Yeah it’s the /etc/docker-distribution/registry/config.yml file that is the config file for the local registry .

And you’re correct that the realm in that file is set to the StarlingX OAM Address.

This was done intentionally to support external servers with connectivity to the StarlingX OAM interfaces, as being able to push to the local registry.

E.g. a CICD system could push directly to the local registry of this StarlingX system.

( NOTE: it still works for internal starlingx hosts, since they have a path to this OAM IP over the mgmt network. )

 

So, it is understandable that an external server without connectivity to the StarlingX OAM IP interface, can NOT access the StarlingX local registry.

 

Greg.

 

 

Hi,

 

I have a STX 3.0 bare metal duplex installation here. Followed the

instructions on the web site. Only difference is I added two VLAN

interfaces (one for the mgmt network, the other for the cluster-host

network).

 

Both controllers are up and running (unlocked, available, online). No

alarms.

 

I would like to login to the docker registry (registry.local) from a

machine which sits on the mgmt and cluster-host network (but does not have

access to the OAM network).

 

When I run the docker login cmd like so:

 

docker login -u admin https://registry.local:9001

 

I get back:

 

Error response from daemon: Get https://registry.local:9001/v2/: Get

https://192.168.30.5:9002/token/?account=admin&client_id=docker&offline_token=true&service=192.168.204.1%3A9001:

dial tcp 192.168.30.5:9002: connect: network is unreachable

 

192.168.30.5 is the floating OAM ip address. Digging a bit deeper I found

that this curl command:

 

curl -v -s -H "Content-Type: application/json" -X POST -d '{"username":

"'admin'", "password": "'PassWord123*'"}'

https://registry.local:9001/v2/_catalog

 

returns:

 

< HTTP/1.1 401 Unauthorized

< Content-Type: application/json; charset=utf-8

< Docker-Distribution-Api-Version: registry/2.0

< Www-Authenticate: Bearer realm="https://192.168.30.5:9002/token/

",service="192.168.204.1:9001",scope="registry:catalog:*"

< X-Content-Type-Options: nosniff

< Date: Fri, 10 Jul 2020 17:36:33 GMT

< Content-Length: 145

 

So the bearer realm address returned seems to point to the OAM network (to

which I don't have access, hence the 'network is unreachable' error). I

should also point out the the registry-token-server is configured like so:

 

REGISTRY_TOKEN_SERVER_ADDR=192.168.204.1:9002

REGISTRY_TOKEN_SERVER_ISSUER=bird-token-server

REGISTRY_TOKEN_SERVER_KS_ENDPOINT=http://192.168.204.1:5000/v3

REGISTRY_TOKEN_SERVER_TLSCERT=/etc/ssl/private/registry-cert.crt

REGISTRY_TOKEN_SERVER_TLSKEY=/etc/ssl/private/registry-cert.key

REGISTRY_TOKEN_SERVER_REALM=https://192.168.204.1:9002/token/

REGISTRY_TOKEN_SERVER_KEY=/etc/ssl/private/registry-cert-pkcs1.key

 

Here, the REGISTRY_TOKEN_SERVER_REALM is correctly set to

https://192.168.204.1:9002/token/. Lastly, the

/etc/docker-distribution/registry/config.yml configuration file points to

another realm address:

 

auth:

  token:

    realm: "https://192.168.30.5:9002/token/"

    service: "192.168.204.1:9001"

    issuer: bird-token-server

    rootcertbundle: /etc/ssl/private/registry-cert.crt

 

What am I missing here? How can I login to the registry from outside the

OAM network?

 

Regards,

 

Marc

-------------- next part --------------

An HTML attachment was scrubbed...

URL: <http://lists.starlingx.io/pipermail/starlingx-discuss/attachments/20200710/09bd1ced/attachment.html>

More information about the Starlingx-discuss mailing list