testwill commented 1 year ago

I don't have a proxy set. What are the reasons for this problem

chlins commented 1 year ago

Could you please provide more context and logs?

wy65701436 commented 1 year ago

It seems that there may be a timeout issue somewhere. Could you please provide us with more details about the situation so that we can investigate further? It's also possible that your proxy is resetting the connection.

testwill commented 1 year ago

docker push 192.168.1.xx/deploy/centos:7.6 The push refers to repository [192.168.1.xx/deploy/centos] 650581340567: Layer already exists caa03255291b: Layer already exists 2e77e15479ba: Layer already exists fd91e5d5ab81: Pushing [==================================================>] 807.2MB/807.2MB 174f56854903: Layer already exists use of closed network connection

wy65701436 commented 1 year ago

check the proxy, core and registry log.

wy65701436 commented 1 year ago

for better understanding your questions, you have to provide more info, like harbor version, installation configure and etc.

testwill commented 1 year ago

版本 v2.5.1-b0506782

testwill commented 1 year ago

Configuration file of Harbor

The IP address or hostname to access admin UI and registry service.

DO NOT use localhost or 127.0.0.1, because Harbor needs to be accessed by external clients.

hostname: mpse123.com

http related config

http:

port for http, default is 80. If https enabled, this port will redirect to https port

port: 80

https related config

https:

https port for harbor, default is 443

port: 443

The path of cert and key files for nginx

certificate: /etc/docker/certs.d/192.168.1.94/192.168.1.94.cert

private_key: /etc/docker/certs.d/192.168.1.94/192.168.1.94.key

certificate: /etc/docker/certs.d/mpse123.com/mpse123.com.cert private_key: /etc/docker/certs.d/mpse123.com/mpse123.com.key

Uncomment following will enable tls communication between all harbor components

internal_tls:

set enabled to true means internal tls is enabled

enabled: true

put your cert and key files on dir

dir: /etc/harbor/tls/internal

Uncomment external_url if you want to enable external proxy

And when it enabled the hostname will no longer used

external_url: https://reg.mydomain.com:8433

The initial password of Harbor admin

It only works in first time to install harbor

Remember Change the admin password from UI after launching Harbor.

harbor_admin_password: Harbor12345

Harbor DB configuration

database:

The password for the root user of Harbor DB. Change this before any production use.

password: root123

The maximum number of connections in the idle connection pool. If it <=0, no idle connections are retained.

max_idle_conns: 100

The maximum number of open connections to the database. If it <= 0, then there is no limit on the number of open connections.

Note: the default number of connections is 1024 for postgres of harbor.

max_open_conns: 900

The default data volume

data_volume: /data

Harbor Storage settings by default is using /data dir on local filesystem

Uncomment storage_service setting If you want to using external storage

storage_service:

ca_bundle is the path to the custom root ca certificate, which will be injected into the truststore

of registry's and chart repository's containers. This is usually needed when the user hosts a internal storage with self signed certificate.

ca_bundle:

storage backend, default is filesystem, options include filesystem, azure, gcs, s3, swift and oss

for more info about this configuration please refer https://docs.docker.com/registry/configuration/

filesystem:

maxthreads: 100

set disable to true when you want to disable registry redirect

redirect:

disabled: false

Trivy configuration

#

Trivy DB contains vulnerability information from NVD, Red Hat, and many other upstream vulnerability databases.

It is downloaded by Trivy from the GitHub release page https://github.com/aquasecurity/trivy-db/releases and cached

in the local file system. In addition, the database contains the update timestamp so Trivy can detect whether it

should download a newer version from the Internet or use the cached one. Currently, the database is updated every

12 hours and published as a new release to GitHub.

trivy:

ignoreUnfixed The flag to display only fixed vulnerabilities

ignore_unfixed: false

skipUpdate The flag to enable or disable Trivy DB downloads from GitHub

#

You might want to enable this flag in test or CI/CD environments to avoid GitHub rate limiting issues.

