.
+
+**Usage**
+
+ - 1> The address of the demo server is [https://demo.goharbor.io](https://demo.goharbor.io)
+ - 2> You can register a new user by yourself
+ - 3> Then you can use the account/password created in step 2 to log in
+ ```
+ docker login demo.goharbor.io
+ ```
+You can refer to [User Guide](user_guide.md) for more details on how to use Harbor.
diff --git a/docs/img/china-mobile.png b/docs/img/china-mobile.png
new file mode 100644
index 000000000..98e3589da
Binary files /dev/null and b/docs/img/china-mobile.png differ
diff --git a/docs/img/create_rule.png b/docs/img/create_rule.png
index d116a641d..c7e869af6 100644
Binary files a/docs/img/create_rule.png and b/docs/img/create_rule.png differ
diff --git a/docs/img/delete_rule.png b/docs/img/delete_rule.png
index 518fce238..0c29e82eb 100644
Binary files a/docs/img/delete_rule.png and b/docs/img/delete_rule.png differ
diff --git a/docs/img/list_stop_jobs.png b/docs/img/list_stop_jobs.png
index df772c30d..e5c562498 100644
Binary files a/docs/img/list_stop_jobs.png and b/docs/img/list_stop_jobs.png differ
diff --git a/docs/img/rule_under_project_view.png b/docs/img/rule_under_project_view.png
index f5033dc7b..79403e1c6 100644
Binary files a/docs/img/rule_under_project_view.png and b/docs/img/rule_under_project_view.png differ
diff --git a/docs/img/start_replicate.png b/docs/img/start_replicate.png
index d88e55746..2d5bf76c2 100644
Binary files a/docs/img/start_replicate.png and b/docs/img/start_replicate.png differ
diff --git a/docs/installation_guide.md b/docs/installation_guide.md
index ca44e9a73..8939b5363 100644
--- a/docs/installation_guide.md
+++ b/docs/installation_guide.md
@@ -34,7 +34,7 @@ Harbor is deployed as several Docker containers, and, therefore, can be deployed
|Port|Protocol|Description|
|---|---|---|
|443|HTTPS|Harbor UI and API will accept requests on this port for https protocol|
-|4443|HTTS|Connections to the Docker Content Trust service for Harbor, only needed when Notary is enabled|
+|4443|HTTPS|Connections to the Docker Content Trust service for Harbor, only needed when Notary is enabled|
|80|HTTP|Harbor UI and API will accept requests on this port for http protocol|
## Installation Steps
diff --git a/docs/migration_guide.md b/docs/migration_guide.md
index 5abba7f8f..bf18fb64f 100644
--- a/docs/migration_guide.md
+++ b/docs/migration_guide.md
@@ -39,7 +39,7 @@ When upgrading your existing Habor instance to a newer version, you may need to
5. Back up database/harbor.cfg to a directory such as `/path/to/backup`. You need to create the directory if it does not exist. Also, note that the username and password to access the db are provided via environment variable "DB_USR" and "DB_PWD".
- **NOTE:** Upgrade from harbor 1.2 or older to harbor 1.3 must use `vmware/migratorharbor-db-migrator:1.2`. Because DB engine replaced by MariaDB in harbor 1.3
+ **NOTE:** Upgrade from harbor 1.2 or older to harbor 1.3 must use `vmware/harbor-db-migrator:1.2`. Because DB engine replaced by MariaDB in harbor 1.3
```
docker run -it --rm -e DB_USR=root -e DB_PWD={db_pwd} -v ${harbor_db_path}:/var/lib/mysql -v ${harbor_cfg}:/harbor-migration/harbor-cfg/harbor.cfg -v ${backup_path}:/harbor-migration/backup vmware/harbor-migrator:[tag] backup
diff --git a/docs/swagger.yaml b/docs/swagger.yaml
index 66ed3fe2b..3e35883ba 100644
--- a/docs/swagger.yaml
+++ b/docs/swagger.yaml
@@ -2325,14 +2325,18 @@ paths:
summary: Search available ldap groups.
description: >
This endpoint searches the available ldap groups based on related
- configuration parameters. Support searched by input ladp configuration,
- load configuration from the system and specific filter.
+ configuration parameters. support to search by groupname or groupdn.
parameters:
- name: groupname
in: query
type: string
required: false
description: Ldap group name
+ - name: groupdn
+ in: query
+ type: string
+ required: false
+ description: The LDAP group DN
tags:
- Products
responses:
@@ -2342,6 +2346,10 @@ paths:
type: array
items:
$ref: '#/definitions/UserGroup'
+ "400":
+ description: The Ldap group DN is invalid.
+ '404':
+ description: No ldap group found.
'500':
description: Unexpected internal errors.
/ldap/users/search:
@@ -2372,6 +2380,7 @@ paths:
description: Only admin has this authority.
'500':
description: Unexpected internal errors.
+
/ldap/users/import:
post:
summary: Import selected available ldap users.
@@ -2720,25 +2729,24 @@ definitions:
type: object
properties:
public:
- type: integer
- format: int
- description: The public status of the project.
+ type: string
+ description: The public status of the project. The valid values are "true", "false".
enable_content_trust:
- type: boolean
+ type: string
description: >-
Whether content trust is enabled or not. If it is enabled, user cann't
- pull unsigned images from this project.
+ pull unsigned images from this project. The valid values are "true", "false".
prevent_vulnerable_images_from_running:
- type: boolean
- description: Whether prevent the vulnerable images from running.
+ type: string
+ description: Whether prevent the vulnerable images from running. The valid values are "true", "false".
prevent_vulnerable_images_from_running_severity:
type: string
description: >-
If the vulnerability is high than severity defined here, the images
- cann't be pulled.
+ cann't be pulled. The valid values are "negligible", "low", "medium", "high", "critical".
automatically_scan_images_on_push:
- type: boolean
- description: Whether scan images automatically when pushing.
+ type: string
+ description: Whether scan images automatically when pushing. The valid values are "true", "false".
Manifest:
type: object
properties:
@@ -2989,9 +2997,7 @@ definitions:
The replication policy filter kind. The valid values are project,
repository and tag.
value:
- type:
- - string
- - integer
+ type: string
description: The value of replication policy filter. When creating repository and tag filter, filling it with the pattern as string. When creating label filter, filling it with label ID as integer.
pattern:
type: string
@@ -3497,6 +3503,9 @@ definitions:
ldap_group_search_scope:
type: integer
description: The scope to search ldap. '0-LDAP_SCOPE_BASE, 1-LDAP_SCOPE_ONELEVEL, 2-LDAP_SCOPE_SUBTREE'
+ ldap_group_admin_dn:
+ type: string
+ description: Specify the ldap group which have the same privilege with Harbor admin.
project_creation_restriction:
type: string
description: >-
@@ -3653,6 +3662,7 @@ definitions:
ldap_group_dn:
type: string
description: The DN of the LDAP group if group type is 1 (LDAP group).
+
Resource:
type: object
properties:
diff --git a/docs/user_guide.md b/docs/user_guide.md
index 79034d06c..29ced06b5 100644
--- a/docs/user_guide.md
+++ b/docs/user_guide.md
@@ -126,11 +126,12 @@ There may be a bit of delay during replication according to the situation of the
Replication can be configured by creating a rule. Click `NEW REPLICATION RULE` under `Administration->Replications` and fill in the necessary fields. You can choose different image filters and trigger modes according to the different requirements. If there is no endpoint available in the list, you need to create one. Click `SAVE` to create a replication rule for the selected project. If `Replicate existing images immediately` is chosen, the existing images under the project will be replicated to the remote registry immediately.
#### Image filter
-Two image filters are supported:
+Three image filters are supported:
* **Repository**: Filter images according to the repository part of image name.
* **Tag**: Filter images according to the tag part of image name.
+* **Label**: Filter images according to the [labels](#managing-labels). **Notes**: If the labels referenced by a rule are deleted, the rule's status will be set to `Disabled`. You need to edit and update it according to the tips.
-Two terms are supported in filter pattern:
+Two terms are supported in the pattern used by repository filter and tag filter:
* **\***: Matches any sequence of non-separator characters `/`.
