Harbor: Why robot account are scoped to the project ?

Created on 22 May 2019 · 8Comments · Source: goharbor/harbor

Hi,

We don't use ldap auth because we missed local users features for jenkins, kubernetes etc.

In v1.8.0 we now have robot account, great ! But we cannot use a single user/password for multiple projects because robot account are scoped to the project. And docker doens't support multi-account for a registry in a single docker config :/

I wonder why robot account are scoped to the project ?

kinquestion kinrequirement

Source

philpep

👍1

Most helpful comment

Scoped permissions become an issue when an image in one project is expected to extend an image from another project, which is a well used pattern in Docker. Consider the following which is currently not possible with robot accounts:

# Dockerfile for `example.com/my-project/my-image`.
FROM example.com/library/base-image

Running docker build will fail when using a robot account since it is scoped to my-project and will not have any access to library, even if the robot account has both pull and push access on my-project.

pvormittag on 10 Jun 2019

👍2

All 8 comments

From the security perspective, Harbor doesn't store the password(jwt token) of the account, that means, the token cannot be modified once it created. In another word, the robot account cannot be added to another project.

wy65701436 on 22 May 2019

Let's keep this issue open to get more thoughts.

wy65701436 on 22 May 2019

Is it possible to treat the robot account as a normal account, but he has a robot tag. A project corresponds to a robot, which has a great impact on our succession. If we add items here, we need to add robots and then sync to the secret of K8S. It will be difficult to maintain this secret when there are more projects.

qiqizjl on 25 May 2019

# Dockerfile for `example.com/my-project/my-image`.
FROM example.com/library/base-image

pvormittag on 10 Jun 2019

👍2

Hi, everyone. We are currently working through the IP whitelist. Add the network segment of the intranet IP to the ip whitelist, and he has the pull/push permission. This network segment can be set by itself. And you don't need to remember any passwords. But is there a risk in this? Is there a security risk when a machine invades?

qiqizjl on 10 Jun 2019

I have started a topic about it, but it is not scoped to the project, the web UI allow only to set it per project. But with a command-line you can set a robot account for many projects.