镜像推上去就不管了？Harbor 制品仓库的权限管控、漏洞扫描与 200GB 存储治理

                    ┌─────────────┐
                    │   客户端     │  docker push / pull
                    └──────┬──────┘
                           │
                    ┌──────▼──────┐
                    │   Nginx     │  反向代理 + TLS
                    │  (Portal)   │
                    └──────┬──────┘
                           │
          ┌────────────────┼────────────────┐
          │                │                │
   ┌──────▼──────┐ ┌──────▼──────┐ ┌──────▼──────┐
   │  Core API   │ │  Registry   │ │  JobService  │
   │ (API+UI)    │ │ (Distribution)│ │ (扫描/复制/GC)│
   └──────┬──────┘ └──────┬──────┘ └──────┬──────┘
          │               │                │
   ┌──────▼──────┐ ┌─────▼───────┐ ┌─────▼───────┐
   │ PostgreSQL  │ │   Storage   │ │   Trivy     │
   │ (元数据)     │ │ (文件系统)   │ │  (扫描引擎)  │
   └─────────────┘ └────────────┘ └─────────────┘

# 下载 Harbor 离线安装包
wget https://github.com/goharbor/harbor/releases/download/v2.12.0/harbor-offline-installer-v2.12.0.tgz
tar xzf harbor-offline-installer-v2.12.0.tgz
cd harbor

# 复制配置模板
cp harbor.yml.tmpl harbor.yml

# HTTPS 配置——生产环境必须开 TLS
hostname: harbor.yourcompany.com
http:
  port: 80
https:
  port: 443
  certificate: /data/cert/harbor.crt
  private_key: /data/cert/harbor.key

# 管理员初始密码，首次登录后立即改
harbor_admin_password: Harbor12345  # 别用这个！

# 数据存储目录
data_volume: /data/harbor

# 数据库配置
database:
  password: change_this_to_random_string
  max_idle_conns: 50
  max_open_conns: 100

# Trivy 扫描器
trivy:
  ignore_unfixed: false  # 不要忽略未修复的漏洞
  skip_update: false    # 每次启动更新漏洞库
  offline_scan: false

# 垃圾回收
garbage_collection:
  enabled: true
  schedule: "0 3 * * *"  # 每天凌晨 3 点执行

# 审计日志
audit_log:
  enabled: true

# 生成自签名证书（测试环境用，生产请用正式证书）
mkdir -p /data/cert
openssl req -x509 -newkey rsa:4096 -nodes \
  -keyout /data/cert/harbor.key \
  -out /data/cert/harbor.crt \
  -days 365 \
  -subj "/CN=harbor.yourcompany.com"

# 安装
./install.sh --with-trivy --with-chartmuseum

# 启动后验证
docker-compose ps  # 所有组件应该是 healthy

# 添加 Harbor Helm 仓库
helm repo add harbor https://helm.goharbor.io
helm repo update

# 创建 values.yaml 覆盖默认配置
cat > harbor-values.yaml << 'EOF'
expose:
  type: ingress
  tls:
    enabled: true
    certSource: secret
    secret:
      secretName: harbor-tls

externalURL: https://harbor.yourcompany.com

# 持久化存储——生产环境必须配
persistence:
  persistentVolumeClaim:
    registry:
      size: 500Gi
      storageClass: managed-nfs-storage
    database:
      size: 20Gi
      storageClass: managed-nfs-storage
    trivy:
      size: 10Gi
      storageClass: managed-nfs-storage

# Trivy 扫描配置
trivy:
  enabled: true
  skipUpdate: false

# 垃圾回收
garbageCollection:
  enabled: true
  schedule: "0 3 * * *"

# 资源限制
resources:
  core:
    requests:
      cpu: 500m
      memory: 512Mi
    limits:
      cpu: 1000m
      memory: 1Gi

# 高可用（需要外置 PostgreSQL 和 Redis）
# 生产环境建议至少 2 个 Core 副本
core:
  replicas: 2
EOF

# 安装
helm install harbor harbor/harbor \
  -f harbor-values.yaml \
  -n harbor \
  --create-namespace

prod 项目：
  - SRE 团队 → 项目管理员
  - CI/CD 服务账号 → 开发者（只能 push，不能删）
  - 部署系统 → 访客（只能 pull）

dev 项目：
  - 开发团队 → 开发者
  - QA 团队 → 维护人员

# 创建项目
curl -X POST "https://harbor.yourcompany.com/api/v2.0/projects" \
  -u "admin:your_password" \
  -H "Content-Type: application/json" \
  -d '{
    "project_name": "prod",
    "metadata": {
      "public": "false",
      "auto_scan": "true",
      "reuse_sys_cve_allowlist": "false"
    }
  }'

# 给项目添加成员
curl -X POST "https://harbor.yourcompany.com/api/v2.0/projects/1/members" \
  -u "admin:your_password" \
  -H "Content-Type: application/json" \
  -d '{
    "role_id": 2,  # 2=开发者, 3=访客
    "entity_type": "user",
    "entity_id": 5
  }'

# 创建机器人账号（只有 push 权限）
curl -X POST "https://harbor.yourcompany.com/api/v2.0/projects/1/robots" \
  -u "admin:your_password" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "ci-pusher",
    "level": "project",
    "duration": -1,
    "permissions": [{
      "access": [
        {"action": "pull", "resource": "repository"},
        {"action": "push", "resource": "repository"}
      ],
      "kind": "project",
      "namespace": "prod"
    }]
  }'

