Skip to content

Add support for authenticated registries #245

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
ehelms wants to merge 1 commit into
base: master
Choose a base branch
from
+54 −23
Open

Add support for authenticated registries #245

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 17 additions & 15 deletions docs/deployment.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,25 +44,27 @@ A deployment can have multiple base features enabled.

### Authenticated Registry Handling

In the non-default case where the image sources are supplied from an authenticated location users will need to inject a login step.
For example, users might be consuming a custom build of the Foreman image.
If you need to pull images from private or authenticated container registries, you can configure registry authentication using Podman's auth file.

In this case, the happy path becomes:
#### Setting up Registry Authentication

1. Configure package repository
2. Install `foremanctl` package
3. Run deployment utility and provide registry username and token
1. **Login to your registry** using Podman and save credentials to the default auth file location:
```bash
podman login <registry> --authfile=/etc/foreman/registry-auth.json
```

The advanced path breaks down to:
2. **Ensure proper permissions** on the auth file:
```bash
sudo chmod 600 /etc/foreman/registry-auth.json
sudo chown root:root /etc/foreman/registry-auth.json
```

1. Configure package repository
2. Install `foremanctl` package
3. Login to registry with podman
3. Pull images
4. Generate certificates
5. Execute pre-requisite checks
6. Run deployment utility
7. Post deploy checks
3. **Deploy as usual** - foremanctl will automatically detect and use the authentication file:
```bash
./foremanctl deploy
```

This approach integrates seamlessly with both the happy path and advanced deployment paths described above. The authentication is handled transparently during image pulling operations.

## Deployer Stages

Expand Down
15 changes: 9 additions & 6 deletions src/playbooks/pull-images/pull-images.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,27 +8,30 @@
- "../../vars/images.yml"
- "../../vars/base.yaml"
become: true
tasks:
- name: Install podman
ansible.builtin.package:
name:
- podman

roles:
- role: pre_install
post_tasks:
- name: Pull an image
containers.podman.podman_image:
name: "{{ item }}"
environment:
REGISTRY_AUTH_FILE: "{{ registry_auth_file }}"
loop: "{{ images }}"

- name: Pull foreman_proxy images
containers.podman.podman_image:
name: "{{ item }}"
environment:
REGISTRY_AUTH_FILE: "{{ registry_auth_file }}"
loop: "{{ foreman_proxy_images }}"
when:
- "'foreman-proxy' in enabled_features"

- name: Pull database images
containers.podman.podman_image:
name: "{{ item }}"
environment:
REGISTRY_AUTH_FILE: "{{ registry_auth_file }}"
loop: "{{ database_images }}"
when:
- database_mode == 'internal'
1 change: 1 addition & 0 deletions src/roles/candlepin/defaults/main.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,7 @@ candlepin_ciphers:
- TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256
candlepin_container_image: quay.io/foreman/candlepin
candlepin_container_tag: "4.4.14"
candlepin_registry_auth_file: /etc/foreman/registry-auth.json

candlepin_database_host: localhost
candlepin_database_port: 5432
Expand Down
2 changes: 2 additions & 0 deletions src/roles/candlepin/tasks/main.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,6 +55,8 @@
containers.podman.podman_image:
name: "{{ candlepin_container_image }}:{{ candlepin_container_tag }}"
state: present
environment:
REGISTRY_AUTH_FILE: "{{ candlepin_registry_auth_file }}"

- name: Deploy Candlepin quadlet
containers.podman.podman_container:
Expand Down
1 change: 1 addition & 0 deletions src/roles/foreman/defaults/main.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
---
foreman_container_image: "quay.io/foreman/foreman"
foreman_container_tag: "nightly"
foreman_registry_auth_file: /etc/foreman/registry-auth.json

foreman_database_name: foreman
foreman_database_user: foreman
Expand Down
5 changes: 3 additions & 2 deletions src/roles/foreman/tasks/main.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,8 @@
containers.podman.podman_image:
name: "{{ foreman_container_image }}:{{ foreman_container_tag }}"
state: present
environment:
REGISTRY_AUTH_FILE: "{{ foreman_registry_auth_file }}"

