Sign in to Docker and Helm

This document describes how to sign in to Docker or Helm using CLI secrets.

Harbor registry instances in Google Distributed Cloud (GDC) air-gapped appliance use Identity-Aware Proxy (IAP) for authentication. After you sign in to the Harbor web interface using IAP for the first time, you can retrieve a static CLI secret from your Harbor user profile and use it as your password when signing in from the Docker or Helm CLI. This method is only available with the Harbor UI.

Before you begin

Required IAM roles

To configure authentication for Harbor registry instances, contact your Project IAM Admin to request the Harbor Instance Viewer (harbor-instance-viewer) role, which lets you get, list, and watch Harbor instances in the project namespace. This role includes the required permissions to view the details of existing Harbor instances so you can retrieve the registry URLs for authentication.

Sign in with CLI secrets

To sign in to Docker or Helm with CLI secrets, follow these steps:

  1. Sign in to Harbor with an IAP user account.
  2. Click your username and select User Profile.
  3. To copy the CLI secret associated with your account, click Copy.

  4. Optional: To display buttons for automatically generating or manually creating a new CLI secret, click More in your user profile.

  5. If you generated a new CLI secret, click Copy to copy it.

  6. Use your CLI secret as the password when signing in to Harbor from the Docker or Helm CLI:

    docker login -u USERNAME -p CLI_SECRET HARBOR_INSTANCE_URL

    Replace the following:

    • USERNAME: the Harbor account username.
    • CLI_SECRET: the generated CLI secret.
    • HARBOR_INSTANCE_URL: the URL of the Harbor instance.