### Install Harbor with Trivy (sudo ./install.sh --with-trivy)

Source: https://goharbor.io/docs/2.15.0/install-config/run-installer-script

Run the installer with the --with-trivy parameter to include the Trivy vulnerability scanner. The default installation does not include Trivy.

```shell
sudo ./install.sh --with-trivy


```

--------------------------------

### Install an OCI Helm chart

Source: https://goharbor.io/docs/2.15.0/working-with-projects/working-with-oci/working-with-helm-oci-charts

Installs a chart from an OCI registry. Login first if the project is private. Example: helm install MyRelease oci://demo.goharbor.io/oci/demo --version 0.1.0

```bash
helm install <release_name> oci://<harbor_address>/<project>/<chart_name> --version <version>

```

```bash
helm install MyRelease oci://demo.goharbor.io/oci/demo --version 0.1.0

```

--------------------------------

### GPG Verification Output Example

Source: https://goharbor.io/docs/2.15.0/install-config/download-installer

Example output showing a successful signature verification for the Harbor installer.

```text
gpg: armor header: Version: GnuPG v1
gpg: assuming signed data in 'harbor-online-installer-v2.0.2.tgz'
gpg: Signature made Tue Jul 28 09:49:20 2020 UTC
gpg:                using RSA key 644FF454C0B4115C
gpg: using pgp trust model
gpg: Good signature from "Harbor-sign (The key for signing Harbor build) <jiangd@vmware.com>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 7722 D168 DAEC 4578 06C9  6FF9 644F F454 C0B4 115C
gpg: binary signature, digest algorithm SHA1, key algorithm rsa4096
```

--------------------------------

### Build and install with official Golang image

Source: https://goharbor.io/docs/2.15.0/build-customize-contribute/compile-guide

Builds, installs, and brings up Harbor using the official Golang image. Use this approach if you don't have a local Golang environment.

```bash
make install COMPILETAG=compile_golangimage

```

--------------------------------

### Install Harbor without Trivy (sudo ./install.sh)

Source: https://goharbor.io/docs/2.15.0/install-config/run-installer-script

Run the default Harbor installer script. This does not include the Trivy service. Installation may take time while images are downloaded from Docker Hub. After success, visit http://reg.yourdomain.com (replace with your configured hostname) and log in with default admin credentials if changeless (admin / Harbor12345).

```shell
sudo ./install.sh


```

--------------------------------

### Start Harbor with Docker Compose

Source: https://goharbor.io/docs/2.15.0/install-config/customize-token-service

Starts Harbor using Docker Compose after replacing the key and certificate. Run this command from the make directory.

```bash
docker compose up -d
```

--------------------------------

### Build and install with local Golang environment

Source: https://goharbor.io/docs/2.15.0/build-customize-contribute/compile-guide

Builds, installs, and runs Harbor using your own Golang environment. Requires the source code to be in $GOPATH.

```bash
cd $GOPATH/src/github.com/goharbor/harbor
$ make install

```

--------------------------------

### Verify installation success message

Source: https://goharbor.io/docs/2.15.0/build-customize-contribute/compile-guide

Expected output after a successful installation. If everything works, you will see this message.

```text
...
Start complete. You can visit harbor now.

```

--------------------------------

### Install Harbor with Helm 3

Source: https://goharbor.io/docs/2.15.0/install-config/harbor-ha-helm

Installs the Harbor chart with release name 'my-release' using Helm 3.

```bash
helm install my-release harbor/

```

--------------------------------

### Install Notation CLI

Source: https://goharbor.io/docs/2.15.0/working-with-projects/working-with-images/sign-images

Install the latest version of the Notation CLI on Linux using Homebrew.

```bash
brew install notation
```

--------------------------------

### Install Harbor with Helm 2

Source: https://goharbor.io/docs/2.15.0/install-config/harbor-ha-helm

Installs the Harbor chart with release name 'my-release' using Helm 2.

```bash
helm install --name my-release harbor/

```

--------------------------------

### Start Harbor frontend development server

Source: https://goharbor.io/docs/2.15.0/build-customize-contribute/ui-contribution-get-started

Serve Harbor locally. After running this command, visit https://localhost:4200.

```bash
npm run start

```

--------------------------------

### Build and run Harbor from source code

Source: https://goharbor.io/docs/2.15.0/build-customize-contribute/use-make

Builds Harbor from source code and starts the instance. This target compiles binaries, builds images, prepares the specific version of the compose file, and starts the Harbor instance.

```bash
make install
```

--------------------------------

### Load migration tool from offline package

Source: https://goharbor.io/docs/2.15.0/administration/upgrade

Extract the offline installer package and load the Harbor image tarball to get the migration tool.

```bash
tar zxf <offline package>
docker image load -i harbor/harbor.[version].tar.gz

```

--------------------------------

### Install npm dependencies

Source: https://goharbor.io/docs/2.15.0/build-customize-contribute/ui-contribution-get-started

Install npm packages and 3rd-party dependencies for the Harbor frontend.

```bash
npm install

```

--------------------------------

### Configure Docker Daemon for HTTP Harbor (daemon.json)

Source: https://goharbor.io/docs/2.15.0/install-config/run-installer-script

For HTTP-based Harbor installations, add the --insecure-registry option to your Docker daemon. The example adds example.com and 0.0.0.0 as insecure registries in daemon.json. After updating the file, restart Docker Engine and Harbor.

```json
{
"insecure-registries" : ["_myregistrydomain.com_:5000", "0.0.0.0"]
}


```

--------------------------------

### Package offline installer

Source: https://goharbor.io/docs/2.15.0/build-customize-contribute/use-make

Prepares the offline install package for Harbor. This target creates the offline installer package.

```bash
make package_offline
```

--------------------------------

### Extract Online Installer

Source: https://goharbor.io/docs/2.15.0/install-config/download-installer

Use the tar command to extract the online installer package.

```bash
bash $ tar xzvf harbor-online-installer-version.tgz
```

--------------------------------

### Restart Harbor service with install.sh

Source: https://goharbor.io/docs/2.15.0/administration/upgrade/roll-back-upgrade

If the previous version was installed by a release build, run these commands to restart the Harbor service.

```bash
cd harbor
./install.sh

```

--------------------------------

### Verify Harbor Installation with Docker Login and Push

Source: https://goharbor.io/docs/2.15.0/install-config/run-installer-script

After creating a project (e.g., myproject) in the Harbor portal, use Docker to log in to your Harbor registry and push an image. Replace reg.yourdomain.com with your configured hostname.

```shell
docker login reg.yourdomain.com
docker push reg.yourdomain.com/myproject/myrepo:mytag