* **?**: Matches any single non-separator character `/`.
diff --git a/make/common/templates/adminserver/env b/make/common/templates/adminserver/env
index 81df12302..45d20a6c7 100644
--- a/make/common/templates/adminserver/env
+++ b/make/common/templates/adminserver/env
@@ -62,3 +62,5 @@ READ_ONLY=false
SKIP_RELOAD_ENV_PATTERN=$skip_reload_env_pattern
RELOAD_KEY=$reload_key
CHART_SERVICE_URL=$chart_service_url
+LDAP_GROUP_ADMIN_DN=$ldap_group_admin_dn
+REGISTRY_CONTROLLER_URL=$registry_controller_url
diff --git a/make/common/templates/nginx/nginx.http.conf b/make/common/templates/nginx/nginx.http.conf
index 9e4123a9d..5fd84ac5a 100644
--- a/make/common/templates/nginx/nginx.http.conf
+++ b/make/common/templates/nginx/nginx.http.conf
@@ -12,11 +12,6 @@ http {
# this is necessary for us to be able to disable request buffering in all cases
proxy_http_version 1.1;
-
- upstream registry {
- server registry:5000;
- }
-
upstream ui {
server ui:8080;
}
diff --git a/make/common/templates/nginx/nginx.https.conf b/make/common/templates/nginx/nginx.https.conf
index d0b295b7a..faf0ba842 100644
--- a/make/common/templates/nginx/nginx.https.conf
+++ b/make/common/templates/nginx/nginx.https.conf
@@ -13,10 +13,6 @@ http {
# this is necessary for us to be able to disable request buffering in all cases
proxy_http_version 1.1;
- upstream registry {
- server registry:5000;
- }
-
upstream ui {
server ui:8080;
}
diff --git a/make/common/templates/registry/config.yml b/make/common/templates/registry/config.yml
index c39c42aa1..92a4834cc 100644
--- a/make/common/templates/registry/config.yml
+++ b/make/common/templates/registry/config.yml
@@ -5,13 +5,16 @@ log:
service: registry
storage:
cache:
- layerinfo: inmemory
+ layerinfo: redis
$storage_provider_info
maintenance:
uploadpurging:
enabled: false
delete:
enabled: true
+redis:
+ addr: $redis_url
+ db: 1
http:
addr: :5000
secret: placeholder
diff --git a/make/common/templates/registry/config_ha.yml b/make/common/templates/registry/config_ha.yml
index 46776c8ff..2f6d76d55 100644
--- a/make/common/templates/registry/config_ha.yml
+++ b/make/common/templates/registry/config_ha.yml
@@ -14,15 +14,7 @@ storage:
enabled: true
redis:
addr: $redis_url
- db: 0
- dialtimeout: 10ms
- readtimeout: 10ms
- writetimeout: 10ms
- pool:
- maxidle: 16
- maxactive: 64
- idletimeout: 300s
-
+ db: 1
http:
addr: :5000
secret: placeholder
diff --git a/make/common/templates/registryctl/config.yml b/make/common/templates/registryctl/config.yml
new file mode 100644
index 000000000..7b2a1d910
--- /dev/null
+++ b/make/common/templates/registryctl/config.yml
@@ -0,0 +1,8 @@
+---
+protocol: "http"
+port: 8080
+log_level: "INFO"
+
+#https_config:
+# cert: "server.crt"
+# key: "server.key"
\ No newline at end of file
diff --git a/make/common/templates/registryctl/env b/make/common/templates/registryctl/env
new file mode 100644
index 000000000..188efbcf4
--- /dev/null
+++ b/make/common/templates/registryctl/env
@@ -0,0 +1,3 @@
+UI_SECRET=$ui_secret
+JOBSERVICE_SECRET=$jobservice_secret
+
diff --git a/make/common/templates/ui/env b/make/common/templates/ui/env
index 5dee4ba9e..ad1a9fd69 100644
--- a/make/common/templates/ui/env
+++ b/make/common/templates/ui/env
@@ -6,3 +6,4 @@ GODEBUG=netdns=cgo
ADMINSERVER_URL=$adminserver_url
UAA_CA_ROOT=/etc/ui/certificates/uaa_ca.pem
_REDIS_URL=$redis_url
+SYNC_REGISTRY=false
diff --git a/make/dev/nodeclarity/entrypoint.sh b/make/dev/nodeclarity/entrypoint.sh
index b4899bb6d..bec32011d 100644
--- a/make/dev/nodeclarity/entrypoint.sh
+++ b/make/dev/nodeclarity/entrypoint.sh
@@ -34,7 +34,7 @@ sed -i 's/* as//g' src/app/shared/gauge/gauge.component.js
cp ./dist/build.min.js ../ui/static/
cp -r ./src/i18n/ ../ui/static/
-cp ./src/styles.scss ../ui/static/
+cp ./src/styles.css ../ui/static/
cp -r ./src/images/ ../ui/static/
cp ./src/setting.json ../ui/static/
diff --git a/make/dev/registryctl/Dockerfile b/make/dev/registryctl/Dockerfile
new file mode 100644
index 000000000..84fd27304
--- /dev/null
+++ b/make/dev/registryctl/Dockerfile
@@ -0,0 +1,12 @@
+FROM golang:1.9.2
+
+MAINTAINER wangyan@vmware.com
+
+COPY . /go/src/github.com/vmware/harbor
+
+WORKDIR /go/src/github.com/vmware/harbor/src/registryctl
+
+RUN go build -a -o /go/bin/harbor_registryctl \
+ && chmod u+x /go/bin/harbor_registryctl
+WORKDIR /go/bin/
+ENTRYPOINT ["/go/bin/harbor_registryctl"]
diff --git a/make/docker-compose.clair.tpl b/make/docker-compose.clair.tpl
index 74fad5a29..62bd25dc1 100644
--- a/make/docker-compose.clair.tpl
+++ b/make/docker-compose.clair.tpl
@@ -22,7 +22,7 @@ services:
container_name: clair
image: vmware/clair-photon:__clair_version__
restart: always
- cpu_quota: 150000
+ cpu_quota: 50000
depends_on:
- postgresql
volumes:
diff --git a/make/docker-compose.tpl b/make/docker-compose.tpl
index 5556b393f..9f70d7413 100644
--- a/make/docker-compose.tpl
+++ b/make/docker-compose.tpl
@@ -22,8 +22,6 @@ services:
- harbor
environment:
- GODEBUG=netdns=cgo
- command:
- ["serve", "/etc/registry/config.yml"]
depends_on:
- log
logging:
@@ -31,6 +29,27 @@ services:
options:
syslog-address: "tcp://127.0.0.1:1514"
tag: "registry"
+ registryctl:
+ image: vmware/harbor-registryctl:__version__
+ container_name: registryctl
+ env_file:
+ - ./common/config/registryctl/env
+ restart: always
+ volumes:
+ - /data/registry:/storage:z
+ - ./common/config/registry/:/etc/registry/:z
+ - ./common/config/registryctl/config.yml:/etc/registryctl/config.yml:z
+ networks:
+ - harbor
+ environment:
+ - GODEBUG=netdns=cgo
+ depends_on:
+ - log
+ logging:
+ driver: "syslog"
+ options:
+ syslog-address: "tcp://127.0.0.1:1514"
+ tag: "registryctl"
postgresql:
image: vmware/harbor-db:__version__
container_name: harbor-db
@@ -116,7 +135,7 @@ services:
container_name: redis
restart: always
volumes:
- - /data/redis:/data
+ - /data/redis:/var/lib/redis
networks:
- harbor
depends_on:
diff --git a/make/migrations/postgresql/0001_initial_schema.up.sql b/make/migrations/postgresql/0001_initial_schema.up.sql
index 3e58d5029..57179eff5 100644
--- a/make/migrations/postgresql/0001_initial_schema.up.sql
+++ b/make/migrations/postgresql/0001_initial_schema.up.sql
@@ -341,5 +341,5 @@ CREATE TABLE IF NOT EXISTS alembic_version (
version_num varchar(32) NOT NULL
);
-insert into alembic_version values ('1.5.0');
+insert into alembic_version values ('1.6.0');
diff --git a/make/photon/Makefile b/make/photon/Makefile
index ae1eaad88..3a409155c 100644
--- a/make/photon/Makefile
+++ b/make/photon/Makefile
@@ -71,6 +71,10 @@ DOCKERFILEPATH_REG=$(DOCKERFILEPATH)/registry
DOCKERFILENAME_REG=Dockerfile
DOCKERIMAGENAME_REG=vmware/registry-photon
+DOCKERFILEPATH_REGISTRYCTL=$(DOCKERFILEPATH)/registryctl
+DOCKERFILENAME_REGISTRYCTL=Dockerfile
+DOCKERIMAGENAME_REGISTRYCTL=vmware/harbor-registryctl
+
DOCKERFILEPATH_NOTARY=$(DOCKERFILEPATH)/notary
DOCKERFILENAME_NOTARYSIGNER=signer.Dockerfile
DOCKERIMAGENAME_NOTARYSIGNER=vmware/notary-signer-photon
@@ -177,6 +181,11 @@ _build_registry:
fi
@echo "building registry container for photon..."
