harbor

Chart · Datastore · standard · v0.0.49

digest pinnedcosign signedSPDX SBOMSLSA provenanceamd64 · arm64

Hardened harbor image, built from source on Wolfi.

Version

The latest line lives at the base page; older lines have their own page so you can pin and verify exactly that version. Only the most recent releases are listed — an older chart pins an older image digest.

Deployed image digest

sha256:d7a668b8d8a9d9db4f99eee3a3b63b7dcfbc2933f59dc58992ce17d003068749

Chart OCI version

oci://ghcr.io/quenchworks/charts/harbor:0.0.49

The chart pins its image by this signed digest, so you never track it yourself. Signatures, SBOM, and provenance attach to the same digest.

Signed

cosign keyless

SBOM

SPDX, on image

Provenance

SLSA build

Architectures

amd64, arm64

Runs as

nonroot (uid 1001)

Root filesystem

read-only

Install the chart

Deploy to Kubernetes with hardened defaults. The chart pins its image by signed digest, so you never track it yourself.

Install (latest)

helm install my-harbor oci://ghcr.io/quenchworks/charts/harbor --version 0.0.49

Deploys images (digest-pinned)

harbor-core2.15.4
D
ghcr.io/quenchworks/images/harbor-core@sha256:d7a668b8d8a9d9db4f99eee3a3b63b7dcfbc2933f59dc58992ce17d003068749
harbor-jobservice2.15.4
D
ghcr.io/quenchworks/images/harbor-jobservice@sha256:1a17697e5c177455e6eabd8c17de0163b08b368faf7160e85a9d2d9ed8e6bc74
harbor-registry2.15.4
D
ghcr.io/quenchworks/images/harbor-registry@sha256:c137c2ef05ea2a9598a344a74e427da68db2596e6167339711a79ab2b2a47aec
harbor-registryctl2.15.4
D
ghcr.io/quenchworks/images/harbor-registryctl@sha256:f3135e0e033151d9b3c89572470d8b8f42992c56a7ec14432456eacf45fe4c42
harbor-portal2.15.4
A+
ghcr.io/quenchworks/images/harbor-portal@sha256:3ff850c14d49d31a0f4a9d4a91ee54e17053d5b267e2dec016f0818e974be522
harbor-trivy-adapter2.15.4
D
ghcr.io/quenchworks/images/harbor-trivy-adapter@sha256:a54a322b7a216a4528a80caeebae4f87573456d6034da4ab589d446d47db4eee
harbor-exporter2.15.4
D
ghcr.io/quenchworks/images/harbor-exporter@sha256:d0c229d08e32a007d8c5f67a40398a0f9943a4f9879d123ba3496fff4520ecfa
nginx1.30.6
A+
ghcr.io/quenchworks/images/nginx@sha256:b104b20bcc1d2a7e0ee26086c3db8f51c2262cdd4d36fab9991602209ac6a7ce
busybox1.38.0
A+
ghcr.io/quenchworks/images/busybox@sha256:ca51f41cf97009e6913c4ea272879cffa6f8333a691839a3fa40eb7d16945d3a
postgresql18.6
B
ghcr.io/quenchworks/images/postgresql@sha256:42316ed44fa7722f611c35af6edb37882ceaac8c83f48a59735d329d5c12d977
valkey9.1.2
A+
ghcr.io/quenchworks/images/valkey@sha256:22b644a4aaef49828a48d2cc0b1753cf7a950dc6315dc2d34731012e2326ec4d

Chart version: 0.0.49
App version: 2.15.2
Chart license: Apache-2.0
App license: Unknown
Signed: cosign (keyless)
Values schema: yes
Last published: 2026-10-22

Values keys

images: pullPolicy core jobservice registry registryctl portal trivyAdapter exporter proxy busybox
nameOverride
logLevel
externalURL
auth: adminPassword
postgresql: enabled auth primary
externalDatabase: host port user password database sslmode existingSecret existingSecretPasswordKey
valkey: enabled auth primary
externalCache: host port password existingSecret existingSecretPasswordKey
redisDB: core registry jobservice cacheLayer trivyStore trivyJobQueue
persistence: enabled size storageClass accessModes
proxy: enabled replicaCount service resources
core: replicaCount service resources csrfTrustedOrigins
jobservice: replicaCount maxJobWorkers service resources
registry: replicaCount service resources registryctl
portal: replicaCount service resources
trivy: enabled debugMode insecure ignoreUnfixed skipUpdate offlineScan securityCheck dbRepository service persistence resources
metrics: enabled exporter core registry jobservice
ingress: enabled className host annotations tls
podLabels
podAnnotations
nodeSelector
affinity
tolerations
topologySpreadConstraints
priorityClassName
schedulerName
terminationGracePeriodSeconds
podSecurityContext
containerSecurityContext
serviceAccount: create name annotations
rbac: create
networkPolicy: enabled allowExternal
podDisruptionBudget: enabled minAvailable

Verify the chart

cosign verify ghcr.io/quenchworks/charts/harbor:0.0.49 \
  --certificate-identity-regexp 'https://github.com/quenchworks/.+' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Transparency

The chart publishes its attestations on GitHub and the image it deploys carries its own on the same digest, publicly verifiable with the commands above. Both log to the Sigstore transparency log (Rekor), which cosign verify checks for you.

View on ArtifactHub Chart source

Upstream project: https://quench-works.com