Create Docker Registry on for TRE/EGRESS level containers

[douglowe]

The VM's that will host our backend services do not have internet access. We need a container registry on the world-facing VM that they can use to pull down the required VMs.

[douglowe]

Let's go with Harbor for this, as it's what Swansea use. We will have one instance on the external facing VM, which will download all the container images we need. Then a second instance within the TRE infrastructure, which will mirror the external instance.

On the front VM the location of our install tool will be: /opt/Harbor/harbor

Instructions (heavily borrowed from chatGPT):

1. Use off-line installer for both installs, getting this from:
   • wget https://github.com/goharbor/harbor/releases/download/v2.15.0/harbor-offline-installer-v2.15.0.tgz
   • Note: get latest version number from https://github.com/goharbor/harbor/releases
2. Extract and enter harbor directory:
   • tar xvf harbor-offline-installer-v2.15.0.tgz
   • cd harbor

[douglowe]

Give docker your self-signed certs (see #63 for creation of these).

1. sudo mkdir -p /etc/docker/certs.d/10.99.53.84.sslip.io
2. Copy the file rootCA.crt to /etc/docker/certs.d/10.99.53.84.sslip.io/rootCA.crt
3. sudo systemctl restart docker

Note, I had followed https://goharbor.io/docs/2.14.0/install-config/configure-https/ - but this advises copying in more certificates than are actually needed. Only the root certificate should be required.

[douglowe]

Copy the harbor.yml.tmpl file to harbor.yml.

Edit these settings in that file (for DMZ harbor setup):

1. hostname: 10.99.53.84.sslip.io
2. certificate: /opt/Harbor/data/cert/harbor-dmz.crt
3. private_key: /opt/Harbor/data/cert/harbor-dmz.key
4. (database password) password: ***********
5. data_volume: /var/opt/harbor/data

Copy the harbor-dmz.crt and harbor-dmz.key files to the location /opt/Harbor/data/cert

[douglowe]

Install Harbor using sudo ./install.sh

[douglowe]

DMZ Harbor is available at: https://10.99.53.84.sslip.io/

Admin account is admin. Password has been reset for admin (after logging in using default password) - talk with Doug for this information.

[douglowe]

Harbor can be controlled using docker.

DMZ harbor - location /opt/Harbor/harbor

Start harbor: docker compose start
Stop harbor: docker compose stop

[douglowe]

Registry Endpoints. Following documentation at https://goharbor.io/docs/2.14.0/administration/configuring-replication/create-replication-endpoints/ we create the following replication endpoints:

• Harbor:
  • Settings:
    • Provider: Harbor
    • Name / Description: add as needed
    • Endpoint: https://
    • Verify Remote Cert: True
    • Access ID / Secret: leave blank
    • CA Certificate: leave empty
  • Services:
    • UK-SERP: harbor.ukserp.ac.uk
    • Fed-A: harbor.federated-analytics.ac.uk
• GHCR:
  • Settings:
    • Provider: Github GHCR
    • Name / Description: add as needed
    • Access ID / Secret: generate a GitHub access token with read permissions
• Docker Hub:
  • Settings:
    • Provider: Docker Hub
    • Name / Description: add as needed
    • Access ID / Secret: generate a DockerHub access token with read permissions
• Elastic Docker Reg:
  • Settings:
    • Provider: Docker Registry
    • Endpoint: https://docker.elastic.co
    • Verify Remote Cert: True
    • Access ID / Secret: leave blank
• Quay.io Docker Reg:
  • Settings:
    • Provider: Docker Registry
    • Endpoint: https://quay.io
    • Verify Remote Cert: True
    • Access ID / Secret: leave blank

[douglowe]

Replication rules. Following documentation at https://goharbor.io/docs/2.14.0/administration/configuring-replication/create-replication-rules/ we create the following replication rules:

• control-egress:
  • Replication mode: Pull-based
  • Source registry: UK-SERP
  • Source resource filter:
    • Name: dare-trefx/control-egress-{ui,api}
    • Tag: 3.*
• 5s-tes_agent:
  • Replication mode: Pull-based
  • Source registry: Fed-A
  • Source resource filter:
    • Name: 5s-tes/agent-{ui,web,api}
    • Tag: 1.7.*
• 5s-tes_submission:
  • Replication mode: Pull-based
  • Source registry: Fed-A
  • Source resource filter:
    • Name: 5s-tes/submission-{ui,api}
    • Tag: 1.7.*
• 5s-tes_creds:
  • Replication mode: Pull-based
  • Source registry: Fed-A
  • Source resource filter:
    • Name: 5s-tes/credentials-camunda
    • Tag: 1.7.*

I've completed 20 replication rules, for all the containers in the docker compose files. They are not all noted here, but are similar in setup.

When replicating remember to specify the tag - or you will pull a lot of files!