You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
@@ -31,9 +31,9 @@ The following sections detail application deployment using the *kubectl* CLI and
31
31
32
32
The following sections describe in detail how to deploy *Harbor* into PCAI using the *Import Framework*. You will learn how to create a private project, create users and assign them with specific role permissions, and push images using *Harbor* credentials. Used as a local image registry witin PCAI, *Harbor* helps ensure your container images remain secure and well governed.
33
33
34
-
### Harbor Deployment via PCAI *Import Framework*
34
+
### Harbor deployment via PCAI *Import Framework*
35
35
36
-
Based on the latest Helm charts from the official [*Harbor* site](https://helm.goharbor.io/harbor-1.17.0.tgz), the following required YAML manifest files have been added:
36
+
Based on the latest Helm charts from the official [*Harbor* site](https://helm.goharbor.io/harbor-1.17.0.tgz), the following required YAML manifest files have been added under *templates/ezua/*:
37
37
38
38
**virtualService.yaml*: an Istio *VirtualService* configuration file to define routing rules for incoming requests.
39
39
**kyverno-cluster-policy*: a Kyverno *ClusterPolicy* file to add the required labels to the deployment.
@@ -61,7 +61,7 @@ Using updated Helm charts, *Harbor* can be easily deployed into PCAI via the *Im
61
61
62
62
63
63
64
-
2. Harbor UI access via its endpoint
64
+
###Harbor UI access via its endpoint
65
65
66
66
After *Harbor* is installed through PCAI *Import Framework*, an **Imported***Harbor* tile is added to *Tools & Frameworks*, under *Data Science* tab. A virtual service endpoint, e.g., *https://harbor.ingress.pcai0104.ld7.hpecolo.net*, has been configured and exposed for *Harbor* access.
67
67
@@ -75,33 +75,33 @@ Using the default Harbor *admin* user credentials, you can log into *Harbor* pro
75
75
76
76
77
77
78
-
####Harbor project and user creation
78
+
### Harbor project and user creation
79
79
80
80
*Harbor* manages container images through projects. A project contains all image repositories of an application. Images cannot be pushed to *Harbor* before a project is created. By default, there is a public project *library* pre-created. You can create your project by clicking *+ NEW PRORJECT*:
81
81
82
82
83
83
84
-
You should always create a private project to restrict any user to pull images from the project. You can further add quota to limit project usage of registry capacity. The *demo*project is created using the default unlimited (-1) quota.
84
+
You should always create a private project to restrict any user to pull images from the *Harbor*project. The private project *demo* is created using the default unlimited (**-1**) quota. However, you can add quota, e.g., *500G*, to limit project usage of registry capacity, in your production setup.
85
85
86
86
You can then create users and add them as the members to a project using RBAC.
87
87
88
-
Two users, *pcai-developer*, & *pcai-admin*, are created:
88
+
In this section, two users, *pcai-developer*, & *pcai-admin*, are created:
89
89
90
90
91
91
92
-
In addition to the default admin user, these two newly created users have been added as members to the project *demo* with *Developer* and *Maintainer*, respectively. The user *pcai-developer* has read and write privileges for the project, while *pcai-admin* has elevated permissions including the ability to scan images, view replication jobs and delete images.
92
+
In addition to the default admin user, these two newly created users have been added as members to the project *demo* with the role *Developer* and *Maintainer*, respectively. The user *pcai-developer* has read and write privileges for the project, while *pcai-admin* has elevated permissions including the ability to scan images, view replication jobs and delete images.
93
93
94
94
95
95
96
-
Please refer to [Harbor Managing Users](https://goharbor.io/docs/2.13.0/administration/managing-users/) for the detailed permissions in each role. In order to more focus on image pushing process and application deployment from Harbor, the project will use its default *admin* user. As a best practice in production environment, it’s highly recommended to set up users with different role assignments in Harbor.
96
+
Please refer to [Harbor Managing Users](https://goharbor.io/docs/2.13.0/administration/managing-users/) for the detailed permissions in each role. As a best practice in production environment, it’s highly recommended to set up users with different role assignments in *Harbor*.
97
97
98
-
3. Pushing Images to Harbor Registry
98
+
###Pushing Images to Harbor Registry
99
99
100
-
You can push your images using the following steps:
100
+
With the project and users created, you can now push the container images using the following steps:
101
101
102
-
**Login to Harbor registry*
102
+
**Log into Harbor registry*
103
103
104
-
Login to Harbor registry in Docker client by running the command with the user *pcai-admin* credentials:
104
+
Log into *Harbor* registry from the Docker client by running the command using the user *pcai-admin* credentials:
If you get any certificate error when trying to login from your Linux client, you can edit the file */etc/docker/daemon.json* to add the line below:
118
+
If you get any certificate error when trying to log in from your Linux client, you can edit the file */etc/docker/daemon.json* to add the line below, by replacing the *Harbor* registry URL with your own one.
119
119
120
120
```shell
121
121
{
@@ -127,7 +127,7 @@ You need to run *'systemctl daemon-reload'* and restart the *docker* service aft
127
127
128
128
**Tag an existing image*
129
129
130
-
Instead of building a Docker image using a Dockerfile, we pull a sample nginx imagefrom DockerHub and tag it with the harbor registry URL and project name:
130
+
Instead of building a Docker image using a Dockerfile, we pull a sample nginx image, *'pcaidemo/cfe-nginx'*, from *DockerHub* and tag it with the *Harbor* registry URL and project name:
harbor.ingress.pcai0104.ld7.hpecolo.net/demo/cfe-nginx v0.1.0 1e5f3c5b981a 2 months ago 192MB
199
199
```
200
200
201
-
## Application Deployment using Harbor Registry
201
+
## Application deployment using Harbor registry
202
202
203
-
With images being pushed to Harbor registry, let’s try to deploy the application to PCAI using the same Import Framework and demonstrate pulling images from the local Harbor repository.
