Harbor registry monitoring with Topologix

Infrastructure & Networking

A Harbor container registry (API v2.0) as a source of the software inventory: the images your clusters run — and, optionally, each repository's newest tag — with their Trivy scan reports. Each scanned image gets the scanner's vulnerable packages and its own verdicts (Software → Images, Vulnerabilities → By image), one row per CVE next to the advisory feeds' matches. Read-only: nothing is pulled and no scan is started.

Requirements

• Harbor 2.x with its Trivy scanner (the default interrogation service) — images must have been scanned in Harbor (scan on push, or a scheduled scan). Harbor 2.11+ also keeps an SBOM per image.
• A read-only robot account (or a user): project list, repository list + pull, artifact list + read, artifact-addition read, scan read (and SBOM read on 2.11+). The secret is sealed at rest.
• HTTPS reach to the registry from the Topologix server, or from a proxy agent picked on the integration (a proxied Harbor needs the proxy release that ships the Harbor kinds — the form says so).

1 · Set up the integration

1. Open the Integrations pageClick Integrations in the toolbar and pick Harbor registry from the catalogue.
2. Enter the URL and the accountThe Harbor URL (e.g. https://harbor.example.local), the robot account (robot$topologix) and its secret. Tick Allow self-signed certificate or paste the registry's CA certificate (PEM).
3. Choose what to importProjects (empty = every project the account sees — on a large registry name them: one list run has a 90-second budget and the repositories past it are never listed); Import: by default each repository's newest tag only when projects are named (without projects only the images your clusters run), or explicitly running + newest / running only; Max artifacts (1 000); the Architecture whose child report a multi-arch image uses (amd64); the interval (60 min); optionally a Proxy. The “In effect” line shows each value and whether it is saved or the default.
4. Create, then verifyClick Create, reopen it and click Test — it reports the Harbor version, how many projects the account sees, and whether SBOM accessories are available. A 401 is a wrong secret; a 403 a missing robot permission.

2 · Add it to a flow

1. No flow sourceHarbor has no metric source: the software inventory's import job reads it at most every interval. Its images appear in Infrastructure → Servers → Software → Images (“Runs on: the Harbor integration · project”) and its CVEs in Vulnerabilities → By image.
2. Check the importReopen the integration: the Last import line says when it ran, how many artifacts were listed and imported, and why anything was skipped.

Good to know

• An image a Kubernetes cluster's Trivy Operator already reports is not imported a second time: the cluster's report wins (Trivy Operator > Harbor), so one image is one row and at most one finding per CVE.
• With an SBOM accessory (Harbor 2.11+ — generate SBOMs in the project) an image gets its full component list, read through the sbom addition or the registry (the accessory's layer, with the registry's own token for the same account); without one it holds its vulnerable packages only, labelled so. The CVEs are the scanner's own (a “scanner” chip) — a known-exploited or critical one becomes a finding per image digest.
• Multi-arch images: the cluster runs the index digest, Harbor scans the platform children — the child of the configured architecture is the one read.
• Admin → Background workers holds the instance switch and caps shared with the Trivy Operator import (Software inventory: Trivy Operator import, reports read a run, scanned images kept).