Multiple user authentication for Docker Private Registry running inside Kubernetes

Question

I'm running a docker private registry inside a kubernetes cluster using the standard registry:2 image. The image has basic functionality to provide user authentication using the Apache htpasswd utility. In my case multiple users need to access the repository and therefore need to setup username passwords for multiple different users. What would be the best approach to implement this.

I got the single user htpsswd based authentication working, but does not seem to find a way to enable auth for multiple users i.e. having proper access control.

The registry is SSL enabled.(TLS at the ingress level)

Answer 1

There are multiple ways this could be done. First of all its possible to have multiple users in the htpasswd file. It was not working with docker becasue docker required the passwords to be hashed using bcrypt algorithm.

Use the -B flag while creating the htpasswd file.

sudo htpasswd -c -B /etc/apache2/.htpasswd <username1>

Another way this could be done, is using nginx authentication annotations.

nginx.ingress.kubernetes.io/auth-url: "url to auth service"

If the service return 200, nginx forwards the request or else returns authentication error response. With this you could have a lot of custom logic as you create and manage the authentication server.