Setting up a Harbor repository

The BMC Helix Innovation Suite platform and service management application container images are hosted on BMC Docker Trusted Registry (DTR) containers.bmc.com. You can access the platform and application container images in any of the following ways:

Method	Description
Access images directly from BMC DTR	Configure the deployment pipeline to access the images directly from BMC DTR by using the image access key. While performing the BMC Helix IT Service Management installation, based on the type in which you want to provide the deployment input configuration file, specify the parameter values: If you want to provide the deployment input configuration file manually, specify the values for the REGISTRY, IMAGE_REGISTRY_USERNAME, IMAGE_REGISTRY_PASSWORD, and IMAGEPULLSECRETS_NAME parameters in the deployment input configuration file. Learn about the deployment input configuration file at Inventory parameters in the deployment input configuration file. If you want to generate the deployment input configuration file automatically, specify the values for the REGISTRY_TYPE, HARBOR_REGISTRY_HOST, IMAGE_REGISTRY_USERNAME, IMAGE_REGISTRY_PASSWORD, and IMAGESECRET_NAME parameter in the HELIX_ONPREM_DEPLOYMENT Jenkins pipeline. Learn about the installation pipeline parameters at Performing the installation.
Access images from a local Harbor repository	Set up a Harbor repository, synchronize the Harbor repository with BMC DTR, and access the images from the local Harbor repository. Important: To synchronize the container images with BMC DTR, BMC validates using the open-source Harbor repository. You can choose any container repository solution that is compatible with the BMC Helix IT Service Management deployment. BMC does not anticipate any issues with alternative repositories. However, BMC does not provide support for alternative container repositories.
Access images from an air-gapped environment	See To access images from an air-gapped environment.

Important

Update your firewall policies to enable access to BMC DTR. Use the following fully qualified domain names:

containers.bmc.com
containers-glb.bmc.com
containers-irl.bmc.com
containers-msr-irl.bmc.com

Before you begin

Download the 210502_ITSM_Platform_Images.txt and 210502_ITSM_Smartapps_Images.txt files.
These files contain the list of images that are synchronized from BMC DTR. You can use these files to verify your Harbor repository after you synchronize it with BMC DTR.
Make sure that you have downloaded the key to access the container images from the BMC Electronic Product Distribution (EPD) site.

Make sure that your system meets the following requirements to set up your Harbor repository:

Requirement	Description
Hardware	Minimum 4 CPU with 8 GB memory and 250 GB disk space
Software	Docker Engine version 20.10.7 To install Docker Engine, see Install Docker Engine . Docker Compose version 1.29.2 To install Docker Compose, see Install Docker Compose . OpenSSL latest version Operating system CentOS 7/Red Hat 7
Network port	Harbor installation uses the following ports as the default ports: Port 443 with HTTPS protocol Port 4443 with HTTPS protocol Port 80 with HTTP protocol Learn about Harbor installation network port requirements at Harbor Installation Prerequisites .

To access container images from a local Harbor repository

Set up a Harbor repository and synchronize your Harbor repository with BMC DTR by using the access key. Perform the following actions to synchronize your Harbor repository with BMC DTR:

To create a Harbor registry

In your local system, download Harbor by using the following command:

wget https://github.com/goharbor/harbor/releases/download/v2.1.4/harbor-offline-installer-v2.1.4.tgz

Unzip the TAR file by using the following command:
```
tar xvzf harbor-offline-installer*.tgz
```
Navigate to the harbor directory by using the following command:
```
cd harbor
```
Copy the configuration template by using the following command:
```
cp harbor.yml.tmpl harbor.yml
```
Install Harbor.
- To install Harbor without using self signed SSL certificates, perform the following steps in the harbor.yml file:
  1. Update the values for the following parameters:
    - hostname—Name of system where you want to install Harbor.
      Specify a fully qualified domain name. For example, hostname.company.com
    - harbor_admin_password—Password for the Harbor system administrator.
      The harbor.yml file contains a default harbor_admin_password. You can modify the password.
    - database password—Root password for the local database.
      The harbor.yml file contains a default database password. You can modify the password.
  2. Comment the following lines:
```
https related config
https
https port for harbor, default is 443
port: 443
The path of cert and key files for nginx
certificate: /your/certificate/path
private_key: /your/private/key/path
```
    For example,
- To install Harbor by using self signed SSL certificates, see Configure HTTPS Access to Harbor .
Run the following command:
```
 ./install.sh
```
Verify that you can access the Harbor registry by using the admin username and password to log in.
Important

The default Harbor installation does not includes Notary and Clair services that are used for vulnerability scanning. To install Harbor with Notary and Clair services, see Installation with Notary and Installation with Clair .

To configure a Harbor registry

In the Harbor admin UI, navigate to the Administration menu, and click Registries.
Click NEW ENDPOINT, and specify the following field values:
- Provider—Docker Registry
- Endpoint URL—https://containers.bmc.com
- Access ID—Support user ID that you use to log in to EPD.
- Access Secret—Container image access key specified in the container-token.bmc file that you downloaded from EPD.
The following image shows an example configuration:
Click OK.
The configuration is saved and the configuration status is displayed as Healthy as shown in the following image:

Use this configuration in a replication rule to synchronize your local Harbor repository and BMC DTR.

To synchronize a Harbor repository with BMC DTR

In the Harbor admin UI, navigate to the Administration menu, and click Replications.

Click NEW REPLICATION RULE and specify the values for the following fields:

Field	Description
Name	Name of the replication rule. Use lower case letters to specify the name.
Replication mode	Type of replication mode. Select the Pull-based mode.
Source registry	Name of the Harbor registry that you configured to synchronize with BMC DTR.
Source resource filter: Name	Path of the image in the BMC DTR that you want to synchronize to your Harbor repository. Specify the path as bmc/lp00x.
Source resource filter: Tag	Tag of the images that you want to synchronize. Specify the tag value as *.
Destination namespace	Your project name. Keep this field blank.
Trigger Mode	One of the following rule trigger modes: Manual Scheduled

The following image shows an example replication rule:

Click Save.
To run the rule manually, click REPLICATE.
After rule execution is complete, navigate to Projects, and verify that the container images are synchronized.
Create another replication rule by performing the steps 1 to 5 and specifying the Source resource filter: Name as bmc/lp0ry in step 2.

To access images from an air-gapped environment

The following image describes the process to access the BMC Helix Innovation Suite platform and service management application container images from an air-gapped environment:

Perform the following steps to access images from an air-gapped environment:

Create and configure a local Harbor registry in your network.
Create and configure a Harbor registry in a demilitarized zone (DMZ).
Set up a proxy to enable communication between the local Harbor registry in your network and the Harbor registry in a DMZ.
Synchronize your local Harbor repository in your network with BMC DTR.
Synchronize your Harbor repository in a DMZ with your local Harbor repository in your network.
Perform the steps in To synchronize a Harbor repository with BMC DTR by modifying the following fields:
- Source registry—Name of the DMZ Harbor registry that you configured to synchronize with your local Harbor repository.
- Source resource filter: Name—Path of the image in your local Harbor repository that you want to synchronize to your DMZ Harbor repository.

Where to go from here

Setting up BMC Deployment Engine