Manage access to registry using groups

[qits-kkruse]

Ask a Question!

I have a custom registry:

services:
  registry:
    image: registry:2
    container_name: docker-registry
    restart: unless-stopped
    environment:
      - REGISTRY_AUTH=htpasswd
      - REGISTRY_AUTH_HTPASSWD_REALM=Registry Realm
      - REGISTRY_AUTH_HTPASSWD_PATH=/auth/htpasswd
      - REGISTRY_STORAGE_FILESYSTEM_ROOTDIRECTORY=/var/lib/registry
    volumes:
      - registry-data:/var/lib/registry
      - registry-auth:/auth
    labels:      
      - "traefik.http.routers.docker_registry_tls.entrypoints=websecure"
      - "traefik.http.routers.docker_registry_tls.rule=Host(`docker-registry.mylan.local`)"
      - "traefik.http.routers.docker_registry_tls.tls=true"
      - "traefik.http.middlewares.https_redirect.redirectscheme.scheme=https"
      - "traefik.http.routers.docker_registry.middlewares=https_redirect"
      - "traefik.http.routers.docker_registry.entrypoints=web"
      - "traefik.http.routers.docker_registry.rule=Host(`docker-registry.mylan.local`)"
      - "traefik.http.services.docker_registry.loadbalancer.server.port=5000"
      - "traefik.enable=true"
      - "traefik.docker.network=traefik-public"
    networks:
      - traefik-public

volumes:
  registry-data:
    external: true
  registry-auth:
    external: true

networks:
  traefik-public:
    external:
      name: traefik-public

Works fine. So i added it to Portainer as a custom registry with authentication.

I have two Environments, Test Server and Prod Server, connected via Portainer Agent. I have three groups defined (A, B and C).

Now, when managing access to the registry on the Test Server, i can select only group A. Can't select B or C. On the Prod Server i can only select the group B, but neither A nor C.

Any idea what the cause could be? I would expect to see all three groups that i have when i manage access to the registry in the Environment.

[mikespook]

Hi @qits-kkruse Can I know which version of Portainer you are using?

[qits-kkruse]

Portainer is 2.33.3 LTS and the Agents are latest as of today (not sure where the version string hides).

To reproduce you create three user groups, A, B, C. Then add a custom registry with authentication. Then you add two Agents, ServerA and ServerB and manage access to the registry on ServerA, then ServerB. You can only add one group on ServerA and the same group can't have access on ServerB.

[mikespook]

Thank you for the detailed reproducing instruction.

Can you show me the roles on both ServerA and ServerB of your teams?

For example, in the screenshot, users foo, bar and team-one which are Standard User role will be showing in the registry access dropdown list. While the other two won't show in it because they already have the access of the registry in the environment.

We will improve the UI design to make it more clear and obvious in the following version.

But feel free contact us if it's not align to your case. Cheers!