# 通过 API 设置项目级安全策略
# prevent_vul 等于 "true" 时，有高危漏洞的镜像不能被 pull
curl -X PUT "https://harbor.yourcompany.com/api/v2.0/projects/1" \
  -u "admin:your_password" \
  -H "Content-Type: application/json" \
  -d '{
    "metadata": {
      "auto_scan": "true",
      "prevent_vul": "true",
      "severity": "high"
    }
  }'

# 全局 CVE 白名单
curl -X PUT "https://harbor.yourcompany.com/api/v2.0/system/CVEWhitelist" \
  -u "admin:your_password" \
  -H "Content-Type: application/json" \
  -d '{
    "items": [
      {"cve_id": "CVE-2024-12345"},
      {"cve_id": "CVE-2024-67890"}
    ],
    "expires_at": 1767225600
  }'

dev 项目：
  保留策略 → 保留最近 10 个 tag，其余删除
  执行频率 → 每天一次

staging 项目：
  保留策略 → 保留 7 天内的 tag
  执行频率 → 每天一次

prod 项目：
  保留策略 → 保留匹配 v* 的最近 20 个 tag
  执行频率 → 每周一次

# 给 dev 项目设置保留策略：保留最近 10 个 tag
curl -X POST "https://harbor.yourcompany.com/api/v2.0/retentions" \
  -u "admin:your_password" \
  -H "Content-Type: application/json" \
  -d '{
    "scope": {
      "level": "project",
      "ref": 1
    },
    "trigger": {
      "kind": "Schedule",
      "settings": {
        "cron": "0 3 * * *"
      }
    },
    "rules": [{
      "action": "retain",
      "template": "latestPulledNCount",
      "params": {
        "latestPulledNCount": 10
      },
      "tag_selectors": [{
        "kind": "doublestar",
        "decoration": "matches",
        "pattern": "**"
      }]
    }]
  }'

# 手动触发 GC（建议先停 push 操作）
# Harbor UI → 系统 → 垃圾回收 → 立即执行

# 或通过 API
curl -X POST "https://harbor.yourcompany.com/api/v2.0/system/gc/schedule" \
  -u "admin:your_password" \
  -H "Content-Type: application/json" \
  -d '{
    "schedule": {
      "type": "Daily",
      "cron": "0 3 * * *"
    }
  }'

# 1. 先配置保留策略，清理不需要的 tag
# 2. 等保留策略执行完，确认删除的 tag 确实不需要
# 3. 手动触发一次 GC
# 4. 查看 GC 日志确认释放了多少空间

# 查看 GC 执行结果
curl -s "https://harbor.yourcompany.com/api/v2.0/system/gc?page=1&page_size=5" \
  -u "admin:your_password" | python3 -m json.tool | grep -E "status|space_released"

# 给 dev 项目设 50GB 存储配额
curl -X PUT "https://harbor.yourcompany.com/api/v2.0/projects/1" \
  -u "admin:your_password" \
  -H "Content-Type: application/json" \
  -d '{
    "storage_limit": 53687091200  # 50GB in bytes
  }'

主 Harbor (机房A)  ──push──>  从 Harbor (机房B)
                              │
                              └── K8s 集群直接从机房B拉镜像

# harbor.yml 中启用 metrics
metric:
  enabled: true
  port: 9090
  path: /metrics

# Prometheus 告警规则
groups:
  - name: harbor
    rules:
      # 磁盘使用率 > 80%
      - alert: HarborStorageHigh
        expr: |
          harbor_storage_usage_bytes / harbor_storage_capacity_bytes > 0.8          
        for: 10m
        labels:
          severity: warning
        annotations:
          summary: "Harbor 存储使用率超过 80%"

      # 扫描失败率 > 10%
      - alert: HarborScanFailureHigh
        expr: |
          rate(harbor_scan_total{result="error"}[5m])
          / rate(harbor_scan_total[5m]) > 0.1          
        for: 5m
        labels:
          severity: warning
        annotations:
          summary: "Harbor 扫描失败率超过 10%"

      # GC 执行失败
      - alert: HarborGCFailed
        expr: harbor_gc_status{status="failed"} == 1
        for: 5m
        labels:
          severity: critical
        annotations:
          summary: "Harbor 垃圾回收执行失败"

# PostgreSQL 备份脚本
#!/bin/bash
DATE=$(date +%Y%m%d)
pg_dump -h harbor-db.internal -U postgres harbor | gzip > /backup/harbor-db-${DATE}.sql.gz
# 保留 30 天
find /backup -name "harbor-db-*.sql.gz" -mtime +30 -delete

# .gitlab-ci.yml 示例
stages:
  - build
  - push
  - scan

build_and_push:
  stage: build
  image: docker:24
  variables:
    HARBOR_URL: "harbor.yourcompany.com"
    HARBOR_USER: "ci-pusher"  # 机器人账号
    HARBOR_PASS: "$HARBOR_CI_TOKEN"  # 从 CI 变量注入
  before_script:
    # 登录 Harbor
    - echo "$HARBOR_PASS" | docker login -u "$HARBOR_USER" --password-stdin "$HARBOR_URL"
  script:
    # 构建镜像，用多阶段构建减小体积
    - docker build -t $HARBOR_URL/prod/app:$CI_COMMIT_TAG .
    # 推送前先做本地 Trivy 扫描
    - trivy image --severity HIGH,CRITICAL --exit-code 1 $HARBOR_URL/prod/app:$CI_COMMIT_TAG
    # 扫描通过才推送
    - docker push $HARBOR_URL/prod/app:$CI_COMMIT_TAG
    # Harbor 会自动触发二次扫描
  after_script:
    - docker logout $HARBOR_URL
  rules:
    - if: $CI_COMMIT_TAG =~ /^v\d+\.\d+\.\d+$/  # 只有打 tag 才推送