If the flag is enabled you have to download the `trivy-offline.tar.gz` archive manually, extract `trivy.db` and

`metadata.json` files and mount them in the `/home/scanner/.cache/trivy/db` path.

skip_update: false #

The offline_scan option prevents Trivy from sending API requests to identify dependencies.

Scanning JAR files and pom.xml may require Internet access for better detection, but this option tries to avoid it.

For example, the offline mode will not try to resolve transitive dependencies in pom.xml when the dependency doesn't

exist in the local repositories. It means a number of detected vulnerabilities might be fewer in offline mode.

It would work if all the dependencies are in local.

This option doesn’t affect DB download. You need to specify "skip-update" as well as "offline-scan" in an air-gapped environment.

offline_scan: false #

insecure The flag to skip verifying registry certificate

insecure: false

github_token The GitHub access token to download Trivy DB

#

Anonymous downloads from GitHub are subject to the limit of 60 requests per hour. Normally such rate limit is enough

for production operations. If, for any reason, it's not enough, you could increase the rate limit to 5000

requests per hour by specifying the GitHub access token. For more details on GitHub rate limiting please consult

https://developer.github.com/v3/#rate-limiting

#

You can create a GitHub token by following the instructions in

https://help.github.com/en/github/authenticating-to-github/creating-a-personal-access-token-for-the-command-line

#

github_token: xxx

jobservice:

Maximum number of job workers in job service

max_job_workers: 10

notification:

Maximum retry count for webhook job

webhook_job_max_retry: 10

chart:

Change the value of absolute_url to enabled can enable absolute url in chart

absolute_url: disabled

Log configurations

log:

options are debug, info, warning, error, fatal

level: info

configs for logs in local storage

local:

Log files are rotated log_rotate_count times before being removed. If count is 0, old versions are removed rather than rotated.

rotate_count: 50
# Log files are rotated only if they grow bigger than log_rotate_size bytes. If size is followed by k, the size is assumed to be in kilobytes.
# If the M is used, the size is in megabytes, and if G is used, the size is in gigabytes. So size 100, size 100k, size 100M and size 100G
# are all valid.
rotate_size: 200M
# The directory on your host that store log
location: /var/log/harbor

Uncomment following lines to enable external syslog endpoint.

external_endpoint:

protocol used to transmit log to external endpoint, options is tcp or udp

protocol: tcp

The host of external endpoint

host: localhost

Port of external endpoint

port: 5140

This attribute is for migrator to detect the version of the .cfg file, DO NOT MODIFY!

_version: 2.5.0

Uncomment external_database if using external database.

external_database:

harbor:

host: harbor_db_host

port: harbor_db_port

db_name: harbor_db_name

username: harbor_db_username

password: harbor_db_password

ssl_mode: disable

max_idle_conns: 2

max_open_conns: 0

notary_signer:

host: notary_signer_db_host

port: notary_signer_db_port

db_name: notary_signer_db_name

username: notary_signer_db_username

password: notary_signer_db_password

ssl_mode: disable

notary_server:

host: notary_server_db_host

port: notary_server_db_port

db_name: notary_server_db_name

username: notary_server_db_username

password: notary_server_db_password

ssl_mode: disable

Uncomment external_redis if using external Redis server

external_redis:

support redis, redis+sentinel

host for redis: :

host for redis+sentinel:

:,:,:

host: redis:6379

password:

sentinel_master_set must be set to support redis+sentinel

sentinel_master_set:

db_index 0 is for core, it's unchangeable

registry_db_index: 1

jobservice_db_index: 2

chartmuseum_db_index: 3

trivy_db_index: 5

idle_timeout_seconds: 30

Uncomment uaa for trusting the certificate of uaa instance that is hosted via self-signed cert.

uaa:

ca_file: /path/to/ca

Global proxy

Config http proxy for components, e.g. http://my.proxy.com:3128

Components doesn't need to connect to each others via http proxy.

Remove component from `components` array if want disable proxy

for it. If you want use proxy for replication, MUST enable proxy

for core and jobservice, and set `http_proxy` and `https_proxy`.

