{"record":{"id":"4390906d5fefc1ee","repo":"goharbor/harbor","slug":"this-operation-only-allowed-for-admin","errorCode":null,"errorMessage":"This operation only allowed for admin","messagePattern":"This operation only allowed for admin","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"tools/migrate_chart/migrate_chart.py","lineNumber":115,"sourceCode":"\n        oci_ref = \"oci://{host}/{project}\".format(\n            host=hostname,\n            project=self.project)\n\n        return subprocess.run([MIGRATE_CHART_SCRIPT, HELM_CMD, self.filepath, oci_ref],\n        text=True, stdout=subprocess.DEVNULL, stderr=subprocess.PIPE)\n\n\n@click.command()\n@click.option('--hostname', default='127.0.0.1', help='the password to login harbor')\n@click.option('--username', default='admin', help='The username to login harbor')\n@click.option('--password', default='Harbor12345', help='the password to login harbor')\ndef migrate(hostname, username, password):\n    \"\"\"\n    Migrate chart v2 to harbor oci registry\n    \"\"\"\n    if username != 'admin':\n        raise Exception('This operation only allowed for admin')\n    subprocess.run([CA_UPDATE_CMD])\n    subprocess.run([HELM_CMD, 'registry', 'login', hostname, '--username', username, '--password', password])\n    charts = [ChartV2(c) for p in CHART_SOURCE_DIR.iterdir() if p.is_dir() for c in p.iterdir() if c.is_file() and c.name.endswith(\".tgz\")]\n    with click.progressbar(charts, label=\"Migrating chart ...\", length=len(charts),\n    item_show_func=lambda x: \"{}/{}:{} total errors: {}\".format(x.project, x.name, x.version, len(errs)) if x else '') as bar:\n        for chart in bar:\n            try:\n                if chart.name == \"\" or chart.version == \"\" :\n                    print(\"skip the chart {} has no name or version info\".format(chart.filepath))\n                    continue\n                result = chart.migrate(hostname, username, password)\n                if result.stderr:\n                    errs.append(\"chart: {name}:{version} in {project} has err: {err}\".format(\n                        name=chart.name,\n                        version=chart.version,\n                        project=chart.project,\n                        err=result.stderr\n                    ))","sourceCodeStart":97,"sourceCodeEnd":133,"githubUrl":"https://github.com/goharbor/harbor/blob/7b2fd08cc568955cca339afeefab27372840d936/tools/migrate_chart/migrate_chart.py#L97-L133","documentation":"The migrate CLI hard-requires the Harbor username to be exactly 'admin' before doing any work, because the v2->OCI chart migration pushes charts into every project and needs admin rights. Any other --username aborts immediately with this exception, before the CA update, helm login, or any chart processing.","triggerScenarios":"Running the tool with --username set to anything other than admin (the default is admin, so only an explicitly passed non-admin value triggers it).","commonSituations":"Operators passing personal or robot/service account credentials via wrapper scripts; teams whose admin password is rotated and someone substitutes another account.","solutions":["Run with --username admin (or omit it — it defaults to admin) and the matching admin --password","If the admin password is unknown, reset it via the Harbor UI or htpasswd tooling first","Do not use robot accounts — they lack the cross-project push rights this tool needs"],"exampleFix":"# before\npython3 migrate_chart.py --hostname harbor.example.com --username bob --password ****\n# after\npython3 migrate_chart.py --hostname harbor.example.com --username admin --password '<admin-password>'","handlingStrategy":"validation","validationCode":"if username != 'admin':\n    raise SystemExit('migration requires the admin account; rerun with --username admin')\n# equivalent shell guard before invoking:\n# [ \"$HARBOR_USER\" = 'admin' ] || { echo 'admin only'; exit 1; }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Default the username to admin in wrapper scripts instead of inheriting CI credentials","Reset the admin password before migration day so nobody substitutes another account","Remember robot accounts cannot run this tool"],"tags":["python","harbor","chart-migration","authorization","cli"],"backgroundTag":null,"analyzedSha":"7b2fd08cc568955cca339afeefab27372840d936","analyzedAt":"2026-08-16T00:00:10.961Z","schemaVersion":2},"datasetVersion":"2026-08-16T03:17:38.424Z"}