Upgrade distribution to 2.8

[darend]

what

Upgrade the distribution package to 2.8

why

Harbor is currently on 2.7.1 which was released in 2019. Full release notes available here https://github.com/distribution/distribution/releases/tag/v2.8.0

EDIT: IRSA support not included in this release

See distribution/distribution#3552 (comment)

The 2.7 release uses an out of date AWS SDK which does not support the AWS AssumeRoleWithWebIdentity required for deployments under Kubernetes that use IRSA. This was fixed in the 2.8 release, see distribution/distribution#3097. Support for IRSA is of growing importance. It is the recommended solution when running Kubernetes on AWS

Unfortunately while distribution has a 2.8 branch they have not made a release. I pinned the upgrade to the last commit of the 2.8 release branch

IRSA Documentation:

• Overview https://aws.amazon.com/blogs/opensource/introducing-fine-grained-iam-roles-service-accounts/
• Required AWS SDK versions https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts-minimum-sdk.html

This fixes goharbor/harbor-helm#725

[sakomws]

lg

[sydorovdmytro]

There is some progress on the official 2.8 release distribution/distribution#3552

[zyyw]

It states I pinned the upgrade to the last commit of the 2.8 release branch, while the code change of this PR is pointing to 2.7.2,

github.com/docker/distribution v2.7.2-0.20211123191640-3b7b53456922+incompatible

[darend]

@zyyw thanks for catching that. Im running into some limitations with go get.

When attempting to pin to a specific commit it is silently falling back to the previous release. The go get docs do not explicitly state that you can pin to a commit...

# pins to github.com/docker/distribution v2.7.2-0.20211123191640-3b7b53456922+incompatible
go get github.com/docker/distribution@3b7b534569220c840993aad03e3eafe54b923f4d

I am also unable to pin to the release/2.8 branch. go get says you can pin to a branch but this specific branch appears to violate a naming convention

❯ go get github.com/docker/distribution@release/2.8
go get: github.com/docker/distribution@release/2.8: invalid version: version "release/2.8" invalid: disallowed version string

[darend]

Distribution cut a 2.8 Beta release but has not back ported the IRSA fix that we need into it

• Prepare for v2.8.0 release distribution/distribution#3552 (comment)

[chlins]

@darend Distribution has released v2.8.0 version recently. https://github.com/distribution/distribution/releases/tag/v2.8.0

[darend]

@chlins It is updated to 2.8

[MinerYang]

Hi @darend ,

We have just bumped up github.com/docker/distribution to v2.8.0+incompatible in the PR #16460
We would close this one and appreciate your contribution sincerely!

Best,
Miner