Yeah it’s the /etc/docker-distribution/registry/config.yml file that is the config file for the local registry . And you’re correct that the realm in that file is set to the StarlingX OAM Address. This was done intentionally to support external servers with connectivity to the StarlingX OAM interfaces, as being able to push to the local registry. E.g. a CICD system could push directly to the local registry of this StarlingX system. ( NOTE: it still works for internal starlingx hosts, since they have a path to this OAM IP over the mgmt network. ) So, it is understandable that an external server without connectivity to the StarlingX OAM IP interface, can NOT access the StarlingX local registry. Greg. Hi, I have a STX 3.0 bare metal duplex installation here. Followed the instructions on the web site. Only difference is I added two VLAN interfaces (one for the mgmt network, the other for the cluster-host network). Both controllers are up and running (unlocked, available, online). No alarms. I would like to login to the docker registry (registry.local) from a machine which sits on the mgmt and cluster-host network (but does not have access to the OAM network). When I run the docker login cmd like so: docker login -u admin https://registry.local:9001 I get back: Error response from daemon: Get https://registry.local:9001/v2/: Get https://192.168.30.5:9002/token/?account=admin&client_id=docker&offline_token=true&service=192.168.204.1%3A9001: dial tcp 192.168.30.5:9002: connect: network is unreachable 192.168.30.5 is the floating OAM ip address. Digging a bit deeper I found that this curl command: curl -v -s -H "Content-Type: application/json" -X POST -d '{"username": "'admin'", "password": "'PassWord123*'"}' https://registry.local:9001/v2/_catalog returns: < HTTP/1.1 401 Unauthorized < Content-Type: application/json; charset=utf-8 < Docker-Distribution-Api-Version: registry/2.0 < Www-Authenticate: Bearer realm="https://192.168.30.5:9002/token/ ",service="192.168.204.1:9001",scope="registry:catalog:*" < X-Content-Type-Options: nosniff < Date: Fri, 10 Jul 2020 17:36:33 GMT < Content-Length: 145 So the bearer realm address returned seems to point to the OAM network (to which I don't have access, hence the 'network is unreachable' error). I should also point out the the registry-token-server is configured like so: REGISTRY_TOKEN_SERVER_ADDR=192.168.204.1:9002 REGISTRY_TOKEN_SERVER_ISSUER=bird-token-server REGISTRY_TOKEN_SERVER_KS_ENDPOINT=http://192.168.204.1:5000/v3 REGISTRY_TOKEN_SERVER_TLSCERT=/etc/ssl/private/registry-cert.crt REGISTRY_TOKEN_SERVER_TLSKEY=/etc/ssl/private/registry-cert.key REGISTRY_TOKEN_SERVER_REALM=https://192.168.204.1:9002/token/ REGISTRY_TOKEN_SERVER_KEY=/etc/ssl/private/registry-cert-pkcs1.key Here, the REGISTRY_TOKEN_SERVER_REALM is correctly set to https://192.168.204.1:9002/token/.<https://192.168.204.1:9002/token/> Lastly, the /etc/docker-distribution/registry/config.yml configuration file points to another realm address: auth: token: realm: "https://192.168.30.5:9002/token/" service: "192.168.204.1:9001" issuer: bird-token-server rootcertbundle: /etc/ssl/private/registry-cert.crt What am I missing here? How can I login to the registry from outside the OAM network? Regards, Marc -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://lists.starlingx.io/pipermail/starlingx-discuss/attachments/20200710/09bd1ced/attachment.html> ________________________________ * Previous message (by thread): [Starlingx-discuss] What's the 4.0-rc0 build status?<http://lists.starlingx.io/pipermail/starlingx-discuss/2020-July/009156.html> * Next message (by thread): [Starlingx-discuss] Simplex Installation Question<http://lists.starlingx.io/pipermail/starlingx-discuss/2020-July/009148.html> * Messages sorted by: [ date ]<http://lists.starlingx.io/pipermail/starlingx-discuss/2020-July/date.html#9145> [ thread ]<http://lists.starlingx.io/pipermail/starlingx-discuss/2020-July/thread.html#9145> [ subject ]<http://lists.starlingx.io/pipermail/starlingx-discuss/2020-July/subject.html#9145> [ author ]<http://lists.starlingx.io/pipermail/starlingx-discuss/2020-July/author.html#9145> ________________________________ More information about the Starlingx-discuss mailing list<http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss>