Hi,

I have a STX 3.0 bare metal duplex installation here. Followed the instructions on the web site. Only difference is I added two VLAN interfaces (one for the mgmt network, the other for the cluster-host network).

Both controllers are up and running (unlocked, available, online). No alarms.

I would like to login to the docker registry (registry.local) from a machine which sits on the mgmt and cluster-host network (but does not have access to the OAM network).

When I run the docker login cmd like so:

docker login -u admin https://registry.local:9001

I get back:

Error response from daemon: Get https://registry.local:9001/v2/: Get https://192.168.30.5:9002/token/?account=admin&client_id=docker&offline_token=true&service=192.168.204.1%3A9001: dial tcp 192.168.30.5:9002: connect: network is unreachable

192.168.30.5 is the floating OAM ip address. Digging a bit deeper I found that this curl command:

curl -v -s -H "Content-Type: application/json" -X POST -d '{"username": "'admin'", "password": "'PassWord123*'"}' https://registry.local:9001/v2/_catalog

returns:

< HTTP/1.1 401 Unauthorized
< Content-Type: application/json; charset=utf-8
< Docker-Distribution-Api-Version: registry/2.0
< Www-Authenticate: Bearer realm="https://192.168.30.5:9002/token/",service="192.168.204.1:9001",scope="registry:catalog:*"
< X-Content-Type-Options: nosniff
< Date: Fri, 10 Jul 2020 17:36:33 GMT
< Content-Length: 145

So the bearer realm address returned seems to point to the OAM network (to which I don't have access, hence the 'network is unreachable' error). I should also point out the the registry-token-server is configured like so:

REGISTRY_TOKEN_SERVER_ADDR=192.168.204.1:9002
REGISTRY_TOKEN_SERVER_ISSUER=bird-token-server
REGISTRY_TOKEN_SERVER_KS_ENDPOINT=http://192.168.204.1:5000/v3
REGISTRY_TOKEN_SERVER_TLSCERT=/etc/ssl/private/registry-cert.crt
REGISTRY_TOKEN_SERVER_TLSKEY=/etc/ssl/private/registry-cert.key
REGISTRY_TOKEN_SERVER_REALM=https://192.168.204.1:9002/token/
REGISTRY_TOKEN_SERVER_KEY=/etc/ssl/private/registry-cert-pkcs1.key

Here, the REGISTRY_TOKEN_SERVER_REALM is correctly set to https://192.168.204.1:9002/token/. Lastly, the /etc/docker-distribution/registry/config.yml configuration file points to another realm address:

auth:
  token:
    realm: "https://192.168.30.5:9002/token/"
    service: "192.168.204.1:9001"
    issuer: bird-token-server
    rootcertbundle: /etc/ssl/private/registry-cert.crt

What am I missing here? How can I login to the registry from outside the OAM network?

Regards,

Marc