```

--------------------------------

### Run prepare script to enable HTTPS

Source: https://goharbor.io/docs/2.15.0/install-config/configure-https

Run the prepare script in the Harbor installer bundle to configure nginx to use HTTPS. This is required before restarting Harbor.

```bash
./prepare

```

--------------------------------

### Verify Online Installer Signature

Source: https://goharbor.io/docs/2.15.0/install-config/download-installer

Verify the authenticity of the online installer package using the downloaded .asc file.

```bash
gpg -v --keyserver hkps://keyserver.ubuntu.com --verify harbor-online-installer-version.tgz.asc
```

--------------------------------

### Example OCI image index JSON

Source: https://goharbor.io/docs/2.15.0/working-with-projects/working-with-images/deleting-artifact

Illustrates the structure of an OCI image index manifest, showing how it references multiple platform-specific image manifests with digests, sizes, and platform details.

```json
{
  "schemaVersion": 2,
  "manifests": [
    {
      "mediaType": "application/vnd.oci.image.manifest.v1+json",
      "size": 7143,
      "digest": "sha256:e692418e4cbaf90ca69d05a66403747baa33ee08806650b51fab815ad7fc331f",
      "platform": {
        "architecture": "ppc64le",
        "os": "linux"
      }
    },
    {
      "mediaType": "application/vnd.oci.image.manifest.v1+json",
      "size": 7682,
      "digest": "sha256:5b0bcabd1ed22e9fb1310cf6c2dec7cdef19f0ad69efa1f392e94a4333501270",
      "platform": {
        "architecture": "amd64",
        "os": "linux"
      }
    }
  ],
  "annotations": {
    "com.example.key1": "value1",
    "com.example.key2": "value2"
  }
}
```

--------------------------------

### Restart Harbor

Source: https://goharbor.io/docs/2.15.0/install-config/reconfigure-manage-lifecycle

Starts all stopped Harbor containers.

```bash
sudo docker compose start
Starting log         ... done
Starting registry    ... done
Starting registryctl ... done
Starting postgresql  ... done
Starting core        ... done
Starting portal      ... done
Starting redis       ... done
Starting jobservice  ... done
Starting proxy       ... done
```

--------------------------------

### Extract Offline Installer

Source: https://goharbor.io/docs/2.15.0/install-config/download-installer

Use the tar command to extract the offline installer package.

```bash
bash $ tar xzvf harbor-offline-installer-version.tgz
```

--------------------------------

### Verify Offline Installer Signature

Source: https://goharbor.io/docs/2.15.0/install-config/download-installer

Verify the authenticity of the offline installer package using the downloaded .asc file.

```bash
gpg -v --keyserver hkps://keyserver.ubuntu.com --verify harbor-offline-installer-version.tgz.asc
```

--------------------------------

### Configure Swift storage backend in storage_service

Source: https://goharbor.io/docs/2.15.0/install-config/configure-yml-file

Example configuration for using OpenStack Swift as the storage backend. Set the storage_service setting in the Harbor configuration file. Parameters include username, password, authurl, tenant, domain, region, container, and redirect settings.

```yaml
storage_service:
  ca_bundle:
  swift:
    username: admin
    password: ADMIN_PASS
    authurl: http://keystone_addr:35357/v3/auth
    tenant: admin
    domain: default
    region: regionOne
    container: docker_images
  redirect:
    disabled: false

```

--------------------------------

### Docker Certificate Directory Structure

Source: https://goharbor.io/docs/2.15.0/install-config/configure-https

Example of the final directory structure required by Docker for custom certificates.

```text
/etc/docker/certs.d/
    └── yourdomain.com:port
       ├── yourdomain.com.cert
       ├── yourdomain.com.key
       └── ca.crt
```

--------------------------------

### Cosign sign command to sign an image

Source: https://goharbor.io/docs/2.15.0/working-with-projects/working-with-images/sign-images

Use `cosign sign --key cosign.key` to sign an image and upload the signature to Harbor. Replace `<harbor-instance>/<image/path>:<image-tag>` with your Harbor instance and image path. Requires cosign installed locally and a private key generated.

```shell
cosign sign --key cosign.key <harbor-instance>/<image/path>:<image-tag>
```

--------------------------------

### Prometheus scrape_configs for Harbor components

Source: https://goharbor.io/docs/2.15.0/administration/metrics

Example configuration for a Prometheus server to scrape metrics from various Harbor components including exporter, core, registry, and jobservice.

```yaml
  scrape_configs:

    - job_name: 'harbor-exporter'
      scrape_interval: 20s
      static_configs:
        # Scrape metrics from the Harbor exporter component
        - targets: ['<harbor_instance>:<metrics_port>']

    - job_name: 'harbor-core'
      scrape_interval: 20s
      params:
        # Scrape metrics from the Harbor core component
        comp: ['core']
      static_configs:
        - targets: ['<harbor_instance>:<metrics_port>']

    - job_name: 'harbor-registry'
      scrape_interval: 20s
      params:
        # Scrape metrics from the Harbor registry component
        comp: ['registry']
      static_configs:
        - targets: ['<harbor_instance>:<metrics_port>']

    - job_name: 'harbor-jobservice'
      scrape_interval: 20s
      params:
        # Scrape metrics from the Harbor jobservice component
        comp: ['jobservice']
      static_configs:
        - targets: ['<harbor_instance>:<metrics_port>']
```

--------------------------------

### Push an OCI Helm chart

Source: https://goharbor.io/docs/2.15.0/working-with-projects/working-with-oci/working-with-helm-oci-charts

Pushes a chart to an OCI registry. Replace placeholders with actual values. Example: helm push example-0.1.0.tgz oci://demo.goharbor.io/oci

```bash
helm push <chart_name_and_version>.tgz oci://<harbor_address>/<project>

```

```bash
helm push example-0.1.0.tgz oci://demo.goharbor.io/oci

```

--------------------------------

### Receive Harbor Public Key

Source: https://goharbor.io/docs/2.15.0/install-config/download-installer

Obtain the public key required to verify the authenticity of the Harbor installer package.

```bash
gpg --keyserver hkps://keyserver.ubuntu.com --receive-keys 644FF454C0B4115C
```

--------------------------------

### Quay Registry Access Secret JSON Example

Source: https://goharbor.io/docs/2.15.0/administration/configuring-replication/create-replication-endpoints

Example JSON for the Access Secret when connecting to a Quay registry with authorization. The Access ID defaults to 'json_file'. The 'oauth2_token' is optional and only needed for automatic organization creation; 'account_name' is the login name; 'docker_cli_password' is the CLI password generated on the Quay UI.

```json
{
"oauth2_token": "YmQZ1QZENVmOD6v9kENzmfptNVhgBuy5oVl85eGV", // optional
"account_name": "jack",
"docker_cli_password": "q6NVazikNqIf4coiQ+JvV4iqiCpkNjE0DLX8ZMQuFRbkHk5iMv6/hd4WdV3W3nyX"
}
```

