Chapter 3. Authenticating to an OCI registry

Procedure

1. Set the namespace and name of the Kubernetes service account.

   $ export NAMESPACE=<namespace>
   $ export SERVICE_ACCOUNT_NAME=<service_account>

   <namespace>

   The namespace associated with the service account.

   <service_account>

   The name of the service account.

2. Create a Kubernetes secret.

   $ oc create secret registry-credentials \
     --from-file=.dockerconfigjson \
     --type=kubernetes.io/dockerconfigjson \
     -n $NAMESPACE

   --from-file

   Substitute with the path to your Docker config file. Default path is ~/.docker/config.json.

3. Give the service account access to the secret.

   $ oc patch serviceaccount $SERVICE_ACCOUNT_NAME \
     -p "{\"imagePullSecrets\": [{\"name\": \"registry-credentials\"}]}" -n $NAMESPACE

   If you patch the default pipeline service account that Red Hat OpenShift Pipelines assigns to all task runs, the Red Hat OpenShift Pipelines Operator will override the service account. As a best practice, you can perform the following steps:

   1. Create a separate service account to assign to user’s task runs.

      $ oc create serviceaccount <service_account_name>

   2. Associate the service account to the task runs by setting the value of the serviceaccountname field in the task run template.

      apiVersion: tekton.dev/v1
      kind: TaskRun
      metadata:
        name: build-push-task-run-2
      spec:
        taskRunTemplate:
          serviceAccountName: build-bot
        taskRef:
          name: build-push
      ...

      serviceAccountName

      Substitute with the name of the newly created service account.