Skip to content

Commit 3b4f135

Browse files
author
edge-katanomi-app2[bot]
committed
📚 Sync docs from alaudadevops/connectors-operator on d00cb15366dc704098e0860f056012b27c423cce
Source: feat(connectors): add ConnectorsHarbor component support (#417) Author: kycheng Ref: refs/heads/main Commit: d00cb15366dc704098e0860f056012b27c423cce This commit automatically syncs documentation changes from the source-docs repository. 🔗 View source commit: https://github.com/alaudadevops/connectors-operator/commit/d00cb15366dc704098e0860f056012b27c423cce 🤖 Synced on 2025-12-11 04:58:03 UTC
1 parent c31fee9 commit 3b4f135

22 files changed

+1415
-18
lines changed

‎.github/SYNC_INFO.md‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
11
# Documentation Sync Information
22

3-
- **Last synced**: 2025-12-10 11:07:31 UTC
3+
- **Last synced**: 2025-12-11 04:58:03 UTC
44
- **Source repository**: alaudadevops/connectors-operator
5-
- **Source commit**: [e964585fe4cabafec837c233582b9eed151c434f](https://github.com/alaudadevops/connectors-operator/commit/e964585fe4cabafec837c233582b9eed151c434f)
5+
- **Source commit**: [d00cb15366dc704098e0860f056012b27c423cce](https://github.com/alaudadevops/connectors-operator/commit/d00cb15366dc704098e0860f056012b27c423cce)
66
- **Triggered by**: edge-katanomi-app2[bot]
7-
- **Workflow run**: [#58](https://github.com/alaudadevops/connectors-operator/actions/runs/20096482907)
7+
- **Workflow run**: [#59](https://github.com/alaudadevops/connectors-operator/actions/runs/20122467163)
88

99
## Files synced:
1010
- docs/

‎docs/en/apis/kubernetes_apis/operator/operator.connectors.alauda.io_connectorsharbors.mdx‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
---
2+
weight: 10
3+
---
4+
5+
# ConnectorsHarbor [operator.connectors.alauda.io/v1alpha1]
6+
7+
<K8sCrd name="connectorsharbors.operator.connectors.alauda.io" />