--------------------------------

### Example OCI manifest for user-defined artifact

Source: https://goharbor.io/docs/2.15.0/administration/user-defined-oci-artifact

Shows a complete OCI manifest with Harbor-specific annotations. The config annotation `io.goharbor.artifact.v1alpha1.skip-list` lists keys to ignore, and the layer annotation `io.goharbor.artifact.v1alpha1.icon` marks the icon layer.

```json
{
    "schemaVersion": 2,
    "config": {
        "mediaType": "application/vnd.caicloud.model.config.v1alpha1+json",
        "digest": "sha256:be948daf0e22f264ea70b713ea0db35050ae659c185706aa2fad74834455fe8c",
        "size": 187,
        "annotations": {
            "io.goharbor.artifact.v1alpha1.skip-list": "metrics,git"
        }
    },
    "layers": [
        {
            "mediaType": "image/png",
            "digest": "sha256:d923b93eadde0af5c639a972710a4d919066aba5d0dfbf4b9385099f70272da0",
            "size": 166015,
            "annotations": {
                "io.goharbor.artifact.v1alpha1.icon": ""
            }
        },
        {
            "mediaType": "application/tar+gzip",
            "digest": "sha256:d923b93eadde0af5c639a972710a4d919066aba5d0dfbf4b9385099f70272da0",
            "size": 166015
        }
    ]
}
```

--------------------------------

### Get current configuration

Source: https://goharbor.io/docs/2.15.0/install-config/configure-system-settings-cli

Retrieves the current Harbor configuration using the API endpoint /api/v2.0/configurations. Requires a username and password for basic authentication.

```bash
curl -u "<username>:<password>" -H "Content-Type: application/json" -ki <Harbor Server URL>/api/v2.0/configurations

```

--------------------------------

### Hugo table shortcode

Source: https://goharbor.io/docs/2.15.0/build-customize-contribute/style-guide

Example of using the Hugo shortcode to create a data table with a caption.

```markdown
{{< table caption="Configuration parameters" >}}
Parameter | Description | Default
:---------|:------------|:-------
`timeout` | The timeout for requests | `30s`
`logLevel` | The log level for log output | `INFO`
{{< /table >}}
```

--------------------------------

### Slack Webhook Notification Format

Source: https://goharbor.io/docs/2.15.0/working-with-projects/project-configuration/configure-webhooks

Example of the rich text format received when using a Slack incoming webhook URL.

```text
Harbor webhook events
event_type: PUSH_ARTIFACT
occur_at: April 15th at 11:59 AM
operator: admin
event_data:
{
    "resources": [
        {
            "digest": "sha256:8a9e9863dbb6e10edb5adfe917c00da84e1700fa76e7ed02476aa6e6fb8ee0d8",
            "tag": "latest",
            "resource_url": "hub.harbor.com/test-webhook/debian:latest"
        }
    ],
    "repository": {
        "date_created": 1586922308,
        "name": "debian",
        "namespace": "test-webhook",
        "repo_full_name": "test-webhook/debian",
        "repo_type": "private"
    }
}
```

--------------------------------

### Check Harbor Container Status with docker compose ps

Source: https://goharbor.io/docs/2.15.0/install-config/troubleshoot-installation

Check whether all Harbor containers are in the Up state. If a container is not Up, inspect its log file in /var/log/harbor, for example core.log for harbor-core.

```bash
sudo docker compose ps
        Name                     Command               State                    Ports
  -----------------------------------------------------------------------------------------------------------------------------
  harbor-core         /harbor/start.sh                 Up
  harbor-db           /entrypoint.sh postgres          Up      5432/tcp
  harbor-jobservice   /harbor/start.sh                 Up
  harbor-log          /bin/sh -c /usr/local/bin/ ...   Up      127.0.0.1:1514->10514/tcp
  harbor-portal       nginx -g daemon off;             Up      80/tcp
  nginx               nginx -g daemon off;             Up      0.0.0.0:443->443/tcp, 0.0.0.0:4443->4443/tcp, 0.0.0.0:80->80/tcp
  redis               docker-entrypoint.sh redis ...   Up      6379/tcp
  registry            /entrypoint.sh /etc/regist ...   Up      5000/tcp
  registryctl         /harbor/start.sh                 Up

```

--------------------------------

### Example CONFIG_OVERWRITE_JSON configuration

Source: https://goharbor.io/docs/2.15.0/install-config/configure-system-settings-cli

Sets Harbor configuration items via the CONFIG_OVERWRITE_JSON environment variable. Once set, configuration can only be updated by modifying this variable and restarting the container; the Harbor UI and command line cannot be used. Note that if a legacy user exists, the authentication mode cannot be changed with this variable.

```plaintext
CONFIG_OVERWRITE_JSON={"ldap_verify_cert":"false", "auth_mode":"ldap_auth","ldap_base_dn":"dc=example,dc=com", "ldap_search_dn":"cn=admin,dc=example,dc=com","ldap_search_password":"admin","ldap_url":"myldap.example.com", "ldap_scope":2}
```

--------------------------------

### Pull an OCI Helm chart

Source: https://goharbor.io/docs/2.15.0/working-with-projects/working-with-oci/working-with-helm-oci-charts

Pulls a chart from an OCI registry. Replace placeholders with actual values. Example: helm pull oci://demo.goharbor.io/oci/demo --version 0.1.0

```bash
helm pull oci://<harbor_address>/<project>/<chart_name> --version <version>

```

```bash
helm pull oci://demo.goharbor.io/oci/demo --version 0.1.0

```

--------------------------------

### Example of en-us-lang.json structure

Source: https://goharbor.io/docs/2.15.0/build-customize-contribute/developer-guide-i18n

Shows the JSON structure of the translation file. The file contains key-value pairs for UI strings, with keys like APP_TITLE and nested values. When creating a new language file, copy en-us-lang.json and translate all values without changing keys.

```json
{
  "APP_TITLE": {
    "VMW_HARBOR": "Harbor",
    "HARBOR": "Harbor",
    // ...
  },
  // ...
}

```

--------------------------------

### Get secrets to find Harbor ingress/nginx certificate secret

Source: https://goharbor.io/docs/2.15.0/administration/upgrade/helm-upgrade

Lists all secrets in the current namespace. Find the secret whose name ends with '-harbor-ingress' (when exposing via Ingress) or '-harbor-nginx' (when exposing via ClusterIP or NodePort).

```bash
kubectl get secret

```

--------------------------------

### Build and tag a test image

Source: https://goharbor.io/docs/2.15.0/install-config/demo-server

Build an image from the Dockerfile and tag it with the demo server and your project name.

```bash
docker build -t demo.goharbor.io/your-project/test-image .

