He Weiwei

The downgrade is not allowed in the harbor.

We will find a solution to fix this issue in harbor 2.5.0. cc @xaleeks

`ExternalURL` is a required configuration for the harbor-core because the harbor-core uses this configuration to generate the auth service URL. ingress can be changed to not required

Need to update the spec of the gcs storage to support the workload identity.

@ninjadq should we validate the configurations during the preparing stage? Especially the length of the secret key and xsrf key.

Only project admin can access this API `/projects/{project_name_or_id}/scanner/candidates`, so it doesn't use the (scanner, read) permission.

Please disable the "prevent vulnerable" for the proxy-cache project, otherwise you can't pull images from the project.

Hi, @toastbrotch, let me clarify the reply from @zyyw, his reply about the `Prevent vulnerable images from running` is wrong. `Prevent vulnerable images from running` will block the image to...

@voltcode https://github.com/joelgriffith/browserless#usage-with-chromeless may works!

An option to resolve this problem: the artifact in the distribution is untagged, the tag is managed in the harbor core side.