@cd $(DOCKERFILEPATH_REG) && chmod 655 $(DOCKERFILEPATH_REG)/binary/registry && $(DOCKERBUILD) -f $(DOCKERFILEPATH_REG)/$(DOCKERFILENAME_REG) -t $(DOCKERIMAGENAME_REG):$(REGISTRYVERSION)-$(VERSIONTAG) .
+ @echo "Done."
+
+_build_registryctl:
+ @echo "building registry controller for photon..."
+ $(DOCKERBUILD) -f $(DOCKERFILEPATH_REGISTRYCTL)/$(DOCKERFILENAME_REGISTRYCTL) -t $(DOCKERIMAGENAME_REGISTRYCTL):$(VERSIONTAG) .
@rm -rf $(DOCKERFILEPATH_REG)/binary
@echo "Done."
@@ -187,14 +196,14 @@ _build_redis:
_build_migrator:
@echo "building db migrator container for photon..."
- @cd $(DOCKERFILEPATH_MIGRATOR) && $(DOCKERBUILD) -f $(DOCKERFILEPATH_MIGRATOR)/$(DOCKERFILENAME_MIGRATOR) -t $(DOCKERIMAGENAME_MIGRATOR):$(VERSIONTAG) .
+ @cd $(DOCKERFILEPATH_MIGRATOR) && $(DOCKERBUILD) -f $(DOCKERFILEPATH_MIGRATOR)/$(DOCKERFILENAME_MIGRATOR) -t $(DOCKERIMAGENAME_MIGRATOR):$(MIGRATORVERSION) .
@echo "Done."
define _get_binary
$(WGET) --timeout 30 --no-check-certificate $1 -O $2
endef
-build: _build_db _build_adminiserver _build_ui _build_jobservice _build_log _build_nginx _build_registry _build_notary _build_clair _build_redis _build_migrator _build_chart_server
+build: _build_db _build_adminiserver _build_ui _build_jobservice _build_log _build_nginx _build_registry _build_registryctl _build_notary _build_clair _build_redis _build_migrator _build_chart_server
cleanimage:
@echo "cleaning image for photon..."
diff --git a/make/photon/adminserver/Dockerfile b/make/photon/adminserver/Dockerfile
index 46803cdff..948fe184c 100644
--- a/make/photon/adminserver/Dockerfile
+++ b/make/photon/adminserver/Dockerfile
@@ -7,7 +7,7 @@ RUN tdnf erase vim -y \
&& groupadd -r -g 10000 harbor && useradd --no-log-init -r -g 10000 -u 10000 harbor \
&& mkdir /harbor/
COPY ./make/dev/adminserver/harbor_adminserver ./make/photon/adminserver/start.sh /harbor/
-#There is a race condition that both ui and adminserver may initialize schema
+#As UI will be blocked until adminserver is ready, let adminserver do the initialise work for DB
COPY ./make/migrations /harbor/migrations
HEALTHCHECK CMD curl --fail -s http://127.0.0.1:8080/api/ping || exit 1
diff --git a/make/photon/clair/Dockerfile b/make/photon/clair/Dockerfile
index f3c4cc14c..0c8a485e5 100644
--- a/make/photon/clair/Dockerfile
+++ b/make/photon/clair/Dockerfile
@@ -5,10 +5,10 @@ RUN tdnf distro-sync -y \
&& tdnf erase vim -y \
&& tdnf install -y git shadow sudo bzr rpm xz python-xml >>/dev/null\
&& tdnf clean all \
- && mkdir /clair2.0.1/ \
+ && mkdir /clair/ \
&& groupadd -r -g 10000 clair \
&& useradd --no-log-init -m -r -g 10000 -u 10000 clair
-COPY ./binary/clair /clair2.0.1/
+COPY ./binary/clair /clair/
COPY docker-entrypoint.sh /docker-entrypoint.sh
COPY dumb-init /dumb-init
@@ -16,8 +16,8 @@ VOLUME /config
EXPOSE 6060 6061
-RUN chown -R 10000:10000 /clair2.0.1 \
- && chmod u+x /clair2.0.1/clair \
+RUN chown -R 10000:10000 /clair \
+ && chmod u+x /clair/clair \
&& chmod u+x /docker-entrypoint.sh \
&& chmod +x /dumb-init
diff --git a/make/photon/clair/Dockerfile.binary b/make/photon/clair/Dockerfile.binary
index 2b10ec73c..4cdf7d0f3 100644
--- a/make/photon/clair/Dockerfile.binary
+++ b/make/photon/clair/Dockerfile.binary
@@ -1,6 +1,6 @@
-FROM golang:1.7.3
+FROM golang:1.9.2
ADD . /go/src/github.com/coreos/clair/
WORKDIR /go/src/github.com/coreos/clair/
-RUN go install -v github.com/coreos/clair/cmd/clair
\ No newline at end of file
+RUN go install -v github.com/coreos/clair/cmd/clair
diff --git a/make/photon/clair/docker-entrypoint.sh b/make/photon/clair/docker-entrypoint.sh
index f8e60defb..6ed1c969c 100644
--- a/make/photon/clair/docker-entrypoint.sh
+++ b/make/photon/clair/docker-entrypoint.sh
@@ -1,4 +1,4 @@
#!/bin/bash
set -e
-sudo -E -H -u \#10000 sh -c "/dumb-init -- /clair2.0.1/clair -config /etc/clair/config.yaml"
+sudo -E -H -u \#10000 sh -c "/dumb-init -- /clair/clair -config /etc/clair/config.yaml"
set +e
diff --git a/make/photon/redis/Dockerfile b/make/photon/redis/Dockerfile
index 562e41973..9b75db19b 100644
--- a/make/photon/redis/Dockerfile
+++ b/make/photon/redis/Dockerfile
@@ -1,12 +1,10 @@
FROM vmware/photon:1.0
RUN tdnf distro-sync -y \
- && tdnf install -y redis sudo \
- && mkdir /data \
- && chown redis:redis /data
+ && tdnf install -y redis sudo
-VOLUME /data
-WORKDIR /data
+VOLUME /var/lib/redis
+WORKDIR /var/lib/redis
COPY docker-entrypoint.sh /usr/bin/
COPY redis.conf /etc/redis.conf
RUN chmod +x /usr/bin/docker-entrypoint.sh \
diff --git a/make/photon/registry/Dockerfile b/make/photon/registry/Dockerfile
index 75393eef4..84c284d28 100644
--- a/make/photon/registry/Dockerfile
+++ b/make/photon/registry/Dockerfile
@@ -22,4 +22,4 @@ HEALTHCHECK CMD curl 127.0.0.1:5000/
VOLUME ["/var/lib/registry"]
EXPOSE 5000
ENTRYPOINT ["/entrypoint.sh"]
-CMD ["/etc/registry/config.yml"]
+CMD ["/etc/registry/config.yml"]
\ No newline at end of file
diff --git a/make/photon/registryctl/Dockerfile b/make/photon/registryctl/Dockerfile
new file mode 100644
index 000000000..bb1ff01f6
--- /dev/null
+++ b/make/photon/registryctl/Dockerfile
@@ -0,0 +1,25 @@
+FROM vmware/photon:1.0
+
+MAINTAINER wangyan@vmware.com
+
+RUN tdnf distro-sync -y || echo \
+ && tdnf erase vim -y \
+ && tdnf install sudo -y >> /dev/null\
+ && tdnf clean all \
+ && groupadd -r -g 10000 harbor && useradd --no-log-init -r -g 10000 -u 10000 harbor \
+ && mkdir -p /etc/registry
+
+COPY ./make/photon/registry/binary/registry /usr/bin
+COPY ./make/photon/registryctl/start.sh /harbor/
+COPY ./make/dev/registryctl/harbor_registryctl /harbor/
+
+RUN chmod u+x /harbor/harbor_registryctl \
+ && chmod u+x /usr/bin/registry \
+ && chmod u+x /harbor/start.sh
+
+HEALTHCHECK CMD curl --fail -s http://127.0.0.1:8080/api/health || exit 1
+
+VOLUME ["/var/lib/registry"]
+WORKDIR /harbor/
+
+ENTRYPOINT ["/harbor/start.sh"]
diff --git a/make/photon/registryctl/start.sh b/make/photon/registryctl/start.sh
new file mode 100644
index 000000000..49dedf8bd
--- /dev/null
+++ b/make/photon/registryctl/start.sh
@@ -0,0 +1,20 @@
+#!/bin/sh
+
+set -e
+
+# The directory /var/lib/registry is within the container, and used to store image in CI testing.
