Harbor: Add Gitlab Registry Support with harbor.

Created on 19 Aug 2016  路  36Comments  路  Source: goharbor/harbor

I have success run the harbor with docker compose, and login success with docker login command, but while i want to enable gitlab registry support with harbor, and i found it fails to config the registry.

Here is the registry doc: GitLab Documentation, and :

The Docker Registry configuration will need container_registry as the service and https://gitlab.example.com/jwt/auth as the realm:

auth:
  token:
    realm: https://gitlab.example.com/jwt/auth
    service: container_registry
    issuer: gitlab-issuer
    rootcertbundle: /root/certs/certbundle

so:

  1. export the public key from the Deploy/config/registry/root.crt: openssl x509 -pubkey -noout -in config/registry/root.crt > config/registry/root.key
  2. modify the templates/registry/config.yml:
#auth:
#  token:
#    issuer: registry-token-issuer
#    realm: $ui_url/service/token
#    rootcertbundle: /etc/registry/root.crt
#    service: token-service
auth:
  token:
    issuer: registry-token-issuer
    realm: $ui_url/jwt/auth
    rootcertbundle: /etc/registry/root.crt
    service: container_registry

then i restart the service by docker-compose down && docker-compose up -d, and i fount i cant login to harbor while i use docker login, it returns 404 response (and i modify auth to the default, it runs OK):

Password: 
Error response from daemon: Get http://192.168.3.111:20080/v2/: error parsing HTTP 404 response body: invalid character '<' looking for beginning of value: "\n<!DOCTYPE html>\n<html lang=\"en\">\n\t<head>\n\t\t<meta http-equiv=\"Content-Type\" content=\"text/html; charset=UTF-8\">\n\t\t<title>Not Found</title>\n\t\t<style type=\"text/css\">\n\t\t\t* {\n\t\t\t\tmargin:0;\n\t\t\t\tpadding:0;\n\t\t\t}\n\n\t\t\tbody {\n\t\t\t\tbackground-color:#EFEFEF;\n\t\t\t\tfont: .9em \"Lucida Sans Unicode\", \"Lucida Grande\", sans-serif;\n\t\t\t}\n\n\t\t\t#wrapper{\n\t\t\t\twidth:600px;\n\t\t\t\tmargin:40px auto 0;\n\t\t\t\ttext-align:center;\n\t\t\t\t-moz-box-shadow: 5px 5px 10px rgba(0,0,0,0.3);\n\t\t\t\t-webkit-box-shadow: 5px 5px 10px rgba(0,0,0,0.3);\n\t\t\t\tbox-shadow: 5px 5px 10px rgba(0,0,0,0.3);\n\t\t\t}\n\n\t\t\t#wrapper h1{\n\t\t\t\tcolor:#FFF;\n\t\t\t\ttext-align:center;\n\t\t\t\tmargin-bottom:20px;\n\t\t\t}\n\n\t\t\t#wrapper a{\n\t\t\t\tdisplay:block;\n\t\t\t\tfont-size:.9em;\n\t\t\t\tpadding-top:20px;\n\t\t\t\tcolor:#FFF;\n\t\t\t\ttext-decoration:none;\n\t\t\t\ttext-align:center;\n\t\t\t}\n\n\t\t\t#container {\n\t\t\t\twidth:600px;\n\t\t\t\tpadding-bottom:15px;\n\t\t\t\tbackground-color:#FFFFFF;\n\t\t\t}\n\n\t\t\t.navtop{\n\t\t\t\theight:40px;\n\t\t\t\tbackground-color:#24B2EB;\n\t\t\t\tpadding:13px;\n\t\t\t}\n\n\t\t\t.content {\n\t\t\t\tpadding:10px 10px 25px;\n\t\t\t\tbackground: #FFFFFF;\n\t\t\t\tmargin:;\n\t\t\t\tcolor:#333;\n\t\t\t}\n\n\t\t\ta.button{\n\t\t\t\tcolor:white;\n\t\t\t\tpadding:15px 20px;\n\t\t\t\ttext-shadow:1px 1px 0 #00A5FF;\n\t\t\t\tfont-weight:bold;\n\t\t\t\ttext-align:center;\n\t\t\t\tborder:1px solid #24B2EB;\n\t\t\t\tmargin:0px 200px;\n\t\t\t\tclear:both;\n\t\t\t\tbackground-color: #24B2EB;\n\t\t\t\tborder-radius:100px;\n\t\t\t\t-moz-border-radius:100px;\n\t\t\t\t-webkit-border-radius:100px;\n\t\t\t}\n\n\t\t\ta.button:hover{\n\t\t\t\ttext-decoration:none;\n\t\t\t\tbackground-color: #24B2EB;\n\t\t\t}\n\n\t\t</style>\n\t</head>\n\t<body>\n\t\t<div id=\"wrapper\">\n\t\t\t<div id=\"container\">\n\t\t\t\t<div class=\"navtop\">\n\t\t\t\t\t<h1>Not Found</h1>\n\t\t\t\t</div>\n\t\t\t\t<div id=\"content\">\n\t\t\t\t\t<br>The page you have requested has flown the coop.<br>Perhaps you are here because:<br><br><ul><br>The page has moved<br>The page no longer exists<br>You were looking for your puppy and got lost<br>You like 404 pages</ul>\n\t\t\t\t\t<a href=\"/\" title=\"Home\" class=\"button\">Go Home</a><br />\n\n\t\t\t\t\t<br>Powered by beego 1.6.1\n\t\t\t\t</div>\n\t\t\t</div>\n\t\t</div>\n\t</body>\n</html>\n"

