harbor-terraform

Harbor Terraform Provider

Provider: goharbor/harbor. Latest: v3.12.0 (Jun 4, 2026). Registry: v3.11.6 (Apr 22, 2026). Source: github.com/goharbor/terraform-provider-harbor.

Tested against: Harbor 2.13–2.15, Terraform 1.12–1.14.

Provider Config

terraform {
  required_providers {
    harbor = {
      source  = "goharbor/harbor"
      version = "~> 3.11"
    }
  }
}

provider "harbor" {
  url       = "https://harbor.example.com"
  username  = "admin"
  password  = var.harbor_password
  insecure  = false    # Verify TLS (default: true — must explicitly set false)
}

Auth Methods

Method	Fields	Env Var
Basic	username + password	HARBOR_USERNAME, HARBOR_PASSWORD
Bearer Token	bearer_token	—
OIDC Session	session_id	HARBOR_SESSION_ID

api_version (default: 2) — use 1 for Harbor pre-2.0. robot_prefix — auto-detected via admin API unless explicitly set.

Resources (20)

Projects

resource "harbor_project" "myapp" {
  name                   = "myapp"
  public                 = false
  vulnerability_scanning = true
  vulnerability_scanner  = "Trivy"             # v3.11.6+: per-project scanner override
  enable_content_trust   = true                # Notary
  enable_content_trust_cosign = false          # Cosign signatures
  auto_sbom_generation   = true                # Harbor 2.11+ SBOM on push
  storage_quota          = 100                 # GB
  deployment_security    = "high"              # Block images >= this severity
  cve_allowlist          = ["CVE-1234"]
  force_destroy          = false               # Allow destroy even with repos
}

# Proxy cache project
resource "harbor_registry" "dockerhub" {
  provider_name = "docker-hub"
  name          = "dockerhub-proxy"
  endpoint_url  = "https://hub.docker.com"
}

resource "harbor_project" "proxy" {
  name                           = "docker-proxy"
  registry_id                    = harbor_registry.dockerhub.registry_id
  proxy_speed_kb                 = -1
  proxy_cache_local_on_not_found = true   # Harbor 2.15.1+
}