```

--------------------------------

### Create a simple Dockerfile

Source: https://goharbor.io/docs/2.15.0/install-config/demo-server

Create a minimal Dockerfile based on busybox:latest to build a test image.

```dockerfile
FROM busybox:latest

```

--------------------------------

### Push the test image to Harbor

Source: https://goharbor.io/docs/2.15.0/install-config/demo-server

Push the built image to your project in the Harbor demo server.

```bash
docker push demo.goharbor.io/your-project/test-image

```

--------------------------------

### Run the migration tool

Source: https://goharbor.io/docs/2.15.0/administration/upgrade

Run the migration tool to upgrade the harbor.yml file. Replace [tag] with the new Harbor version and ${path to harbor.yml} with the actual path.

```bash
docker run -it --rm -v /:/hostfs goharbor/prepare:[tag] migrate -i ${path to harbor.yml}

```

--------------------------------

### Docker login to demo.goharbor.io

Source: https://goharbor.io/docs/2.15.0/install-config/demo-server

Log in to the Harbor demo server using Docker with the credentials created earlier.

```bash
docker login demo.goharbor.io

```

--------------------------------

### Create x509 v3 extension file

Source: https://goharbor.io/docs/2.15.0/install-config/configure-https

Creates a v3.ext file to ensure the certificate complies with SAN and x509 v3 requirements. Replace DNS entries with your actual domain information.

```bash
cat > v3.ext <<-EOF
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names

[alt_names]
DNS.1=yourdomain.com
DNS.2=yourdomain
DNS.3=hostname
EOF
```

--------------------------------

### Kubectl command and output

Source: https://goharbor.io/docs/2.15.0/build-customize-contribute/style-guide

Demonstrates the correct way to separate a command from its resulting output in documentation.

```bash
kubectl get pods --output=wide
```

```text
NAME     READY     STATUS    RESTARTS   AGE    IP           NODE
nginx    1/1       Running   0          13s    10.200.0.4   worker0
```

--------------------------------

### Download Harbor Helm chart

Source: https://goharbor.io/docs/2.15.0/install-config/harbor-ha-helm

Adds the Harbor Helm repository and downloads the chart to the current directory, unpacking it for configuration.

```bash
helm repo add harbor https://helm.goharbor.io
helm fetch harbor/harbor --untar

```

--------------------------------

### Create Harbor Certificate Directory

Source: https://goharbor.io/docs/2.15.0/install-config/configure-https

Create the default directory where Harbor expects to find its certificates.

```bash
sudo mkdir -p /data/cert/
```

--------------------------------

### Create and package an OCI chart

Source: https://goharbor.io/docs/2.15.0/working-with-projects/working-with-oci/working-with-helm-oci-charts

Steps to create, edit, package, and push an OCI chart. The chart is created with 'helm create', edited, packaged, and pushed to a Harbor registry.

```bash
helm create oci-chart-example

```

```bash
helm package oci-chart-example

```

```bash
helm push oci-chart-example-0.1.0.tgz oci://demo.goharbor.io/oci-charts

```

--------------------------------

### Backup Harbor with CSI or Native Snapshot

Source: https://goharbor.io/docs/2.15.0/administration/backup-restore

Command to initiate a Harbor backup using CSI or native snapshots. Replace the namespace and backup name as required.

```bash
# replace the namespace and backup name with yours
velero backup create harbor-backup --include-namespaces harbor --snapshot-volumes --wait
```

--------------------------------

### Reconfigure Harbor

Source: https://goharbor.io/docs/2.15.0/install-config/reconfigure-manage-lifecycle

Steps to reconfigure Harbor, including stopping the instance, updating the configuration, running the prepare script, and restarting the instance.

```bash
sudo docker compose down -v
```

```bash
vim harbor.yml
```

```bash
sudo ./prepare
```

```bash
sudo ./prepare --with-trivy
```

```bash
sudo docker compose up -d
```

--------------------------------

### Copy proxy.config.mjs.temp to proxy.config.mjs

Source: https://goharbor.io/docs/2.15.0/build-customize-contribute/ui-contribution-get-started

Navigate to the Harbor portal directory and copy the proxy configuration template to the active configuration file.

```bash
cd harbor/src/portal
cp proxy.config.mjs.temp proxy.config.mjs

```

--------------------------------

### Import Trust Policy

Source: https://goharbor.io/docs/2.15.0/working-with-projects/working-with-images/sign-images

Import the trust policy configuration from the JSON file into Notation.

```bash
notation policy import ./trustpolicy.json
```

--------------------------------

### Create a release build

Source: https://goharbor.io/docs/2.15.0/build-customize-contribute/compile-guide

By default, the make process creates a development build. Set DEVFLAG=false to create a release build.

```bash
make XXXX -e DEVFLAG=false

```

--------------------------------

### Restore Harbor using Velero

Source: https://goharbor.io/docs/2.15.0/administration/backup-restore

Use the velero restore create command to initiate a restore from a specific backup. The --wait flag ensures the command waits for the restore process to complete.

```bash
# replace the backup and restore names with yours
velero restore create harbor-restore --from-backup harbor-backup --wait
```

--------------------------------

### Configure Docker Daemon Trust

Source: https://goharbor.io/docs/2.15.0/install-config/configure-https

Create a dedicated directory for the Harbor domain and copy the required certificate files to enable Docker trust.

```bash
mkdir -p /etc/docker/certs.d/yourdomain.com/
cp yourdomain.com.cert /etc/docker/certs.d/yourdomain.com/
cp yourdomain.com.key /etc/docker/certs.d/yourdomain.com/
cp ca.crt /etc/docker/certs.d/yourdomain.com/
```

--------------------------------

### Backup Harbor with CSI Snapshot and Data Move

Source: https://goharbor.io/docs/2.15.0/administration/backup-restore

Command to initiate a Harbor backup using CSI snapshots with data movement. Replace the namespace and backup name as required.

```bash
# replace the namespace and backup name with yours
velero backup create harbor-backup --include-namespaces harbor --snapshot-volumes --snapshot-move-data --wait
```

--------------------------------

### Backup Harbor with File System Backup

Source: https://goharbor.io/docs/2.15.0/administration/backup-restore

Command to initiate a Harbor backup using file system backup. Ensure you have reviewed Velero file system backup limitations before proceeding.

```bash
# replace the namespace and backup name with yours
velero backup create harbor-backup --include-namespaces harbor --default-volumes-to-fs-backup --wait
```

