Bonnes pratiques¶

# Lancer un GC dry-run via API
curl -X POST "https://harbor.example.com/api/v2.0/system/gc/schedule" \
  -H "Content-Type: application/json" \
  -u admin:ADMIN_PASSWORD \
  -d '{
    "parameters": {
      "delete_untagged": true,
      "dry_run": true
    },
    "schedule": {
      "type": "Manual"
    }
  }'

# Verifier les resultats du dry-run
curl -s "https://harbor.example.com/api/v2.0/system/gc" \
  -u admin:ADMIN_PASSWORD | jq '.[0]'

# Configurer le GC hebdomadaire
curl -X PUT "https://harbor.example.com/api/v2.0/system/gc/schedule" \
  -H "Content-Type: application/json" \
  -u admin:ADMIN_PASSWORD \
  -d '{
    "parameters": {
      "delete_untagged": true,
      "dry_run": false
    },
    "schedule": {
      "type": "Weekly",
      "cron": "0 0 2 * * 0"
    }
  }'

# Creer une politique de retention pour app-backend
curl -X POST "https://harbor.example.com/api/v2.0/retentions" \
  -H "Content-Type: application/json" \
  -u admin:ADMIN_PASSWORD \
  -d '{
    "algorithm": "or",
    "scope": {
      "level": "project",
      "ref": 2
    },
    "trigger": {
      "kind": "Schedule",
      "settings": {
        "cron": "0 0 3 * * 0"
      }
    },
    "rules": [
      {
        "action": "retain",
        "template": "latestPushedK",
        "params": {"latestPushedK": 10},
        "tag_selectors": [
          {"kind": "doublestar", "decoration": "matches", "pattern": "v*"}
        ],
        "scope_selectors": {
          "repository": [
            {"kind": "doublestar", "decoration": "repoMatches", "pattern": "**"}
          ]
        }
      },
      {
        "action": "retain",
        "template": "nDaysSinceLastPush",
        "params": {"nDaysSinceLastPush": 90},
        "tag_selectors": [
          {"kind": "doublestar", "decoration": "matches", "pattern": "**"}
        ],
        "scope_selectors": {
          "repository": [
            {"kind": "doublestar", "decoration": "repoMatches", "pattern": "**"}
          ]
        }
      }
    ]
  }'

# Replication push event-based : chaque artefact pousse est immediatement replique
curl -X POST https://harbor.example.com/api/v2.0/replication/policies \
  -H "Content-Type: application/json" \
  -u admin:ADMIN_PASSWORD \
  -d '{
    "name": "dr-all-projects",
    "dest_registry": {"id": 1},
    "trigger": {
      "type": "event_based"
    },
    "filters": [
      {"type": "name", "value": "**"},
      {"type": "resource", "value": "image"},
      {"type": "resource", "value": "chart"}
    ],
    "enabled": true,
    "override": true,
    "speed": -1
  }'

#!/bin/bash
# /home/ops/scripts/test-dr-failover.sh
set -euo pipefail

DR_REGISTRY="harbor-dr.example.com"

echo "=== Test de bascule DR ==="

# 1. Verifier la connectivite
echo "1. Test connectivite..."
curl -sf "https://${DR_REGISTRY}/api/v2.0/health" | jq '.status'

# 2. Verifier que la replication est a jour
echo "2. Verification replication..."
curl -s "https://${DR_REGISTRY}/api/v2.0/replication/executions?page_size=5" \
  -u admin:DR_PASSWORD | jq '.[] | {id, status, trigger}'

# 3. Tester le pull depuis le DR
echo "3. Test pull..."
podman pull "${DR_REGISTRY}/app-backend/api:v3.0.1"

# 4. Verifier le scan
echo "4. Verification scan..."
curl -s "https://${DR_REGISTRY}/api/v2.0/projects/app-backend/repositories/api/artifacts/v3.0.1?with_scan_overview=true" \
  -u admin:DR_PASSWORD | jq '.scan_overview'

echo "=== Bascule DR : OK ==="

