Registry credentials

Your code may need to pull charts and images from registries with a login (Harbor, GHCR, Docker Hub), or modules and providers from a private Terraform registry. Credentials can come from the settings or from the repository.

In the settings

They are inherited by host: the nearest level wins, and different hosts add up.

curl -X PUT -H "$H" $O/settings -d '{
  "registries": [
    {"host": "harbor.example.com", "username": "robot$infra", "password": "..."},
    {"host": "ghcr.io", "username": "bot", "password_vault": {"path": "secret/ci/ghcr", "field": "token"}},
    {"host": "tf.example.com", "kind": "terraform", "password": "..."}
  ]
}'

kind is oci by default, or terraform for a private registry of modules and providers. The password is never returned. Sent empty, the stored one stays. Without the registries field, the level's credentials stay as they are, and [] removes them all.

A settings PUT replaces what the level defines. Send the level's variables and other settings together with registries. See Settings in the API.

In the repository

Use registries in config.yaml, with the same sources as the declaration ({var: ...}, {vault: ...}):

registries:
  - host: harbor.example.com
    username: robot$infra
    password: { vault: secret/infra/harbor, field: token }

For the same host, the settings win.

In the run

• Firstlume writes Docker's config.json in the phase's HOME and points DOCKER_CONFIG and HELM_REGISTRY_CONFIG at it. The helm provider and helm itself read from there.
• For registries of kind terraform, it exports TF_TOKEN_<host>.
• Passwords, and the base64 user:password, are masked in the log.
• The apply uses the plan's credentials.

Registry credentials are only for registries. They don't apply to cloning Git, and the Git token doesn't apply to registries.