Harbor and OVHcloud

Note

Included in the Pro and Business plans. On other plans, the CLI stops before scanning and the API refuses the upload (402).

OVHcloud Managed Private Registry is a Harbor. Two cases:

Harbor with Trivy (OVHcloud M and L plans)

Harbor scans images itself. Use the Harbor connection on the portal Integrations page: after each scan, Harbor notifies CheckOps (webhook “Scanning finished”) and CheckOps reads the report with a read-only robot account.

1. Create a robot account with the pull permission on the projects to follow.
2. Add the connection in the portal (registry address, for example https://xxxx.c1.gra9.container-registry.ovh.net, robot account, secret).
3. In each Harbor project, add a “Scanning finished” webhook rule to the displayed address, with the displayed authentication header (shown only once).
4. Enable Automatically scan images on push in the project configuration.
5. Click Reprendre l’existant (import existing): CheckOps reads the latest scanned image of each repository once (500 repositories at most per import).

Product = prefix + repository (acme/api becomes acme-api), application = Harbor project, version = tag.

Harbor without a scanner (OVHcloud S plan)

checkops harbor sync lists recently pushed images through the Harbor API, scans them with Trivy and sends the reports. Schedule it once a day (scheduled CI, Kubernetes CronJob):

docker run --rm \
  -e HARBOR_URL=https://xxxx.c1.gra9.container-registry.ovh.net \
  -e HARBOR_USERNAME='robot$checkops' -e HARBOR_PASSWORD -e CHECKOPS_TOKEN \
  registry.gitlab.com/clearcloud.fr/check-ops/cli:trivy \
  checkops harbor sync

The first time, add --all to take the latest image of each repository whatever its date. --dry-run lists the selected images without scanning or sending anything.

Option	Variable	Default	Purpose
--harbor-url	HARBOR_URL	—	Harbor address.
--username	HARBOR_USERNAME	—	Robot account (pull).
--password	HARBOR_PASSWORD	—	Robot account secret.
--project	CHECKOPS_HARBOR_PROJECT	all	Projects to follow.
--prefix	CHECKOPS_PRODUCT_PREFIX	—	Product prefix.
--since-hours	—	25	Images pushed within this delay.
--all	—	—	Ignore the delay.
--secrets	—	—	Also look for exposed secrets (Pro and Business plans).
--trivy	TRIVY_BIN	trivy	Trivy command.