Skip to content

Commit c9546ec

Browse files
chengjingtaochengjingtao
committed
📚 Sync docs from alaudadevops/connectors-operator on f6ac686740365cb80e5714c63be8b7228b23a885
Source: docs: add using oci/harbor forward proxy in pipeline (#431) Author: chengjingtao Ref: refs/heads/main Commit: f6ac686740365cb80e5714c63be8b7228b23a885 This commit automatically syncs documentation changes from the source-docs repository. 🔗 View source commit: AlaudaDevops/connectors-operator@f6ac686 🤖 Synced on 2025-12-11 06:06:47 UTC
1 parent 3b4f135 commit c9546ec

File tree

8 files changed

+270
-40
lines changed

8 files changed

+270
-40
lines changed

‎.github/SYNC_INFO.md‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
11
# Documentation Sync Information
22

3-
- **Last synced**: 2025-12-11 04:58:03 UTC
3+
- **Last synced**: 2025-12-11 06:06:47 UTC
44
- **Source repository**: alaudadevops/connectors-operator
5-
- **Source commit**: [d00cb15366dc704098e0860f056012b27c423cce](https://github.com/alaudadevops/connectors-operator/commit/d00cb15366dc704098e0860f056012b27c423cce)
6-
- **Triggered by**: edge-katanomi-app2[bot]
7-
- **Workflow run**: [#59](https://github.com/alaudadevops/connectors-operator/actions/runs/20122467163)
5+
- **Source commit**: [f6ac686740365cb80e5714c63be8b7228b23a885](https://github.com/alaudadevops/connectors-operator/commit/f6ac686740365cb80e5714c63be8b7228b23a885)
6+
- **Triggered by**: chengjingtao
7+
- **Workflow run**: [#60](https://github.com/alaudadevops/connectors-operator/actions/runs/20123703939)
88

99
## Files synced:
1010
- docs/

‎docs/en/connectors-harbor/concepts/harbor_connectorclass.mdx‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -194,4 +194,7 @@ insecure-entitlements = [ "network.host", "security.insecure" ]
194194
## Further Reading
195195

196196
- [Harbor Connector Quick Start](../quick_start)
197-
- [Harbor Connector How To Guides](../how_to)
197+
- [General Introduction to Using the Harbor Connector Proxy in K8S Workload](../how_to/using_harbor_connector_in_k8s.mdx)
198+
- [Building Images Using Harbor Connector in K8S Job](../how_to/using_harbor_connector_in_k8s_job.mdx)
199+
- [Building Images Using Harbor Connector in Tekton Pipeline](../how_to/using_harbor_connector_forward_proxy_in_tekton_pipeline.mdx)
200+

‎docs/en/connectors-harbor/how_to/using_harbor_connector_forward_proxy_in_tekton_pipeline.mdx‎

