๐ก Harbor Container Registry T-Shoot & Recovery โ Executive Summary
Technical architectural analysis, practical configuration manifests, and deployment instructions for Harbor Container Registry T-Shoot & Recovery.
When: docker push
Issue: unknown blob (
bash
docker push my-harbor/base/ubuntu:latest
>>>
The push refers to repository [my-harbor/base/ubuntu]
a46a5fb872b5: Pushing [==================================================>] 80.62MB
unknown blobGiven
- Use Bitnami Helmchart (https://github.com/bitnami/charts/tree/main/bitnami/harbor)
values.yamlexposureType: ingressnginx.tls.enabled: truenginx.behindReverseProxy: false- It worked normally when hosting internally, but an error occurred when using a cloud load balancer
Root Cause
- When using a reverse proxy such as LB, the following HTTP Header must be removed from
nginx.conf proxy_set_header X-Forwarded-Proto $scheme;- For bitnami helmchart, there are template exceptions
templates/nginx/configmap-http.yaml
yaml
data:
nginx.conf: |+
...
{{- if not .Values.nginx.behindReverseProxy }}
proxy_set_header X-Forwarded-Proto $scheme;
{{- end }}Resolution
- [Error fix] change harbor exposure to proxy ยท myeong-han/playgrounds-fredric@0a01de9
values.yamlexposureType: proxynginx.tls.enabled: falsenginx.behindReverseProxy: true
- Change to NodePort service.
docker pushworking normally
Issue: 413 Request Entity Too Large (
bash
docker push my-harbor/n8n/n8n-base:debian
>>>
The push refers to repository [my-harbor/n8n/n8n-base]
f92f9df0c0a1: Pushing [==================================================>] 1.204GB
d8f1ee01d682: Layer already exists
c3b7ec7bda15: Layer already exists
5f3b966899d3: Layer already exists
c37a8863d35e: Layer already exists
7f0175a09165: Pushing [==================================================>] 569.7MB
9ea571566ff7: Layer already exists
8d6551b23d41: Layer already exists
8badcfdd9076: Layer already exists
unknown: <html>
<head><title>413 Request Entity Too Large</title></head>
<body>
<center><h1>413 Request Entity Too Large</h1></center>
<hr><center>cloudflare</center>
<script>(function(){function c(){var b=a.contentDocument||a.contentWindow.document;if(b){var d=b.createElement('script');d.innerHTML="window.__CF$cv$params={r:'8db2408d5dcfdd55',t:'MTczMDM2MzE1OS4wMDAwMDA='};var a=document.createElement('script');a.nonce='';a.src='/cdn-cgi/challenge-platform/scripts/jsd/main.js';document.getElementsByTagName('head')[0].appendChild(a);";b.getElementsByTagName('head')[0].appendChild(d)}}if(document.body){var a=document.createElement('iframe');a.height=1;a.width=1;a.style.position='absolute';a.style.top=0;a.style.left=0;a.style.border='none';a.style.visibility='hidden';document.body.appendChild(a);if('loading'!==document.readyState)c();else if(window.addEventListener)document.addEventListener('DOMContentLoaded',c);else{var e=document.onreadystatechange||function(){};document.onreadystatechange=function(b){e(b);'loading'!==document.readyState&&(document.onreadystatechange=e,c())}}}})();</script></body>
</html>Given
- Use Bitnami Helmchart (https://github.com/bitnami/charts/tree/main/bitnami/harbor)
- Proxied using Cloudflare free plan CDN service
- Problem identified when
pushof large images exceeding 1GB in size
Root Cause
- Cloudflare free plan has maximum upload size limited to 100MB
- Because it is a CDN service, there are upload restrictions.
- When using only DNS, there are no restrictions as Cloudflare is not responsible for network traffic.
- Key differences when not using a CDN:
- Port forwarding is not possible, so a reverse proxy is needed.
- TLS is not automatically applied, so you need to manage it yourself
Plan
- Expose reverse proxy LB to NodePort for TLS application and service routing
- TLS can be managed with Certmanager.
- General purpose LB for internal TCP routing
- Register routing as harbor service route
- Use IPTime to forward machine public IP and DDNS port 80 to reverse proxy LB
- Register IPTime DDNS to harbor domain with Cloudflare CNAME as DNS Only (proxy off)
Resolution //TODO
Leave a Reply