‎docs/en/connectors-harbor/concepts/harbor_connectorclass.mdx‎

Lines changed: 197 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,197 @@
1+
---
2+
weight: 20
3+
---
4+
5+
# Harbor Connector
6+
7+
The Harbor connector is a platform-agnostic connector that you can use to connect to any Harbor registry.
8+
9+
You can use the Harbor Connector to securely perform container image operations in CICD pipelines, or use it in kubernetes workloads to perform image operations without credentials.
10+
11+
Additionally, you can centralize the management of Harbor access configurations across namespaces, avoiding the need to repeat the Harbor credentials in each namespace.
12+
13+
## Overview
14+
15+
This document covers:
16+
17+
- **Integration Requirements**: Prerequisites for target Harbor registries
18+
- **Creating Harbor connector**
19+
- **Advanced Features**: Proxy capabilities and configuration capabilities about Harbor connector
20+
21+
## Integration Requirements
22+
23+
**Harbor Registries Prerequisites**
24+
25+
- Supports Harbor 2.x versions
26+
27+
## Creating a simple Harbor connector
28+
29+
Here's how to create a basic Harbor Connector:
30+
31+
```yaml
32+
# Harbor Connector
33+
apiVersion: connectors.alauda.io/v1alpha1
34+
kind: Connector
35+
metadata:
36+
name: harbor-connector
37+
spec:
38+
connectorClassName: harbor
39+
address: https://harbor.example.com
40+
```
41+
42+
## Fields Reference
43+
44+
**spec.connectorClassName**:
45+
46+
`harbor` (constant), specifies the ConnectorClass name for Harbor integration.
47+
48+
**spec.address**:
49+
50+
Target Harbor registry address, for example: `https://harbor.example.com`.
51+
52+
**spec.auth(optional)**:
53+
54+
specifies the authentication method of the Harbor registry
55+
56+
- `spec.auth.name`: should be `basicAuth` for Harbor connector.
57+
58+
- `spec.auth.secretRef`: specifies the secret that contains the authentication information of the Harbor registry, the secret should be created in the same namespace as the connector. If your Harbor registry does not require authentication, you can omit this field. secret type must be `kubernetes.io/basic-auth`.
59+
60+
**Optional Metadata fields**:
61+
62+
- `cpaas.io/description`: Description information for the Harbor connector, for example:
63+
64+
```yaml
65+
apiVersion: connectors.alauda.io/v1alpha1
66+
kind: Connector
67+
metadata:
68+
name: harbor-connector
69+
annotations:
70+
cpaas.io/description: "Connect to team development Harbor registry"
71+
```
72+
73+
## Connector Capabilities
74+
75+
### Authentication Methods
76+
77+
The Harbor Connector supports the following authentication methods:
78+
79+
- **Basic Authentication**: Username and password authentication, secret type must be `kubernetes.io/basic-auth`.
80+
81+
if your Harbor registry does not require authentication, you can omit this field.
82+
83+
#### Token Permissions Required \{#token_permissions_required}
84+
85+
The required permissions for the configured credential depend on how you intend to use it in your Pods/Pipelines.
86+
87+
For example:
88+
- **Image pull and push operations**: If you need to pull and push images using this connector, the credentials must have both read and write permissions for the target Harbor registry.
89+
- **API operations**: Configure permissions based on the operations you need to perform. When configuring credentials, ensure the account has permission to access user information (/users/current).
90+
91+
For security best practices, we recommend creating credentials with minimal required permissions. When additional privileges are needed, create separate Connectors with more privileged secret and use namespace isolation to control which users can access each Connector.