Lines changed: 105 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,105 @@
1+
---
2+
weight: 35
3+
title: Using Harbor Connector Forward Proxy in Tekton Task
4+
---
5+
6+
# Using Harbor Connector Forward Proxy in Tekton Task
7+
8+
Using Harbor Connector Forward Proxy in Tekton Tasks enables centralized management of Harbor credentials and secure access to Harbor registries during Tekton Task execution.
9+
10+
## Requirements for Tekton Task \{#requirements-for-tekton-task}
11+
12+
Not all Tekton Tasks can use Harbor Connector Forward Proxy.
13+
14+
Harbor Connector injects proxy configurations through a CSI Driver. It provides built-in configuration files for forward proxy usage:
15+
16+
- `.env`: Environment variables file containing `http_proxy`, `https_proxy`, and `no_proxy` in `key=value` format
17+
- `http.proxy`: Forward proxy URL with authentication for HTTP
18+
- `https.proxy`: Forward proxy URL with authentication for HTTPS
19+
20+
**Therefore, Tekton Tasks must meet the following requirements to use Harbor Connector Forward Proxy:**
21+
22+
**1. The CLI tools used in the Task must support HTTP proxy environment variables**
23+
24+
**2. The Task must support configuring HTTP proxy environment variables**.
25+
> This can be done by:
26+
> - Mounting a workspace containing a `.env` file
27+
> - Using custom commands to read environment variables from files
28+
29+
**3. The Task must support configuring insecure registries**
30+
> This can be done by:
31+
> - Mounting a workspace containing a configuration file that supports insecure registries that connectorclass provides
32+
> - Using cli arguments to configure insecure registries
33+
34+
## Usage Instructions
35+
36+
### Using Forward Proxy with .env Workspace
37+
38+
If the Task natively supports a workspace containing a `.env` file, and will expose the `.env` file to the environment variable, you can directly mount the Harbor Connector's configurations via CSI.
39+
40+
In the following example, we use a `buildah` Task that accepts a `docker-config` workspace with a `.env` file containing `http_proxy`, `https_proxy`, and `no_proxy` environment variables:
41+
42+
```yaml
43+
apiVersion: tekton.dev/v1
44+
kind: TaskRun
45+
metadata:
46+
name: buildah-build-my-repo
47+
spec:
48+
taskRef:
49+
name: buildah
50+
params:
51+
- name: IMAGES
52+
value:
53+
- harbor.example.com/my-repo/my-image
54+
- name: TLS_VERIFY
55+
value: "false"
56+
workspaces:
57+
- name: source
58+
persistentVolumeClaim:
59+
claimName: my-source
60+
- name: docker-config
61+
csi:
62+
readOnly: true
63+
driver: connectors-csi
64+
volumeAttributes:
65+
connector.name: "harbor-connector"
66+
configuration.names: "config"
67+
```
68+
69+
### Using Forward Proxy with Custom Commands
70+
71+
If the Task does not natively support a `.env` workspace, but allows custom commands, you can source the `.env` file manually in the command.
72+
73+
In the following example, we use a `buildah-cli` Task that accepts a `cmd` parameter for custom shell commands. The Task mounts the `docker-config` workspace to `/workspace/docker-config`:
74+
75+
```yaml
76+
apiVersion: tekton.dev/v1
77+
kind: TaskRun
78+
metadata:
79+
name: buildah-build-my-repo
80+
spec:
81+
taskRef:
82+
name: buildah-cli
83+
workspaces:
84+
- name: docker-config
85+
csi:
86+
readOnly: true
87+
driver: connectors-csi
88+
volumeAttributes:
89+
connector.name: "harbor-connector"
90+
configuration.names: "config"
91+
params:
92+
- name: cmd
93+
value: |
94+
source /workspace/docker-config/.env
95+
buildah push --tls-verify=false myimage harbor.example.com/library/myimage:v1
96+
```
97+
98+
**Note:** The `--tls-verify=false` flag is required because the forward proxy intercepts and re-signs TLS traffic. Different CLI tools have different ways to configure insecure registries. Please refer to your CLI documentation for details.
99+
100+
## Further Reading
101+
102+
- [Using Harbor Connector Proxy in K8S Workload](./using_harbor_connector_in_k8s.mdx) - Learn about the general logic of using Harbor Connector proxy
103+
- [Harbor ConnectorClass Forward Proxy](../concepts/harbor_connectorclass.mdx#forward-proxy) - Learn about forward proxy configurations
104+
- [Connectors CSI Built-in Configurations](../../connectors/concepts/connectors_csi.mdx#built-in-configurations) - Learn about built-in configuration files
105+
- [Using CSI Volumes in Tekton](https://tekton.dev/docs/pipelines/workspaces/#csi) - Tekton CSI workspace documentation

‎docs/en/connectors-harbor/how_to/using_harbor_connector_in_k8s.mdx‎

Lines changed: 16 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -18,15 +18,19 @@ If you already have a preliminary understanding, you can directly refer to more
1818

