Vadim Bauer f6f5bac8d1 feat(webhook): add webhook egress policy levels and allowlist (#24079) ...

The webhook SSRF guard was a single boolean. With it off (the default
since #24078) webhooks can reach loopback and cloud metadata; with it on,
every internal receiver breaks.

HARBOR_WEBHOOK_EGRESS_POLICY (harbor.yml webhook_egress.policy) selects a
level: allow_all, block_restricted (default) or public_only. Restricted
covers loopback, link-local, cloud metadata, unspecified, multicast and
NAT64/6to4/Teredo. HARBOR_WEBHOOK_EGRESS_ALLOWLIST takes IPs, CIDRs,
hostnames and *.domain suffixes that are allowed at every level.

When the policy is unset, the deprecated HARBOR_ALLOW_PRIVATE_NETWORK_ACCESS
keeps its 2.15 meaning: true is allow_all, false is public_only. Invalid
values fail closed, prepare rejects an unknown policy, and a blocked
target is logged with the setting that reopens it.

Signed-off-by: Vadim Bauer <vb@container-registry.com>

2026-10-08 07:15:15 +05:30

..

commands

add prepare migration script for 2.15.0 (#22788)

2026-01-30 15:28:02 +08:00

migrations

fix(webhook): allow private network access by default to avoid regres… (#24078)

2026-10-07 20:04:17 +08:00

scripts

remove the notary from backend (#18668)

2023-05-18 18:47:42 +08:00

templates

feat(webhook): add webhook egress policy levels and allowlist (#24079)

2026-10-08 07:15:15 +05:30

tests/migrations

Enhance: Support multi downversion in migration

2020-07-07 21:36:58 +08:00

utils

feat(webhook): add webhook egress policy levels and allowlist (#24079)

2026-10-08 07:15:15 +05:30

__init__.py

Refacotr the prepare script base on the proposal https://github.com/goharbor/community/pull/22

2019-03-08 16:46:13 +08:00

Dockerfile

Support custom PyPI index URL for prepare image builds (#23205)

2026-05-08 02:23:40 +00:00

Dockerfile.base

Rebuild goharbor/photon image before create new harbor base images (#23248)

2026-05-18 10:01:58 +00:00

g.py

prepare redis tls config (#21667)

2025-02-27 17:38:08 +08:00

main.py

Feat: Add config migrator to prepare

2020-03-20 03:04:10 +08:00

models.py

chore: fix incorrect otel timeout in harbor yaml template (#19120)

2023-08-16 16:26:16 +08:00

Pipfile

Update pipenv for prepare (#22124)

2025-07-01 14:23:05 +08:00

Pipfile.lock

chore(deps-dev): bump pygments from 2.19.2 to 2.20.0 in /make/photon/prepare (#23053)

2026-07-02 09:05:14 +00:00

test_purgeuploads.py

Add upload purge config to registry/config.yml

2022-01-04 11:15:51 +08:00