Add domain to the `no_proxy` field, when you want disable proxy

for some special registry.

proxy: http_proxy: https_proxy: no_proxy: components:

core
jobservice
trivy

metric:

enabled: false

port: 9090

path: /metrics

Trace related config

only can enable one trace provider(jaeger or otel) at the same time,

and when using jaeger as provider, can only enable it with agent mode or collector mode.

if using jaeger collector mode, uncomment endpoint and uncomment username, password if needed

if using jaeger agetn mode uncomment agent_host and agent_port

trace:

enabled: true

set sample_rate to 1 if you wanna sampling 100% of trace data; set 0.5 if you wanna sampling 50% of trace data, and so forth

sample_rate: 1

namespace used to differenciate different harbor services

namespace:

attributes is a key value dict contains user defined attributes used to initialize trace provider

attributes:

application: harbor

jaeger should be 1.26 or newer.

jaeger:

endpoint: http://hostname:14268/api/traces

username:

password:

agent_host: hostname

export trace data by jaeger.thrift in compact mode

agent_port: 6831

otel:

endpoint: hostname:4318

url_path: /v1/traces

compression: false

insecure: true

timeout: 10s

enable purge _upload directories

upload_purging: enabled: true

remove files in _upload directories which exist for a period of time, default is one week.

age: 168h

the interval of the purge operations

interval: 24h dryrun: false

zyyw commented 1 year ago

As mentioned above, could you please provide us with the proxy.log, core.log and registry.log as well when you experienced the error.

github-actions[bot] commented 1 year ago

This issue is being marked stale due to a period of inactivity. If this issue is still relevant, please comment or remove the stale label. Otherwise, this issue will close in 30 days.

github-actions[bot] commented 1 year ago

This issue was closed because it has been stalled for 30 days with no activity. If this issue is still relevant, please re-open a new issue.

SmallGaoX commented 1 year ago

who can save me

nginx --> harbor

harbor.yml

hostname: harbor.internal.com
http:
  port: 80
  relativeurls: true
external_url: https://harbor.internal.com
harbor_admin_password: G3Sde1d2!
database:
  password: G3Sde1d2!
  max_idle_conns: 100
  max_open_conns: 900
  conn_max_lifetime: 5m
  conn_max_idle_time: 0
data_volume: /data
storage_service:
  s3:
    accesskey: TR6N5GVW8DGAWFKWODOO
    secretkey: izNj6lKxFbjdsvpk1dJFKGnqqvjhTD762tzshybQ
    region: us-east-1
    regionendpoint: https://oss.internal.com
    bucket: harbor
    multipartcopythresholdsize: "5368709120"
trivy:
  ignore_unfixed: false
  skip_update: false
  offline_scan: false
  security_check: vuln
  insecure: false
jobservice:
  max_job_workers: 10
  logger_sweeper_duration: 1 
notification:
  webhook_job_max_retry: 3
  webhook_job_http_client_timeout: 3 
log:
  level: info
  local:
    rotate_count: 50
    rotate_size: 200M
    location: /var/log/harbor
_version: 2.8.0
external_redis:
  host: 10.10.101.17:6379
  password: G3Sde1d2
  registry_db_index: 1
  jobservice_db_index: 2
  trivy_db_index: 5
  idle_timeout_seconds: 30
proxy:
  http_proxy:
  https_proxy:
  no_proxy:
  components:
    - core
    - jobservice
    - trivy
metric:
  enabled: false
  port: 9090
  path: /metrics
upload_purging:
  enabled: true
  age: 168h
  interval: 24h
  dryrun: false
cache:
  enabled: false
  expire_hours: 24

helm push loki-5.8.9.tgz  oci://harbor.internal.com/library
Error: failed commit on ref "unknown-sha256:27f6b31d6e9884505825a54c2eea1428a2cd0edf834ce3e1d2d2fb5670638de7": unexpected status: 401 Unauthorized

