Awesome Open Source
Awesome Open Source

Harbor Operator

CI Pipeline CodeQL Codacy Badge Go Reference


Harbor is a CNCF hosted open source trusted cloud-native registry project that stores, signs, and scans content. Harbor is composed on numerous stateful and stateless components and dependencies that may be deployed, updated, healed, backuped or scaled respecting some constraints.

The Harbor Operator provides an easy and solid solution to deploy and manage a full Harbor service stack including both the harbor service components and its relevant dependent services such as database, cache and storage services to the target Kubernetes clusters in a scalable and high-available way. The Harbor Operator defines a set of Harbor-related custom resources on top of Kubernetes Custom Resources. The Kubernetes API can then be used in a declarative way to manage Harbor deployment stack and ensure its scalability and high-availability operation, thanks to the Kubernetes control loop. The project harbor-operator aims to cover both Day1 and Day2 operations of an enterprise-grade Harbor deployment.


Harbor deployment stack is controlled by a custom Harbor resource HarborCluster. HarborCluster owns the custom resource Harbor that represents the Harbor own service stack, and the custom resources of the related dependent services (PostgreSQL, Redis and MinIO) that are required when deploying the full Harbor deployment stack.

  • Provides strong flexibility to deploy different stacks of Harbor cluster (identified by HarborCluster CR)
    • Minimal stack: only required Harbor components Core, Registry, Registry Controller, Job Service and Portal are provisioned.
    • Standard stack: the optional Harbor components Notary, Trivy, ChartMuseum and Metrics Exporter can be selected to enable.
    • Full stack: both the Harbor components (required+optional) and also the related dependent services including the database (PostgreSQL), cache (Redis) and storage (MinIO) can be deployed into the Kubernetes cluster together with a scalable and high-available way.
  • Supports configuring either external or in-cluster deployed dependent services
  • Supports a variety of backend storage configurations
    • [X] filesystem: A storage driver configured to use a directory tree in the a kubernetes volume.
    • [X] s3: A driver storing objects in an Amazon Simple Storage Service (S3) bucket.
    • [X] swift: A driver storing objects in Openstack Swift.
  • Supports updating the deployed Harbor cluster
    • Adjust replicas of components
    • Add the optional Harbor components
  • Support upgrading the managed Harbor registry version
  • Deletes all the linked resources when deleting the Harbor cluster
  • Configures Harbor system settings with CRD-based configuration or labeled ConfigMap
  • Support services exposed with ingress (default, gce, ncp and contour)
  • Support services exposed with LoadBalancer

Future features

  • Auto-scaling for each component.
  • Backup/restore data (registry layer, chartmuseum data, databases content).
  • More backend storage configurations supported
    • [ ] azure: A driver storing objects in Microsoft Azure Blob Storage.
    • [ ] oss: A driver storing objects in Aliyun OSS.
    • [ ] gcs: A driver storing objects in a Google Cloud Storage bucket.
  • Supports updating the deployed Harbor cluster
    • Remove the optional Harbor components
  • More day2 operations (see PoC project)
    • Auto mapping Kubernetes namespaces and Harbor project
    • Pull secrets injections
    • Container image path rewriting
    • Transparent proxy cache settings

Release plans

Getting started

For a quick first try follow the instructions of this tutorial.


Versions of the underlying components are listed below:

Components Harbor MinIO operator PostgreSQL operator Redis operator
Versions 2.3.x [1] 4.0.6+ 1.5.0+ 1.0.0


[1] .x means all the patch releases of Harbor can be naturally supported in one operator version.


Applicative Kubernetes versions

Harbor operator supports two extra Kubernetes versions besides the current latest version (n-2 pattern):

Versions 1.19 1.20 1.21
Compatibility ✔️ ✔️ ✔️

Cert manager versions

Harbor operator relies on cert manager to manage kinds of certificates used by Harbor cluster components. Table shown below lists the compatibilities of cert manager versions:

Versions 1.2 1.3 1.4
Compatibility ✔️ ✔️ ✔️

Ingress controller types

Harbor operator exposes the frontend service with ingress (CRD version: v1beta1). Table shown below lists the ingress controller types supported.

Ingress Controller Compatibility Description
default ✔️ Default ingress controller like NGINX
gce ✔️ Google Cloud Engine ingress controller
ncp ✔️ NSX-T Container plugin ingress controller
contour ✔️ Ingress controller that works by deploying the Envoy proxy


✔️ : support ✖️ : not support ⭕️ : not verified (probably support)



Harbor operator project is developed and maintained by the Harbor operator workgroup. If you're willing to join the group and do contributions to operator project, welcome to contact us. Follow the Development guide to start on the project.

Special thanks to the contributors who did significant contributions.


Additional references

Related links


The operator was initially developed by OVHcloud and donated to the Harbor community as one of its governing projects in March 2020, becoming the basis of the official Harbor Operator.

OVHcloud uses the operator at scale to operate part of its private registry service. But the operator was designed in an agnostic way and it's continuing to evolve into a more pervasive architecture to bring values to any companies in search of deploying and managing one or multiple Harbor.


See LICENSE for licensing details.

Get A Weekly Email With Trending Projects For These Topics
No Spam. Unsubscribe easily at any time.
Go (194,022
Kubernetes (11,192
Operator (551
Kubernetes Operator (305
Related Projects