+# So for now we need to chown to it to avoid failure in CI.
+if [ -d /var/lib/registry ]; then
+ chown 10000:10000 -R /var/lib/registry
+fi
+
+if [ -d /storage ]; then
+ if ! stat -c '%u:%g' /storage | grep -q '10000:10000' ; then
+ # 10000 is the id of harbor user/group.
+ # Usually NFS Server does not allow changing owner of the export directory,
+ # so need to skip this step and requires NFS Server admin to set its owner to 10000.
+ chown 10000:10000 -R /storage
+ fi
+fi
+
+sudo -E -u \#10000 "/harbor/harbor_registryctl" "-c" "/etc/registryctl/config.yml"
diff --git a/make/photon/ui/Dockerfile b/make/photon/ui/Dockerfile
index 787341523..ad32c945e 100644
--- a/make/photon/ui/Dockerfile
+++ b/make/photon/ui/Dockerfile
@@ -11,8 +11,6 @@ HEALTHCHECK CMD curl --fail -s http://127.0.0.1:8080/api/ping || exit 1
COPY ./make/dev/ui/harbor_ui ./src/favicon.ico ./make/photon/ui/start.sh ./UIVERSION /harbor/
COPY ./src/ui/views /harbor/views
COPY ./src/ui/static /harbor/static
-#There is a race condition that both ui and adminserver may initialize schema
-COPY ./make/migrations /harbor/migrations
RUN chmod u+x /harbor/start.sh /harbor/harbor_ui
WORKDIR /harbor/
diff --git a/make/prepare b/make/prepare
index f131425cc..75c98374c 100755
--- a/make/prepare
+++ b/make/prepare
@@ -295,7 +295,7 @@ storage_provider_config = rcp.get("configuration", "registry_storage_provider_co
# yaml requires 1 or more spaces between the key and value
storage_provider_config = storage_provider_config.replace(":", ": ", 1)
ui_secret = ''.join(random.choice(string.ascii_letters+string.digits) for i in range(16))
-jobservice_secret = ''.join(random.choice(string.ascii_letters+string.digits) for i in range(16))
+jobservice_secret = ''.join(random.choice(string.ascii_letters+string.digits) for i in range(16))
adminserver_config_dir = os.path.join(config_dir,"adminserver")
if not os.path.exists(adminserver_config_dir):
@@ -306,6 +306,7 @@ ui_certificates_dir = prep_conf_dir(ui_config_dir,"certificates")
db_config_dir = prep_conf_dir(config_dir, "db")
job_config_dir = prep_conf_dir(config_dir, "jobservice")
registry_config_dir = prep_conf_dir(config_dir, "registry")
+registryctl_config_dir = prep_conf_dir(config_dir, "registryctl")
nginx_config_dir = prep_conf_dir (config_dir, "nginx")
nginx_conf_d = prep_conf_dir(nginx_config_dir, "conf.d")
log_config_dir = prep_conf_dir (config_dir, "log")
@@ -316,6 +317,8 @@ ui_conf = os.path.join(config_dir, "ui", "app.conf")
ui_cert_dir = os.path.join(config_dir, "ui", "certificates")
jobservice_conf = os.path.join(config_dir, "jobservice", "config.yml")
registry_conf = os.path.join(config_dir, "registry", "config.yml")
+registryctl_conf_env = os.path.join(config_dir, "registryctl", "env")
+registryctl_conf_yml = os.path.join(config_dir, "registryctl", "config.yml")
db_conf_env = os.path.join(config_dir, "db", "env")
job_conf_env = os.path.join(config_dir, "jobservice", "env")
nginx_conf = os.path.join(config_dir, "nginx", "nginx.conf")
@@ -323,6 +326,7 @@ cert_dir = os.path.join(config_dir, "nginx", "cert")
log_rotate_config = os.path.join(config_dir, "log", "logrotate.conf")
adminserver_url = "http://adminserver:8080"
registry_url = "http://registry:5000"
+registry_controller_url = "http://registryctl:8080"
ui_url = "http://ui:8080"
token_service_url = "http://ui:8080/service/token"
@@ -356,6 +360,8 @@ else:
#Use reload_key to avoid reload config after restart harbor
reload_key = ''.join(random.choice(string.ascii_uppercase + string.digits) for _ in range(6)) if reload_config == "true" else ""
+ldap_group_admin_dn = rcp.get("configuration", "ldap_group_admin_dn") if rcp.has_option("configuration", "ldap_group_admin_dn") else ""
+
render(os.path.join(templates_dir, "adminserver", "env"),
adminserver_conf_env,
reload_config=reload_config,
@@ -376,6 +382,7 @@ render(os.path.join(templates_dir, "adminserver", "env"),
ldap_group_filter=ldap_group_filter,
ldap_group_gid=ldap_group_gid,
ldap_group_scope=ldap_group_scope,
+ ldap_group_admin_dn=ldap_group_admin_dn,
db_password=db_password,
db_host=db_host,
db_user=db_user,
@@ -415,6 +422,7 @@ render(os.path.join(templates_dir, "adminserver", "env"),
reload_key=reload_key,
skip_reload_env_pattern=skip_reload_env_pattern,
chart_service_url=chart_service_url
+ registry_controller_url = registry_controller_url
)
render(os.path.join(templates_dir, "ui", "env"),
@@ -425,7 +433,8 @@ render(os.path.join(templates_dir, "ui", "env"),
adminserver_url = adminserver_url
)
-registry_config_file = "config_ha.yml" if args.ha_mode else "config.yml"
+registry_config_file_ha = "config_ha.yml"
+registry_config_file = "config.yml"
if storage_provider_name == "filesystem":
if not storage_provider_config:
storage_provider_config = "rootdirectory: /storage"
@@ -436,6 +445,13 @@ storage_provider_conf_list = [storage_provider_name + ':']
for c in storage_provider_config.split(","):
storage_provider_conf_list.append(c.strip())
storage_provider_info = ('\n' + ' ' * 4).join(storage_provider_conf_list)
+render(os.path.join(templates_dir, "registry", registry_config_file_ha),
+ registry_conf,
+ storage_provider_info=storage_provider_info,
+ public_url=public_url,
+ ui_url=ui_url,
+ redis_url=redis_url)
+
render(os.path.join(templates_dir, "registry", registry_config_file),
registry_conf,
storage_provider_info=storage_provider_info,
@@ -463,7 +479,13 @@ render(os.path.join(templates_dir, "log", "logrotate.conf"),
log_rotate_count=log_rotate_count,
log_rotate_size=log_rotate_size)
+render(os.path.join(templates_dir, "registryctl", "env"),
+ registryctl_conf_env,
+ jobservice_secret=jobservice_secret,
+ ui_secret=ui_secret)
+
shutil.copyfile(os.path.join(templates_dir, "ui", "app.conf"), ui_conf)
+shutil.copyfile(os.path.join(templates_dir, "registryctl", "config.yml"), registryctl_conf_yml)
print("Generated configuration file: %s" % ui_conf)
if auth_mode == "uaa_auth":
@@ -525,7 +547,7 @@ def openssl_installed():
if customize_crt == 'on' and openssl_installed():
shell_stat = subprocess.check_call(["which", "openssl"], stdout=FNULL, stderr=subprocess.STDOUT)
- empty_subj = "/C=/ST=/L=/O=/CN=/"
+ empty_subj = "/"
private_key_pem = os.path.join(config_dir, "ui", "private_key.pem")
root_crt = os.path.join(config_dir, "registry", "root.crt")
create_root_cert(empty_subj, key_path=private_key_pem, cert_path=root_crt)
diff --git a/open_source_license b/open_source_license
new file mode 100644
index 000000000..ee1cc985a
--- /dev/null
+++ b/open_source_license
@@ -0,0 +1,22311 @@
+open_source_license.txt
+
+Harbor 1.5.2 GA
+
+======================================================================
+
+
+
+=============== TABLE OF CONTENTS =============================
+
+The following is a listing of the open source components detailed in
+this document. This list is provided for your convenience; please read
+further if you wish to review the copyright notice(s) and the full text
+of the license associated with each component.