nginx              | 192.168.2.237 - "HEAD /v2/library/loki/blobs/sha256:8ef1d433ae2a02b609865fd016982d1c22c4efc2cccac424e13cd29730732341 HTTP/1.1" 401 0 "-" "Helm/3.10.0" 0.002 0.002 .
nginx              | 192.168.2.237 - "HEAD /v2/library/loki/blobs/sha256:27f6b31d6e9884505825a54c2eea1428a2cd0edf834ce3e1d2d2fb5670638de7 HTTP/1.1" 401 0 "-" "Helm/3.10.0" 0.001 0.001 .
nginx              | 192.168.2.237 - "POST /service/token HTTP/1.1" 405 19 "-" "Helm/3.10.0" 0.001 0.001 .
nginx              | 192.168.2.237 - "GET /service/token?scope=repository%3Alibrary%2Floki%3Apull&scope=repository%3Alibrary%2Floki%3Apull%2Cpush&service=harbor-registry HTTP/1.1" 200 1050 "-" "Helm/3.10.0" 0.025 0.025 .
nginx              | 192.168.2.237 - "HEAD /v2/library/loki/blobs/sha256:8ef1d433ae2a02b609865fd016982d1c22c4efc2cccac424e13cd29730732341 HTTP/1.1" 404 0 "-" "Helm/3.10.0" 0.005 0.005 .
nginx              | 192.168.2.237 - "HEAD /v2/library/loki/blobs/sha256:27f6b31d6e9884505825a54c2eea1428a2cd0edf834ce3e1d2d2fb5670638de7 HTTP/1.1" 404 0 "-" "Helm/3.10.0" 0.005 0.005 .
registry           | time="2023-07-12T01:24:26.203782556Z" level=info msg="authorized request" go.version=go1.20.4 http.request.host=harbor.internal.com http.request.id=29e485f6-5520-45ed-b158-2ca71a4c10ee http.request.method=POST http.request.remoteaddr=10.0.1.1 http.request.uri="/v2/library/loki/blobs/uploads/" http.request.useragent="Helm/3.10.0" vars.name="library/loki"
registry           | time="2023-07-12T01:24:26.205083779Z" level=info msg="authorized request" go.version=go1.20.4 http.request.host=harbor.internal.com http.request.id=9a4cc5bf-9d9f-42d7-81e5-084f32296824 http.request.method=POST http.request.remoteaddr=10.0.1.1 http.request.uri="/v2/library/loki/blobs/uploads/" http.request.useragent="Helm/3.10.0" vars.name="library/loki"
registry           | time="2023-07-12T01:24:26.964477415Z" level=info msg="response completed" go.version=go1.20.4 http.request.host=harbor.internal.com http.request.id=29e485f6-5520-45ed-b158-2ca71a4c10ee http.request.method=POST http.request.remoteaddr=10.0.1.1 http.request.uri="/v2/library/loki/blobs/uploads/" http.request.useragent="Helm/3.10.0" http.response.duration=765.284815ms http.response.status=202 http.response.written=0
registry           | 172.18.0.8 - - [12/Jul/2023:01:24:26 +0000] "POST /v2/library/loki/blobs/uploads/ HTTP/1.1" 202 0 "" "Helm/3.10.0"
nginx              | 192.168.2.237 - "POST /v2/library/loki/blobs/uploads/ HTTP/1.1" 202 0 "-" "Helm/3.10.0" 0.774 0.774 .
nginx              | 192.168.2.237 - "GET /v2/library/loki/blobs/uploads/19e4005e-c0db-491f-ad88-4b573a80d238?_state=AmRRRvjIat0rebllJMY6uf-dWsKHDdPsICQ_jzTXbFR7Ik5hbWUiOiJsaWJyYXJ5L2xva2kiLCJVVUlEIjoiMTllNDAwNWUtYzBkYi00OTFmLWFkODgtNGI1NzNhODBkMjM4IiwiT2Zmc2V0IjowLCJTdGFydGVkQXQiOiIyMDIzLTA3LTEyVDAxOjI0OjI2LjIwMzg5Mzk3MloifQ%3D%3D&digest=sha256%3A8ef1d433ae2a02b609865fd016982d1c22c4efc2cccac424e13cd29730732341 HTTP/1.1" 401 152 "http://harbor.internal.com/v2/library/loki/blobs/uploads/19e4005e-c0db-491f-ad88-4b573a80d238?_state=AmRRRvjIat0rebllJMY6uf-dWsKHDdPsICQ_jzTXbFR7Ik5hbWUiOiJsaWJyYXJ5L2xva2kiLCJVVUlEIjoiMTllNDAwNWUtYzBkYi00OTFmLWFkODgtNGI1NzNhODBkMjM4IiwiT2Zmc2V0IjowLCJTdGFydGVkQXQiOiIyMDIzLTA3LTEyVDAxOjI0OjI2LjIwMzg5Mzk3MloifQ%3D%3D&digest=sha256%3A8ef1d433ae2a02b609865fd016982d1c22c4efc2cccac424e13cd29730732341" "Helm/3.10.0" 0.002 0.002 .
nginx              | 192.168.2.237 - "POST /v2/library/loki/blobs/uploads/ HTTP/1.1" 499 0 "-" "Helm/3.10.0" 0.797 0.797 .
harbor-core        | 2023/07/12 01:24:26 http: proxy error: context canceled
registry           | time="2023-07-12T01:24:27.126936123Z" level=info msg="response completed" go.version=go1.20.4 http.request.host=harbor.internal.com http.request.id=9a4cc5bf-9d9f-42d7-81e5-084f32296824 http.request.method=POST http.request.remoteaddr=10.0.1.1 http.request.uri="/v2/library/loki/blobs/uploads/" http.request.useragent="Helm/3.10.0" http.response.duration=927.980067ms http.response.status=202 http.response.written=0
registry           | 172.18.0.8 - - [12/Jul/2023:01:24:26 +0000] "POST /v2/library/loki/blobs/uploads/ HTTP/1.1" 202 0 "" "Helm/3.10.0"
registry           | 172.18.0.8 - - [12/Jul/2023:01:24:29 +0000] "GET / HTTP/1.1" 200 0 "" "Go-http-client/1.1"
harbor-portal      | 172.18.0.8 - - [12/Jul/2023:01:24:29 +0000] "GET / HTTP/1.1" 200 785 "-" "Go-http-client/1.1"
registryctl        | 172.18.0.8 - - [12/Jul/2023:01:24:29 +0000] "GET /api/health HTTP/1.1" 200 9

