Document URL: https://docs.openshift.com/container-platform/3.4/install_config/registry/accessing_registry.html#access
Section Number and Name: Installation and Configuration - Accessing the Registry - Accessing the Registry Directly
Describe the issue:
It gives special roles to normal users like "system:registry" and "system:image-builder". They are roles for system users (in other words service accounts), the "system:registry" for service account default/registry and "system:image-builder" for service account */builder.
These "system:" roles are not supposed to bind to normal users.
Also it gives "admin" role to a user on openshift project, which is too wide and not recommended.
Suggestions for improvement:
To allow a user to docker push to particular project, we need:
oadm policy add-role-to-user registry-editor USERNAME -n PROJECT
For example, user joe and project openshift:
oadm policy add-role-to-user registry-editor joe -n openshift
For pull only acceess we can use "registry-viewer" role, also worth to put here.
Updated the docs with suggestions in https://github.com/openshift/openshift-docs/pull/8919
@tkimura Can you please review the changes in https://github.com/openshift/openshift-docs/pull/8919
Added review comment.
Commit pushed to master at https://github.com/openshift/openshift-docs
Merge pull request #8919 from gaurav-nelson/bug1419384-fixes
added registry-editor and registry-viewer roles info
Updates are live now from OCP 3.5 onward https://docs.openshift.com/container-platform/3.5/install_config/registry/accessing_registry.html#access-user-prerequisites