starlingx/docs
Code Issues Proposed changes
docs/doc/source/usertasks/kubernetes/kubernetes-user-tutorials-authentication-and-authorization.rst
Ron Stone f125a8b892 Remove spurious escapes (r8,dsR8) 
This change addresses a long-standing issue in rST documentation imported from XML.
That import process added backslash escapes in front of various characters. The three
most common being '(', ')', and '_'.
These instances are removed.

Signed-off-by: Ron Stone <ronald.stone@windriver.com>
Change-Id: Id43a9337ffcd505ccbdf072d7b29afdb5d2c997e
2023-03-01 11:19:04 +00:00

2.3 KiB
Raw Blame History

Local Docker Registry Authentication and Authorization

Authentication is enabled for the local docker registry. When logging in, users are authenticated using their platform keystone credentials.

For example:

$ docker login registry.local:9001 -u <keystoneUserName> -p <keystonePassword>

An authorized administrator ('admin' and 'sysinv') can perform any docker action. Regular users can only interact with their own repositories (i.e. registry.local:9001/<keystoneUserName>/). Any authenticated user can pull from the following list of public images:

  • registry.local:9001:/public/*
  • registry.local:9001:/k8s.gcr.io/pause
  • registry.local:9001:/quay.io/jetstack/cert-manager-acmesolver

The mtce user can only pull public images, but cannot push any images.

For example, only admin and testuser accounts can push to or pull from:

registry.local:9001/testuser/busybox:latest

Username and Docker Compatibility

Repository names in Docker registry paths must be lower case. For this reason, a keystone user must exist that consists of all lower case characters. For example, the user testuser is correct in the following URL, while testUser would result in an error:

registry.local:9001/testuser/busybox:latest

Note

Use of the auto-generated self-signed certificate for the registry certificate is not recommended. If you must do so, then from the central cloud/systemController, access to the local registry can only be done using registry.local:9001. registry.central:9001 will be inaccessible. Installing a CA-signed certificate for the registry and the certificate of the CA as an 'ssl_ca' certificate will remove this restriction.

https://docs.docker.com/engine/reference/commandline/docker/ for more information about docker commands.