[Starlingx-discuss] Problem with docker login, wrong realm address returned

[Marc Ferland]

Hi,

I have a STX 3.0 bare metal duplex installation here. Followed the
instructions on the web site. Only difference is I added two VLAN
interfaces (one for the mgmt network, the other for the cluster-host
network).

Both controllers are up and running (unlocked, available, online). No
alarms.

I would like to login to the docker registry (registry.local) from a
machine which sits on the mgmt and cluster-host network (but does not have
access to the OAM network).

When I run the docker login cmd like so:

docker login -u admin https://registry.local:9001

I get back:

Error response from daemon: Get https://registry.local:9001/v2/: Get
https://192.168.30.5:9002/token/?account=admin&client_id=docker&offline_token=true&service=192.168.204.1%3A9001:
dial tcp 192.168.30.5:9002: connect: network is unreachable

192.168.30.5 is the floating OAM ip address. Digging a bit deeper I found
that this curl command:

curl -v -s -H "Content-Type: application/json" -X POST -d '{"username":
"'admin'", "password": "'PassWord123*'"}'
https://registry.local:9001/v2/_catalog

returns:

< HTTP/1.1 401 Unauthorized
< Content-Type: application/json; charset=utf-8
< Docker-Distribution-Api-Version: registry/2.0
< Www-Authenticate: Bearer realm="https://192.168.30.5:9002/token/
",service="192.168.204.1:9001",scope="registry:catalog:*"
< X-Content-Type-Options: nosniff
< Date: Fri, 10 Jul 2020 17:36:33 GMT
< Content-Length: 145

So the bearer realm address returned seems to point to the OAM network (to
which I don't have access, hence the 'network is unreachable' error). I
should also point out the the registry-token-server is configured like so:

REGISTRY_TOKEN_SERVER_ADDR=192.168.204.1:9002
REGISTRY_TOKEN_SERVER_ISSUER=bird-token-server
REGISTRY_TOKEN_SERVER_KS_ENDPOINT=http://192.168.204.1:5000/v3
REGISTRY_TOKEN_SERVER_TLSCERT=/etc/ssl/private/registry-cert.crt
REGISTRY_TOKEN_SERVER_TLSKEY=/etc/ssl/private/registry-cert.key
REGISTRY_TOKEN_SERVER_REALM=https://192.168.204.1:9002/token/
REGISTRY_TOKEN_SERVER_KEY=/etc/ssl/private/registry-cert-pkcs1.key

Here, the REGISTRY_TOKEN_SERVER_REALM is correctly set to
https://192.168.204.1:9002/token/. Lastly, the
/etc/docker-distribution/registry/config.yml configuration file points to
another realm address:

auth:
  token:
    realm: "https://192.168.30.5:9002/token/"
    service: "192.168.204.1:9001"
    issuer: bird-token-server
    rootcertbundle: /etc/ssl/private/registry-cert.crt

What am I missing here? How can I login to the registry from outside the
OAM network?

Regards,

Marc
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.starlingx.io/pipermail/starlingx-discuss/attachments/20200710/09bd1ced/attachment.html>