provider-harbor

README

provider-harbor

Overview

A native Crossplane provider for Harbor container registry management. Manage Harbor resources (projects, registries, users, repositories, webhooks, and more) using Kubernetes-native declarative configuration.

Container Registry

• Primary: ghcr.io/rossigee/provider-harbor:v0.17.2

Features

• Projects — create and manage Harbor projects with security policies
• Registries — register and manage remote registries
• Users & User Groups — user accounts with password secrets; LDAP/HTTP/OIDC group management
• Repositories & Artifacts — repository lifecycle, metadata, and image artifact management with vulnerability scanning
• Scanners — scanner registration (Trivy, Clair, Aqua, etc.)
• Robot Accounts — CI/CD service accounts with scoped permissions
• Webhooks — event automation for scan completion, image push
• Replication Policies — cross-registry image replication with filtering
• Retention Policies — automated artifact cleanup with custom rules
• Members — project member management and role-based access control
• Scans — vulnerability scan management and reporting

Getting Started

Prerequisites

• Kubernetes with Crossplane installed
• A Harbor instance and admin (or sufficiently scoped) credentials

Installation

kubectl crossplane install provider ghcr.io/rossigee/provider-harbor:v0.17.2

Configuration

apiVersion: v1
kind: Secret
metadata:
  name: harbor-creds
type: Opaque
stringData:
  url: https://harbor.example.com
  username: admin
  password: password
---
apiVersion: harbor.m.crossplane.io/v1beta1
kind: ProviderConfig
metadata:
  name: default
spec:
  credentials:
    source: Secret
    secretRef:
      name: harbor-creds

Usage

apiVersion: project.harbor.m.crossplane.io/v1beta1
kind: Project
metadata:
  name: my-project
spec:
  forProvider:
    name: my-project
    public: false
  providerConfigRef:
    name: default

Resource Types

Resource	API Group	Description
Project	project.harbor.m.crossplane.io/v1beta1	Harbor projects and security policies
Registry	registry.harbor.m.crossplane.io/v1beta1	Remote registry registration
User	user.harbor.m.crossplane.io/v1beta1	User accounts
UserGroup	usergroup.harbor.m.crossplane.io/v1beta1	LDAP/HTTP/OIDC group management
Repository	repository.harbor.m.crossplane.io/v1beta1	Repository lifecycle and metadata
Artifact	artifact.harbor.m.crossplane.io/v1beta1	Image artifact and vulnerability management
Scanner	scanner.harbor.m.crossplane.io/v1beta1	Scanner registration
Robot	robot.harbor.m.crossplane.io/v1beta1	CI/CD service accounts
Webhook	webhook.harbor.m.crossplane.io/v1beta1	Event automation
Replication	replication.harbor.m.crossplane.io/v1beta1	Cross-registry replication policies
Retention	retention.harbor.m.crossplane.io/v1beta1	Artifact retention policies
Member	member.harbor.m.crossplane.io/v1beta1	Project membership and RBAC
Scan	scan.harbor.m.crossplane.io/v1beta1	Vulnerability scan management
ProviderConfig	harbor.m.crossplane.io/v1beta1	Provider credentials (cluster-scoped)

All resources are namespaced v1beta1 (.m. groups) for Crossplane v2 multi-tenancy. See docs/index.md for the full reference and API coverage gaps.

Development

# Build
make build

# Test
make test

# Lint
make lint

# Generate
make generate

Further documentation:

• DEPLOYMENT.md — production deployment, security, monitoring, RBAC, troubleshooting
• RELEASE_PROCESS.md — release versioning, timeline, checklist
• IMPLEMENTATION.md — implementation guide for features and resources
• API_ANALYSIS.md — Harbor API gaps and coverage analysis
• MIGRATION_UPJET.md — migration guide from the Upjet-based provider
• MIGRATION_TERRAFORM.md — migration guide from the Terraform provider
• ROBOTACCOUNT-DOCKER-CONFIG.md — Docker config JSON support for RobotAccount
• CHANGELOG.md — version history and release notes

Contributing

Issues and pull requests are welcome at github.com/rossigee/provider-harbor.

License

provider-harbor is under the Apache 2.0 license.

Implementation

This provider is a native Crossplane controller that directly implements the provider APIs without using Terraform or upjet scaffolding. This approach yields smaller binaries, simpler code, and reduced dependencies.