+
+PART 1. HARBOR
+
+
+SECTION 1: Apache License, V2.0
+
+ >>> Clair-2.0.4
+ >>> beego-1.9.0
+ >>> docker-17.06.2
+ >>> docker-compose-1.16.1
+ >>> docker/libtrust-aabc10ec2
+ >>> gopkg.in/yaml.v2-v2.1.1
+ >>> redigo-v1.6.0
+ >>> rxjs-5.5.8
+
+
+SECTION 2: BSD-STYLE, MIT-STYLE, OR SIMILAR STYLE LICENSES
+
+ >>> clarity-ui-0.10.24
+ >>> golang-1.9.2
+ >>> golang.org/x/crypto-5f961cd492ac9d43fc33a8ef646bae79d113fd97
+ >>> gorilla/context-v1.1
+ >>> gorilla/handlers-v1.3.0
+ >>> gorilla/mux-v1.6.0
+ >>> jquery-3.3.1
+ >>> lib/pq-b2004221932bd6b13167ef654c81cffac36f7537
+ >>> mattn/go-sqlite3-v1.6.0
+ >>> robfig/cron-v1
+ >>> zone.js-0.8.26
+
+
+SECTION 3: Mozilla Public License, V2.0
+
+ >>> go-sql-driver/mysql-v1.3
+
+
+PART 2. OPERATING SYSTEM: PHOTON
+
+
+SECTION 1: Apache License, V2.0
+
+ >>> photon-release-1.0-6.ph1
+
+
+SECTION 2: BSD-STYLE, MIT-STYLE, OR SIMILAR STYLE LICENSES
+
+ >>> bzip2-1.0.6-6.ph1
+ >>> cronie-1.5.0-12.ph1
+ >>> curl-7.58.0-1.ph1
+ >>> cyrus-sasl-2.1.26-10.ph1
+ >>> expat-2.2.4-1.ph1
+ >>> file-5.24-2.ph1
+ >>> flex-2.5.39-3.ph1
+ >>> iputils-20151218-3.ph1
+ >>> json-c-0.12-2.ph1
+ >>> krb5-1.16-1.ph1
+ >>> libcap-2.25-2.ph1
+ >>> libffi-3.2.1-2.ph1
+ >>> liblogging-1.0.5-2.ph1
+ >>> libselinux-2.6-2.ph1
+ >>> libsolv-0.6.19-4.ph1
+ >>> libssh2-1.8.0-1.ph1
+ >>> libxml2-2.9.6-2.ph1
+ >>> linux-pam-1.2.1-4.ph1
+ >>> lua-5.3.2-2.ph1
+ >>> ncurses-6.0-8.ph1
+ >>> nginx-1.11.13-4.ph1
+ >>> openldap-2.4.43-3.ph1
+ >>> openssl-1.0.2n-1.ph1
+ >>> openssl-1.0.2o-1.ph1
+ >>> pcre-8.41-1.ph1
+ >>> popt-1.16-2.ph1
+ >>> postgresql-9.6.8-1.ph1
+ >>> python-pip-8.1.2-3.ph1
+ >>> python-setuptools-21.0.0-2.ph1
+ >>> python2-2.7.13-4.ph1
+ >>> redis-4.0.6-1.ph1
+ >>> shadow-4.2.1-11.ph1
+ >>> sqlite-autoconf-3.22.0-1.ph1
+ >>> sudo-1.8.20p2-1.ph1
+ >>> tcsh-6.19.00-7.ph1
+ >>> tzdata-2016h-2.ph1
+ >>> vim-7.4-9.ph1
+ >>> xz-5.2.2-2.ph1
+ >>> zlib-1.2.8-5.ph1
+
+
+SECTION 3: GNU AFFERO GENERAL PUBLIC LICENSE 3.0
+
+ >>> db-6.1.26-2.ph1
+
+
+SECTION 4: GNU General Public License, V1.0
+
+ >>> perl-5.22.1-5.ph1
+ >>> perl-yaml-1.15-2.ph1
+
+
+SECTION 5: GNU General Public License, V2.0
+
+ >>> attr-2.4.47-3.ph1
+ >>> bzr-2.7.0-1.ph1
+ >>> e2fsprogs-1.42.13-3.ph1
+ >>> git-2.14.2-1.ph1
+ >>> gpgme-1.6.0-2.ph1
+ >>> linux-api-headers-4.4.115-1.ph1
+ >>> logrotate-3.9.1-4.ph1
+ >>> m4-1.4.17-2.ph1
+ >>> mariadb-10.2.10-1.ph1
+ >>> net-tools-1.60-7.ph1
+ >>> perl-cgi-4.26-2.ph1
+ >>> perl-dbi-1.634-2.ph1
+ >>> photon-repos-1.0-4.ph1
+ >>> pkg-config-0.28-2.ph1
+ >>> procps-ng-3.3.11-4.ph1
+ >>> rpm-4.13.0.1-4.ph1
+ >>> systemd-228-45.ph1
+ >>> util-linux-2.27.1-3.ph1
+
+
+SECTION 6: GNU General Public License, V3.0
+
+ >>> autogen-5.18.7-2.ph1
+ >>> bash-4.3.48-2.ph1
+ >>> binutils-2.30-2.ph1
+ >>> coreutils-8.25-2.ph1
+ >>> elfutils-0.169-1.ph1
+ >>> filesystem-1.1-2.ph1
+ >>> findutils-4.6.0-2.ph1
+ >>> gawk-4.1.3-3.ph1
+ >>> gcc-5.3.0-4.ph1
+ >>> gdbm-1.11-2.ph1
+ >>> grep-2.21-2.ph1
+ >>> gzip-1.6-2.ph1
+ >>> librelp-1.2.9-2.ph1
+ >>> readline-6.3-5.ph1
+ >>> rsyslog-8.15.0-8.ph1
+ >>> sed-4.2.2-2.ph1
+ >>> tar-1.29-1.ph1
+ >>> which-2.21-2.ph1
+
+
+SECTION 7: GNU Lesser General Public License, V2.1
+
+ >>> cracklib-2.9.6-3.ph1
+ >>> glibc-2.22-19.ph1
+ >>> gnutls-3.5.15-2.ph1
+ >>> hawkey-2014.1-5.ph1
+ >>> kmod-21-4.ph1
+ >>> libassuan-2.4.3-1.ph1
+ >>> libestr-0.1.10-2.ph1
+ >>> libgcrypt-1.7.6-3.ph1
+ >>> libgpg-error-1.27-1.ph1
+ >>> librepo-1.7.17-3.ph1
+ >>> libtasn1-4.13-1.ph1
+ >>> tdnf-1.1.0-3.ph1
+
+
+SECTION 8: GNU Lesser General Public License, V3.0
+
+ >>> gmp-6.0.0a-3.ph1
+ >>> mpc-1.0.3-2.ph1
+ >>> mpfr-3.1.3-2.ph1
+ >>> nettle-3.3-1.ph1
+
+
+SECTION 9: GNU Library General Public License, V2.0
+
+ >>> glib-2.47.6-2.ph1
+
+
+SECTION 10: Mozilla Public License, V2.0
+
+ >>> ca-certificates-20160109-5.ph1
+ >>> nspr-4.15-1.ph1
+ >>> nss-3.31-1.ph1
+
+
+PART 3. VIRTUAL APPLIANCE: APPLICATION LAYER
+
+
+SECTION 1: Apache License, V2.0
+
+ >>> docker/distribution-2.6.0
+ >>> docker/notary-c04e3e6d05881045def11167c51d4a8baa34899a
+ >>> opencontainers/go-digest-aa2ec055abd10d26d539eb630a92241b781ce4bc
+ >>> registry-2.6.2
+ >>> web-animations-js-2.3.1
+
+
+SECTION 2: BSD-STYLE, MIT-STYLE, OR SIMILAR STYLE LICENSES
+
+ >>> alembic-0.8.8
+ >>> angular-4.4.6
+ >>> core-js-2.4.1
+ >>> dgrijalva/jwt-go-d2709f9f1f31ebcda9651b03077758c1f3a0018c
+ >>> dumb-init-1.2.0
+ >>> go-ldap/ldap-v2.5.0
+ >>> golang/oauth2-bb50c06
+ >>> intl.js-1.2.5
+ >>> mutationobserver-shim-0.3.2
+ >>> ngx-cookie-1.0.1
+ >>> ngx-translate-6.0.1
+ >>> ngx-translate/http-loader-0.0.3
+ >>> testify-v1.2.0
+ >>> ts-helpers-1.1.2
+ >>> webcomponents/custom-elements-1.0.6
+
+
+APPENDIX. Standard License Files
+
+ >>> GNU AFFERO GENERAL PUBLIC LICENSE 3.0
+
+ >>> Apache License, V2.0
+
+ >>> GNU General Public License, V1.0
+
+ >>> GNU General Public License, V2.0
+
+ >>> GNU General Public License, V3.0
+
+ >>> GNU Library General Public License, V2.0
+
+ >>> GNU Lesser General Public License, V2.1
+
+ >>> GNU Lesser General Public License, V3.0
+
+ >>> Mozilla Public License, V2.0
+
+
+
+====================PART 1. HARBOR ====================
+
+
+--------------- SECTION 1: Apache License, V2.0 ----------
+
+Apache License, V2.0 is applicable to the following component(s).