203
+
With images being pushed to *Harbor* registry, let’s try to deploy the application to PCAI using the same *Import Framework* and demonstrate pulling images from the *Harbor* registry.
204
204
205
-
The Helm charts of the sample Nginx application has been available from GitHub repo at https://github.com/GuopingJia/pcai-helm-examples/tree/main/nginx-chart
206
-
The *values.yaml* of the sample Helm charts includes the Harbor access credentials for the user *pcai-developer*. The Secret resource *harbor* is created and it’s used for *imagePullSecrets* for pulling images from Harbor.
205
+
The Helm charts of the sample Nginx application has been available from GitHub repository [nginx-chart](https://github.com/GuopingJia/pcai-helm-examples/tree/main/nginx-chart). In addition to the *virtualService* and Kyverno *ClusterPolicy* YAML manifest files, the *values.yaml* of the sample Helm charts includes the *imageCredentials* section to provide the *Harbor* access credentials for the user *pcai-developer*. The *imagePullSecrets* uses the Secret resource *harbor*, which is created as part of deployment, for
Using this sample Helm charts, the CFE Nginx application can be easily deployed to PCAI using the *Import Framework*. An **Imported***Nginx* tile shows up under *Tools & Framework*, with its virtual service endpoint:
226
+
225
227
226
228
229
+
By clicking *Open* button, you land to the CFE Nginx page:
230
+
227
231
228
232
229
-
Typing the following command to check the CFE Nginx deployment in the namespace *nginx*:
233
+
The CFE Nginx application is deployed to the namespace *nginx* in the K8s cluster. If you have access to the cluster, type the following command to see the deployment:
From the namespace *nginx*, the secrete *harbor* with the type *dockerconfigjson* is created. This secret is used when pulling the image from the *Harbor* registry’s private project *demo* during CFE Nginx application deployment:
251
+
252
+
```shell
253
+
# kubectl get secret harbor -n nginx
254
+
NAME TYPE DATA AGE
255
+
harbor kubernetes.io/dockerconfigjson 1 3m41s
256
+
```
257
+
Type the following command, you can see the image *cfe-nginx* with tag *v0.1.0* is pulling from the *Harbor* registry:
258
+
259
+
```shell
244
260
[root@ez-master01 ~]# k describe pod/nginx-chart-546476cd99-2nqzz -n nginx
Normal Scheduled 15s scheduler-plugins-scheduler Successfully assigned nginx/nginx-chart-5cf7969fd4-ct9hw to scs04.pcai0104.ld7.hpecolo.net
368
-
Normal Pulling 14s kubelet Pulling image "harbor.ingress.pcai0104.ld7.hpecolo.net/demo/cfe-nginx:v0.1.0"
369
-
Normal Pulled 14s kubelet Successfully pulled image "harbor.ingress.pcai0104.ld7.hpecolo.net/demo/cfe-nginx:v0.1.0" in 302ms (302ms including waiting)
370
-
Normal Created 14s kubelet Created container nginx-chart
371
-
Normal Started 13s kubelet Started container nginx-chart
372
-
```
278
+
The *Logs* page of *Harbor* registry contains all the audit logs about project and user creation, image push and pull operations, etc.
373
279
374
280
375
281
376
282
### Conclusion
377
283
378
-
This blog post offers you a comprehensive guide on how to deploy Harbor to HPE Private Cloud AI and set it up as a local container image registry. By creating a private project, customers can push their Docker image into this local registry.
284
+
This blog post offers you a comprehensive guide on how to deploy *Harbor* to HPE Private Cloud AI and set it up as a local container registry. By creating a private *Harbor*project and adding users with the appropriate roles, customers can push their images into this registry and pull them for their application deployment.
379
285
380
-
Harbor is not just an image registry. It provides security and vulnerability analysis and content signing and validation features to ensure images are scanned and free from vulnerabilities. Organizations have choices to set up users, scan the image and deploy their applications to avoid using any third party container registries like Docker Hub, GitHub container registry, or using cloud providers like Azure Container Registry (ACR), Amazon Elastic Contianer Registry (ECR) or Google Cloud Container Registry (GCR), etc.
286
+
Harbor is not just a container registry. It provides security and vulnerability analysis and content signing and validation features to ensure images are scanned and free from vulnerabilities. Organizations have choices to set up users, scan the image and deploy their applications to avoid using any third party container registries like Docker Hub, GitHub container registry, or using cloud providers like Azure Container Registry (ACR), Amazon Elastic Contianer Registry (ECR) or Google Cloud Container Registry (GCR), etc.
381
287
This can be used by an organization for hosting the container images for their native cloud applications. To match their security regulation and ….
382
288
383
-
As of now, HPE Private Cloud AI doesn’t have a service for container registry. By deploying Harbor via PCAI Import Framework,
384
-
385
289
Please keep coming back to the [HPE Developer Community blog](https://developer.hpe.com/blog/) to learn more about HPE Private Cloud for AI and get more ideas on how you can use it in your everyday operations.
0 commit comments