1919
## Utilizing Harbor Connector Proxy Capability
2020

21-
Currently, there are two proxy modes supported:
22-
- Forward Proxy
23-
- Reverse Proxy
21+
The Harbor Connector supports two proxy modes:
22+
23+
- **Forward Proxy** - Recommended for most cases. Less intrusive to client configurations and easier to use.
24+
- **Reverse Proxy** - Requires modifying the target image address and additional client configuration.
2425

2526
### Forward Proxy
2627

27-
- Configure the forward proxy for the Harbor Connector, such as `http_proxy`, `https_proxy`, `no_proxy`, etc.
28+
Using Forward Proxy involves the following aspects:
2829

29-
The `Harbor ConnectorClass` provides an out-of-the-box configuration that can be mounted through connector-csi.
30+
- Setting proxy environment variables for the client
31+
- Configuring the client to support insecure registries (if required)
32+
33+
Mount the [built-in configurations](../../connectors/concepts/connectors_csi.mdx#built-in-configurations) through the Connectors CSI Driver:
3034

3135
```yaml
3236
volumes:
@@ -38,21 +42,24 @@ volumes:
3842
connector.name: "harbor"
3943
```
4044
41-
> Note: The configuration name don't need support, it will be mounted as `http.proxy` and `https.proxy`.
42-
43-
Before using, configure the proxy according to different container registry clients. Most container registry clients support directly reading the HTTP_PROXY, HTTPS_PROXY, NO_PROXY, http_proxy, https_proxy, no_proxy environment variables.
45+
Most container registry clients support reading proxy settings from environment variables (`http_proxy`, `https_proxy`, `no_proxy`). You can configure them in two ways:
4446

4547
```bash
48+
# Option 1: Set proxy variables individually
4649
export http_proxy=$(cat /{mount-path}/http.proxy)
4750
export https_proxy=$(cat /{mount-path}/https.proxy)
4851
export HTTP_PROXY=$http_proxy
4952
export HTTPS_PROXY=$https_proxy
5053
export no_proxy=localhost,127.0.0.1
5154
export NO_PROXY=$no_proxy
55+
56+
# Option 2: Source the environment file
57+
source /{mount-path}/.env
5258
```
5359

54-
Some clients need to specify the proxy in the software configuration file, the configuration method needs to refer to the specific documentation of the client.
60+
> Note: Some clients require specifying proxy settings in their configuration files.
5561

62+
Since the forward proxy intercepts and re-signs TLS traffic (MITM), clients must be configured to trust the proxy's certificate or allow insecure connections. Refer to your CLI documentation for details, or see the [Harbor ConnectorClass Forward Proxy](../concepts/harbor_connectorclass.mdx#forward-proxy) for default configurations provided by the ConnectorClass.
5663

5764
### Reverse Proxy
5865

‎docs/en/connectors-oci/how_to/using_oci_connector_forward_proxy_in_tekton_pipeline.mdx‎