--------------------------------

### Display information about a Pod using kubectl

Source: https://goharbor.io/docs/2.15.0/build-customize-contribute/style-guide

Use the kubectl describe command with angle brackets for placeholders. The -n parameter can be omitted if the pod is in the default namespace.

```bash
kubectl describe pod <pod-name> -n <namespace>
```

--------------------------------

### Copy Certificates to Harbor Directory

Source: https://goharbor.io/docs/2.15.0/install-config/configure-https

Copy the server certificate and private key to the Harbor certificate directory.

```bash
cp yourdomain.com.crt /data/cert/
sudo cp yourdomain.com.key /data/cert/
```

--------------------------------

### Tag an image for Harbor

Source: https://goharbor.io/docs/2.15.0/working-with-projects/working-with-images/pulling-pushing-images

Tag a local image to match the Harbor project and repository structure.

```bash
docker tag ubuntu:14.04 <harbor_address>/demo/ubuntu:14.04
```

--------------------------------

### Authenticate to Harbor Registry

Source: https://goharbor.io/docs/2.15.0/working-with-projects/working-with-images/sign-images

Set environment variables to authenticate the Notation CLI with the Harbor registry.

```bash
export NOTATION_USERNAME="YOUR_REGISTRY_USERNAME"
export NOTATION_PASSWORD="YOUR_REGISTRY_PASSWORD"
```

--------------------------------

### Create Certificate Bundle with cat

Source: https://goharbor.io/docs/2.15.0/install-config/troubleshoot-installation

Merge an intermediate certificate with your own certificate to create a certificate bundle for HTTPS connections.

```bash
cat intermediate-certificate.pem >> yourdomain.com.crt

```

--------------------------------

### Back up the database

Source: https://goharbor.io/docs/2.15.0/administration/upgrade

Copy the database directory (default /data/database) to a backup location.

```bash
cp -r /data/database /my_backup_dir/

```

--------------------------------

### Pull image from proxy cache project

Source: https://goharbor.io/docs/2.15.0/administration/configure-proxy-cache

To use the proxy cache, prefix your image tag with the Harbor server name and the proxy project name.

```bash
> docker pull <harbor_server_name>/<proxy_project_name>/goharbor/harbor-core:dev
```

--------------------------------

### Login to Harbor registry with Helm

Source: https://goharbor.io/docs/2.15.0/working-with-projects/working-with-oci/working-with-helm-oci-charts

Use this command to authenticate with a Harbor registry before pulling or pushing OCI charts. Required for private projects.

```bash
helm registry login <harbor_address>

```

--------------------------------

### Generate internal TLS certificates with prepare tool

Source: https://goharbor.io/docs/2.15.0/install-config/configure-internal-tls

Run this docker command to automatically generate all internal TLS certificates into the specified directory. Replace <current_harbor_version> with the Harbor version and /path/to/internal/tls/cert with the directory path.

```bash
docker run -v /:/hostfs goharbor/prepare:<current_harbor_version> gencert -p /path/to/internal/tls/cert

```

--------------------------------

### Back up Harbor Clair database

Source: https://goharbor.io/docs/2.15.0/administration/vulnerability-scanning/import-vulnerability-data

Back up the Harbor Clair database before importing data. Creates all.sql.

```shell
docker exec harbor-db /bin/sh -c  "pg_dump -U postgres -c" > all.sql

```

--------------------------------

### Replace default Harbor key and certificate

Source: https://goharbor.io/docs/2.15.0/install-config/customize-token-service

Copies your own private key and root certificate into the Harbor data volume, replacing the default ones. Assumes the new key and certificate are in /root/cert and that /srv/harbor/data is the data_volume.

```bash
cd config/ui
cp /root/cert/private_key.pem /srv/harbor/data/secret/core/private_key.pem
cp /root/cert/root.crt /srv/harbor/data/secret/registry/root.crt
```

--------------------------------

### Restore older Harbor version from backup

Source: https://goharbor.io/docs/2.15.0/administration/upgrade/roll-back-upgrade

Move the backed-up Harbor directory to the current location to restore the previous version.

```bash
mv /my_backup_dir/harbor harbor

```

--------------------------------

### Clone the Harbor repository

Source: https://goharbor.io/docs/2.15.0/build-customize-contribute/compile-guide

Clones the Harbor source code from GitHub. Required before building.

```bash
git clone https://github.com/goharbor/harbor

```

--------------------------------

### Generate Test Key and Certificate

Source: https://goharbor.io/docs/2.15.0/working-with-projects/working-with-images/sign-images

Generate a test RSA key and self-signed X.509 certificate for development purposes.

```bash
notation cert generate-test --default "wabbit-networks.io"
```

--------------------------------

### Generate server certificate signing request (CSR)

Source: https://goharbor.io/docs/2.15.0/install-config/configure-https

Creates a CSR for the server certificate. Ensure the CN matches your Harbor host FQDN.

```bash
openssl req -sha512 -new \
    -subj "/C=CN/ST=Beijing/L=Beijing/O=example/OU=Personal/CN=yourdomain.com" \
    -key yourdomain.com.key \
    -out yourdomain.com.csr
```

--------------------------------

### Edit harbor.yml configuration

Source: https://goharbor.io/docs/2.15.0/build-customize-contribute/compile-guide

Change into the harbor directory and edit the make/harbor.yml file to set hostname, admin password, and mail server.

```bash
cd harbor
vi make/harbor.yml

```

--------------------------------

### Move source code to GOPATH

Source: https://goharbor.io/docs/2.15.0/build-customize-contribute/compile-guide

Moves the Harbor source code into the GOPATH structure required for building with a local Golang environment.

```bash
mkdir $GOPATH/src/github.com/goharbor/
cd ..
mv harbor $GOPATH/src/github.com/goharbor/.

```

--------------------------------

### Import vulnerability data to Harbor Clair database

Source: https://goharbor.io/docs/2.15.0/administration/vulnerability-scanning/import-vulnerability-data

Import the dumped vulnerability data into the Harbor Clair database. Run clear.sql first, then vulnerability.sql.

```shell
docker exec -i harbor-db psql -U postgres < clear.sql  
docker exec -i harbor-db psql -U postgres < vulnerability.sql

```

--------------------------------

### Authenticate with a Project Robot Account using docker login

Source: https://goharbor.io/docs/2.15.0/working-with-projects/project-configuration/create-robot-accounts

Use docker login with the robot account credentials. The username is in the format <prefix><project_name>+<account_name> and the password is the robot account secret.

```bash
docker login <harbor_address>
Username: <prefix><project_name>+<account_name>
Password: <secret>

```

--------------------------------

### Push an image to Harbor

Source: https://goharbor.io/docs/2.15.0/working-with-projects/working-with-images/pulling-pushing-images

