Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

secrets: Doc credential helper #563

Merged
merged 1 commit into from
May 29, 2024
Merged

secrets: Doc credential helper #563

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
10 changes: 9 additions & 1 deletion docs/src/building/secrets.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,8 @@
# Secrets (e.g. container pull secrets)

To have `bootc` fetch updates from registry which requires authentication,
you must include a pull secret in `/etc/ostree/auth.json`.
you must include a pull secret in `/etc/ostree/auth.json` (or
as of recent versions in `/usr/lib/ostree/auth.json`).

Another common case is to also fetch container images via
`podman` or equivalent. There is a [pull request to add `/etc/containers/auth.json`](https://github.com/containers/image/pull/1746)
Expand All @@ -12,6 +13,13 @@ Regardless, injecting this data is a good example of a generic
"secret". The bootc project does not currently include one
single opinionated mechanism for secrets.

## Using a credential helper

In order to use a credential helper as configured in `registries.conf`
such as `credential-helpers = ["ecr-login"]`, you must currently
also write a "no-op" authentication file with the contents `{}` (i.e. an
empty JSON object, not an empty file) into the pull secret location.
cgwalters marked this conversation as resolved.
Show resolved Hide resolved

## Embedding in container build

This was mentioned above; you can include secrets in
Expand Down