Hi,
I have a STX 3.0 bare metal duplex installation here. Followed the instructions on the web site. Only difference is I added two VLAN interfaces (one for the mgmt network, the other for the cluster-host network).
Both controllers are up and running (unlocked, available, online). No alarms.
I would like to login to the docker registry (registry.local) from a machine which sits on the mgmt and cluster-host network (but does not have access to the OAM network).
When I run the docker login cmd like so:
I get back:
192.168.30.5 is the floating OAM ip address. Digging a bit deeper I found that this curl command:
returns:
< HTTP/1.1 401 Unauthorized
< Content-Type: application/json; charset=utf-8
< Docker-Distribution-Api-Version: registry/2.0
< Www-Authenticate: Bearer realm="
https://192.168.30.5:9002/token/",service="
192.168.204.1:9001",scope="registry:catalog:*"
< X-Content-Type-Options: nosniff
< Date: Fri, 10 Jul 2020 17:36:33 GMT
< Content-Length: 145
So the bearer realm address returned seems to point to the OAM network (to which I don't have access, hence the 'network is unreachable' error). I should also point out the the registry-token-server is configured like so:
REGISTRY_TOKEN_SERVER_ADDR=
192.168.204.1:9002REGISTRY_TOKEN_SERVER_ISSUER=bird-token-server
REGISTRY_TOKEN_SERVER_KS_ENDPOINT=
http://192.168.204.1:5000/v3REGISTRY_TOKEN_SERVER_TLSCERT=/etc/ssl/private/registry-cert.crt
REGISTRY_TOKEN_SERVER_TLSKEY=/etc/ssl/private/registry-cert.key
REGISTRY_TOKEN_SERVER_REALM=
https://192.168.204.1:9002/token/REGISTRY_TOKEN_SERVER_KEY=/etc/ssl/private/registry-cert-pkcs1.key
Here, the REGISTRY_TOKEN_SERVER_REALM is correctly set to
https://192.168.204.1:9002/token/. Lastly, the /etc/docker-distribution/registry/config.yml configuration file points to another realm address:
What am I missing here? How can I login to the registry from outside the OAM network?
Regards,
Marc