Harbor でプライベートコンテナレジストリを構築する

# 1. Harbor インストーラーのダウンロード
wget https://github.com/goharbor/harbor/releases/download/v2.12.0/harbor-online-installer-v2.12.0.tgz
tar xzvf harbor-online-installer-v2.12.0.tgz
cd harbor

# 2. 設定ファイルの編集
cp harbor.yml.tmpl harbor.yml

hostname: harbor.example.com

# HTTPS 設定（本番必須）
https:
  port: 443
  certificate: /etc/ssl/certs/harbor.crt
  private_key: /etc/ssl/private/harbor.key

# 管理者パスワード
harbor_admin_password: StrongPassword123!

# データベース設定
database:
  password: db-password
  max_idle_conns: 100
  max_open_conns: 900

# ストレージ設定
data_volume: /data/harbor

# 3. Trivy 付きでインストール
./install.sh --with-trivy

# 4. 動作確認
docker compose ps
curl -k https://harbor.example.com/api/v2.0/health

# Helm リポジトリの追加
helm repo add harbor https://helm.goharbor.io
helm repo update

# values.yaml の作成
cat <<EOF > harbor-values.yaml
expose:
  type: ingress
  ingress:
    hosts:
      core: harbor.example.com
    className: nginx
  tls:
    enabled: true
    certSource: secret
    secret:
      secretName: harbor-tls
externalURL: https://harbor.example.com
persistence:
  enabled: true
  persistentVolumeClaim:
    registry:
      size: 100Gi
    database:
      size: 10Gi
trivy:
  enabled: true
EOF

# Harbor のデプロイ
helm install harbor harbor/harbor \
  -f harbor-values.yaml \
  -n harbor --create-namespace

# Harbor CLI でプロジェクト作成
curl -X POST "https://harbor.example.com/api/v2.0/projects" \
  -H "Authorization: Basic $(echo -n 'admin:password' | base64)" \
  -H "Content-Type: application/json" \
  -d '{
    "project_name": "production",
    "metadata": {
      "public": "false",
      "auto_scan": "true",
      "prevent_vul": "true",
      "severity": "high"
    }
  }'

# API でスキャン結果を取得
curl "https://harbor.example.com/api/v2.0/projects/production/repositories/myapp/artifacts/latest/additions/vulnerabilities" \
  -H "Authorization: Basic $(echo -n 'admin:password' | base64)"

{
  "name": "sync-to-dr",
  "src_registry": { "id": 0 },
  "dest_registry": { "id": 1 },
  "dest_namespace": "production",
  "trigger": {
    "type": "event_based"
  },
  "filters": [
    { "type": "name", "value": "production/**" },
    { "type": "tag", "value": "v*" }
  ],
  "enabled": true
}