Refresh ghcr registry credentials

[ootkin]

Hi,

I've got a k3d configuration as follows:

apiVersion: k3d.io/v1alpha5
kind: Simple
metadata:
  name: dev
registries:
  config: |
    mirrors:
      ghcr.io:
        endpoint:
          - http://ghcr.io
    configs:
      ghcr.io:
        auth:
          username: git
          password: ${GITHUB_TOKEN}
volumes:
  - volume: $PWD/dev/data:/var/data
ports:
  - port: 80:80
  - port: 443:443
  - port: 5431:30000
  - port: 27017:30001
options:
  k3s:
    extraArgs:
      - arg: "-disable=traefik"
        nodeFilters:
          - server:*

As you can see I've put registries sections in order to be able to pull private images from github.

This morning my GITHUB_TOKEN expired, and i didn't find a way to refresh it. Instead, i recreated the cluster entirely.

Is there a way to refresh the credendials without recreating the cluster?

Thanks

[NeverBehave]

Related discussion: #1181

TL;DR: create a proxy and setup your cluster to use fixed registry (https://k3d.io/v5.6.3/usage/registries/#creating-a-registry-proxy-pull-through-registry), but you need to use your own implementation of proxy pull thru

---

Similar problem, but it seems k3d currently does not have such option, and it is possibly because how k3s handle it: https://docs.k3s.io/installation/private-registry

Basically this is initialized by k3s and handled by containerd config, so if you have multiple agents you will need to find a way to update all config in each container(agent) and let containerd pickup. Instead of that, another option is just to setup a proxy and always ask agent to pull from there. Every time you need to update your credential, just delete the registry and recreate it with the same name but updated credentials.

Still this might not work as Registry proxy does not support Basic Auth yet if you have private registry with auth enabled: distribution/distribution#3153, so you will have to use one that support and manually add it to the network k3d created.

[mreinhart2805]

In my case i have update the /etc/rancher/k3s/registries.yaml on my k3s Node.
For that do it like so on the Docker Host:

# Get k3s Container ID
docker ps

# Start terminal session in k3s container
# Replace [CONTAINER-ID] with the ID of your k3s Container Id
docker exec -it [CONTAINER-ID] sh

# Update the /etc/rancher/k3s/registries.yaml file with new creds
vi /etc/rancher/k3s/registries.yaml

# Close terminal session
exit

# Restart k3d Cluster
k3d cluster stop [CLUSTER-NAME]
k3d cluster start [CLUSTER-NAME]

Thats have work for me.

Note: If you have more Nodes you have to do for each node.

[ootkin]

It works, good job.