SmallGaoX commented 1 year ago

who can save me

谁能救我

nginx --> harbor

harbor.yml

hostname: harbor.internal.com
http:
  port: 80
  relativeurls: true
external_url: https://harbor.internal.com
harbor_admin_password: G3Sde1d2!
database:
  password: G3Sde1d2!
  max_idle_conns: 100
  max_open_conns: 900
  conn_max_lifetime: 5m
  conn_max_idle_time: 0
data_volume: /data
storage_service:
  s3:
    accesskey: TR6N5GVW8DGAWFKWODOO
    secretkey: izNj6lKxFbjdsvpk1dJFKGnqqvjhTD762tzshybQ
    region: us-east-1
    regionendpoint: https://oss.internal.com
    bucket: harbor
    multipartcopythresholdsize: "5368709120"
trivy:
  ignore_unfixed: false
  skip_update: false
  offline_scan: false
  security_check: vuln
  insecure: false
jobservice:
  max_job_workers: 10
  logger_sweeper_duration: 1 
notification:
  webhook_job_max_retry: 3
  webhook_job_http_client_timeout: 3 
log:
  level: info
  local:
    rotate_count: 50
    rotate_size: 200M
    location: /var/log/harbor
_version: 2.8.0
external_redis:
  host: 10.10.101.17:6379
  password: G3Sde1d2
  registry_db_index: 1
  jobservice_db_index: 2
  trivy_db_index: 5
  idle_timeout_seconds: 30
proxy:
  http_proxy:
  https_proxy:
  no_proxy:
  components:
    - core
    - jobservice
    - trivy
metric:
  enabled: false
  port: 9090
  path: /metrics
upload_purging:
  enabled: true
  age: 168h
  interval: 24h
  dryrun: false
cache:
  enabled: false
  expire_hours: 24

