Collect requirements/idea/features for v2.6.0

[OrlinVasilev]

Hi Community,

as we approach the release of v2.5 it's time to brainstorm the ideas and requirements for the feature list for 2.6!

Please share your thoughts here so we can all work on proper roadmap and achiving it!

Orlix

[srvsstieber]

Hi, i'm a happy Harbor User. In our department we are looking for:

• custom roles & permissions
• helm scanners & linters
• harbor edge instances
• gdpr compliant deletion of OIDC importet users

Hope this helps.

Stefan.

[sixeela]

+1 for custom roles & permissions.

In addition, would it be possible to study on having both local users (used as "technicals") and LDAP or OIDC ? Is there anything which prevents having both type of users ?

[dioguerra]

+1 on deletion OIDC users

[geoger]

+1 for custom roles & permissions.

[sagikazarmark]

It would be nice to consolidate authn/authz a little bit more: if you enable OIDC (which I believe every 15+ company would do) you end up with:

• an admin user
• OIDC users
• OIDC groups
• project level robot accounts
• system level robot accounts

The result of this little bit fragmented system is that:

• You can't create users manually (kind of okay)
• You can create groups manually, but you can't add users to them (pushing authorization to the OIDC provider which is not always a good idea)
• Only admins can create system robot accounts
• Project owners can't control system robot account access to their projects
• Only the admin user and system robot accounts can talk to the API?

I think it'd be nice to see some IAM-like structure.

Another use case that it would support better is customer access. Currently it's only possible with system robot accounts created by an admin user which is not terrible, but also not a very good experience at the moment.

I'd be happy to talk more about these topics and even get involved in some of the implementation.

[Vad1mo]

I agree that the current authn/autz possibilities are fragmented. This is because a lot of things were added over time based on immediate requirements.
In a few places, Harbor is already using casbin which offers an enormous set of possibilities. IMHO a good start would be to expose casbin to the end user. Allow users to deviate from "our" suggested default as they wish.

I a second step we should introduce Casbin in other areas of Harbor.

[sagikazarmark]

Personally, I'm not a huge fan of Casbin. Had a lot of issues with it in the past. Regardless of that dislike, a higher level redesign would make more sense IMO and then exposing Casbin features through an abstract interface could be a next step.

[Vad1mo]

@sagikazarmark, what do you consider a better alternative to Casbin in the Golang world? The only ohter thing that comes into my mind would be OPA. However, it has its own merits, especially in the context we are in.

[sagikazarmark]

@Vad1mo OPA would be a good example, but my point is I wouldn't expose Casbin directly to users, I'd make it an implementation detail hidden behind a custom interface.

That way introducing OPA at some point would become easier.

[Vad1mo]

I understand. Exposing the languages of eg. Casbin or OPA to the user has the enormous advantage that we don't have to reinvent the wheel. No forcing the user to learn our concepts and syntax, no extra documentation needed.

[losadacris71]

Hi Community,

as we approach the release of v2.5 it's time to brainstorm the ideas and requirements for the feature list for 2.6!

Please share your thoughts here so we can all work on proper roadmap and achiving it!

Orlix

Please work with docker and trivy adapter actual script instalation don't work --with-trivy
thanks

[OrlinVasilev]

Hi @losadacris71, do you have an open issue for that? I just tested it again and works fine with the offline installer!
If that persist on your side please open issue

[danielzhanghl]

hi harbor team,
we are looking for redis over TLS to secure the internal pod traffic, as in below ticket.
#13223

thanks.

[doublest]

+1 for secure redis traffic

[AlenversFr]

Hi,
We'd love to see this feature "Add a Security Dashboard"
https://github.com/goharbor/harbor/issues/16121

Basicaly a simple view at project level with a resume of :

• top common CVE in latest image:tag (image push during last 7days in a project)
• list of latest images:tag (push during last 7 days) with the detail of all critical and Major cve
• A global tendency on the security with a comparison between images pushed a month ago versus now (not sure how to calculate this... cvss score ?)
• the possibility to filter the time period (default 7 days), the level of CVE (Critical by default)

And new API endpoints to GET data :

• Get all image:tags with a specific CVE as parameter
• Get all CVE on a specific image:tag as parameter
• Get all CVE on all image:tag with a specific project as parameter (group by CVE)
• Get all CVE on all image:tag on all project (full list) with the possibility to filter on the level of CVE

[dioguerra]

It would be nice for Harbor to fully suport regex.
There are some use cases like registry replication, where i want to be more selective on the image tags I replicate

[nyarly]

The single feature that's preventing us from adopting Harbor is #8649 - we'd love to see Cockroach as a backend database, and other cloud-native DBs (e.g. Yugabyte) would be great options for Harbor.

Likewise, I haven't seen confirmation here yet, but if Harbor can use Rook Rados object stores (which, like Cockroach) are S3 compatible, that would be ideal for us.

[OrlinVasilev]

@qnetter - hope you can find interesting topics here! :)

[qnetter]

Excellent!

[chrisminton]

I'd really like to see AWS IAM service accounts able to be used for s3 backends as per #16490. This is the sole feature that is preventing us going to production with Harbor 🙏

[sagikazarmark]

I believe there is still a problem on the Docker registry side that keeps us from using IAM service accounts: distribution/distribution#3275

[Vad1mo]

This feature depends on upstream docker distribution.

Given the pace and rate of innovation in docker distribution it makes little sense having this in Harbor present before upstream.

[OrlinVasilev]

@tianon any ideas here? :)

[wy65701436]

Distribution supports this only in main, not in any release. Harbor has to wait for the distribution v3.0 release off main branch, then bump up.

[chrisminton]

sad times. Thanks all for the update 👍

[geoger]

I suggest to add such a feature. As system admin, projects , and members who could access one projects could easily be known by UI. But if the administrator want to know which projects could be accessed by a specific user , it is a little hard. no UI place could help

[robdewit]

Using the docker image, I would like to be able to choose English language in the UI with a sane date format - not MM/DD/YY, but something like YYYY-MM-DD or DD/MM/YYYY. I guess uk_GB would do.

We are using the docker-compose environment and I know I could rebuild the whole thing following the documentation with another locale, but having English with an internationally readable date format would really be a nice addition to the docker image.

[robdewit]

Oh, OK so it looks like #16796 is fixing this. I can't wait!

[PengWuLin]

#17133 ，Can we have a minimal configuration。I just need docker registry。

[qnetter]

#17133 ，Can we have a minimal configuration。I just need docker registry。

I may be missing something but: if you just need a Docker registry, why not install Docker-distribution instead of Harbor?

[PengWuLin]

Thank you for your suggest !
In fact, I should describe it this way, We still need some capabilities of harbor, such as trivy. With the development of business, we will also use other components in the future. Therefore, in the first version, I want to use harbor and add the components I want in subsequent versions.

[qnetter]

Thanks - being able to configure only the services you want to use - that’s a clear request.

[OrlinVasilev]

Since we have released Harbor 2.6 will lock that discussion for historical reference!