am i miss something? or anyone know how to enable gitlab registry with harbor?

candidat1.10 kinrequirement
Source
picture hwangjr
👍23 ❤8

Most helpful comment

Well, I was trying to configure this from Gitlab side, but I didn't fully succeed with that.

First I've checked existing config which Harbor using for running docker-registry in common/config/registry/config.yml:

version: 0.1
log:
  level: debug
  fields:
    service: registry
storage:
  cache:
    layerinfo: redis
  filesystem:
    rootdirectory: /storage
  maintenance:
    uploadpurging:
      enabled: false
  delete:
    enabled: true
redis:
  addr: redis:6379
  password:
  db: 1
http:
  addr: :5000
  secret: placeholder
  debug:
    addr: localhost:5001
auth:
  token:
    issuer: harbor-token-issuer
    realm: https://harbor.example.org/service/token
    rootcertbundle: /etc/registry/root.crt
    service: harbor-registry
validation:
  disabled: true
notifications:
  endpoints:
  - name: harbor
    disabled: false
    url: http://core:8080/service/notifications
    timeout: 3000ms
    threshold: 5
    backoff: 1s
compatibility:
  schema1:
    enabled: true

Then I found tiny project which allows to generate tokens using just the private key: docker-registry-token-genarator

Thus I have achieved the working tokens generation:

./docker-registry-token-genarator -issuer harbor-token-issuer -key /tmp/key -username kvaps -scope 'repository:some-project/some-repo:pull,push' -service "harbor-registry"

The generated token can be simple checked as described here:

curl -i -k -H "Content-Type: application/json" -H "Authorization:  Bearer $TOKEN" -X GET https://harbor.example.org/v2/some-project/some-repo/manifests/latest

BTW, the generated token can be simple decrypted on jwt.io site.