+
+
+>>> Clair-2.0.4
+
+CoreOS Project
+Copyright 2015 CoreOS, Inc
+
+This product includes software developed at CoreOS, Inc.
+(http://www.coreos.com/).
+
+Copyright 2017 clair authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+
+ADDITIONAL LICENSE INFORMATION:
+
+> MIT STYLE
+
+clair-2.0.4.tar.gz\clair-2.0.4.tar\clair-2.0.4\DCO
+
+Developer Certificate of Origin
+Version 1.1
+
+Copyright (C) 2004, 2006 The Linux Foundation and its contributors.
+660 York Street, Suite 102,
+San Francisco, CA 94110 USA
+
+Everyone is permitted to copy and distribute verbatim copies of this
+license document, but changing it is not allowed.
+
+
+Developer's Certificate of Origin 1.1
+
+By making a contribution to this project, I certify that:
+
+(a) The contribution was created in whole or in part by me and I
+have the right to submit it under the open source license
+indicated in the file; or
+
+(b) The contribution is based upon previous work that, to the best
+of my knowledge, is covered under an appropriate open source
+license and I have the right under that license to submit that
+work with modifications, whether created in whole or in part
+by me, under the same open source license (unless I am
+permitted to submit under a different license), as indicated
+in the file; or
+
+(c) The contribution was provided directly to me by some other
+person who certified (a), (b) or (c) and I have not modified
+it.
+
+(d) I understand and agree that this project and the contribution
+are public and that a record of the contribution (including all
+personal information I submit with it, including my sign-off) is
+maintained indefinitely and may be redistributed consistent with
+this project or the open source license(s) involved.
+
+>MIT
+
+clair-2.0.4.tar.gz\clair-2.0.4.tar\clair-2.0.4\vendor\github.com\beorn7\perks\LICENSE
+
+Copyright (C) 2013 Blake Mizerany
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+>BSD-2
+
+clair-2.0.4.tar.gz\clair-2.0.4.tar\clair-2.0.4\vendor\github.com\guregu\null\LICENSE
+
+Copyright (c) 2014, Greg Roseberry
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+>MPL 2.0
+
+clair-2.0.4.tar.gz\clair-2.0.4.tar\clair-2.0.4\vendor\github.com\hashicorp\golang-lru\LICENSE
+
+LICENSE: MPL 2.0
+
+>BSD-3
+
+clair-2.0.4.tar.gz\clair-2.0.4.tar\clair-2.0.4\vendor\github.com\julienschmidt\httprouter\LICENSE
+
+Copyright (c) 2013 Julien Schmidt. All rights reserved.
+
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+Redistributions of source code must retain the above copyright
+notice, this list of conditions and the following disclaimer.
+Redistributions in binary form must reproduce the above copyright
+notice, this list of conditions and the following disclaimer in the
+documentation and/or other materials provided with the distribution.
+The names of the contributors may not be used to endorse or promote
+products derived from this software without specific prior written
+permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL JULIEN SCHMIDT BE LIABLE FOR ANY
+DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+>BSD-3 Clause with Google patent grant
+
+clair-2.0.4.tar.gz\clair-2.0.4.tar\clair-2.0.4\vendor\golang.org\x\sys\LICENSE
+clair-2.0.4.tar.gz\clair-2.0.4.tar\clair-2.0.4\vendor\golang.org\x\sys\PATENTS
+
+Copyright (c) 2009 The Go Authors. All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are
+met:
+
+Redistributions of source code must retain the above copyright
+notice, this list of conditions and the following disclaimer.
+Redistributions in binary form must reproduce the above
+copyright notice, this list of conditions and the following disclaimer
+in the documentation and/or other materials provided with the
+distribution.
+Neither the name of Google Inc. nor the names of its
+contributors may be used to endorse or promote products derived from
+this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+Additional IP Rights Grant (Patents)
+
+"This implementation" means the copyrightable works distributed by
+Google as part of the Go project.
+
+Google hereby grants to You a perpetual, worldwide, non-exclusive,
+no-charge, royalty-free, irrevocable (except as stated in this section)
+patent license to make, have made, use, offer to sell, sell, import,
+transfer and otherwise run, modify and propagate the contents of this
+implementation of Go, where such license applies only to those patent
+claims, both currently owned or controlled by Google and acquired in
+the future, licensable by Google that are necessarily infringed by this
+implementation of Go. This grant does not include claims that would be
+infringed only as a consequence of further modification of this
+implementation. If you or your agent or exclusive licensee institute or
+order or agree to the institution of patent litigation against any
+entity (including a cross-claim or counterclaim in a lawsuit) alleging
+that this implementation of Go or any code incorporated within this
+implementation of Go constitutes direct or contributory patent
+infringement, or inducement of patent infringement, then any patent
+rights granted to you under this License for this implementation of Go
+shall terminate as of the date such litigation is filed.
+
+
+>>> beego-1.9.0
+
+Copyright 2014 beego Author. All Rights Reserved.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+http:www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+
+ADDITIONAL LICENSE INFORMATION:
+
+>MIT
+
+beego-1.9.0.tar.gz\beego-1.9.0.tar\beego-1.9.0\utils\captcha\LICENSE
+
+Copyright (c) 2011-2014 Dmitry Chestnykh 
.
+Below are some of the partners and users of Harbor projects. If you wish to be listed on this page as reference partners or users, please contact us at .
## Users
-
-
-
+
+
+
-
-
-
+
+
+
-
-
-
-
-
+
+
+
+
+
+
## Partners
-
-
-
-
+
+
+
+
-
-
-
+
+
+
diff --git a/src/adminserver/api/cfg.go b/src/adminserver/api/cfg.go
index b23c1f86b..e18b0081e 100644
--- a/src/adminserver/api/cfg.go
+++ b/src/adminserver/api/cfg.go
@@ -31,7 +31,7 @@ func ListCfgs(w http.ResponseWriter, r *http.Request) {
handleInternalServerError(w)
return
}
-
+ systemcfg.AddMissedKey(cfg)
if err = writeJSON(w, cfg); err != nil {
log.Errorf("failed to write response: %v", err)
return
@@ -52,7 +52,6 @@ func UpdateCfgs(w http.ResponseWriter, r *http.Request) {
handleBadRequestError(w, err.Error())
return
}
-
if err = systemcfg.CfgStore.Write(m); err != nil {
log.Errorf("failed to update system configurations: %v", err)
handleInternalServerError(w)
@@ -68,7 +67,6 @@ func ResetCfgs(w http.ResponseWriter, r *http.Request) {
handleInternalServerError(w)
return
}
-
if err := systemcfg.CfgStore.Write(cfgs); err != nil {
log.Errorf("failed to write system configurations to storage: %v", err)
handleInternalServerError(w)
diff --git a/src/adminserver/systemcfg/systemcfg.go b/src/adminserver/systemcfg/systemcfg.go
index 62a2becbc..61dda2ffc 100644
--- a/src/adminserver/systemcfg/systemcfg.go
+++ b/src/adminserver/systemcfg/systemcfg.go
@@ -30,6 +30,7 @@ import (
comcfg "github.com/vmware/harbor/src/common/config"
"github.com/vmware/harbor/src/common/dao"
"github.com/vmware/harbor/src/common/models"
+ "github.com/vmware/harbor/src/common/utils"
"github.com/vmware/harbor/src/common/utils/log"
)
@@ -163,7 +164,8 @@ var (
env: "READ_ONLY",
parse: parseStringToBool,
},
- common.ReloadKey: "RELOAD_KEY",
+ common.ReloadKey: "RELOAD_KEY",
+ common.LdapGroupAdminDn: "LDAP_GROUP_ADMIN_DN",
}
// configurations need read from environment variables
@@ -244,34 +246,43 @@ func parseStringToBool(str string) (interface{}, error) {
// Init system configurations. If env RESET is set or configurations
// read from storage driver is null, load all configurations from env
func Init() (err error) {
- if err = initCfgStore(); err != nil {
+ //init database
+ envCfgs := map[string]interface{}{}
+ if err := LoadFromEnv(envCfgs, true); err != nil {
return err
}
- cfgs := map[string]interface{}{}
+ db := GetDatabaseFromCfg(envCfgs)
+ //Initialize the schema, then register the DB.
