securing-container-registry-with-harbor

# Securing Container Registry with Harbor ## Overview Harbor is an open-source container registry that provides security features including vulnerability scanning (integrated Trivy), image signing (Notary/Cosign), RBAC, content trust policies, replication, and audit logging. Securing Harbor involves configuring these features to enforce image provenance, prevent vulnerable image deployment, and maintain registry access control. ## When to Use - When deploying or configuring securing container registry with harbor capabilities in your environment - When establishing security controls aligned to compliance requirements - When building or improving security architecture for this domain - When conducting security assessments that require this implementation ## Prerequisites - Harbor 2.10+ installed (Helm or Docker Compose) - TLS certificates for HTTPS - Trivy scanner integration - OIDC/LDAP for authentication - Kubernetes cluster (for deployment target) ## Workflow ### Step 1: Install Harbor with Security Configuration ```yaml # harbor-values.yaml for Helm deployment expose: type: ingress tls: enabled: true certSource: secret secret: secretName: harbor-tls notarySecretName: harbor-tls ingress: hosts: core: harbor.example.com notary: notary.example.com externalURL: https://harbor.example.com persistence: enabled: true resourcePolicy: "keep" harborAdminPassword: "<strong-password>" trivy: enabled: true gitHubToken:...