Helm Chart v2.1.0

Released 2026-10-19.

Summary

Adds a Harbor Grafana dashboard for health, runtime, API traffic, storage, jobs and project usage. Switch installations using shared datasource, cluster and namespace selectors. The dashboard also highlights PostgreSQL/pgx monitoring available in the 8gcr Harbor distribution. Import the JSON directly or enable metrics.grafanaDashboard.enabled to provision it through a Grafana sidecar.

The portal and the API no longer render inside a frame on another site. If you embed the Harbor UI in an iframe, for example on a dashboard, that stops working after the upgrade. To keep it, supply your own portal nginx config through portal.existingConfigMap.

Fixes GHSA: GHSA-2phj-cp9f-qq6w, “SSRF in webhook delivery allows ProjectAdmin to reach internal services and cloud metadata endpoints.” Reported by @OX-IgorStepansky and @iggypopi (Igor Stepansky). The discovery is theirs.

Also fixes: GHSA-55x6-4mx9-528x, “Webhook notification delivery performs no private/loopback/link-local/metadata egress filtering (scheme is the only target constraint), follows attacker redirects with POST->GET conversion, and reflects non-2xx internal response bodies verbatim into project-readable task logs. The in-tree SSRF sanitizer (‘Prevent SSRF #3755’) is dead code: a Go range value-copy makes the sanitize write a no-op, and even if it ran it would not block internal IPs.” Reported by @e1024x. The discovery is theirs.

Also fixes: GHSA-mxjq-7hr5-pq2q, “Webhook Notification Job Has No SSRF Protection, Internal Network Access.” Reported by @sermikr0 (Saidakbarxon Maxsudxonov). The discovery is theirs.

Webhook and Slack deliveries refuse private, loopback, link-local and metadata addresses, do not follow redirects and no longer echo the target’s response body. Set network.allowPrivateNetworkAccess (chart) or HARBOR_ALLOW_PRIVATE_NETWORK_ACCESS (compose) to true for trusted internal endpoints.

Features

  • chart: Add Harbor Grafana dashboard with 8gcr pgx monitoring (#849)
  • chart: Bump appVersion To v2.15.10 (#1184)
  • chart: Bump chart appVersion to v2.15.13 (#1272)

Fixes

  • Send Cache-Control no-store On API And Static JSON Responses (#992)
  • Send Referrer-Policy And Permissions-Policy From Portal And Core (#994)
  • Send X-Content-Type-Options nosniff From Portal And Core (#990)
  • Send X-Frame-Options And CSP frame-ancestors From Portal And Core (#989)
  • webhook: Block Private-Network Targets And Stop Reflecting Response Bodies (#1140)

Install

helm install harbor oci://8gears.container-registry.com/8gcr/charts/harbor \
  --version 2.1.0 -n harbor --create-namespace -f my-values.yaml

Signed with cosign. Verify the chart signature:

cosign verify \
  --certificate-identity "https://github.com/container-registry/harbor-next/.github/workflows/publish-chart.yml@refs/heads/main" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  8gears.container-registry.com/8gcr/charts/harbor:2.1.0

Default Harbor image tags follow the chart appVersion: v2.15.13.