+ if err := dao.UpgradeSchema(db); err != nil {
+ return err
+ }
+ if err := dao.InitDatabase(db); err != nil {
+ return err
+ }
+ if err := initCfgStore(); err != nil {
+ return err
+ }
+
//Use reload key to avoid reset customed setting after restart
curCfgs, err := CfgStore.Read()
if err != nil {
return err
}
- loadAll := isLoadAll(curCfgs[common.ReloadKey])
- if !loadAll {
- cfgs = curCfgs
- if cfgs == nil {
- log.Info("configurations read from storage driver are null, will load them from environment variables")
- loadAll = true
- cfgs = map[string]interface{}{}
- }
+ loadAll := isLoadAll(curCfgs)
+ if curCfgs == nil {
+ curCfgs = map[string]interface{}{}
}
-
- if err = LoadFromEnv(cfgs, loadAll); err != nil {
+ //restart: only repeatload envs will be load
+ //reload_config: all envs will be reload except the skiped envs
+ if err = LoadFromEnv(curCfgs, loadAll); err != nil {
return err
}
-
- return CfgStore.Write(cfgs)
+ AddMissedKey(curCfgs)
+ return CfgStore.Write(curCfgs)
}
-func isLoadAll(curReloadKey interface{}) bool {
- return strings.EqualFold(os.Getenv("RESET"), "true") && os.Getenv("RELOAD_KEY") != curReloadKey
+func isLoadAll(cfg map[string]interface{}) bool {
+ return cfg == nil || strings.EqualFold(os.Getenv("RESET"), "true") && os.Getenv("RELOAD_KEY") != cfg[common.ReloadKey]
}
func initCfgStore() (err error) {
@@ -287,16 +298,6 @@ func initCfgStore() (err error) {
log.Infof("the path of json configuration storage: %s", path)
if drivertype == common.CfgDriverDB {
- //init database
- cfgs := map[string]interface{}{}
- if err = LoadFromEnv(cfgs, true); err != nil {
- return err
- }
- cfgdb := GetDatabaseFromCfg(cfgs)
- //Initialize the schema.
- if err = dao.InitDatabase(cfgdb, true); err != nil {
- return err
- }
CfgStore, err = database.NewCfgStore()
if err != nil {
return err
@@ -322,7 +323,6 @@ func initCfgStore() (err error) {
// only used when migrating harbor release before v1.3
// after v1.3 there is always a db configuration before migrate.
validLdapScope(jsonconfig, true)
-
err = CfgStore.Write(jsonconfig)
if err != nil {
log.Error("Failed to update old configuration to database")
@@ -412,11 +412,11 @@ func GetDatabaseFromCfg(cfg map[string]interface{}) *models.Database {
database := &models.Database{}
database.Type = cfg[common.DatabaseType].(string)
postgresql := &models.PostGreSQL{}
- postgresql.Host = cfg[common.PostGreSQLHOST].(string)
- postgresql.Port = int(cfg[common.PostGreSQLPort].(int))
- postgresql.Username = cfg[common.PostGreSQLUsername].(string)
- postgresql.Password = cfg[common.PostGreSQLPassword].(string)
- postgresql.Database = cfg[common.PostGreSQLDatabase].(string)
+ postgresql.Host = utils.SafeCastString(cfg[common.PostGreSQLHOST])
+ postgresql.Port = int(utils.SafeCastInt(cfg[common.PostGreSQLPort]))
+ postgresql.Username = utils.SafeCastString(cfg[common.PostGreSQLUsername])
+ postgresql.Password = utils.SafeCastString(cfg[common.PostGreSQLPassword])
+ postgresql.Database = utils.SafeCastString(cfg[common.PostGreSQLDatabase])
database.PostGreSQL = postgresql
return database
}
@@ -442,3 +442,26 @@ func validLdapScope(cfg map[string]interface{}, isMigrate bool) {
cfg[ldapScopeKey] = ldapScope
}
+
+//AddMissedKey ... If the configure key is missing in the cfg map, add default value to it
+func AddMissedKey(cfg map[string]interface{}) {
+
+ for k, v := range common.HarborStringKeysMap {
+ if _, exist := cfg[k]; !exist {
+ cfg[k] = v
+ }
+ }
+
+ for k, v := range common.HarborNumKeysMap {
+ if _, exist := cfg[k]; !exist {
+ cfg[k] = v
+ }
+ }
+
+ for k, v := range common.HarborBoolKeysMap {
+ if _, exist := cfg[k]; !exist {
+ cfg[k] = v
+ }
+ }
+
+}
diff --git a/src/adminserver/systemcfg/systemcfg_test.go b/src/adminserver/systemcfg/systemcfg_test.go
index 581725c78..efc4bc1f5 100644
--- a/src/adminserver/systemcfg/systemcfg_test.go
+++ b/src/adminserver/systemcfg/systemcfg_test.go
@@ -135,8 +135,10 @@ func TestIsLoadAll(t *testing.T) {
if err := os.Setenv("RESET", "True"); err != nil {
t.Fatalf("failed to set env: %v", err)
}
- assert.False(t, isLoadAll("123456"))
- assert.True(t, isLoadAll("654321"))
+ cfg1 := map[string]interface{}{common.ReloadKey: "123456"}
+ cfg2 := map[string]interface{}{common.ReloadKey: "654321"}
+ assert.False(t, isLoadAll(cfg1))
+ assert.True(t, isLoadAll(cfg2))
}
func TestLoadFromEnvWithReloadConfigInvalidSkipPattern(t *testing.T) {
@@ -258,3 +260,31 @@ func TestValidLdapScope(t *testing.T) {
}
}
+func Test_AddMissingKey(t *testing.T) {
+
+ cfg := map[string]interface{}{
+ common.LDAPURL: "sampleurl",
+ common.EmailPort: 555,
+ common.LDAPVerifyCert: true,
+ }
+
+ type args struct {
+ cfg map[string]interface{}
+ }
+ tests := []struct {
+ name string
+ args args
+ }{
+ {"Add default value", args{cfg}},
+ }
+ for _, tt := range tests {
+ t.Run(tt.name, func(t *testing.T) {
+ AddMissedKey(tt.args.cfg)
+ })
+ }
+
+ if _, ok := cfg[common.LDAPBaseDN]; !ok {
+ t.Errorf("Can not found default value for %v", common.LDAPBaseDN)
+ }
+
+}
diff --git a/src/common/const.go b/src/common/const.go
index b53ec35ea..e83629020 100644
--- a/src/common/const.go
+++ b/src/common/const.go
@@ -38,74 +38,160 @@ const (
ResourceTypeRepository = "r"
ResourceTypeImage = "i"
- ExtEndpoint = "ext_endpoint"
- AUTHMode = "auth_mode"
- DatabaseType = "database_type"
- PostGreSQLHOST = "postgresql_host"
- PostGreSQLPort = "postgresql_port"
- PostGreSQLUsername = "postgresql_username"
- PostGreSQLPassword = "postgresql_password"
- PostGreSQLDatabase = "postgresql_database"
- PostGreSQLSSLMode = "postgresql_sslmode"
- SelfRegistration = "self_registration"
- UIURL = "ui_url"
- JobServiceURL = "jobservice_url"
- LDAPURL = "ldap_url"
- LDAPSearchDN = "ldap_search_dn"
- LDAPSearchPwd = "ldap_search_password"
