Harbor默认安装时，采用Bearer认证。下面我们来测试一下Harbore-registry如下三个API，并借以了解Bearer认证的大体流程：

首先我们测试一下:

# curl -ikL -X GET http://192.168.69.128/v2
HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Mon, 09 Apr 2018 09:09:26 GMT
Content-Type: text/html
Content-Length: 178
Location: http://192.168.69.128/v2/
Connection: keep-alive

HTTP/1.1 401 Unauthorized Server: nginx Date: Mon, 09 Apr 2018 09:09:26 GMT Content-Type: application/json; charset=utf-8 Content-Length: 87 Connection: keep-alive Docker-Distribution-Api-Version: registry/2.0 Set-Cookie: beegosessionID=f7c73dc9e006a967b95cac49c1; Path=/; HttpOnly Www-Authenticate: Bearer realm=”http://192.168.69.128/service/token”,service=“harbor-registry”

{“errors”:[{“code”:“UNAUTHORIZED”,“message”:“authentication required”,“detail”:null}]}

我们发现提示。通过查看相关文档及上面的错误提示，我们应该先获取token，然后再进行访问。

1) 获取token

讯享网# curl -ikL -X GET -u admin:Harbor12345 http://192.168.69.128/service/token?account=admin&service=harbor-registry HTTP/1.1 200 OK Server: nginx Date: Mon, 09 Apr 2018 09:22:53 GMT Content-Type: application/json; charset=utf-8 Content-Length: 1100 Connection: keep-alive Set-Cookie: beegosessionID=946e433f64d7b3f6f25f1c194de1573b; Path=/; HttpOnly { "token": "_ThyL4OfJUCg", "expires_in": 1800, "issued_at": "2018-04-09T09:22:53Z" } 

注意上面为了显示，我们对字段进行了适当的裁剪。

2) 查询API版本号

[root@localhost test]# curl -ikL -X GET -H "Content-Type: application/json" -H "Authorization: Bearer _ThyL4OfJUCg" http://192.168.69.128/v2
HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Mon, 09 Apr 2018 09:27:01 GMT
Content-Type: text/html
Content-Length: 178
Location: http://192.168.69.128/v2/
Connection: keep-alive

HTTP/1.1 200 OK
Server: nginx
Date: Mon, 09 Apr 2018 09:27:01 GMT
Content-Type: application/json; charset=utf-8
Content-Length: 2
Connection: keep-alive
Docker-Distribution-Api-Version: registry/2.0
Set-Cookie: beegosessionID=192d5078479411d2c59fa4318b31a3ea; Path=/; HttpOnly

可以看到上面返回，表明当前所用registry API确实为v2版本。(注意上面后面为完整的token值，这里进行了适当裁剪)

讯享网# curl -ikL -X GET http://192.168.69.128/v2/_catalog HTTP/1.1 401 Unauthorized Server: nginx Date: Mon, 09 Apr 2018 09:31:43 GMT Content-Type: application/json; charset=utf-8 Content-Length: 145 Connection: keep-alive Docker-Distribution-Api-Version: registry/2.0 Set-Cookie: beegosessionID=aef9ca966c37848f3232f16f8; Path=/; HttpOnly Www-Authenticate: Bearer realm=”http://192.168.69.128/service/token”,service=“harbor-registry”,scope=“registry:catalog:*”

{“errors”:[{“code”:“UNAUTHORIZED”,“message”:“authentication required”,“detail”:[{“Type”:“registry”,“Class”:“”,“Name”:“catalog”,“Action”:””}]}]}

这里我们看到提示错误。因此下面我们要获取相应token，然后再访问。

# curl -ikL -X GET -u admin:Harbor12345 http://192.168.69.128/service/token?account=admin&service=harbor-registry&scope=registry:catalog:

{ “token”: “A7yfEdUBYD3bDhLM”, “expires_in”: 1800, “issued_at”: “2018-04-09T09:33:52Z”

注意上面为了显示，我们对字段进行了适当的裁剪。

2） 查询仓库中的镜像

讯享网# curl -ikL -X GET -H “Content-Type: application/json” -H “Authorization: Bearer LA7yfEdUBYD3bDhLM” http://192.168.69.128/v2/_catalog HTTP/1.1 200 OK Server: nginx Date: Mon, 09 Apr 2018 09:36:35 GMT Content-Type: application/json; charset=utf-8 Content-Length: 34 Connection: keep-alive Docker-Distribution-Api-Version: registry/2.0 Set-Cookie: beegosessionID=1b84e760ab0f06680e56e28818; Path=/; HttpOnly

{“repositories”:[“library/redis”]}

上面我们看到返回仓库中的镜像有。(注意上面后面为完整的token值，这里进行了适当裁剪)

# curl -ikL -X GET http://192.168.69.128/v2/library/redis/tags/list HTTP/1.1 401 Unauthorized Server: nginx Date: Mon, 09 Apr 2018 09:41:32 GMT Content-Type: application/json; charset=utf-8 Content-Length: 156 Connection: keep-alive Docker-Distribution-Api-Version: registry/2.0 Set-Cookie: beegosessionID=c3054d54b29b37572ae507b7a39341a7; Path=/; HttpOnly Www-Authenticate: Bearer realm=”http://192.168.69.128/service/token”,service=“harbor-registry”,scope=“repository:library/redis:pull”

{“errors”:[{“code”:“UNAUTHORIZED”,“message”:“authentication required”,“detail”:[{“Type”:“repository”,“Class”:“”,“Name”:“library/redis”,“Action”:“pull”}]}]}

