当前位置：网站首页>How can I easily manage harbor in multi-user scenarios!

How can I easily manage harbor in multi-user scenarios!

2022-04-21 15:45:00 【Key guest Li Dabai】

‍ Blogger introduction ： Hello everyone ！ I'm Li Dabai , An O & M engineer , Love sharing knowledge , Nice to meet you here

Be good at the field ： Cloud native 、 database 、 Automatic operation and maintenance

If this article is helpful to all of you , Focus on + give the thumbs-up + Comment on + Collection , I'll pay a return visit, too , Help each other ！！！

In addition, my level is limited , Designed to create easy to understand articles , If there is any mistake in the description of the article , Please correct me , In this thank you ！！！

Fallen leaves and know autumn , Knowledgeable and knowledgeable ！

Boutique column ： Harbor vernacular （ Enterprise class ）

What this article shares is Harbor The mirror warehouse is in the actual business scenario , How to manage multiple users .

One 、 Environmental statement

This article is based on Harbor 2.3.1 The version is demo environment , For other versions, please refer to .

DevOps In the environment Harbor Application scenarios of .

Two 、Harbor Several roles in

Multi user scenario Harbor, How I manage easily ！_ Operation and maintenance

System administrator （admin）

namely admin user ,Harbor System administrator ” Have the most permissions （ Maximum authority ）, It can list all items 、 Set ordinary users as administrators 、 Delete users and set vulnerability scanning policies for all images . All items are also owned by the Administrator .

Project manager

When the system administrator （admin） To a user “ Project manager ” After your role , The user can ” Project manager “ Manage the project as , Other unassigned items have no permission ,” Project manager “ The project administrator has image upload / Pull 、 add to / Delete members 、Helm Chart Upload / download 、 Configuration management and other permissions . This role is usually assigned to the person in charge of a project in the actual business scenario .

Multi user scenario Harbor, How I manage easily ！_Harbor_02

Multi user scenario Harbor, How I manage easily ！_ Cloud native _03

developer

The developer has access to the project , That is, upload the image to the project and pull the image from the project 、 Upload / download HelmChart、 Check the log , No other permissions .

Multi user scenario Harbor, How I manage easily ！_docker_04

maintenance staff （ Maintainer ）

Defenders have the power to transcend “ developer ” Authority , Including scanning images 、 View replication tasks and delete mirrors and Helm Chart Upload / download 、 Ability to delete .

Multi user scenario Harbor, How I manage easily ！_ Cloud native _05

Multi user scenario Harbor, How I manage easily ！_kubernetes_06

Multi user scenario Harbor, How I manage easily ！_docker_07

visitor

The guest has read-only access to the specified item . They can pull and relabel images , But you can't push , You can also log in Harbor UI Interface .

Restricted visitors

Restricted visitors do not have full access to the item . They can pull images, but they can't push , And they don't see logs or other members of the project . for example , You can create restricted visitors for users with shared project access from different organizations .

Restricted visitors can also log in Harbor, However, it only has the permission to pull images , Unable to view log and other permissions .

Multi user scenario Harbor, How I manage easily ！_ Operation and maintenance _08

3、 ... and 、Harbor UI The management interface assigns roles to users

If you want to assign a project to （Project) Assigned to a user role , You need to be in 【 System management 】——【 User management 】——【 Create user 】 To create users ; Then go to the specified project ,【 member 】——【+ user 】 To assign permissions to users .

Multi user scenario Harbor, How I manage easily ！_ Cloud native _09

Multi user scenario Harbor, How I manage easily ！_ Operation and maintenance _10

Four 、Harbor Manage users in API

GET	/users/search	Search for users by user name
GET	/users/current/permissions	Get the permission of the current user
GET	/users/current	Get current user information
GET	/users	List users
GET	/users/{user_id}	Get information about a user
PUT	/users/{user_id}/cli_secret	/users/{user_id}/cli_secret
PUT	/users/{user_id}/sysadmin	Update the registered user to Harbor The administrator of .
PUT	/users/{user_id}/password	Modify the password of an existing user .
PUT	/users/{user_id}	Update user profile .
DELETE	/users/{user_id}	Delete the specified user
POST	/users	Create local users , The API Only when the authentication method is local DB When using . When self registration is disabled .

5、 ... and 、 adopt Harbor API Automatic management of users

obtain Harbor User information in

 
       # curl -u admin:Harbor12345 -H "Content-Type: application/json" \
       
       -X GET https:
       
       //192.168.2.250:443/api/v2.0/users \
       
       -
       
       k 
       
       | 
       
       python 
       
       -
       
       m 
       
       json.
       
       tool
       
[
       
  {
       
       "admin_role_in_auth": 
       
       false,   
       
       # 
       
        Whether it is admin Role permissions 
       
       "creation_time": 
       
       "2022-04-14T02:39:08.053Z",   
       
       # 
       
        User creation time 
       
       "email": 
       
       "[email protected]",   
       
       # 
       
        mailbox 
       
       "realname": 
       
       "libai",   
       
       # 
       
        Full Name 
       
       "sysadmin_flag": 
       
       false,   
       
       # 
       
        System administrator tab （false Indicates that you are not a system administrator ）
       
       "update_time": 
       