- LDAPBaseDN = "ldap_base_dn"
- LDAPUID = "ldap_uid"
- LDAPFilter = "ldap_filter"
- LDAPScope = "ldap_scope"
- LDAPTimeout = "ldap_timeout"
- LDAPVerifyCert = "ldap_verify_cert"
- LDAPGroupBaseDN = "ldap_group_base_dn"
- LDAPGroupSearchFilter = "ldap_group_search_filter"
- LDAPGroupAttributeName = "ldap_group_attribute_name"
- LDAPGroupSearchScope = "ldap_group_search_scope"
- TokenServiceURL = "token_service_url"
- RegistryURL = "registry_url"
- EmailHost = "email_host"
- EmailPort = "email_port"
- EmailUsername = "email_username"
- EmailPassword = "email_password"
- EmailFrom = "email_from"
- EmailSSL = "email_ssl"
- EmailIdentity = "email_identity"
- EmailInsecure = "email_insecure"
- ProjectCreationRestriction = "project_creation_restriction"
- MaxJobWorkers = "max_job_workers"
- TokenExpiration = "token_expiration"
- CfgExpiration = "cfg_expiration"
- JobLogDir = "job_log_dir"
- AdminInitialPassword = "admin_initial_password"
- AdmiralEndpoint = "admiral_url"
- WithNotary = "with_notary"
- WithClair = "with_clair"
- ScanAllPolicy = "scan_all_policy"
- ClairDBPassword = "clair_db_password"
- ClairDBHost = "clair_db_host"
- ClairDBPort = "clair_db_port"
- ClairDB = "clair_db"
- ClairDBUsername = "clair_db_username"
- UAAEndpoint = "uaa_endpoint"
- UAAClientID = "uaa_client_id"
- UAAClientSecret = "uaa_client_secret"
- UAAVerifyCert = "uaa_verify_cert"
- DefaultClairEndpoint = "http://clair:6060"
- CfgDriverDB = "db"
- CfgDriverJSON = "json"
- NewHarborAdminName = "admin@harbor.local"
- RegistryStorageProviderName = "registry_storage_provider_name"
- UserMember = "u"
- GroupMember = "g"
- ReadOnly = "read_only"
- ClairURL = "clair_url"
- NotaryURL = "notary_url"
- DefaultAdminserverEndpoint = "http://adminserver:8080"
- DefaultJobserviceEndpoint = "http://jobservice:8080"
- DefaultUIEndpoint = "http://ui:8080"
- DefaultNotaryEndpoint = "http://notary-server:4443"
- LdapGroupType = 1
- ReloadKey = "reload_key"
+ ExtEndpoint = "ext_endpoint"
+ AUTHMode = "auth_mode"
+ DatabaseType = "database_type"
+ PostGreSQLHOST = "postgresql_host"
+ PostGreSQLPort = "postgresql_port"
+ PostGreSQLUsername = "postgresql_username"
+ PostGreSQLPassword = "postgresql_password"
+ PostGreSQLDatabase = "postgresql_database"
+ PostGreSQLSSLMode = "postgresql_sslmode"
+ SelfRegistration = "self_registration"
+ UIURL = "ui_url"
+ JobServiceURL = "jobservice_url"
+ LDAPURL = "ldap_url"
+ LDAPSearchDN = "ldap_search_dn"
+ LDAPSearchPwd = "ldap_search_password"
+ LDAPBaseDN = "ldap_base_dn"
+ LDAPUID = "ldap_uid"
+ LDAPFilter = "ldap_filter"
+ LDAPScope = "ldap_scope"
+ LDAPTimeout = "ldap_timeout"
+ LDAPVerifyCert = "ldap_verify_cert"
+ LDAPGroupBaseDN = "ldap_group_base_dn"
+ LDAPGroupSearchFilter = "ldap_group_search_filter"
+ LDAPGroupAttributeName = "ldap_group_attribute_name"
+ LDAPGroupSearchScope = "ldap_group_search_scope"
+ TokenServiceURL = "token_service_url"
+ RegistryURL = "registry_url"
+ EmailHost = "email_host"
+ EmailPort = "email_port"
+ EmailUsername = "email_username"
+ EmailPassword = "email_password"
+ EmailFrom = "email_from"
+ EmailSSL = "email_ssl"
+ EmailIdentity = "email_identity"
+ EmailInsecure = "email_insecure"
+ ProjectCreationRestriction = "project_creation_restriction"
+ MaxJobWorkers = "max_job_workers"
+ TokenExpiration = "token_expiration"
+ CfgExpiration = "cfg_expiration"
+ JobLogDir = "job_log_dir"
+ AdminInitialPassword = "admin_initial_password"
+ AdmiralEndpoint = "admiral_url"
+ WithNotary = "with_notary"
+ WithClair = "with_clair"
+ ScanAllPolicy = "scan_all_policy"
+ ClairDBPassword = "clair_db_password"
+ ClairDBHost = "clair_db_host"
+ ClairDBPort = "clair_db_port"
+ ClairDB = "clair_db"
+ ClairDBUsername = "clair_db_username"
+ UAAEndpoint = "uaa_endpoint"
+ UAAClientID = "uaa_client_id"
+ UAAClientSecret = "uaa_client_secret"
+ UAAVerifyCert = "uaa_verify_cert"
+ DefaultClairEndpoint = "http://clair:6060"
+ CfgDriverDB = "db"
+ CfgDriverJSON = "json"
+ NewHarborAdminName = "admin@harbor.local"
+ RegistryStorageProviderName = "registry_storage_provider_name"
+ UserMember = "u"
+ GroupMember = "g"
+ ReadOnly = "read_only"
+ ClairURL = "clair_url"
+ NotaryURL = "notary_url"
+ DefaultAdminserverEndpoint = "http://adminserver:8080"
+ DefaultJobserviceEndpoint = "http://jobservice:8080"
+ DefaultUIEndpoint = "http://ui:8080"
+ DefaultNotaryEndpoint = "http://notary-server:4443"
+ LdapGroupType = 1
+ ReloadKey = "reload_key"
+ LdapGroupAdminDn = "ldap_group_admin_dn"
+ DefaultRegistryControllerEndpoint = "http://registryctl:8080"
+)
+
+// Shared variable, not allowed to modify
+var (
+ // the keys of configurations which user can modify in PUT method and user can
+ // get in GET method
+ HarborValidKeys = []string{
+ AUTHMode,
+ SelfRegistration,
+ LDAPURL,
+ LDAPSearchDN,
+ LDAPSearchPwd,
+ LDAPBaseDN,
+ LDAPUID,
+ LDAPFilter,
+ LDAPScope,
+ LDAPTimeout,
+ LDAPVerifyCert,
+ LDAPGroupAttributeName,
+ LDAPGroupBaseDN,
+ LDAPGroupSearchFilter,
+ LDAPGroupSearchScope,
+ EmailHost,
+ EmailPort,
+ EmailUsername,
+ EmailPassword,
+ EmailFrom,
+ EmailSSL,
+ EmailIdentity,
+ EmailInsecure,
+ ProjectCreationRestriction,
+ TokenExpiration,
+ ScanAllPolicy,
+ UAAClientID,
+ UAAClientSecret,
+ UAAEndpoint,
+ UAAVerifyCert,
+ ReadOnly,
+ }
+
+ //value is default value
+ HarborStringKeysMap = map[string]string{
+ AUTHMode: "db_auth",
+ LDAPURL: "",
+ LDAPSearchDN: "",
+ LDAPSearchPwd: "",
+ LDAPBaseDN: "",
+ LDAPUID: "",
+ LDAPFilter: "",
+ LDAPGroupAttributeName: "",
+ LDAPGroupBaseDN: "",
+ LDAPGroupSearchFilter: "",
+ EmailHost: "smtp.mydomain.com",
+ EmailUsername: "sample_admin@mydomain.com",
+ EmailPassword: "abc",
+ EmailFrom: "admin
-
+
-
+
-
+
-
-
+
+
+
+ {{'TOOLTIP.ITEM_REQUIRED' | translate}}
+
+
+
+
+ {{'TOOLTIP.ITEM_REQUIRED' | translate}}
+
+