Harbor 2.7 CLI Credentials for Harbor users
A user can connect the harbor instance programmatically ONLY using generated CLI secret. The password used to log in to the DevOps toolchain will not work. The options to connect to:
- connect to the Docker Registry using the docker command or any OCI client
- connect to the Helm chart repository using the helm command
Create CLI secret
The CLI secret can be created by any user from the Harbor User Interface. At first, login to your harbor instance using Keycloak (LOGIN VIA OIDC PROVIDER):
In the upper right corner, click on your username field and then click User Profile:
You will be prompted to the profile overview, where the CLI Secret can be found:
Description of the fields:
Field | Remark |
|---|---|
Username | The automatically setup username which will be used for docker login etc. |
Your email. Can't be changed (even if it looks like you can, it won't) | |
CLI Secret | The automatically generated secret for command line interfaces. Used instead of password. |
Use the copy icon on the right to copy the CLI secret and use it for authentication.
Authenticate with a CLI Secret
To use a secret in an automated process, use docker login and provide the credentials like username and CLI secret (for password) before you issue additional commands like docker pull or docker push.
Username: <username>
Password: <cli_secret>
docker pull registry-CUSTOMER.devops.t-systems.net/PKEY/REPO:TAG
See the following table to understand the structure of the arguments.
Placeholder | Description |
|---|---|
CUSTOMER | Name of your DevOps-as-a-Service instance |
PKEY | Project Key of the Project like on the Portal |
REPO | The image repository, e.g. tomcat |
TAG | The tag of the image, e.g. latest |
For pulling from a repository, you need at least a VIEWER role. For pushing, you require at least a DEVELOPER role for the affected project.
When done working, you can use docker logout to remove cached credentials from the file-system where your docker commands are executed.
Update/Set Custom CLI Secret
You can refresh a CLI secret after it's created in the event that you need a new one.
For that you will need again go to your user profile and click the three dots on the right-hand side:
You will be prompted to update interface:
From here you can GENERATE SECRET and copy it or click UPLOAD YOUR OWN SECRET and use a predefined one:
