Skip to content
UMKIMDocs

Harbor

Experimental: registry availability, access control, transport security, and recovery remain operator responsibilities.

Harbor is the hub registry for fleet-built images and chart artifacts. The fleet project holds images built by the repository’s Ansible workflows; the charts project holds OCI Helm charts consumed by FleetApp; the mirror project holds images copied from a chart publish with imagePolicy: copy.

Build and publish

Section titled “Build and publish”

Use the repository workflow rather than ad-hoc registry credentials or manual pushes:

Terminal window
ansible-playbook harbor.yml -l hub --tags harbor_push_fleet

Operators can also publish into the hub library with scripts/fleet-chart.sh or the console Apps Library tab. Fleet-built images use the release image tag configured by umkim_version / harbor_fleet_image_tag.

v0.2 hub images are built from the umkim checkout only. Sibling service-provider clones are not required.

Security and recovery

Section titled “Security and recovery”
  • Restrict registry administration and image-push access to trusted operators.
  • Keep registry credentials in the encrypted vault.
  • Verify TLS, client trust, firewall exposure, and pull policy in the live deployment.
  • Back up Harbor data separately from the hub helper backup.

See secrets, backup and restore, and FleetApp.