Lines changed: 105 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,105 @@
1+
---
2+
weight: 35
3+
title: Using OCI Connector Forward Proxy in Tekton Task
4+
---
5+
6+
# Using OCI Connector Forward Proxy in Tekton Task
7+
8+
Using OCI Connector Forward Proxy in Tekton Tasks enables centralized management of OCI registry credentials and secure access to OCI registries during Tekton Task execution.
9+
10+
## Requirements for Tekton Task \{#requirements-for-tekton-task}
11+
12+
Not all Tekton Tasks can use OCI Connector Forward Proxy.
13+
14+
OCI Connector injects proxy configurations through a CSI Driver. It provides built-in configuration files for forward proxy usage:
15+
16+
- **`.env`**: Environment variables file containing `http_proxy`, `https_proxy`, and `no_proxy` in `key=value` format
17+
- **`http.proxy`**: Forward proxy URL with authentication for HTTP
18+
- **`https.proxy`**: Forward proxy URL with authentication for HTTPS
19+
20+
**Therefore, Tekton Tasks must meet the following requirements to use OCI Connector Forward Proxy:**
21+
22+
**1. The CLI tools used in the Task must support HTTP proxy environment variables**
23+
24+
**2. The Task must support configuring HTTP proxy environment variables**.
25+
> This can be done by:
26+
> - Mounting a workspace containing a `.env` file
27+
> - Using custom commands to read environment variables from files
28+
29+
**3. The Task must support configuring insecure registries**
30+
> This can be done by:
31+
> - Mounting a workspace containing a configuration file that supports insecure registries that connectorclass provides
32+
> - Using cli arguments to configure insecure registries
33+
34+
## Usage Instructions
35+
36+
### Using Forward Proxy with .env Workspace
37+
38+
If the Task natively supports a workspace containing a `.env` file, you can directly mount the OCI Connector's built-in configurations via CSI.
39+
40+
In the following example, we use a `buildah` Task that accepts a `docker-config` workspace with a `.env` file containing `http_proxy`, `https_proxy`, and `no_proxy` environment variables:
41+
42+
```yaml
43+
apiVersion: tekton.dev/v1
44+
kind: TaskRun
45+
metadata:
46+
name: buildah-build-my-repo
47+
spec:
48+
taskRef:
49+
name: buildah
50+
params:
51+
- name: IMAGES
52+
value:
53+
- registry.example.com/my-repo/my-image
54+
- name: TLS_VERIFY
55+
value: "false"
56+
workspaces:
57+
- name: source
58+
persistentVolumeClaim:
59+
claimName: my-source
60+
- name: docker-config
61+
csi:
62+
readOnly: true
63+
driver: connectors-csi
64+
volumeAttributes:
65+
connector.name: "oci-connector"
66+
configuration.names: "config"
67+
```
68+
69+
### Using Forward Proxy with Custom Commands
70+
71+
If the Task does not natively support a `.env` workspace, but allows custom commands, you can source the `.env` file manually in the command.
72+
73+
In the following example, we use a `buildah-cli` Task that accepts a `cmd` parameter for custom shell commands. The Task mounts the `docker-config` workspace to `/workspace/docker-config`:
74+
75+
```yaml
76+
apiVersion: tekton.dev/v1
77+
kind: TaskRun
78+
metadata:
79+
name: buildah-build-my-repo
80+
spec:
81+
taskRef:
82+
name: buildah-cli
83+
workspaces:
84+
- name: docker-config
85+
csi:
86+
readOnly: true
87+
driver: connectors-csi
88+
volumeAttributes:
89+
connector.name: "oci-connector"
90+
configuration.names: "config"
91+
params:
92+
- name: cmd
93+
value: |
94+
source /workspace/docker-config/.env
95+
buildah push --tls-verify=false myimage registry.example.com/library/myimage:v1
96+
```
97+
98+
> **Note:** The `--tls-verify=false` flag is required because the forward proxy intercepts and re-signs TLS traffic. Different CLI tools have different ways to configure insecure registries. Please refer to your CLI documentation for details.
99+
100+
## Further Reading
101+
102+
- [Using OCI Connector Proxy in K8S Workload](./using_oci_connector_in_k8s.mdx) - Learn about the general logic of using OCI Connector proxy
103+
- [OCI ConnectorClass Forward Proxy](../concepts/oci_connectorclass.mdx#forward-proxy) - Learn about forward proxy configurations
104+
- [Connectors CSI Built-in Configurations](../../connectors/concepts/connectors_csi.mdx#built-in-configurations) - Learn about built-in configuration files
105+
- [Using CSI Volumes in Tekton](https://tekton.dev/docs/pipelines/workspaces/#csi) - Tekton CSI workspace documentation

‎docs/en/connectors-oci/how_to/using_oci_connector_in_k8s.mdx‎

Lines changed: 23 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -14,19 +14,23 @@ Currently, there are various OCI clients available in the community for accessin
1414
If you already have a preliminary understanding, you can directly refer to more specific cases:
1515

