harbor-terraform

Files (1)

• SKILL.md

SKILL.md (first lines)

# Harbor Terraform Provider

Provider: `goharbor/harbor`. Latest: **v3.12.0** (Jun 4, 2026). Registry: `v3.11.6` (Apr 22, 2026). Source: `github.com/goharbor/terraform-provider-harbor`.

Tested against: Harbor 2.13–2.15, Terraform 1.12–1.14.

## Provider Config

```hcl
terraform {
  required_providers {
    harbor = {
      source  = "goharbor/harbor"
      version = "~> 3.11"
    }
  }
}

provider "harbor" {
  url       = "https://harbor.example.com"
  username  = "admin"
  password  = var.harbor_password
  insecure  = false    # Verify TLS (default: true — must explicitly set false)
}
```

### Auth Methods
| Method | Fields | Env Var |
|--------|--------|---------|
| Basic | `username` + `password` | `HARBOR_USERNAME`, `HARBOR_PASSWORD` |
| Bearer Token | `bearer_token` | — |
| OIDC Session | `session_id` | `HARBOR_SESSION_ID` |

`api_version` (default: 2) — use 1 for Harbor pre-2.0. `robot_prefix` — auto-detected via admin API unless explicitly set.

## Resources (20)

### Projects

```hcl
resource "harbor_project" "myapp" {
  name                   = "myapp"
  public                 = false
  vulnerability_scanning = true
  vulnerability_scanner  = "Trivy"             # v3.11.6+: per-project scanner override
  enable_content_trust   = true                # Notary
  enable_content_trust_cosign = false          # Cosign signatures
  auto_sbom_generation   = true                # Harbor 2.11+ SBOM on push
  storage_quota          = 100                 # GB
  deployment_security    = "high"              # Block images >= this severity
  cve_allowlist          = ["CVE-1234"]
  force_destroy          = false               # Allow destroy even with repos
}

# Proxy cache project
resource "harbor_registry" "dockerhub" {
  provider_name = "docker-hub"
  name          = "dockerhub-proxy"
  endpoint_url  = "https://hub.docker.com"
}

resource "harbor_project" "proxy" {
  name                           = "docker-proxy"
  registry_id                    = harbor_registry.dockerhub.registry_id
  proxy_speed_kb                 = -1
  proxy_cache_local_on_not_found = true   # Harbor 2.15.1+
}
```

### Robot Accounts

```hcl
# System-level
resource "harbor_robot_account" "system" {
  name        = "ci-system"
  description = "System-level CI robot"
  level       = "system"
  secret      = random_password.robot.result
  permissions {
    kind      = "project"
    namespace = "*"    # All projects
    access {
      resource = "repository"
      action   = "pull"
    }
  }
}

# Project-level
resource "harbor_robot_account" "deploy" {
  name        = "ci-deploy"
  description = "Deploy robot for myapp"
  level       = "project"
  permissions {
    kind      = "project"
    namespace = harbor_project.myapp.name
    access {
      resource = "repository"
      action   = "pull"
    }
    access {
      resource = "repository"
      action   = "push"
    }
  }
}
```

### Replication

```hcl
resource "harbor_replication" "backup" {
  name        = "replicate-to-dr"
  description = "Replicate myapp to DR site"
  registry_id = harbor_registry.dr.registry_id
  destination = "harbor"
  filters {
    name_filter = "myapp/**"
    resource    = "image"

From Aidas-dev/k8s-agent-skills, MIT.

More from Aidas-dev/k8s-agent-skills