92+
93+
### Proxy and Configuration Capabilities
94+
95+
The Harbor Connector provides proxy capabilities to enable secure access to Harbor registries.
96+
97+
To enable clients to access Harbor registries without directly handling credentials, the Harbor ConnectorClass provides a proxy server that automatically injects authentication information.
98+
99+
Clients with access to the connector can use this proxy server to access Harbor registries without needing to configure credentials on the client side.
100+
101+
#### Proxy Address
102+
103+
When creating a Harbor connector, the system will automatically create a Service for proxying access to the Harbor registry.
104+
105+
The system will record the proxy address in the `status.proxy.httpAddress` field.
106+
107+
For example:
108+
109+
```yaml
110+
apiVersion: connectors.alauda.io/v1alpha1
111+
kind: Connector
112+
metadata:
113+
name: harbor-connector
114+
spec:
115+
# . . .
116+
status:
117+
conditions:
118+
# . . .
119+
proxy:
120+
httpAddress:
121+
url: http://c-harbor-connector.default.svc.cluster.local
122+
```
123+
124+
#### Forward Proxy
125+
126+
You can mount proxy information into Pods using CSI, and then use the proxy information through environment variables or configuration files.
127+
128+
```yaml
129+
volumes:
130+
- name: proxyconfig
131+
csi:
132+
readOnly: true
133+
driver: connectors-csi
134+
volumeAttributes:
135+
connector.name: "harbor"
136+
```
137+
138+
Then, before executing container operations, use the proxy information through environment variables or configuration files.
139+
140+
```bash
141+
export http_proxy=$(cat /{mount-path}/http.proxy)
142+
export https_proxy=$(cat /{mount-path}/https.proxy)
143+
export HTTP_PROXY=$http_proxy
144+
export HTTPS_PROXY=$https_proxy
145+
export no_proxy=localhost,127.0.0.1
146+
export NO_PROXY=$no_proxy
147+
echo "Using proxy: http_proxy=$http_proxy, https_proxy=$https_proxy, no_proxy=$no_proxy"
148+
```
149+
150+
#### Reverse Proxy
151+
152+
When using a reverse proxy, you need to modify the target image address to the proxy address.
153+
154+
Example:
155+
harbor.example.com/test/abc:v1 → c-harbor-connector.default.svc.cluster.local/namespaces/harbor-connector-demo/connectors/harbor-connector/test/abc:v1
156+
157+
Additionally, you need to mount the configuration files into the Pod and configure the proxy address in `insecure-registries`. The default configuration files `buildkitd.toml` and `config.json` are provided.
158+
159+
The OCI Connector created based on the OCI Connector type provides the following configurations:
160+
161+
**config**: Configuration information required by Docker CLI.
162+
163+
- Provides the `config.json` configuration file.
164+
- Contains the authentication information required to access the proxy.
165+
166+
For example:
167+
168+
```json
169+
// config.json
170+
171+
{
172+
"auths": {
173+
"<proxy address of the connector>": {
174+
"auth": "<authentication information required to access the connector proxy>"
175+
}
176+
}
177+
}
178+
```
179+
180+
**buildkitd**: Configuration information required by the BuildKit Daemon.
181+
182+
- Provides the `buildkitd.toml` configuration file.
183+
- In the configuration file, the current connector will be set as `insecure-registries` by default.
184+
185+
For example:
186+
187+
```yaml
188+
insecure-entitlements = [ "network.host", "security.insecure" ]
189+
[registry."<proxy address of the connector>"]
190+
http = true
191+
```
192+
193+
194+
## Further Reading
195+
196+
- [Harbor Connector Quick Start](../quick_start)
197+
- [Harbor Connector How To Guides](../how_to)

