Integrating Harbor Registry with Kubernetes for image pulling

Question

Pulumi · Accepted Answer

To integrate Harbor Registry with Kubernetes for image pulling, you'll need to set up a Harbor registry and a Kubernetes cluster that can access this registry. Below is a detailed explanation of how to use Pulumi to accomplish this task, along with a comprehensive TypeScript program.

### Setting up Harbor Registry

1. **Harbor Registry**: The Harbor Registry is an open-source trusted cloud native registry project that stores, signs, and scans content. We will create a Harbor registry instance using Pulumi.

2. **Harbor Project**: Within Harbor, you can group container images in projects. We will create a new Harbor project to organize our images.

3. **Access Credentials**: Credentials are necessary for Kubernetes to authenticate against the registry. We will create a Harbor robot account (a type of user) to obtain credentials for Kubernetes to use.

4. **Secret in Kubernetes**: Kubernetes uses Secrets to hold sensitive information, such as login credentials. We will create a Kubernetes secret with the Harbor robot account credentials.

5. **ImagePullSecrets**: Finally, we will use the Secret we created as an imagePullSecret in a Kubernetes Pod to allow image pulling from the Harbor Registry.

Let's start by installing the necessary Pulumi packages for Harbor and Kubernetes.

```bash
npm install @pulumi/harbor @pulumi/kubernetes
```

Next, we'll create a Pulumi program that sets up the Harbor registry and configures Kubernetes to pull images from it.

### Pulumi Program for Harbor-Kubernetes Integration

```typescript
import * as pulumi from "@pulumi/pulumi";
import * as k8s from "@pulumi/kubernetes";
import * as harbor from "@pulumi/harbor";

// Initialize a new Pulumi Harbor registry.
const registry = new harbor.Registry("my-harbor-registry", {
    endpointUrl: "https://my-harbor-registry.example.com",
    providerName: "harbor-provider",
    // Other parameters like `accessId` and `accessSecret` may be needed depending on your Harbor setup.
    // Ensure `insecure` is set to `false` for production, use `true` only if you are using a self-signed certificate.
    insecure: pulumi.output(false),
});

// Create a new Harbor project within the registry to organize our images.
const project = new harbor.Project("my-harbor-project", {
    registryId: registry.id,
    // You can modify `public` and `storageQuota` according to your requirements.
});

// Create a robot account in Harbor to obtain credentials for Kubernetes.
const robotUser = new harbor.User("k8s-robot-user", {
    admin: pulumi.output(false),
    email: "robot@my-domain.com",
    fullName: "Kubernetes Robot User",
    password: "SecureRandomPassword", // Replace with a generated secure password.
    username: "k8s-robot",
    comment: "Robot account for Kubernetes image pulling",
});

// Retrieve the Harbor robot account's username and password to create a Kubernetes secret.
const robotUsername = robotUser.username;
const robotPassword = robotUser.password;

// Define a Kubernetes Secret using the Harbor robot account credentials.
const harborCredentials = new k8s.core.v1.Secret("harbor-credentials", {
    metadata: { name: "harbor-credentials" },
    type: "kubernetes.io/dockerconfigjson",
    stringData: {
        ".dockerconfigjson": pulumi.all([robotUsername, robotPassword, registry.endpointUrl]).apply(([username, password, endpoint]) => {
            return JSON.stringify({
                auths: {
                    [`${endpoint}`]: {
                        username: username,
                        password: password,
                    },
                },
            });
        }),
    },
}, { provider: /* your k8s provider */ });

// Now you can use `harborCredentials` as an imagePullSecret in your Kubernetes deployments.

// Export the Harbor registry's endpoint URL and the project name for direct use in your Kubernetes manifests.
export const harborEndpointUrl = registry.endpointUrl;
export const harborProjectName = project.name;
```

This program initializes a new Harbor registry and then proceeds to set up a project within the registry for organizing images. It creates a robot account to obtain credentials for Kubernetes and then turns these credentials into a Kubernetes secret. The secret can then be used in Kubernetes deployments as an `imagePullSecret` to pull images from the Harbor registry.

Make sure to replace the placeholder values (like URLs and passwords) with your own correct settings. Additionally, manage sensitive data securely, for example by using Pulumi config secrets or a secrets manager, rather than hardcoding them in your Pulumi program.