[Starlingx-discuss] Problem with docker login, wrong realm address returned

[Waines, Greg]

Yeah it’s the /etc/docker-distribution/registry/config.yml file that is the config file for the local registry .
And you’re correct that the realm in that file is set to the StarlingX OAM Address.
This was done intentionally to support external servers with connectivity to the StarlingX OAM interfaces, as being able to push to the local registry.
E.g. a CICD system could push directly to the local registry of this StarlingX system.
( NOTE: it still works for internal starlingx hosts, since they have a path to this OAM IP over the mgmt network. )

So, it is understandable that an external server without connectivity to the StarlingX OAM IP interface, can NOT access the StarlingX local registry.

Greg.


Hi,

I have a STX 3.0 bare metal duplex installation here. Followed the
instructions on the web site. Only difference is I added two VLAN
interfaces (one for the mgmt network, the other for the cluster-host
network).

Both controllers are up and running (unlocked, available, online). No
alarms.

I would like to login to the docker registry (registry.local) from a
machine which sits on the mgmt and cluster-host network (but does not have
access to the OAM network).

When I run the docker login cmd like so:

docker login -u admin https://registry.local:9001

I get back:

Error response from daemon: Get https://registry.local:9001/v2/: Get
https://192.168.30.5:9002/token/?account=admin&client_id=docker&offline_token=true&service=192.168.204.1%3A9001:
dial tcp 192.168.30.5:9002: connect: network is unreachable

192.168.30.5 is the floating OAM ip address. Digging a bit deeper I found
that this curl command:

curl -v -s -H "Content-Type: application/json" -X POST -d '{"username":
"'admin'", "password": "'PassWord123*'"}'
https://registry.local:9001/v2/_catalog

returns:

< HTTP/1.1 401 Unauthorized
< Content-Type: application/json; charset=utf-8
< Docker-Distribution-Api-Version: registry/2.0
< Www-Authenticate: Bearer realm="https://192.168.30.5:9002/token/
",service="192.168.204.1:9001",scope="registry:catalog:*"
< X-Content-Type-Options: nosniff
< Date: Fri, 10 Jul 2020 17:36:33 GMT
< Content-Length: 145

So the bearer realm address returned seems to point to the OAM network (to
which I don't have access, hence the 'network is unreachable' error). I
should also point out the the registry-token-server is configured like so:

REGISTRY_TOKEN_SERVER_ADDR=192.168.204.1:9002
REGISTRY_TOKEN_SERVER_ISSUER=bird-token-server
REGISTRY_TOKEN_SERVER_KS_ENDPOINT=http://192.168.204.1:5000/v3
REGISTRY_TOKEN_SERVER_TLSCERT=/etc/ssl/private/registry-cert.crt
REGISTRY_TOKEN_SERVER_TLSKEY=/etc/ssl/private/registry-cert.key
REGISTRY_TOKEN_SERVER_REALM=https://192.168.204.1:9002/token/
REGISTRY_TOKEN_SERVER_KEY=/etc/ssl/private/registry-cert-pkcs1.key

Here, the REGISTRY_TOKEN_SERVER_REALM is correctly set to
https://192.168.204.1:9002/token/.<https://192.168.204.1:9002/token/> Lastly, the
/etc/docker-distribution/registry/config.yml configuration file points to
another realm address:

auth:
  token:
    realm: "https://192.168.30.5:9002/token/"
    service: "192.168.204.1:9001"
    issuer: bird-token-server
    rootcertbundle: /etc/ssl/private/registry-cert.crt

What am I missing here? How can I login to the registry from outside the
OAM network?

Regards,

Marc
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.starlingx.io/pipermail/starlingx-discuss/attachments/20200710/09bd1ced/attachment.html>
________________________________

  *   Previous message (by thread): [Starlingx-discuss] What's the 4.0-rc0 build status?<http://lists.starlingx.io/pipermail/starlingx-discuss/2020-July/009156.html>
  *   Next message (by thread): [Starlingx-discuss] Simplex Installation Question<http://lists.starlingx.io/pipermail/starlingx-discuss/2020-July/009148.html>
  *   Messages sorted by: [ date ]<http://lists.starlingx.io/pipermail/starlingx-discuss/2020-July/date.html#9145> [ thread ]<http://lists.starlingx.io/pipermail/starlingx-discuss/2020-July/thread.html#9145> [ subject ]<http://lists.starlingx.io/pipermail/starlingx-discuss/2020-July/subject.html#9145> [ author ]<http://lists.starlingx.io/pipermail/starlingx-discuss/2020-July/author.html#9145>

________________________________
More information about the Starlingx-discuss mailing list<http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss>



-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.starlingx.io/pipermail/starlingx-discuss/attachments/20200716/82c1057b/attachment-0001.html>