Configure trusted base images on an OCI repository

Administrators can maintain a curated list of trusted base images on each OCI Repository resource. Operators then select base images from a picker in the Image Builder workflow instead of typing registry paths manually.

Before you begin

  • You have permission to create or update Repository resources in your organization.
  • The OCI repository resource already exists and points at a registry that Image Builder can reach.

Procedure

  1. Retrieve the current repository definition by running the following command: 
    $ flightctl get repository/<repository_name> -o yaml > repository.yaml
  2. Add or update spec.baseImages. Each entry requires imageName and at least one tag in tags: 
    apiVersion: flightctl.io/v1beta1
kind: Repository
metadata:
  name: <repository_name>
spec:
  type: oci
  url: <registry_url>
  baseImages:
    - imageName: rhel9/rhel-bootc
      tags:
        - "9.4"
        - "9.5"
    - imageName: microshift/microshift-bootc
      tags:
        - "4.18"
  3. Apply the updated repository by running the following command: 
    $ flightctl apply -f repository.yaml
  4. Verify that the base images are stored on the resource by running the following command: 
    $ flightctl get repository/<repository_name> -o yaml

Results

  1. In the Red Hat Edge Manager web console, open the Image Builder workflow and select the OCI repository you updated.
  2. Confirm that the base image dropdown lists the configured entries and tags.
  3. Select a tag and confirm that the source image fields populate automatically.
  • If apply returns 422, check that every baseImages entry includes imageName and a non-empty tags list, and that tag values are not duplicated within the same entry.
  • If the picker shows a connectivity warning, the registry might be unreachable from the service or the tag might not exist. The UI calls registry check endpoints before build submission; resolve registry credentials and network access on the Repository resource.

For the end-to-end build and publish workflow, see Publishing an image build to the Software Catalog.