Harbor: Harbor behind traefik in swarm cluster

[cchan6700]

I deploy harbor in swarm and have traefik in front of the cluster to proxy services in the cluster. I had traefik handle the SSL cert and configure harbor to use http only

traefik version: v1.3.4
docker version: 17.03.0-ce
harbor version: 1.1.2

I got the following error when I try to "docker login [harbor dns name]"
Error response from daemon: Get https://[harbor dns name]/v2/: unauthorized: authentication required

here are the logs

registry.log
Aug 2 17:02:47 10.255.0.3 registry[10755]: time="2017-08-02T17:02:47.302682035Z" level=warning msg="error authorizing context: authorization token required" go.version=go1.7.5 http.request.host=[harbor dns name] http.request.id=d67eacd4-40fe-4731-858f-0698e4e837e8 http.request.method=GET http.request.remoteaddr=10.255.0.3 http.request.uri="/v2/" http.request.useragent="docker/17.06.0-ce go/go1.8.3 git-commit/02c1d87 kernel/4.4.0-87-generic os/linux arch/amd64 UpstreamClient(Docker-Client/17.06.0-ce \(linux\))" instance.id=6868d8c7-b920-4aa1-ac93-014711dcac3e service=registry version=v2.6.1

ui.log
Aug 2 17:01:03 10.255.0.4 ui[11447]: 2017-08-02T17:01:03Z [DEBUG] [token.go:35]: URL for token request: /service/token?account=[username]&client_id=docker&offline_token=true&service=harbor-registry
Aug 2 17:01:03 10.255.0.4 ui[11447]: 2017-08-02T17:01:03Z [DEBUG] [creator.go:206]: scopes: []
Aug 2 17:01:03 10.255.0.4 ui[11447]: 2017-08-02T17:01:03Z [WARNING] Failed to get secret cookie, error: http: named cookie not present
Aug 2 17:01:03 10.255.0.4 ui[11447]: 2017-08-02T17:01:03Z [DEBUG] [authenticator.go:59]: Current AUTH_MODE is db_auth
Aug 2 17:01:03 10.255.0.4 ui[11447]: 2017-08-02T17:01:03Z [DEBUG] [authenticator.go:71]: Login failed, locking , and sleep for 1.5s
Aug 2 17:01:05 10.255.0.4 ui[11447]: 2017-08-02T17:01:05Z [WARNING] Invalid credentials for uid:

proxy.log
Aug 2 16:59:47 10.255.0.3 proxy[10755]: 10.0.0.3 - "GET /v2/ HTTP/1.1" 401 87 "-" "docker/17.06.0-ce go/go1.8.3 git-commit/02c1d87 kernel/4.4.0-87-generic os/linux arch/amd64 UpstreamClient(Docker-Client/17.06.0-ce \x5C(linux\x5C))" 0.002 0.002 .
Aug 2 16:59:48 10.255.0.3 proxy[10755]: 10.0.0.3 - "GET /service/token?account=[user]&client_id=docker&offline_token=true&service=harbor-registry HTTP/1.1" 401 0 "http://[harbor dns name]/service/token?account=[user]&client_id=docker&offline_token=true&service=harbor-registry" "docker/17.06.0-ce go/go1.8.3 git-commit/02c1d87 kernel/4.4.0-87-generic os/linux arch/amd64 UpstreamClient(Docker-Client/17.06.0-ce \x5C(linux\x5C))" 1.500 1.500 .

Thanks

[reasonerjt]

Aug 2 17:01:05 10.255.0.4 ui[11447]: 2017-08-02T17:01:05Z [WARNING] Invalid credentials for uid:

looks you input wrong password?

[cchan6700]

I can login to the UI but docker login failed with the same username/password

[reasonerjt]

noticed the log there's no username in your log

Aug 2 17:01:03 10.255.0.4 ui[11447]: 2017-08-02T17:01:03Z [DEBUG] [authenticator.go:71]: Login failed, locking , and sleep for 1.5s

On my env if I input a wrong password when login with admin this message would look like this:

Aug  5 16:47:02 172.21.0.1 ui[20318]: 2017-08-05T08:47:02Z [DEBUG] [authenticator.go:71]: Login failed, locking admin, and sleep for 1.5s

It looks like traefik dropped the basic auth header?

[cchan6700]

Thanks guys, got if fix, since I did not use the nginx reverse provy, harbor.cfg does not specify using https, I need to modify adminserver and registry end point for harbor, I can now successfully login to harbor and push images into the registry.

