Configure pull credentials using device or fleet configuration

You can configure container registry pull credentials for VM applications by declaring the credentials in a device or fleet specification. The Red Hat Edge Manager agent deploys the credentials file to each managed device automatically.

Before you begin

  • The flightctl CLI is installed and authenticated.
  • A Red Hat account with access to the Red Hat container catalog.
  • A base64-encoded credentials file for registry.redhat.io.
  • The worker.vmRender.launcherImage value is configured on the Red Hat Edge Manager control plane. See Virt-launcher image configuration values for configuration details.

Procedure

  1. Generate the base64-encoded credentials string for your Red Hat account. Specify --authfile explicitly so the credentials are written to a predictable path, rather than a session-specific location such as /run/user/<uid>/containers/auth.json: 
    $ podman login --authfile ~/.config/containers/auth.json registry.redhat.io
$ cat ~/.config/containers/auth.json

    Copy the entire JSON content from the output. You will embed this in the device or fleet specification.

  2. Create or update a device specification with the pull credentials in the spec.config section: 
    apiVersion: v1alpha1
kind: Device
metadata:
  name: edge-device-01
spec:
  config:
    - name: podman-pull-secret
      inline:
        - path: /root/.config/containers/auth.json
          mode: 0600
          content: |
            {
              "auths": {
                "registry.redhat.io": {
                  "auth": "<base64_encoded_credentials>"
                }
              }
            }

    Replace <base64_encoded_credentials> with the credentials string from step 1.

  3. Apply the configuration to the device: 
    $ flightctl apply -f device-spec.yaml
  4. For fleet-wide deployment, add the same configuration to a fleet specification: 
    apiVersion: v1alpha1
kind: Fleet
metadata:
  name: vm-fleet
spec:
  config:
    - name: podman-pull-secret
      inline:
        - path: /root/.config/containers/auth.json
          mode: 0600
          content: |
            {
              "auths": {
                "registry.redhat.io": {
                  "auth": "<base64_encoded_credentials>"
                }
              }
            }
  5. Apply the fleet configuration: 
    $ flightctl apply -f fleet-spec.yaml

Results

  • Check the device status to confirm the configuration was applied: 
    $ flightctl get device edge-device-01 -o yaml

    The output shows the applied configuration in the device status.

  • SSH to the device and verify the credentials file exists. Reading /root/ requires elevated privileges, so use sudo even if you are already logged in as a non-root user: 
    sudo test -f /root/.config/containers/auth.json && echo "Credentials file exists"
Note

Device-level specifications override fleet-level specifications. If a device has credentials configured directly, the fleet configuration does not apply to that device.