‎docs/en/connectors-harbor/concepts/index.mdx‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
---
2+
weight: 40
3+
i18n:
4+
title:
5+
en: Concepts
6+
title: Concepts
7+
---
8+
9+
# Harbor Connector
10+
11+
<Overview />

‎docs/en/connectors-harbor/how_to/index.mdx‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
---
2+
weight: 60
3+
i18n:
4+
title:
5+
en: How To
6+
title: How To
7+
---
8+
9+
# Harbor Connector
10+
11+
<Overview />

‎docs/en/connectors-harbor/how_to/using_harbor_connector_in_k8s.mdx‎

Lines changed: 117 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,117 @@
1+
---
2+
weight: 20
3+
sourceSHA: 9127ed46c690502a00565477f7c29eee7941b32f59f83faf3498b5bb9097e080
4+
---
5+
6+
# Using the Harbor Connector Proxy in K8S Workload
7+
8+
In a Kubernetes cluster, when using container registry clients to access the Harbor Registry, it is often necessary to configure the Registry authentication information for the client. This requires distributing the authentication information to the workload orchestrators, thereby increasing the risk of credential leakage.
9+
10+
The Harbor Connector provides a `secretless` way to access the Registry through its proxy capability, allowing ordinary users to access the Registry without having contact with authentication information, thus maximizing credential security.
11+
12+
Currently, there are various container registry clients available in the community for accessing the `Harbor Registry`. This document will introduce how to utilize the proxy capabilities of the `Harbor Connector` in Kubernetes workloads and explain its general configuration logic.
13+
14+
If you already have a preliminary understanding, you can directly refer to more specific cases:
15+
16+
- [Using Harbor Connector to Build Images in K8S Job](./using_harbor_connector_in_k8s_job.mdx)
17+
- [Using Harbor Connector to Build Images in Tekton Pipeline](./using_harbor_connector_forward_proxy_in_tekton_pipeline.mdx)
18+
19+
## Utilizing Harbor Connector Proxy Capability
20+
21+
Currently, there are two proxy modes supported:
22+
- Forward Proxy
23+
- Reverse Proxy
24+
25+
### Forward Proxy
26+
27+
- Configure the forward proxy for the Harbor Connector, such as `http_proxy`, `https_proxy`, `no_proxy`, etc.
28+
29+
The `Harbor ConnectorClass` provides an out-of-the-box configuration that can be mounted through connector-csi.
30+
31+
```yaml
32+
volumes:
33+
- name: proxyconfig
34+
csi:
35+
readOnly: true
36+
driver: connectors-csi
37+
volumeAttributes:
38+
connector.name: "harbor"
39+
```
40+
41+
> Note: The configuration name don't need support, it will be mounted as `http.proxy` and `https.proxy`.
42+
43+
Before using, configure the proxy according to different container registry clients. Most container registry clients support directly reading the HTTP_PROXY, HTTPS_PROXY, NO_PROXY, http_proxy, https_proxy, no_proxy environment variables.
44+
45+
```bash
46+
export http_proxy=$(cat /{mount-path}/http.proxy)
47+
export https_proxy=$(cat /{mount-path}/https.proxy)
48+
export HTTP_PROXY=$http_proxy
49+
export HTTPS_PROXY=$https_proxy
50+
export no_proxy=localhost,127.0.0.1
51+
export NO_PROXY=$no_proxy
52+
```
53+
54+
Some clients need to specify the proxy in the software configuration file, the configuration method needs to refer to the specific documentation of the client.
55+
56+
57+
### Reverse Proxy
58+
59+
Using the Harbor Connector proxy capability mainly involves the following three aspects:
60+
61+
- Modifying the target image address to the proxied image repository address
62+
- Configuring the authentication information required to access the proxy
63+
- Configuring the client CLI to support pushing to insecure registries
64+
65+
Next, we will elaborate on the specific meaning of each item.
66+
67+
1. Modifying the target image address to the proxied image repository address
68+
69+
Example:
70+
harbor.example.com/test/abc:v1 → c-harbor-connector.default.svc.local/namespaces/harbor-connector-ns/connectors/harbor-connector-name/test/abc:v1
71+
72+
2. Configuring the authentication information required to access the proxy
73+
74+
The authentication information required to access the proxy can be configured through the `config.json` file.
75+
76+
The `Harbor ConnectorClass` provides an out-of-the-box configuration that can be mounted through connector-csi.
77+
78+
```yaml
79+
volumes:
80+
- name: docker-config
81+
csi:
82+
readOnly: true
83+
driver: connectors-csi
84+
volumeAttributes:
85+
connector.name: "harbor"
86+
configuration.names: "config"
87+
```
88+
89+
> For the configuration information of the Harbor ConnectorClass, please refer to [Harbor ConnectorClass Configuration](../concepts/harbor_connectorclass.mdx#configuration).
90+
91+
3. Configuring the client CLI to support pushing to insecure registries
92+
93+
Since the proxy service provided by the connector uses HTTP protocol, it is necessary to configure `insecure-registries` on the client. Different clients have different configuration methods:
94+
95+
`buildkitd` can specify this through `buildkitd.toml`. The Harbor ConnectorClass provides an out-of-the-box configuration for `buildkitd`, which can be mounted through connector-csi.
96+
97+
```yaml
98+
- name: buildkitd-config
99+
csi:
100+
readOnly: true
101+
driver: connectors-csi
102+
volumeAttributes:
103+
connector.name: "harbor"
104+
configuration.names: "buildkitd"
105+
```
106+
107+
Certain tools may support specifying directly in the command line, in which case the corresponding parameters can be fixed in the script.
108+
109+
For example:
110+
111+
- `buildah` specifies `--tls-verify=false` in the command line to support insecure registry.
112+
- `ko` specifies `--insecure-registry` in the command line to support insecure registry.
113+
114+
## More
115+
116+
- [Using Harbor Connector to Build Images in K8S Job](./using_harbor_connector_in_k8s_job.mdx)
117+
- [Using Harbor Connector to Build Images in Tekton Pipeline](./using_harbor_connector_in_tekton_pipeline.mdx)

0 commit comments

Comments
 (0)