       "2022-04-14T02:39:08.053Z",   
       
       # 
       
        Update time 
       
       "user_id": 
       
       5,      
       
       # 
       
        user ID（ Globally unique ）
       
       "username": 
       
       "libai" 
       
       # 
       
        user name 
       
   },
       
 {
       
       "admin_role_in_auth": 
       
       false,
       
       "creation_time": 
       
       "2022-04-14T01:18:47.260Z",
       
       "email": 
       
       "[email protected]",
       
       "realname": 
       
       "lidabai",
       
       "sysadmin_flag": 
       
       true,    
       
       # 
       
       true Indicates that the user is a system administrator 
       
       "update_time": 
       
       "2022-04-14T01:18:47.260Z",
       
       "user_id": 
       
       4,
       
       "username": 
       
       "lidabai"
       
  }
       
]
      
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.
14.
15.
16.
17.
18.
19.
20.
21.
22.
23.
24.
25.
26.

：-u Specify user name and password ;

Delete the specified user

 
       [
       
       root
       
       @Over 
       
       ~]
       
       # 
       
       curl 
       
       -
       
       u 
       
       admin:
       
       Harbor12345  
       
       \
       
       -
       
       H 
       
       "Content-Type: application/json" 
       
       -
       
       X 
       
       DELETE  
       
       \
       
       https:
       
       //192.168.2.250:443/api/v2.0/users/5 -k
      
1.
2.
3.

Check again and find that just now ID by 5 Your user has been successfully deleted .

Multi user scenario Harbor, How I manage easily ！_docker_11

Find the specified user

lookup lidabai This user , adopt ?username= User name criteria to find users , The result will show the user's ID And the user name , If the user doesn't exist , Return null value .

 
       [
       
       root
       
       @Over 
       
       ~]
       
       # 
       
       curl 
       
       -
       
       u 
       
       admin:
       
       Harbor12345  
       
       \
       
       -
       
       H 
       
       "Content-Type: application/json" 
       
       -
       
       X 
       
       GET 
       
       \
       
       https:
       
       //192.168.2.250:443/api/v2.0/users/search?username=lidabai \
       
       -
       
       k  
       
       | 
       
       python 
       
       -
       
       m 
       
       json.
       
       tool
       
       % 
       
       Total    
       
       % 
       
       Received 
       
       % 
       
       Xferd  
       
       Average 
       
       Speed   
       
       Time    
       
       Time     
       
       Time  
       
       Current
       
       Dload  
       
       Upload   
       
       Total   
       
       Spent    
       
       Left  
       
       Speed
       
       100    
       
       37  
       
       100    
       
       37    
       
       0     
       
       0   
       
       1468      
       
       0 
       
       --:
       
       --:
       
       -- 
       
       --:
       
       --:
       
       -- 
       
       --:
       
       --:
       
       --  
       
       1480
       
[
       
    {
       
       "user_id": 
       
       4,       
       
       "username": 
       
       "lidabai"
       
    }
       
]
      
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.
14.

Multi user scenario Harbor, How I manage easily ！_kubernetes_12

Query the details of the current user

Current user refers to the current connected user .

 
       [
       
       root
       
       @Over 
       
       ~]
       
       # 
       
       curl 
       
       -
       
       u 
       
       admin:
       
       Harbor12345  
       
       \
       
       -
       
       H 
       
       "Content-Type: application/json" 
       
       -
       
       X 
       
       GET 
       
       \
       
       https:
       
       //192.168.2.250:443/api/v2.0/users/current \
       
       -
       
       k  
       
       | 
       
       python 
       
       -
       
       m 
       
       json.
       
       tool
       
{
       
       "admin_role_in_auth": 
       
       false,
       
       "comment": 
       
       "admin user",    
       
       # 
       
        describe 
       
       /
       
        notes , That is, the user is admin role 
       
       "creation_time": 
       
       "2021-11-05T07:45:36.052Z",
       
       "realname": 
       
       "system admin",   
       
       # 
       
        System users 
       
       "sysadmin_flag": 
       
       true,   
       
       # 
       
        yes （ no ） It's the administrator 
       
       "update_time": 
       
       "2022-04-13T09:02:08.704Z",
       
       "user_id": 
       
       1,
       
       "username": 
       
       "admin"
       
}
      
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.
14.

Command line creation Harbor user

The API Only when the authentication method is local DB When using . When self registration is disabled .

 
       [
       
       root
       
       @Over 
       
       ~]
       
       # 
       
       curl 
       
       -
       
       X 
       
       POST 
       
       "http://192.168.2.250/api/v2.0/users" 
       
       \
       
       -
       
       H 
       
       "accept: application/json" 
       
       \
       
       -
       
       H 
       
       "Content-Type: application/json" 
       
       \
       
       -
       
       d 
       
       "{ \
       
       "
       
       comment
       
       \
       
       ": \"hanxin\", \
       
       "
       
       username
       
       \
       
       ": \"hanxin\", \
       
       "
       
       password
       
       \
       
       ": \"Harbor12345\", \
       
       "
       
       email
       
       \
       
       ": \"[email protected]\", \
       
       "
       
       realname
       
       \
       
       ": \"hanxin\"}"
      
1.
2.
3.
4.
5.
6.
7.
8.
9.