1) 获取token

讯享网# curl -ikL -X GET -u admin:Harbor12345 http://192.168.69.128/service/token?account=admin&service=harbor-registry&scope=repository:library/redis:pull HTTP/1.1 200 OK Server: nginx Date: Mon, 09 Apr 2018 09:42:37 GMT Content-Type: application/json; charset=utf-8 Content-Length: 1196 Connection: keep-alive Set-Cookie: beegosessionID=2fb20f4b6188c6c5aaafcffe2408bc88; Path=/; HttpOnly

{ “token”: “PZxiZYBNkaxp78fs”, “expires_in”: 1800, “issued_at”: “2018-04-09T09:42:37Z” }

注意上面为了显示，我们对字段进行了适当的裁剪。

2) 查询镜像标签

讯享网

# curl -ikL -X GET -H “Content-Type: application/json” -H “Authorization: Bearer PZxiZYBNkaxp78fs” http://192.168.69.128/v2/library/redis/tags/list HTTP/1.1 200 OK Server: nginx Date: Mon, 09 Apr 2018 09:44:25 GMT Content-Type: application/json; charset=utf-8 Content-Length: 43 Connection: keep-alive Docker-Distribution-Api-Version: registry/2.0 Set-Cookie: beegosessionID=bae4b316f5ffe1f41df9ac45b51736fa; Path=/; HttpOnly

{“name”:“library/redis”,“tags”:[“alpine”]}

上面我们看到镜像的标签为。(注意上面后面为完整的token值，这里进行了适当裁剪)

讯享网# curl -ikL -X GET http://192.168.69.128/v2/library/redis/manifests/latest HTTP/1.1 401 Unauthorized Server: nginx Date: Mon, 09 Apr 2018 09:48:41 GMT Content-Type: application/json; charset=utf-8 Content-Length: 156 Connection: keep-alive Docker-Distribution-Api-Version: registry/2.0 Set-Cookie: beegosessionID=68be9fa8be88c2627f1c2a7b73aff7ab; Path=/; HttpOnly Www-Authenticate: Bearer realm=”http://192.168.69.128/service/token”,service=“harbor-registry”,scope=“repository:library/redis:pull”

{“errors”:[{“code”:“UNAUTHORIZED”,“message”:“authentication required”,“detail”:[{“Type”:“repository”,“Class”:“”,“Name”:“library/redis”,“Action”:“pull”}]}]}

1) 获得token

# curl -ikL -X GET -u admin:Harbor12345 http://192.168.69.128/service/token?account=admin&service=harbor-registry&scope=repository:library/redis:pull HTTP/1.1 200 OK Server: nginx Date: Mon, 09 Apr 2018 09:49:51 GMT Content-Type: application/json; charset=utf-8 Content-Length: 1196 Connection: keep-alive Set-Cookie: beegosessionID=ceff01770bad8aa8751a9b4e7a; Path=/; HttpOnly

{ “token”: “DGYtO4VfXttRh_WNs”, “expires_in”: 1800, “issued_at”: “2018-04-09T09:49:51Z” }

注意上面为了显示，我们对字段进行了适当的裁剪。

2) 获取镜像Manifest

讯享网# curl -ikL -X GET -H “Accept: application/vnd.docker.distribution.manifest.v2+json” -H “Authorization: Bearer DGYtO4VfXttRh_WNs” http://192.168.69.128/v2/library/redis/manifests/alpine HTTP/1.1 200 OK Server: nginx Date: Mon, 09 Apr 2018 09:57:51 GMT Content-Type: application/vnd.docker.distribution.manifest.v2+json Content-Length: 1568 Connection: keep-alive Docker-Content-Digest: sha256:9d017f829df3d0800f2a2582cf6dda4df584be73b1a1b6db3 Docker-Distribution-Api-Version: registry/2.0 Etag: “sha256:9d017f829df3d0800f2a2582cf6dda4df584be73b1a1b6db3” Set-Cookie: beegosessionID=0bcee40b8b46feaffa29d024e32f8d5c; Path=/; HttpOnly

{ “schemaVersion”: 2, “mediaType”: “application/vnd.docker.distribution.manifest.v2+json”, “config”: {

 "mediaType": "application/vnd.docker.container.image.v1+json", "size": 5084, "digest": "sha256:c27fa7a6b4666c7861d9a8cac3f6eec6a2fd296a39fdd" 

}, “layers”: [

讯享网 { "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip", "size": , "digest": "sha256:ff3a5c916c92643ff77519ffa742d3ec61b7f591b6bd95a4a41134e28" }, { "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip", "size": 1252, "digest": "sha256:aae70a2e60279ffae89150a59b81fe10d1d81f341ef6f31b9714ea6cc" }, { "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip", "size": 8554, "digest": "sha256:87c655da471c9a7d8f946ec7b04a6a72a98ae8c1734bddf4bb5638fe20" }, { "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip", "size": , "digest": "sha256:6c09203c8aba31fcd20a3a434a3ee9b94fd7a0a2bc52e1f1cbfc4f1db053da08" }, { "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip", "size": 98, "digest": "sha256:90b6d4891e7fceff0dad2e9dc885d06b932ab6095f34f72ddc774e93fe4258ab" }, { "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip", "size": 402, "digest": "sha256:ffb22fabbe68f3edea917d3dba9cb8868d31dd6cf5b9330a9e3e1c8e4e" } 

] }

上面我们获取到了镜像的manifests。(注意上面后面为完整的token值，这里进行了适当裁剪)

[参考]

1. Harbor FAQs