Then I started configuring Gitlab using this guide

Thus I exported my harbor private key, using this command:

awk '{printf $0 "\\n"} END{printf"\n"}' /data/secret/core/private_key.pem

And updated my /etc/gitlab/gitlab.rbconfig file

Then I've specified few other options: 

registry_external_url 'https://harbor.example.org'
gitlab_rails['registry_enabled'] = true
gitlab_rails['registry_api_url'] = "https://harbor.example.org"
gitlab_rails['registry_issuer'] = "harbor-token-issuer"
registry['internal_key'] = "<private_key content>"
registry['registry_service'] = "harbor-registry"
registry['token_realm'] = "harbor.example.org/service/token"

I also modified /opt/gitlab/embedded/cookbooks/registry/templates/default/registry-config.yml.erb template to make registry_service working:

 auth:
   token:
-    realm: <%= @token_realm %>/jwt/auth
-    service: container_registry
+    realm: <%= @token_realm %>
+    service: <%= @registry_service %>
     issuer: <%= @registry_issuer %>
     rootcertbundle: <%= @rootcertbundle %>
     autoredirect: <%= @autoredirect %>

Finally I was run to reconfigure my Gitlab:

sudo gitlab-ctl reconfigure

Unfortunately it didn't make it working. I don't know why but Gitlab is still generating tokens like this:

CI_REGISTRY_USER=gitlab-ci-token
CI_REGISTRY_PASSWORD=QSzL2ZptbM6y8iKhQvCs

And when docker from the job trying to use these credentials harbor reports error authorizing context: insufficient scope error in /var/log/harbor/registry.log

I'll be glad for any help or guesses with that

related issue on Gitlab.com: https://gitlab.com/gitlab-org/gitlab/-/issues/25948#note_309241844

picture kvaps on 23 Mar 2020
👍23

All 36 comments

Here is the log for ui.log:

Aug 19 13:56:02 172.19.0.1 ui[1379]: 2016/08/19 05:56:02 #033[1;34m[router.go:829][D] | GET        | /jwt/auth                                | 752.197碌s        | notmatch   | #033[0m
Aug 19 13:58:35 172.19.0.1 ui[1379]: 2016/08/19 05:58:35 #033[1;34m[router.go:829][D] | GET        | /jwt/auth                                | 826.155碌s        | notmatch   | #033[0m

proxy.log:

Aug 19 13:56:02 172.19.0.1 proxy[1379]: 192.168.3.111 - - [19/Aug/2016:05:56:02 +0000] "GET /v2/ HTTP/1.1" 401 87 "-" "docker/1.12.0 go/go1.6.3 git-commit/8eab29e kernel/3.10.0-327.18.2.el7.x86_64 os/linux arch/amd64 UpstreamClient(Docker-Client/1.12.0 \x5C(linux\x5C))"
Aug 19 13:56:02 172.19.0.1 proxy[1379]: 192.168.3.111 - admin [19/Aug/2016:05:56:02 +0000] "GET /jwt/auth?account=admin&client_id=docker&offline_token=true&service=container_registry HTTP/1.1" 404 2000 "-" "docker/1.12.0 go/go1.6.3 git-commit/8eab29e kernel/3.10.0-327.18.2.el7.x86_64 os/linux arch/amd64 UpstreamClient(Docker-Client/1.12.0 \x5C(linux\x5C))"
Aug 19 13:58:35 172.19.0.1 proxy[1379]: 192.168.3.111 - - [19/Aug/2016:05:58:35 +0000] "\x16\x03\x01\x00w\x01\x00\x00s\x03\x03_-H5L\xE1\xD4Ld5g\xEFc\xE7\xB5\xBCNL\x02\x93q\xB9\x19`\xB1N#/\xD1\xA0V\xD2\x00\x00\x14\xC0,\xC00\xC0+\xC0/\xC0" 400 173 "-" "-"
Aug 19 13:58:35 172.19.0.1 proxy[1379]: 192.168.3.111 - - [19/Aug/2016:05:58:35 +0000] "GET /v2/ HTTP/1.1" 401 87 "-" "docker/1.12.0 go/go1.6.3 git-commit/8eab29e kernel/3.10.0-327.18.2.el7.x86_64 os/linux arch/amd64 UpstreamClient(Docker-Client/1.12.0 \x5C(linux\x5C))"
Aug 19 13:58:35 172.19.0.1 proxy[1379]: 192.168.3.111 - admin [19/Aug/2016:05:58:35 +0000] "GET /jwt/auth?account=admin&client_id=docker&offline_token=true&service=container_registry HTTP/1.1" 404 2000 "-" "docker/1.12.0 go/go1.6.3 git-commit/8eab29e kernel/3.10.0-327.18.2.el7.x86_64 os/linux arch/amd64 UpstreamClient(Docker-Client/1.12.0 \x5C(linux\x5C))"

it seems that the ui cant match the url.

