Configure registry authentication for builder service images

Mount an auth.json file into the flightctl-imagebuilder-worker pod when you mirror builder service images (podman, bootc-image-builder, and syft) to a private registry that requires authentication. This allows inner Podman commands to pull those images.

Before you begin

Note

global.imagePullSecretName and the worker pod imagePullSecrets authenticate pulls of the flightctl-imagebuilder-worker pod image only. They do not apply to the inner podman run commands that pull builder service images during an image build.

Registry authentication for source and destination images during a build is configured separately on Repository resources. This procedure covers authentication for the builder service images themselves.

Procedure

  1. Create an auth.json file for your mirror registry. Replace <local-registry>, <username>, and <password> with your values: 
    $ podman login <local-registry> \
  --username <username> \
  --password <password> \
  --authfile /tmp/auth.json

    Alternatively, create the file manually:

    {
  "auths": {
    "<local-registry>": {
      "auth": "<base64-encoded-username:password>"
    }
  }
}
  2. Create a generic secret from the auth.json file in the Red Hat Edge Manager release namespace. The secret must contain a key named auth.json: 
    $ oc create secret generic imagebuilder-registry-auth -n <namespace> \
  --from-file=auth.json=/tmp/auth.json
  3. Patch the flightctl-imagebuilder-worker deployment to mount the secret at /root/.config/containers/auth.json. Replace <namespace> with your release namespace: 
    $ oc patch deployment flightctl-imagebuilder-worker -n <namespace> --type=json -p='[
  {"op": "add", "path": "/spec/template/spec/containers/0/volumeMounts/-",
   "value": {"name": "registry-auth", "mountPath": "/root/.config/containers/auth.json", "subPath": "auth.json", "readOnly": true}},
  {"op": "add", "path": "/spec/template/spec/volumes/-",
   "value": {"name": "registry-auth", "secret": {"secretName": "imagebuilder-registry-auth"}}}
]'

    The worker runs as root (HOME=/root). Podman reads registry credentials from /root/.config/containers/auth.json when it pulls builder service images.

    Note

    If you manage the deployment with GitOps or a custom Helm values overlay, add the equivalent volumeMounts and volumes entries to your manifest so the configuration persists across upgrades. Reapply the patch after each helm upgrade when you do not use GitOps or a values overlay.
  4. Confirm the worker pod restarts and mounts the secret: 
    $ oc rollout status deployment/flightctl-imagebuilder-worker -n <namespace>
$ oc logs deployment/flightctl-imagebuilder-worker -n <namespace> --tail=50

Results

  • Worker logs do not report unauthorized or authentication required errors when pulling from <local-registry>.
  • A test image build in the Red Hat Edge Manager web console completes without errors pulling podman, bootc-image-builder, or syft from the authenticated mirror.

For image builder workers on standalone Red Hat Enterprise Linux with Podman Quadlets, see Configuring registry authentication for builder service images in Installing Red Hat Edge Manager on Red Hat Enterprise Linux.