Upload the tagged image to the specified Harbor project repository.

```bash
docker push <harbor_address>/demo/ubuntu:14.04
```

--------------------------------

### Clair update logs

Source: https://goharbor.io/docs/2.15.0/administration/vulnerability-scanning/import-vulnerability-data

Sample Clair logs showing successful vulnerability updates. Look for 'finished fetching' for rhel, alpine, oracle, debian, and ubuntu endpoints, and 'update finished' to confirm the database is up to date.

```log
Jul 3 20:40:45 172.18.0.1 clair[3516]: {"Event":"finished fetching","Level":"info","Location":"updater.go:227","Time":"2017-07-04 03:40:45.890364","updater name":"rhel"}
Jul 3 20:40:46 172.18.0.1 clair[3516]: {"Event":"finished fetching","Level":"info","Location":"updater.go:227","Time":"2017-07-04 03:40:46.768924","updater name":"alpine"}
Jul 3 20:40:47 172.18.0.1 clair[3516]: {"Event":"finished fetching","Level":"info","Location":"updater.go:227","Time":"2017-07-04 03:40:47.190982","updater name":"oracle"}
Jul 3 20:41:07 172.18.0.1 clair[3516]: {"Event":"Debian buster is not mapped to any version number (eg. Jessie-\u003e8). Please update me.","Level":"warning","Location":"debian.go:128","Time":"2017-07-04 03:41:07.833720"}
Jul 3 20:41:07 172.18.0.1 clair[3516]: {"Event":"finished fetching","Level":"info","Location":"updater.go:227","Time":"2017-07-04 03:41:07.833975","updater name":"debian"}
Jul 4 00:26:17 172.18.0.1 clair[3516]: {"Event":"finished fetching","Level":"info","Location":"updater.go:227","Time":"2017-07-04 07:26:17.596986","updater name":"ubuntu"}
Jul 4 00:26:18 172.18.0.1 clair[3516]: {"Event":"adding metadata to vulnerabilities","Level":"info","Location":"updater.go:253","Time":"2017-07-04 07:26:18.060810"}
Jul 4 00:38:05 172.18.0.1 clair[3516]: {"Event":"update finished","Level":"info","Location":"updater.go:198","Time":"2017-07-04 07:38:05.251580"}

```

--------------------------------

### Log into Harbor from Docker client

Source: https://goharbor.io/docs/2.15.0/install-config/configure-https

Log into Harbor from the Docker client to verify the HTTPS connection.

```bash
docker login yourdomain.com

```

--------------------------------

### Default setting.json content

Source: https://goharbor.io/docs/2.15.0/build-customize-contribute/customize-look-feel

Shows the default content of the setting.json file. Edit the values to override the default style. The file is loaded when Harbor is launched.

```json
{
  "headerBgColor": {
    "darkMode": "",
    "lightMode": ""
  },
  "loginBgImg": "",
  "loginTitle": "",
  "product": {
    "name": "",
    "logo": "",
    "introduction": ""
  }
}
```

--------------------------------

### Generate a private key with OpenSSL

Source: https://goharbor.io/docs/2.15.0/install-config/customize-token-service

Generates a 4096-bit RSA private key named private_key.pem in the current directory. This is the first step in creating a root certificate for the Harbor token service.

```bash
openssl genrsa -out private_key.pem 4096
```

--------------------------------

### Docker login to Harbor

Source: https://goharbor.io/docs/2.15.0/working-with-projects/working-with-images/pulling-pushing-images

Use this command to authenticate with a private Harbor project before pulling images.

```bash
docker login <harbor_address>
```

--------------------------------

### Back up Harbor files

Source: https://goharbor.io/docs/2.15.0/administration/upgrade

Move the Harbor directory to a backup location to allow rollback if needed.

```bash
mv harbor /my_backup_dir/harbor

```

--------------------------------

### Configure X-Forwarded-Proto Header in nginx.conf

Source: https://goharbor.io/docs/2.15.0/install-config/troubleshoot-installation

Search for this line in common/config/nginx/nginx.conf when Harbor runs behind an nginx proxy or elastic load balancing. If the proxy already has similar settings, remove it from the location /, location /v2/, and location /service/ sections and redeploy Harbor.

```nginx
proxy_set_header X-Forwarded-Proto $scheme;

```

--------------------------------

### Configure Docker daemon for Windows images

Source: https://goharbor.io/docs/2.15.0/working-with-projects/working-with-images/pulling-pushing-images

Update the daemon.json file to allow pushing non-distributable artifacts to your registry domain.

```json
{
"allow-nondistributable-artifacts" : ["myregistrydomain.com:5000"]
}
```

--------------------------------

### Push Harbor images to Docker Hub

Source: https://goharbor.io/docs/2.15.0/build-customize-contribute/compile-guide

Pushes Harbor images directly to Docker Hub when REGISTRYSERVER is not set. Note: need to add "/" at the end of REGISTRYSERVER if used.

```bash
make pushimage -e DEVFLAG=false REGISTRYUSER=[$USERNAME] REGISTRYPASSWORD=[$PASSWORD] REGISTRYPROJECTNAME=[$PROJECTNAME]

```

--------------------------------

### Authenticate with a System Robot Account

Source: https://goharbor.io/docs/2.15.0/administration/robot-accounts

Use the docker login command to authenticate an automated process using the robot account credentials.

```bash
docker login <harbor_address>
Username: <prefix><account_name>
Password: <secret>
```

--------------------------------

### Pull the migration tool image

Source: https://goharbor.io/docs/2.15.0/administration/upgrade

Pull the goharbor/prepare image with the specified tag from Docker Hub to use for migration.

```bash
docker pull goharbor/prepare:[tag]

```

--------------------------------

### Restrict project creation to Harbor administrators

Source: https://goharbor.io/docs/2.15.0/install-config/configure-system-settings-cli

Sets the project creation restriction to adminonly, limiting project creation to administrators. The output shows a successful HTTP 200 response.

```bash
curl -X PUT -u "<username>:<password>" -H "Content-Type: application/json" -ki https://harbor.sample.domain/api/v2.0/configurations -d'{"project_creation_restriction":"adminonly"}'

```

```http
HTTP/1.1 200 OK
Server: nginx
Date: Wed, 08 May 2019 08:24:32 GMT
Content-Type: text/plain; charset=utf-8
Content-Length: 0
Connection: keep-alive
Set-Cookie: sid=b7925eaf7af53bdefb13bdcae201a14a; Path=/; HttpOnly

```

--------------------------------

### Configure Webhook Job Settings in harbor.yml

Source: https://goharbor.io/docs/2.15.0/working-with-projects/project-configuration/configure-webhooks

