Configure registry authentication for builder service images

Mount an auth.json file into the flightctl-imagebuilder-worker container when your private mirror registry requires authentication for builder service images (podman, bootc-image-builder, and syft).

Before you begin

Note

global.imagePullSecretName and cluster imagePullSecrets authenticate pulls of the flightctl-imagebuilder-worker pod image only. They do not apply to the inner podman run commands that pull builder service images during an image build.

Registry authentication for source and destination images during a build is configured separately on Repository resources. This procedure covers authentication for the builder service images themselves.

Procedure

  1. Create the credential file directory and an auth.json file for your mirror registry. Replace <local-registry>, <username>, and <password> with your values: 
    $ sudo mkdir -p /etc/flightctl
$ sudo podman login <local-registry> \
  --username <username> \
  --password <password> \
  --authfile /etc/flightctl/service-images-auth.json

    Alternatively, create the file manually:

    {
  "auths": {
    "<local-registry>": {
      "auth": "<base64-encoded-username:password>"
    }
  }
}
  2. Restrict permissions on the credential file so only root can read it: 
    $ sudo chmod 600 /etc/flightctl/service-images-auth.json
  3. Create a Quadlet drop-in file to mount the credential file into the worker container. Use a drop-in instead of editing the package-shipped unit under /usr/share/containers/systemd/ so your configuration persists across package upgrades: 
    $ sudo mkdir -p /etc/containers/systemd/flightctl-imagebuilder-worker.container.d
$ sudo tee /etc/containers/systemd/flightctl-imagebuilder-worker.container.d/auth.conf <<'EOF'
[Container]
Volume=/etc/flightctl/service-images-auth.json:/root/.config/containers/auth.json:ro,z
EOF

    The worker runs as root (HOME=/root). Podman reads registry credentials from /root/.config/containers/auth.json when it pulls builder service images.

  4. Reload systemd and restart the worker: 
    $ sudo systemctl daemon-reload
$ sudo systemctl restart flightctl-imagebuilder-worker.service

Results

  • sudo journalctl -u flightctl-imagebuilder-worker.service --no-pager -n 50 does not report unauthorized or authentication required errors when pulling from <local-registry>.
  • A test image build in the Red Hat Edge Manager web console completes without errors pulling podman, bootc-image-builder, or syft from the authenticated mirror.

For image builder workers on Red Hat OpenShift Container Platform, see Configuring registry authentication for builder service images in Installing Red Hat Edge Manager on Red Hat OpenShift Container Platform.