 :

harbor.mydomain.com/myproject/myimages-haha:v3

[bruceforlearn]

这个需求毫无意义，只要是jenkins devops来做自动化就可以了而不是harbor本身的功能

[vinnyzhaowenyu]

建议有此功能：

• harbor 适用在企业内部使用，较少在公网ToC使用，企业内一般会有 规范 要求。类似的标准化镜像名称的场景需求是存在的。
• Jenkins DEVOPS 配置流水线是可以实现部分的，但是在多个不同的团队不同的部门，Jenkins可能有多套，不一定使用相同配置，即使有文档规范也难以约束；功能规范确是必须要准守的，否则无法推送镜像。
• 实现一种需求的方式有多种，不是其他方式能实现就万事大吉了，解决问题应该考虑最优解。

这只是一个需求建议，是一种场景，不是凭空捏造的，需求可以接受或者拒绝。

[vinnyzhaowenyu]

还有，不是所有构建镜像都是使用 Jenkins 的。我喜欢使用 docker build 来构建镜像

[vinnyzhaowenyu]

harbor 私有项目单独开放某个镜像仓库的公开权限

场景：

• 整个项目是 private 的， 例如： harbor.mydomain.com/myproject
• 但是其中某个镜像希望是公开的，例如 harbor.mydomain.com/myproject/pub-image:latest

优点：

• 不用单独维护多个不同权限的项目，

[mmpei]

we have this need too.

[chlins]

+1

[hyy0322]

+1

[lijianfeng1993]

+1

[holooooo]

repo proxy

set a upstream registry in project setting page
when pull image from already setting proxy project, check if upstream exist different sha of image, and pull upstream image if different.

global webhook

use to cicd or something.

[ruster-cn]

Now that I've done this, I can consider incorporating my code into the community

[mmpei]

Operation statistics, such as image and project statistics, usage statistics, pull counts by user in an interval, etc.

[hazcod]

I would really like the support for more complex (security) policies, which is Imo the main driver for harbor adoption.
Placing those constraints in the image registry serves as an absolute control compared to CI/CD.

• be able to limit pushes not adhering to CVE whitelist, but allow pulls to not impact production
• be able to add webhook for when a new CVE is detected
• be able to add a webhook when a image push fails the policy
• be able to ignore CVEs which do not have fixes published

[prahaladdarkin]

@hazcod would you also have a use case where-in you would want to validate that none of your Helm charts in the harbor chart museum refer to images with very high unpatched vulnerabilities?

[hazcod]

@prahaladdarkin I currently store my helm charts on the git repo itself, but I guess that makes sense too!

[akshay201]

Better RBAC with a way to define custom roles

1. Define a role.
2. Specify actions that subjects with role assigned can perform (READ, CREATE, UPDATE, DELETE).
3. Resources on which they can perform action. (Repositories, charts, CVE allowlist, scanners, etc)

[akshay201]

1. Also can we have detailed information from Harbor side, which users are assigned which roles/groups from UI.
   Something like clicking of a group can help me know which users are part of that group. Considering this information is obtained from the OIDC server as part of claims.
2. Can we fix the Delete user functionality from the Harbor UI, right now it seems to be disabled and needs manual deletion from database.

Thanks.

[dioguerra]

• Disabling admin user when using OIDC authentication
  

[rluvaton]

Add upload and download image (as tar file) option

[pengkang1991]

Thank you for your guidance, which solved my question！

…

------------------ 原始邮件 ------------------ 发件人: "goharbor/harbor" ***@***.***>; 发送时间: 2021年3月17日(星期三) 上午10:38 ***@***.***>; ***@***.******@***.***>; 主题: Re: [goharbor/harbor] Collect requirements for v2.3.0 (#14007) @pengkang1991 to the best of my knowledge, image tags are required to uniquely identify a container image and hence hence jdk:v1.11.1 is not the same as jdk:latest. Hence docker push jdk:v1.11 will not automatically create jdk:latest. latest is simply a default label applied on images which are pushed in any of the following manner: docker push jdk or docker push jdk:latest will push the jdk image and create the :latest tag automatically . However a command like docker push jdk:v1.11 will not create a latest lag - instead an image would be pushed and the v1.11 tag would get created. You can read this short and informative blog here : https://vsupalov.com/docker-latest-tag/ Note that :latest should be used very careful since it has the capability to introduce unwanted/undesired updates to the docker image. On that note, I think it would be useful for Harbor UI to display a list of tags available for an image within the registry. @steven-zou does this functionality already exist? I was not able to easily find it in the latest 2.2.0 setup that I have deployed. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub, or unsubscribe.

[matgn]

Important problem to resolve : making exporter work, even with TLS activated.
Maybe beginning with exposing metrics without TLS by default. (adding a specific TLS config for metrics)
#14475

[dioguerra]

Add some endpoint to off-board OIDC user /user in general