Settings for webhook job retry counts and HTTP client timeouts when using Docker Compose.

```yaml
notification:
  # Maximum retry count for webhook job
  # Increase or decrease the retry count when webhook job failed, pay attention that a high number of retries can put pressure on the webhook job queue
  webhook_job_max_retry: 3
  # HTTP client timeout for webhook job
  # Increase the timeout if the webhook endpoint cannot respond to harbor within the specified timeout
  webhook_job_http_client_timeout: 3 #seconds
```

--------------------------------

### Generate server certificate

Source: https://goharbor.io/docs/2.15.0/install-config/configure-https

Uses the CSR and v3.ext file to generate the final server certificate signed by the CA.

```bash
openssl x509 -req -sha512 -days 3650 \
    -extfile v3.ext \
    -CA ca.crt -CAkey ca.key -CAcreateserial \
    -in yourdomain.com.csr \
    -out yourdomain.com.crt
```

--------------------------------

### Convert Certificate for Docker

Source: https://goharbor.io/docs/2.15.0/install-config/configure-https

Convert the server certificate from .crt to .cert format as required by the Docker daemon.

```bash
openssl x509 -inform PEM -in yourdomain.com.crt -out yourdomain.com.cer
```

--------------------------------

### Generate CA certificate

Source: https://goharbor.io/docs/2.15.0/install-config/configure-https

Generates the CA certificate using the previously created private key. Adapt the -subj values to reflect your organization and set the CN to your Harbor host FQDN.

```bash
openssl req -x509 -new -nodes -sha512 -days 3650 \
 -subj "/C=CN/ST=Beijing/L=Beijing/O=example/OU=Personal/CN=MyPersonal Root CA" \
 -key ca.key \
 -out ca.crt
```

--------------------------------

### Trust Certificate on Ubuntu

Source: https://goharbor.io/docs/2.15.0/install-config/troubleshoot-installation

Trust the certificate at the OS level on Ubuntu when the Docker daemon requires it.

```bash
cp yourdomain.com.crt /usr/local/share/ca-certificates/yourdomain.com.crt 
update-ca-certificates

```

--------------------------------

### Verify Image Signature

Source: https://goharbor.io/docs/2.15.0/working-with-projects/working-with-images/sign-images

Verify the signatures associated with a container image in Harbor.

```bash
notation verify <harbor-domain>/<image-reference>
```

--------------------------------

### Upgrade Harbor Helm release

Source: https://goharbor.io/docs/2.15.0/administration/upgrade/helm-upgrade

Runs the Helm upgrade command with --force flag. The --force is necessary when upgrading from version 0.3.0 due to issue #30.

```bash
helm upgrade release-name --force .

```

--------------------------------

### Generate server private key

Source: https://goharbor.io/docs/2.15.0/install-config/configure-https

Generates a 4096-bit RSA private key for the server certificate.

```bash
openssl genrsa -out yourdomain.com.key 4096
```

--------------------------------

### Sign an Image in Harbor

Source: https://goharbor.io/docs/2.15.0/working-with-projects/working-with-images/sign-images

Sign an image pushed to the Harbor registry using the notation sign command.

```bash
notation sign <harbor-domain>/<image-reference>
```

--------------------------------

### Login to Harbor via Docker CLI using CLI secret

Source: https://goharbor.io/docs/2.15.0/administration/configure-authentication/oidc-auth

Use the CLI secret as the password when authenticating with the Docker CLI. Replace 'testuser' with your username and 'jt-dev.local.goharbor.io' with your Harbor instance URL.

```bash
docker login -u testuser -p _cli_secret_ jt-dev.local.goharbor.io
```

--------------------------------

### Update current configuration

Source: https://goharbor.io/docs/2.15.0/install-config/configure-system-settings-cli

Updates a configuration item by sending a PUT request with a JSON payload containing the item name and value. The item name and value are placeholders.

```bash
curl -X PUT -u "<username>:<password>" -H "Content-Type: application/json" -ki <Harbor Server URL>/api/v2.0/configurations -d'{"<item_name>":"<item_value>"}'

```

--------------------------------

### Docker pull image from Harbor

Source: https://goharbor.io/docs/2.15.0/working-with-projects/working-with-images/pulling-pushing-images

Use this command to pull an image from a specific Harbor registry path.

```bash
docker pull <harbor_address>/library/ubuntu:14.04
```

--------------------------------

### Restart Docker Engine

Source: https://goharbor.io/docs/2.15.0/install-config/configure-https

Restart the Docker service to apply the certificate configuration changes.

```bash
systemctl restart docker
```

--------------------------------

### Log into Harbor with custom nginx port

Source: https://goharbor.io/docs/2.15.0/install-config/configure-https

If nginx 443 port is mapped to a different port, add the port in the login command.

```bash
docker login yourdomain.com:port

```

--------------------------------

### trivy-adapter docker-compose configuration with custom CA mount

Source: https://goharbor.io/docs/2.15.0/administration/vulnerability-scanning/configure-custom-certs

Shows the trivy-adapter service configuration in docker-compose.yml, including the bind mount to /harbor_cust_cert for custom CA certificates. Add your CA bundle or public certificates to the mount location.

```yaml
  trivy-adapter:
    container_name: trivy-adapter
    image: goharbor/trivy-adapter-photon:dev
    restart: always
    cap_drop:
      - ALL
    dns_search: .
    depends_on:
      - log
      - redis
    networks:
      - harbor
    volumes:
      - type: bind
        source: /data/trivy-adapter/trivy
        target: /home/scanner/.cache/trivy
      - type: bind
        source: /data/trivy-adapter/reports
        target: /home/scanner/.cache/reports
      - type: bind
        source: ./common/config/shared/trust-certificates
        target: /harbor_cust_cert

```

--------------------------------

### Inspect Image Signature

Source: https://goharbor.io/docs/2.15.0/working-with-projects/working-with-images/sign-images

Inspect the signature and certificate information for a specific image.

```bash
notation inspect $IMAGE
```

--------------------------------

### Push Harbor images to specific registry server

Source: https://goharbor.io/docs/2.15.0/build-customize-contribute/compile-guide

Pushes Harbor images to a specific registry server. Requires REGISTRYSERVER to end with a slash. If REGISTRYSERVER is not set, images are pushed directly to Docker Hub.

```bash
make pushimage -e DEVFLAG=false REGISTRYSERVER=[$SERVERADDRESS] REGISTRYUSER=[$USERNAME] REGISTRYPASSWORD=[$PASSWORD] REGISTRYPROJECTNAME=[$PROJECTNAME]

```

--------------------------------

### Update Harbor to use LDAP authentication

Source: https://goharbor.io/docs/2.15.0/install-config/configure-system-settings-cli

