Skip to content
Snippets Groups Projects

[upstream] Allow pull from repository only for authenticated users and robot accounts with long lived credentials

    • Open Issue created by Spyridon Trigazis @strigazi

    Draft issue:

    Is your feature request related to a problem? Please describe. In a harbor deployment, administrators may want to allow pull access to all authenticated users for a repository, usually in environments with OIDC or LDAP that the set of users is not known beforehand.

    A specific use-case is proxy-cache repositories open to the internet that can potentially create copyright or licencing issues with public registries. For example, dockerhub and other registries have rate limits and if a harbor deployment is open to the internet with a public proxy-cache repo, everyone can bypass protections configured in the public registry.

    Another use case is for a private repository in a public harbor registry, allow access to everyone in an organization. Our organization has ~60,000 members.

    Possible solutions: One solution that has limitations is, create a private repository and give a catch all group the Limited Guest role. The limitation is that users can not create robot accounts for that repository and their personal OIDC token needs refresh which is a problem for automation CI/CD, access from kubernetes etc.

    Another solution is an L7 policy in the LoadBalancers/Ingress but this requires knowledge for all network domain beforehand.

    Describe the solution you'd like Two items must be addressed.

    a. allow all authenticated users with a new option. (there is the anonymous role https://goharbor.io/docs/main/administration/managing-users/, we can say with an option, reject anonymous) This can be worked around with a catch all users approach, but in my opinion it's a hack.

    b. long lived credentials Allow users to create user robot accounts or personal tokens with permisssions granularity. For example gitlab let users create token with specific permissions. Dockerhub allows the creation of personal token but without any granularity on permissions.

    I'm happy to dig more into the design, but let's discuss the need for this first.

    Edited

    Designs

      Child items ...

      2. Activity

      Please register or sign in to reply