hwangjr picture hwangjr on 19 Aug 2016

First, we need to understand what's gitlab registry support means here, I don't have bandwidth to handle it recently but will check later.

the realm is the url for getting the token so when you update to : $ui_url/jwt/auth it gets 404, because the UI is not listening on the url.

reasonerjt picture reasonerjt on 19 Aug 2016
  • 1 for gitlab integration if it's possible.
weaktyper picture weaktyper on 13 Feb 2017
👍12

Still looking for a way to do this.
Gitlab uses a registry to provide the ability for developers to push/pull image transparently in build pipelines.
Harbor provide lots of features (great UI, notary native support, garbage collection, replication, etc.) that we actually need for production images.

We basically need to be able tu push/pull to Harbor's registry from Gitlab.

I found several ways to do it, but there always are hacky workarounds. Like setting up the two registries (Harbor's and Gitlab's) using the same storage backend (NFS share for example).

It4lik picture It4lik on 12 Jun 2017

I have done a deep investigation on this topic, the different auth backend between harbor and gitlab can be resolved by nginx rewrite. But gitlab also requires another important parameter: path per the doc

path | This should be the same directory like specified in Registry's聽rootdirectory. Read the聽storage configuration documentation. This path needs to be readable by the GitLab user, the web-server user and the Registry user. Read more in聽#container-registry-storage-path.

gitlab wants to access the shared registry storage path, this is impossible if the harbor is deployed under different machines with different storage backend such as glusterfs.

MengJueM picture MengJueM on 12 Jan 2018

@hwangjr @It4lik Is it resolved now ?

Runrioter picture Runrioter on 17 Jan 2018

Hey guys, is this still on roadmap?

llozanos81 picture llozanos81 on 16 May 2018

@llozanos81 Not in the mid term I'm afraid.

reasonerjt picture reasonerjt on 16 May 2018

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

stale[bot] picture stale[bot] on 7 Oct 2018

So, this issue will auto closed. But I think this is really a great feature as gitlab is so widely used for companies.

hwangjr picture hwangjr on 8 Oct 2018
👍1

Hi all 鈥撀營 think this is a great idea. As @reasonerjt mentioned above our bandwidth to address this in the short term is rather limited, but we'd love a contribution to help get this working.

If someone is interested in picking this up and running with it to completion please chime in here and I'd be happy to help along the way.

ghost picture ghost on 8 Oct 2018
🎉1 👍1

I cannot +1 this enough

rouing picture rouing on 10 Nov 2018
👍4 🎉1

I was able to use Gitlab Token Auth in Harbor Registry and docker login using cli. But docker pull and Harbor UI is broken, as internal implementations still seem to use the wrong token issuer. #6666. And Gitlab UI is somewhat broken due to the same problem. screenshot

CrystalMethod picture CrystalMethod on 31 Dec 2018

As a PoC I hardcoded the Gitlab Registry settings (issuer +service) and now I have Gitlab Registry support in Harbor. Hurray!

CrystalMethod picture CrystalMethod on 2 Jan 2019
👍1

@CrystalMethod can you share the registry settings for this to work please?

rick-roche picture rick-roche on 4 Jan 2019
👍1

@CrystalMethod can you share the registry settings for this to work please?