helm push loki-5.8.9.tgz  oci://harbor.internal.com/library
Error: failed commit on ref "unknown-sha256:27f6b31d6e9884505825a54c2eea1428a2cd0edf834ce3e1d2d2fb5670638de7": unexpected status: 401 Unauthorized

nginx              | 192.168.2.237 - "HEAD /v2/library/loki/blobs/sha256:8ef1d433ae2a02b609865fd016982d1c22c4efc2cccac424e13cd29730732341 HTTP/1.1" 401 0 "-" "Helm/3.10.0" 0.002 0.002 .
nginx              | 192.168.2.237 - "HEAD /v2/library/loki/blobs/sha256:27f6b31d6e9884505825a54c2eea1428a2cd0edf834ce3e1d2d2fb5670638de7 HTTP/1.1" 401 0 "-" "Helm/3.10.0" 0.001 0.001 .
nginx              | 192.168.2.237 - "POST /service/token HTTP/1.1" 405 19 "-" "Helm/3.10.0" 0.001 0.001 .
nginx              | 192.168.2.237 - "GET /service/token?scope=repository%3Alibrary%2Floki%3Apull&scope=repository%3Alibrary%2Floki%3Apull%2Cpush&service=harbor-registry HTTP/1.1" 200 1050 "-" "Helm/3.10.0" 0.025 0.025 .
nginx              | 192.168.2.237 - "HEAD /v2/library/loki/blobs/sha256:8ef1d433ae2a02b609865fd016982d1c22c4efc2cccac424e13cd29730732341 HTTP/1.1" 404 0 "-" "Helm/3.10.0" 0.005 0.005 .
nginx              | 192.168.2.237 - "HEAD /v2/library/loki/blobs/sha256:27f6b31d6e9884505825a54c2eea1428a2cd0edf834ce3e1d2d2fb5670638de7 HTTP/1.1" 404 0 "-" "Helm/3.10.0" 0.005 0.005 .
registry           | time="2023-07-12T01:24:26.203782556Z" level=info msg="authorized request" go.version=go1.20.4 http.request.host=harbor.internal.com http.request.id=29e485f6-5520-45ed-b158-2ca71a4c10ee http.request.method=POST http.request.remoteaddr=10.0.1.1 http.request.uri="/v2/library/loki/blobs/uploads/" http.request.useragent="Helm/3.10.0" vars.name="library/loki"
registry           | time="2023-07-12T01:24:26.205083779Z" level=info msg="authorized request" go.version=go1.20.4 http.request.host=harbor.internal.com http.request.id=9a4cc5bf-9d9f-42d7-81e5-084f32296824 http.request.method=POST http.request.remoteaddr=10.0.1.1 http.request.uri="/v2/library/loki/blobs/uploads/" http.request.useragent="Helm/3.10.0" vars.name="library/loki"
registry           | time="2023-07-12T01:24:26.964477415Z" level=info msg="response completed" go.version=go1.20.4 http.request.host=harbor.internal.com http.request.id=29e485f6-5520-45ed-b158-2ca71a4c10ee http.request.method=POST http.request.remoteaddr=10.0.1.1 http.request.uri="/v2/library/loki/blobs/uploads/" http.request.useragent="Helm/3.10.0" http.response.duration=765.284815ms http.response.status=202 http.response.written=0
