storage/harbor/README.md

Rama main · réplica de lectura del repositorio original.

# Harbor

Harbor is an open source trusted cloud-native registry to store, sign, and scan content. It adds functionalities like security, identity, and management to the open source Docker distribution.

## Allowing an Application to Pull Images

### Pull-Through Cache

K8s applications to be able to pull from the pull-through caches add this label to the namespace:

```yaml
labels:
  name: your-app
  harbor-image-pulls: "true"
```

This will allow [ESO](../../security/external-secrets-operator/README.md) to place the pull-through cache secret into the namespace for an application.

Your image should be something like this:

```yaml
image: harbor.okwilkins.dev/docker-hub-cache/searxng/searxng:latest
```

Add the credentials to a deployment like so:

```yaml
spec:
  template:
    spec:
      imagePullSecrets:
        - name: harbor-credentials
```

### Setting Up the Image Pull Robot

This is managed in Terraform at `infrastructure/terraform/harbor.tf`.

#### Vault Secret

Create a single Vault entry at:
- **Path**: `harbor/image-pull`
- **Key**: `ROBOT_PASSWORD`
- **Value**: Any random password.

The `dockerconfigjson` is automatically generated by ESO using a template - no manual generation needed.