It does not work out of the box - there are several things to do:

  1. the hardcoded Harbor specific identifiers need to be replaced by the Gitlab specific
    https://github.com/goharbor/harbor/blob/master/src/core/service/token/authutils.go#L36
    https://github.com/goharbor/harbor/blob/master/src/common/utils/registry/auth/util.go#L30
    https://github.com/goharbor/harbor/blob/master/src/core/service/token/creator.go#L40
    I know this is a hack but I have not yet fully understood the internals to work out a PR.
  2. PEM/CRT files need to injected into Gitlab and Harbor images
  3. since there are no conf variables in harbor.cfg yet you have to manually adjust common/config/registry/config.yml
auth:
  token:
    issuer: gitlab-issuer
    realm: https://gitlab.****.com/jwt/auth
    service: container_registry
    rootcertbundle: /etc/registry/root.crt

screenshot

I could try to publish the images built from my fork.

CrystalMethod picture CrystalMethod on 4 Jan 2019

@CrystalMethod thank you!

rick-roche picture rick-roche on 7 Jan 2019

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

stale[bot] picture stale[bot] on 7 Apr 2019

Bumping this, as I would really love to be using harbor with gitlab's CI, but don't want to have to change files and build myself.

ordinarygulp picture ordinarygulp on 8 May 2019
👍7

still using manually patched sources

CrystalMethod picture CrystalMethod on 15 May 2019

I have this working with native 1.8.0. Added gitlab as docker-registry, created access token for my account on gitlab (personal instance), put username in access id and access token in secret. Setup replication rule with namespace 'user/*' and it pulled all images from gitlab for my user.

ordinarygulp picture ordinarygulp on 26 May 2019

But you know, that Gitlab has access to all projects - no matter if you are member of that project. Otherwise your approach will only work in a very limited and personal setup. Because "pull" and "push" is always done using a registered user. And I'm pretty sure that you are not able to browse the registry within Gitlab (Project -> Registry), right? But I'm fine if this is ok for you.

CrystalMethod picture CrystalMethod on 4 Jun 2019

+1 for this and use with gitlab

bcg62 picture bcg62 on 30 Jun 2019
👍1

+1 for this and use with gitlab

javierpi picture javierpi on 3 Jul 2019

+1 for gitlab

blka picture blka on 11 Jul 2019
👍1

Hi there. Any plans on when the support would be made available - Would be great to have Harbor talking to GITLAB.

tvvignesh picture tvvignesh on 3 Aug 2019
👍1

Hi this a coveted feature for Harbor team as well, does anyone have any interest in working on this?

xaleeks picture xaleeks on 7 Aug 2019
👍1

Usage need Personal Access Tokens in input Access Secret

lxShaDoWxl picture lxShaDoWxl on 9 Sep 2019
👍1

I'm also interested in connecting existing gitlab docker registry to Harbor UI or to connect gitlab app to Harbor's registry with tokens.

mlewiarz picture mlewiarz on 13 Sep 2019
👍15

Any update on this?

devopstales picture devopstales on 22 Feb 2020
👍4

Well, I was trying to configure this from Gitlab side, but I didn't fully succeed with that.

First I've checked existing config which Harbor using for running docker-registry in common/config/registry/config.yml:

version: 0.1
log:
  level: debug
  fields:
    service: registry
storage:
  cache:
    layerinfo: redis
  filesystem:
    rootdirectory: /storage
  maintenance:
    uploadpurging:
      enabled: false
  delete:
    enabled: true
redis:
  addr: redis:6379
  password:
  db: 1
http:
  addr: :5000
  secret: placeholder
  debug:
    addr: localhost:5001
auth:
  token:
    issuer: harbor-token-issuer
    realm: https://harbor.example.org/service/token
    rootcertbundle: /etc/registry/root.crt
    service: harbor-registry
validation:
  disabled: true
notifications:
  endpoints:
  - name: harbor
    disabled: false
    url: http://core:8080/service/notifications
    timeout: 3000ms
    threshold: 5
    backoff: 1s
compatibility:
  schema1:
    enabled: true

Then I found tiny project which allows to generate tokens using just the private key: docker-registry-token-genarator

Thus I have achieved the working tokens generation:

./docker-registry-token-genarator -issuer harbor-token-issuer -key /tmp/key -username kvaps -scope 'repository:some-project/some-repo:pull,push' -service "harbor-registry"

The generated token can be simple checked as described here:

curl -i -k -H "Content-Type: application/json" -H "Authorization:  Bearer $TOKEN" -X GET https://harbor.example.org/v2/some-project/some-repo/manifests/latest

BTW, the generated token can be simple decrypted on jwt.io site.