registry           | 172.18.0.8 - - [12/Jul/2023:01:24:26 +0000] "POST /v2/library/loki/blobs/uploads/ HTTP/1.1" 202 0 "" "Helm/3.10.0"
nginx              | 192.168.2.237 - "POST /v2/library/loki/blobs/uploads/ HTTP/1.1" 202 0 "-" "Helm/3.10.0" 0.774 0.774 .
nginx              | 192.168.2.237 - "GET /v2/library/loki/blobs/uploads/19e4005e-c0db-491f-ad88-4b573a80d238?_state=AmRRRvjIat0rebllJMY6uf-dWsKHDdPsICQ_jzTXbFR7Ik5hbWUiOiJsaWJyYXJ5L2xva2kiLCJVVUlEIjoiMTllNDAwNWUtYzBkYi00OTFmLWFkODgtNGI1NzNhODBkMjM4IiwiT2Zmc2V0IjowLCJTdGFydGVkQXQiOiIyMDIzLTA3LTEyVDAxOjI0OjI2LjIwMzg5Mzk3MloifQ%3D%3D&digest=sha256%3A8ef1d433ae2a02b609865fd016982d1c22c4efc2cccac424e13cd29730732341 HTTP/1.1" 401 152 "http://harbor.internal.com/v2/library/loki/blobs/uploads/19e4005e-c0db-491f-ad88-4b573a80d238?_state=AmRRRvjIat0rebllJMY6uf-dWsKHDdPsICQ_jzTXbFR7Ik5hbWUiOiJsaWJyYXJ5L2xva2kiLCJVVUlEIjoiMTllNDAwNWUtYzBkYi00OTFmLWFkODgtNGI1NzNhODBkMjM4IiwiT2Zmc2V0IjowLCJTdGFydGVkQXQiOiIyMDIzLTA3LTEyVDAxOjI0OjI2LjIwMzg5Mzk3MloifQ%3D%3D&digest=sha256%3A8ef1d433ae2a02b609865fd016982d1c22c4efc2cccac424e13cd29730732341" "Helm/3.10.0" 0.002 0.002 .
nginx              | 192.168.2.237 - "POST /v2/library/loki/blobs/uploads/ HTTP/1.1" 499 0 "-" "Helm/3.10.0" 0.797 0.797 .
harbor-core        | 2023/07/12 01:24:26 http: proxy error: context canceled
registry           | time="2023-07-12T01:24:27.126936123Z" level=info msg="response completed" go.version=go1.20.4 http.request.host=harbor.internal.com http.request.id=9a4cc5bf-9d9f-42d7-81e5-084f32296824 http.request.method=POST http.request.remoteaddr=10.0.1.1 http.request.uri="/v2/library/loki/blobs/uploads/" http.request.useragent="Helm/3.10.0" http.response.duration=927.980067ms http.response.status=202 http.response.written=0
registry           | 172.18.0.8 - - [12/Jul/2023:01:24:26 +0000] "POST /v2/library/loki/blobs/uploads/ HTTP/1.1" 202 0 "" "Helm/3.10.0"
registry           | 172.18.0.8 - - [12/Jul/2023:01:24:29 +0000] "GET / HTTP/1.1" 200 0 "" "Go-http-client/1.1"
harbor-portal      | 172.18.0.8 - - [12/Jul/2023:01:24:29 +0000] "GET / HTTP/1.1" 200 785 "-" "Go-http-client/1.1"
registryctl        | 172.18.0.8 - - [12/Jul/2023:01:24:29 +0000] "GET /api/health HTTP/1.1" 200 9

