When working with Harbor you can expect to run into the following issues:
Unfortunately Harbor has not yet delivered a user friendly mechanism for users to interface with their registry via docker cli. To use docker cli one has to login with the registry EVERY time before using the cli. At the same time this fails when one is not logged into the Harbor dashboard beforehand. In order to login without issues one has to follow these steps:
- ONLY ONCE: get the cli secret from the Harbor dashboard (via User Profile).
- refresh Harbor dashboard web view (this will refresh the OIDC auth token)
- docker login using the cli secret as password:
docker login harbor.<cluster-domain> -u < User_Name > -p <CLI secret>
- do your docker pull/push etc within the token TTL window (60 secs)
Usually this is not a problem as team users don't pull or push these images directly. We are working on solving this, and expect to have a fix soon.
Error while logging in to harbor with OIDC:
Conflict, the user with same username or email has been onboarded..
By redeploing keycloak the same user gets a new
sub claim in
openid scope. Harbor uses
iss claims in order to match them to a user from its database (see:
subiss column at
oidc_user table in
registry database). If the same user identifies with a new sub then harbor tries to create a new entry in the
harbor_user database table and it fails on the username column uniqueness constraint.
Please check up on this link when this problem occurs, because a fix might already be released: goharbor/harbor#13674. If so, please create a PR to fix this in the otomi-core repo, or create an issue there. Otherwise continue:
Connect to the database service
Find out the
Remove the user from the database
Try to login once again and observe that you are asked to confirm your username.