skills.rest
Probably-Group
Probably-GroupOFFICIAL
Explore all skills by this author →
Website𝕏@problynotingGitHub

harbor-expert

Secure Harbor registries with Trivy scanning, image signing verification, and RBAC isolation.

3|1|Updated Dec 3, 2025
Search Tags:#RBAC#container registry#replication#harbor#trivy scanning#cosign signing#CVE enforcement
One-click install
npx skills add https://github.com/Probably-Group/Dev-AID --skill harbor-expert-probably-group
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: harbor-expert
Source: https://github.com/Probably-Group/Dev-AID/tree/main/.dev-aid/skills/expert/harbor-expert
Command: npx skills add https://github.com/Probably-Group/Dev-AID --skill harbor-expert-probably-group

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill helps you deploy and operate a Harbor container registry securely by enforcing vulnerability scanning, image signing verification, least-privilege access controls, and safer replication practices.

Core Features & Use Cases

  • Harbor deployment hardening: Provide production-ready Helm configuration with TLS, externalized database/redis, resource limits, and restrictive security contexts.
  • Supply-chain security: Integrate Trivy vulnerability scanning, enforce blocking policies for high/critical CVEs, and require image signature verification (Cosign/Notary) before use.
  • Registry access control: Configure Harbor RBAC with project isolation and scoped robot accounts for CI/CD (no admin credentials in pipelines).
  • Secure replication: Set replication rules that replicate only what you intend using signed/filtered policies and verified endpoints over TLS.

Quick Start

Use this skill to generate a secure Harbor Helm values configuration for Harbor 2.9+ with Trivy scanning enabled, content trust enabled, TLS enforced, and OIDC-based authentication, tailored for a project named production.

Frequently Asked Questions about harbor-expert

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I configure Harbor to block deployments of images with critical CVEs?▼

You can enforce image security in Harbor by integrating Trivy scanning and configuring strict blocking policies that prevent pulling images with high or critical CVEs.

Can I enforce Cosign image signature verification in a Harbor container registry?▼

Yes, Harbor supports content trust by enforcing Cosign or Notary image signature verification, ensuring only cryptographically signed images are pulled within your container registry environment.

What is the best way to set up least-privilege CI/CD robot accounts in Harbor?▼

The best way to secure CI/CD pipelines is configuring Harbor RBAC with project isolation and scoped robot accounts, avoiding the use of admin credentials in automated workflows.

Does this Harbor hardening approach support multi-region replication rules?▼

Yes, this approach secures Harbor multi-region distribution by creating filtered replication rules over TLS-only connectivity, ensuring disaster recovery syncs only verified and intended images.

Do I need Helm to deploy a hardened Harbor 2.9 container registry?▼

Yes, deploying a production-ready Harbor 2.9+ registry requires Helm to configure TLS, externalized databases, resource limits, and restrictive security contexts for proper deployment hardening.

Related Skills

Explore More Software Engineering Skills→
pytorchpytorch
17

osdc-harbor

Configure and troubleshoot Harbor pull-through caching for IPv6-only EKS Kubernetes clusters.

Official
Advanced
abhijeetkakade1234abhijeetkakade1234
1

container-kubernetes-security-audit

Identify and remediate security misconfigurations in container images, Kubernetes workloads, and RBAC policies.

Community
Advanced
MayaDispelerMayaDispeler
3

devsecops

Apply security checks across CI/CD pipelines with GitLeaks, Semgrep, Snyk, Trivy, and cosign.

Community
Advanced
martinholovskymartinholovsky
45

harbor-expert

Administer Harbor container registries with Trivy scanning, RBAC, and replication.

Community
Advanced