Then I started configuring Gitlab using this guide

Thus I exported my harbor private key, using this command:

awk '{printf $0 "\\n"} END{printf"\n"}' /data/secret/core/private_key.pem

And updated my /etc/gitlab/gitlab.rbconfig file

Then I've specified few other options: 

registry_external_url 'https://harbor.example.org'
gitlab_rails['registry_enabled'] = true
gitlab_rails['registry_api_url'] = "https://harbor.example.org"
gitlab_rails['registry_issuer'] = "harbor-token-issuer"
registry['internal_key'] = "<private_key content>"
registry['registry_service'] = "harbor-registry"
registry['token_realm'] = "harbor.example.org/service/token"

I also modified /opt/gitlab/embedded/cookbooks/registry/templates/default/registry-config.yml.erb template to make registry_service working:

 auth:
   token:
-    realm: <%= @token_realm %>/jwt/auth
-    service: container_registry
+    realm: <%= @token_realm %>
+    service: <%= @registry_service %>
     issuer: <%= @registry_issuer %>
     rootcertbundle: <%= @rootcertbundle %>
     autoredirect: <%= @autoredirect %>

Finally I was run to reconfigure my Gitlab:

sudo gitlab-ctl reconfigure

Unfortunately it didn't make it working. I don't know why but Gitlab is still generating tokens like this:

CI_REGISTRY_USER=gitlab-ci-token
CI_REGISTRY_PASSWORD=QSzL2ZptbM6y8iKhQvCs

And when docker from the job trying to use these credentials harbor reports error authorizing context: insufficient scope error in /var/log/harbor/registry.log

I'll be glad for any help or guesses with that

related issue on Gitlab.com: https://gitlab.com/gitlab-org/gitlab/-/issues/25948#note_309241844

kvaps picture kvaps on 23 Mar 2020
👍23

@CrystalMethod ping, any suggestions on this?

kvaps picture kvaps on 23 Mar 2020
👍3

Wow, so many 馃憤
Okay I have something to please you
https://medium.com/@kvaps/connecting-gitlab-with-harbor-for-automated-token-issuing-6446f58269a7

kvaps picture kvaps on 25 Apr 2020
👎3 👍3

From what I get from the conversation there are multiple ways that are tested... but not all working...

1/ same registry storage for GitLab and harbor: the hackity trick
2/ merge GitLab and harbor authentication endpoints: does not work because GitLab generates its own repository logins (CI_REGISTRY_USER and CI_REGISTRY_PASSWORD) so in the end, harbor should use the auth endpoint of GitLab

We are discussing the integration between GitLab and harbor.... and I was thinking we would need some automation to achieve this... webhook from GitLab on repository creation and have harbor create a robot account for them.... so kind of option 3: inform gitlab of harbor authentication.

Still pondering this option as it does require some automation...

cblomart picture cblomart on 6 Jul 2020
👍3

Anything new on this one? Would be great to have GitLab as auth endpoint for Harbor...

dansou901 picture dansou901 on 2 Dec 2020

Hey - GitLab PM here. I was wondering if there is anything I can do to help move this forward. We'd really like to provide a way for our shared customers to use both registries.

timrizzi picture timrizzi on 23 Dec 2020
👍3
Was this page helpful?
0 / 5 - 0 ratings

Related issues

reasonerjt picture reasonerjt  路  3Comments
cten picture cten  路  3Comments
272909106 picture 272909106  路  4Comments
levchik picture levchik  路  4Comments
moooofly picture moooofly  路  3Comments