1616
- [Using OCI Connector to Build Images in K8S Job](./using_oci_connector_in_k8s_job.mdx)
17-
- [Using OCI Connector to Build Images in Tekton Pipeline](./using_oci_connector_reverse_proxy_in_tekton_pipeline.mdx)
17+
- [Using OCI Connector Forward Proxy in Tekton Pipeline](./using_oci_connector_forward_proxy_in_tekton_pipeline.mdx)
1818

1919
## Utilizing OCI Connector Proxy Capability
2020

21-
urrently, there are two proxy modes supported:
22-
- Forward Proxy
23-
- Reverse Proxy
21+
The OCI Connector supports two proxy modes:
22+
23+
- **Forward Proxy** - Recommended for most cases. Less intrusive to client configurations and easier to use.
24+
- **Reverse Proxy** - Requires modifying the target image address and additional client configuration.
2425

2526
### Forward Proxy
2627

27-
- Configure the forward proxy for the OCI Connector, such as `http_proxy`, `https_proxy`, `no_proxy`, etc.
28+
Using Forward Proxy involves the following aspects:
2829

29-
The `OCI ConnectorClass` provides an out-of-the-box configuration that can be mounted through connector-csi.
30+
- Setting proxy environment variables for the client
31+
- Configuring the client to support insecure registries
32+
33+
Mount the [built-in configurations](../../connectors/concepts/connectors_csi.mdx#built-in-configurations) through the Connectors CSI Driver:
3034

3135
```yaml
3236
volumes:
@@ -38,17 +42,24 @@ volumes:
3842
connector.name: "oci-connector"
3943
```
4044
41-
> Note: The configuration name don't need support, it will be mounted as `http.proxy` and `https.proxy`.
42-
43-
Before using, configure the proxy according to different container registry clients. Most container registry clients support directly reading the HTTP_PROXY, HTTPS_PROXY, NO_PROXY, http_proxy, https_proxy, no_proxy environment variables.
45+
Most container registry clients support reading proxy settings from environment variables (`http_proxy`, `https_proxy`, `no_proxy`). You can configure them in two ways:
4446

4547
```bash
48+
# Option 1: Set proxy variables individually
4649
export http_proxy=$(cat /{mount-path}/http.proxy)
4750
export https_proxy=$(cat /{mount-path}/https.proxy)
51+
export HTTP_PROXY=$http_proxy
52+
export HTTPS_PROXY=$https_proxy
4853
export no_proxy=localhost,127.0.0.1
54+
export NO_PROXY=$no_proxy
55+
56+
# Option 2: Source the environment file
57+
source /{mount-path}/.env
4958
```
5059

51-
Some clients need to specify the proxy in the software configuration file, the configuration method needs to refer to the specific documentation of the client.
60+
> Note: Some clients require specifying proxy settings in their configuration files.
61+
62+
Since the forward proxy intercepts and re-signs TLS traffic (MITM), clients must be configured to trust the proxy's certificate or allow insecure connections. Refer to your CLI documentation for details, or see the [OCI ConnectorClass Forward Proxy](../concepts/oci_connectorclass.mdx#forward-proxy) for default configurations provided by the ConnectorClass.
5263

5364
### Reverse Proxy
5465

@@ -121,5 +132,5 @@ For example:
121132

122133
## More
123134

124-
- [Using OCI Connector to Build Images in K8S Job](./using_oci_connector_in_k8s_job.md)
125-
- [Using OCI Connector to Build Images in Tekton Pipeline](./using_oci_connector_in_tekton_pipeline.md)
135+
- [Using OCI Connector to Build Images in K8S Job](./using_oci_connector_in_k8s_job.mdx)
136+
- [Using OCI Connector Forward Proxy in Tekton Pipeline](./using_oci_connector_forward_proxy_in_tekton_pipeline.mdx)

0 commit comments

Comments
 (0)