[kmeekva]

Can you share your traefik configuration? If I run harbor.cfg in http only mode and proxy traffic from traefik to the proxy harbor service with these tags:

proxy:
image: vmware/nginx-photon:1.11.13
container_name: nginx
restart: always
labels:
- "traefik.frontend.passHostHeader=true"
- "traefik.frontend.rule=Host:dev-reg.meekconsulting.com"
- "traefik.backend=nginx"
- "traefik.docker.network=web"
- "traefik.enable=true"
- "traefik.port=80"

I am able to log in to the web interface -- but when I try to log in using docker login -- it fails authorization.

Error response from daemon: Get https://[harbor dns name]/v2/: unauthorized: authentication required

cchan6700 mentioned modifying adminserver and registry as endpoints. Can you share your traefik tags or configuration?

[cchan6700]

I don't use nginx as the reverse proxy, just traefik, here is what I add to the docker-compose.yml

registry labels:
- "traefik.docker.network=web"
- "traefik.frontend.rule=Host:;PathPrefix:/v2/"
- "traefik.port=5000"

ui labels:
- "traefik.docker.network=web"
- "traefik.frontend.rule=Host:"
- "traefik.port=80"

I let traefik handle the ssl encryption using letsencrypt so you have to modify the env file for adminserver
and registry config.yml to use https address

[kmeekva]

Thank you – this is exactly what I want to do.

So you didn’t have to change any of the nginx config because you don’t route any traffic to that – could we not spin up nginx at all ( I’m thinking I can remove it from the docker-compose.yml

I’ll give it a try tonight!

Kevin

From: cchan6700 [mailto:[email protected]]
Sent: Thursday, September 14, 2017 10:57 AM
To: vmware/harbor
Cc: Kevin Meek; Comment
Subject: Re: [vmware/harbor] Harbor behind traefik in swarm cluster (#2948)

I don't use nginx as the reverse proxy, just traefik, here is what I add to the docker-compose.yml

registry labels:

• "traefik.docker.network=web"
• "traefik.frontend.rule=Host:;PathPrefix:/v2/"
• "traefik.port=5000"

ui labels:

• "traefik.docker.network=web"
• "traefik.frontend.rule=Host:"
• "traefik.port=80"

I let traefik handle the ssl encryption using letsencrypt so you have to modify the env file for adminserver
and registry config.yml to use https address

—
You are receiving this because you commented.
Reply to this email directly, view it on GitHubhttps://github.com/vmware/harbor/issues/2948#issuecomment-329508891, or mute the threadhttps://github.com/notifications/unsubscribe-auth/AVgA0NfXRenpR3ECZPZLWOrcHIQ_7u0eks5siT7SgaJpZM4Ore3S.

[kmeekva]

I set up my traefik frontend rules as you indicated and it looks from the logs that my docker login attempts are reaching the registry service. But I'm unable to log in from docker command line:

root@test1:~# docker login https://xxxx.xxxx.com
Username: kmeek
Password:
Error response from daemon: Get https://xxxx.xxxx.com/v2/: unauthorized: authentication required

In the registry.log I see message "error authorizing context authorization token required"

Is there something in the headers not being passed through?

Here is the registry.log
Sep 15 00:32:06 172.20.0.1 registry[358]: time="2017-09-15T00:32:05.675450846Z" level=debug msg="authorizing request" go.version=go1.7.3 http.request.host=reg.meekconsulting.com http.request.id=414930a8-8f2a-4a7c-93ba-82adc56cce76 http.request.method=GET http.request.remoteaddr=159.203.182.124 http.request.uri="/v2/" http.request.useragent="docker/17.05.0-ce go/go1.7.5 git-commit/89658be kernel/4.4.0-87-generic os/linux arch/amd64 UpstreamClient(Docker-Client/17.05.0-ce \(linux\))" instance.id=51cee24e-97d3-48e4-903d-1de51693181d service=registry version=v2.6.2
Sep 15 00:32:07 172.20.0.1 registry[358]: time="2017-09-15T00:32:07.431772592Z" level=warning msg="error authorizing context: authorization token required" go.version=go1.7.3 http.request.host=xxxx.xxxx.com http.request.id=414930a8-8f2a-4a7c-93ba-82adc56cce76 http.request.method=GET http.request.remoteaddr=159.203.182.124 http.request.uri="/v2/" http.request.useragent="docker/17.05.0-ce go/go1.7.5 git-commit/89658be kernel/4.4.0-87-generic os/linux arch/amd64 UpstreamClient(Docker-Client/17.05.0-ce \(linux\))" instance.id=51cee24e-97d3-48e4-903d-1de51693181d service=registry version=v2.6.2

[cchan6700]

Did you modify the adminserver env file (common/config/adminserver/env), registry config.yml (common/config/registry/config.yml)?

I have the same problem before I update these two files to use https://xxx.xxx.com

[bweston92]

@cchan6700 can you take a look at #2868 and see if your Swarm deployment is suitable for a PR?