Sets the authentication mode to LDAP by sending a PUT request with the auth_mode set to ldap_auth. The output shows a successful HTTP 200 response.

```bash
curl -X PUT -u "<username>:<password>" -H "Content-Type: application/json" -ki https://harbor.sample.domain/api/v2.0/configurations -d'{"auth_mode":"ldap_auth"}'

```

```http
HTTP/1.1 200 OK
Server: nginx
Date: Wed, 08 May 2019 08:22:02 GMT
Content-Type: text/plain; charset=utf-8
Content-Length: 0
Connection: keep-alive
Set-Cookie: sid=a5803a1265e2b095cf65ce1d8bbd79b1; Path=/; HttpOnly

```

--------------------------------

### Stop and remove existing Harbor instance

Source: https://goharbor.io/docs/2.15.0/install-config/configure-https

If Harbor is running, stop and remove the existing instance. Image data remains in the file system, so no data is lost.

```bash
docker compose down -v

```

--------------------------------

### Create Trust Policy JSON

Source: https://goharbor.io/docs/2.15.0/working-with-projects/working-with-images/sign-images

Create a trust policy configuration file named trustpolicy.json to define trusted identities and verification levels.

```bash
cat <<EOF > ./trustpolicy.json
{
    "version": "1.0",
    "trustPolicies": [
        {
            "name": "wabbit-networks-images",
            "registryScopes": [ "*" ],
            "signatureVerification": {
                "level" : "strict"
            },
            "trustStores": [ "ca:wabbit-networks.io" ],
            "trustedIdentities": [
                "*"
            ]
        }
    ]
}
EOF
```

--------------------------------

### Harbor proxy.config.mjs with HttpsProxyAgent

Source: https://goharbor.io/docs/2.15.0/build-customize-contribute/ui-contribution-get-started

Proxy configuration for the Harbor frontend development server. Set the target to an available Harbor hostname and optionally enable a corporate proxy agent by setting useAgent to true and specifying an agent server.

```javascript
import HttpsProxyAgent from 'https-proxy-agent';
// Define the proxy configuration
const HarborProxyConfig = [
  {
    "context": [
      "/api",
      "/c",
      "/i18n",
      "/chartrepo",
      "/LICENSE",
      "/swagger.json",
      "/devcenter-api-2.0",
      "/swagger-ui.bundle.js"
    ],
    "target": "${A Harbor server}",
    "secure": false,
    "changeOrigin": true,
    "logLevel": "debug"
  }
];
// Define if you use agent
const useAgent = false;
// Specify an agent server, if empty, will read it from environment variable http_proxy or HTTP_PROXY
const specifiedAgentServer = "${An agent server}";

function setupForCorporateProxy(proxyConfig) {
  if (useAgent) {
    const agentServer = process.env.http_proxy || process.env.HTTP_PROXY || specifiedAgentServer;
    if (agentServer) {
      const agent = new HttpsProxyAgent(agentServer);
      console.log('Using corporate agent server: ' + agentServer);
      proxyConfig.forEach(function (entry) {
        entry.agent = agent;
      });
    }
  }
  return proxyConfig;
}

export default setupForCorporateProxy(HarborProxyConfig);  

```

--------------------------------

### Configure Webhook Job Settings in Helm

Source: https://goharbor.io/docs/2.15.0/working-with-projects/project-configuration/configure-webhooks

Settings for webhook job retry counts and HTTP client timeouts when using Helm charts.

```yaml
jobservice:
  notification:
    # Maximum retry count for webhook job
    # Increase or decrease the retry count when webhook job failed, pay attention that a high number of retries can put pressure on the webhook job queue
    webhook_job_max_retry: 3
    # HTTP client timeout for webhook job
    # Increase the timeout if the webhook endpoint cannot respond to harbor within the specified timeout
    webhook_job_http_client_timeout: 3 # in seconds
```

--------------------------------

### Generate CA certificate private key

Source: https://goharbor.io/docs/2.15.0/install-config/configure-https

Generates a 4096-bit RSA private key for the CA.

```bash
openssl genrsa -out ca.key 4096
```

--------------------------------

### Dump Clair vulnerability database

Source: https://goharbor.io/docs/2.15.0/administration/vulnerability-scanning/import-vulnerability-data

Dump the Clair vulnerability database from the internet-connected instance. The container name 'clair-db' is a placeholder. Generates vulnerability.sql and clear.sql files.

```shell
$ docker exec clair-db /bin/sh -c  "pg_dump -U postgres -a -t feature -t keyvalue -t namespace -t schema_migrations -t vulnerability -t vulnerability_fixedin_feature" > vulnerability.sql  
$ docker exec clair-db /bin/sh -c "pg_dump -U postgres -c -s" > clear.sql

```

--------------------------------

### Generate a root certificate with OpenSSL

Source: https://goharbor.io/docs/2.15.0/install-config/customize-token-service

Creates a self-signed root certificate (root.crt) using the private key generated in the previous step. The certificate is valid for 3650 days. You will be prompted to enter certificate request information.

```bash
openssl req -new -x509 -key private_key.pem -out root.crt -days 3650
```

--------------------------------

### Restart Docker and Harbor after daemon.json changes

Source: https://goharbor.io/docs/2.15.0/install-config/run-installer-script

After updating daemon.json, restart Docker Engine, stop Harbor, and restart Harbor. This is required to apply the insecure registry configuration.

```shell
systemctl restart docker

docker compose down -v

docker compose up -d

```

--------------------------------

### Label Redis resources for Velero backup exclusion

Source: https://goharbor.io/docs/2.15.0/administration/backup-restore

Commands to label the Redis pod, PVC, and PV to exclude them from Velero backups. Replace the namespace and resource names with your specific environment details.

```bash
# label the Pod of Redis, replace the namespace and Pod name with yours
kubectl -n harbor label pod/harbor-redis-0 velero.io/exclude-from-backup=true
# label the PVC of Redis, replace the namespace and PVC name with yours
kubectl -n harbor label pvc/data-harbor-redis-0 velero.io/exclude-from-backup=true
# label the PV of Redis, replace the namespace and PV name with yours
kubectl label pv/$(kubectl -n harbor get pvc data-harbor-redis-0 --template={{.spec.volumeName}}) velero.io/exclude-from-backup=true
```

--------------------------------

### Stop and remove current Harbor service

Source: https://goharbor.io/docs/2.15.0/administration/upgrade/roll-back-upgrade

Run these commands in the harbor directory to stop and remove the current Harbor service before rolling back.

```bash
cd harbor
docker compose down

```

--------------------------------

### Remove Harbor Containers

Source: https://goharbor.io/docs/2.15.0/install-config/reconfigure-manage-lifecycle

Removes Harbor containers while preserving image data and database files.

```bash
sudo docker compose down -v
```