The error message of harbor-core

harbor-core        | 2023/07/12 01:24:26 http: proxy error: context canceled

I'm already logged in

helm registry login harbor.internal.com --username admin

goharbor / harbor

http: proxy error: context canceled #18484

Configuration file of Harbor

The IP address or hostname to access admin UI and registry service.

DO NOT use localhost or 127.0.0.1, because Harbor needs to be accessed by external clients.

http related config

http:

port for http, default is 80. If https enabled, this port will redirect to https port

port: 80

https related config

https port for harbor, default is 443

The path of cert and key files for nginx

certificate: /etc/docker/certs.d/192.168.1.94/192.168.1.94.cert

private_key: /etc/docker/certs.d/192.168.1.94/192.168.1.94.key

Uncomment following will enable tls communication between all harbor components

internal_tls:

set enabled to true means internal tls is enabled

enabled: true

put your cert and key files on dir

dir: /etc/harbor/tls/internal

Uncomment external_url if you want to enable external proxy

And when it enabled the hostname will no longer used

external_url: https://reg.mydomain.com:8433

The initial password of Harbor admin

It only works in first time to install harbor

Remember Change the admin password from UI after launching Harbor.

Harbor DB configuration

The password for the root user of Harbor DB. Change this before any production use.

The maximum number of connections in the idle connection pool. If it <=0, no idle connections are retained.

The maximum number of open connections to the database. If it <= 0, then there is no limit on the number of open connections.

Note: the default number of connections is 1024 for postgres of harbor.

The default data volume

Harbor Storage settings by default is using /data dir on local filesystem

Uncomment storage_service setting If you want to using external storage

storage_service:

ca_bundle is the path to the custom root ca certificate, which will be injected into the truststore

of registry's and chart repository's containers. This is usually needed when the user hosts a internal storage with self signed certificate.

ca_bundle:

storage backend, default is filesystem, options include filesystem, azure, gcs, s3, swift and oss

for more info about this configuration please refer https://docs.docker.com/registry/configuration/

filesystem:

maxthreads: 100

set disable to true when you want to disable registry redirect

redirect:

disabled: false

Trivy configuration

Trivy DB contains vulnerability information from NVD, Red Hat, and many other upstream vulnerability databases.

It is downloaded by Trivy from the GitHub release page https://github.com/aquasecurity/trivy-db/releases and cached

in the local file system. In addition, the database contains the update timestamp so Trivy can detect whether it

should download a newer version from the Internet or use the cached one. Currently, the database is updated every

12 hours and published as a new release to GitHub.

ignoreUnfixed The flag to display only fixed vulnerabilities

skipUpdate The flag to enable or disable Trivy DB downloads from GitHub

You might want to enable this flag in test or CI/CD environments to avoid GitHub rate limiting issues.

If the flag is enabled you have to download the trivy-offline.tar.gz archive manually, extract trivy.db and

metadata.json files and mount them in the /home/scanner/.cache/trivy/db path.

The offline_scan option prevents Trivy from sending API requests to identify dependencies.

Scanning JAR files and pom.xml may require Internet access for better detection, but this option tries to avoid it.

For example, the offline mode will not try to resolve transitive dependencies in pom.xml when the dependency doesn't

exist in the local repositories. It means a number of detected vulnerabilities might be fewer in offline mode.

It would work if all the dependencies are in local.

This option doesn’t affect DB download. You need to specify "skip-update" as well as "offline-scan" in an air-gapped environment.

insecure The flag to skip verifying registry certificate

github_token The GitHub access token to download Trivy DB

Anonymous downloads from GitHub are subject to the limit of 60 requests per hour. Normally such rate limit is enough

for production operations. If, for any reason, it's not enough, you could increase the rate limit to 5000

requests per hour by specifying the GitHub access token. For more details on GitHub rate limiting please consult

https://developer.github.com/v3/#rate-limiting

You can create a GitHub token by following the instructions in

https://help.github.com/en/github/authenticating-to-github/creating-a-personal-access-token-for-the-command-line

github_token: xxx

Maximum number of job workers in job service

Maximum retry count for webhook job

Change the value of absolute_url to enabled can enable absolute url in chart

Log configurations

options are debug, info, warning, error, fatal

configs for logs in local storage

Log files are rotated log_rotate_count times before being removed. If count is 0, old versions are removed rather than rotated.

Uncomment following lines to enable external syslog endpoint.

external_endpoint:

If the flag is enabled you have to download the `trivy-offline.tar.gz` archive manually, extract `trivy.db` and

`metadata.json` files and mount them in the `/home/scanner/.cache/trivy/db` path.

Remove component from `components` array if want disable proxy

for core and jobservice, and set `http_proxy` and `https_proxy`.

Add domain to the `no_proxy` field, when you want disable proxy