# .dockerignore
.git
.github
.gitea
*.md
docs/
tests/
docker-compose*.yml
.env*
*.secret
node_modules/
__pycache__/
.pytest_cache/
coverage/
.vscode/
.idea/

# Lister l'utilisation des quotas par projet
curl -s "https://harbor.example.com/api/v2.0/quotas" \
  -u admin:ADMIN_PASSWORD | \
  jq '.[] | {
    project: .ref.name,
    used_gb: (.used.storage / 1073741824 | floor),
    limit_gb: (.hard.storage / 1073741824 | floor),
    pct: ((.used.storage / .hard.storage) * 100 | floor)
  }'

#!/bin/bash
# /home/ops/scripts/migrate-from-distribution.sh
set -euo pipefail

SOURCE="old-registry.example.com:5000"
TARGET="harbor.example.com"
PROJECT="library"

# Lister les repositories sur l'ancien registre
REPOS=$(curl -s "https://${SOURCE}/v2/_catalog" | jq -r '.repositories[]')

for REPO in ${REPOS}; do
  echo "Migrating ${REPO}..."

  # Lister les tags
  TAGS=$(curl -s "https://${SOURCE}/v2/${REPO}/tags/list" | jq -r '.tags[]')

  for TAG in ${TAGS}; do
    echo "  ${REPO}:${TAG}"

    # Copier avec skopeo (plus efficace que pull+push)
    skopeo copy \
      --src-tls-verify=true \
      --dest-tls-verify=true \
      --dest-creds "robot-migration:TOKEN" \
      "docker://${SOURCE}/${REPO}:${TAG}" \
      "docker://${TARGET}/${PROJECT}/${REPO}:${TAG}"
  done
done

echo "Migration complete."

# Migrer les images Docker depuis Nexus
skopeo copy \
  --src-creds "nexus-user:PASSWORD" \
  --dest-creds "robot-migration:TOKEN" \
  "docker://nexus.example.com/docker-hosted/myapp:v1.0" \
  "docker://harbor.example.com/app-backend/myapp:v1.0"

# Migrer les charts Helm depuis Nexus
# 1. Telecharger depuis Nexus
helm pull myapp --repo https://nexus.example.com/repository/helm-hosted/ --version 1.0.0

# 2. Pousser vers Harbor OCI
helm push myapp-1.0.0.tgz oci://harbor.example.com/charts

# Verifier l'etat du scanner
curl -s "https://harbor.example.com/api/v2.0/scanners" \
  -u admin:ADMIN_PASSWORD | jq '.[].health'

# Verifier les logs Trivy
kubectl logs -n harbor -l component=trivy --tail=50

# Causes frequentes :
# - Base CVE non telechargee (premier demarrage) → attendre 10-15 min
# - Image tres volumineuse (> 2 Go) → augmenter le timeout a 600s
# - Trivy en OOM → augmenter les limites memoire

# Identifier les projets les plus volumineux
curl -s "https://harbor.example.com/api/v2.0/quotas" \
  -u admin:ADMIN_PASSWORD | \
  jq 'sort_by(-.used.storage) | .[:5] | .[] | {
    project: .ref.name,
    used_gb: (.used.storage / 1073741824 * 100 | floor / 100)
  }'

# Identifier les images les plus volumineuses dans un projet
curl -s "https://harbor.example.com/api/v2.0/projects/app-backend/repositories?page_size=100" \
  -u admin:ADMIN_PASSWORD | \
  jq 'sort_by(-.artifact_count) | .[:10] | .[] | {
    name: .name,
    artifact_count: .artifact_count
  }'

# Actions correctives :
# 1. Verifier la politique de retention (trop de versions gardees ?)
# 2. Lancer un GC dry-run pour estimer le gain
# 3. Identifier les images sans tag (untagged) et les supprimer
# 4. Verifier les .dockerignore (fichiers inutiles dans les images ?)
# 5. Passer a des images de base plus legeres (distroless)