- name: Create secret for DATABASE_URL
containers.podman.podman_secret:
Expand Down Expand Up @@ -224,8 +226,7 @@
- bin/rails db:migrate && bin/rails db:seed
detach: false
network: host
env:
FOREMAN_ENABLED_PLUGINS: "{{ foreman_plugins | join(' ') }}"
env: "{{ {'FOREMAN_ENABLED_PLUGINS': foreman_plugins | join(' ')} }}"
secrets:
- 'foreman-database-url,type=env,target=DATABASE_URL'
- 'foreman-seed-admin-user,type=env,target=SEED_ADMIN_USER'
Expand Down
4 changes: 4 additions & 0 deletions src/roles/foreman_proxy/defaults/main.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,8 @@
---
foreman_proxy_container_image: "quay.io/foreman/foreman-proxy"
foreman_proxy_container_tag: "nightly"
foreman_proxy_registry_auth_file: /etc/foreman/registry-auth.json

foreman_proxy_name: "{{ ansible_facts['fqdn'] }}"
foreman_proxy_https_port: 8443
foreman_proxy_url: "https://{{ foreman_proxy_name }}:{{ foreman_proxy_https_port }}"
Expand Down
2 changes: 2 additions & 0 deletions src/roles/foreman_proxy/tasks/main.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,8 @@
containers.podman.podman_image:
name: "{{ foreman_proxy_container_image }}:{{ foreman_proxy_container_tag }}"
state: present
environment:
REGISTRY_AUTH_FILE: "{{ foreman_proxy_registry_auth_file }}"

- name: Create config secrets
ansible.builtin.include_tasks: configs.yaml
Expand Down
1 change: 1 addition & 0 deletions src/roles/postgresql/defaults/main.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
---
postgresql_container_image: quay.io/sclorg/postgresql-13-c9s
postgresql_container_tag: "latest"
postgresql_registry_auth_file: /etc/foreman/registry-auth.json
postgresql_container_name: postgresql
postgresql_network: host
postgresql_restart_policy: always
Expand Down
2 changes: 2 additions & 0 deletions src/roles/postgresql/tasks/main.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,8 @@
containers.podman.podman_image:
name: "{{ postgresql_container_image }}:{{ postgresql_container_tag }}"
state: present
environment:
REGISTRY_AUTH_FILE: "{{ postgresql_registry_auth_file }}"

- name: Create PostgreSQL storage directory
ansible.builtin.file:
Expand Down
1 change: 1 addition & 0 deletions src/roles/pulp/defaults/main.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
---
pulp_container_image: quay.io/foreman/pulp
pulp_container_tag: "3.73"
pulp_registry_auth_file: /etc/foreman/registry-auth.json
pulp_api_image: "{{ pulp_container_image }}:{{ pulp_container_tag }}"
pulp_content_image: "{{ pulp_container_image }}:{{ pulp_container_tag }}"
pulp_worker_image: "{{ pulp_container_image }}:{{ pulp_container_tag }}"
Expand Down
7 changes: 7 additions & 0 deletions src/roles/pulp/tasks/main.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,17 +1,24 @@
---
- name: Pull the Pulp API container image
containers.podman.podman_image:
name: "{{ pulp_api_image }}"
state: present
environment:
REGISTRY_AUTH_FILE: "{{ pulp_registry_auth_file }}"

- name: Pull the Pulp Content container image
containers.podman.podman_image:
name: "{{ pulp_content_image }}"
state: present
environment:
REGISTRY_AUTH_FILE: "{{ pulp_registry_auth_file }}"

- name: Pull the Pulp Worker container image
containers.podman.podman_image:
name: "{{ pulp_worker_image }}"
state: present
environment:
REGISTRY_AUTH_FILE: "{{ pulp_registry_auth_file }}"

- name: Create Pulp storage
ansible.builtin.file:
Expand Down
1 change: 1 addition & 0 deletions src/roles/redis/defaults/main.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,4 @@
---
redis_container_image: quay.io/sclorg/redis-6-c9s
redis_container_tag: "latest"
redis_registry_auth_file: /etc/foreman/registry-auth.json
2 changes: 2 additions & 0 deletions src/roles/redis/tasks/main.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,8 @@
containers.podman.podman_image:
name: "{{ redis_container_image }}:{{ redis_container_tag }}"
state: present
environment:
REGISTRY_AUTH_FILE: "{{ redis_registry_auth_file }}"

- name: Create directory for Redis data
ansible.builtin.file:
Expand Down
1 change: 1 addition & 0 deletions src/vars/defaults.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,3 +5,4 @@ tuning_profile: development
flavor: katello
features: []
enabled_features: "{{ (flavor_features + features) }}"
registry_auth_file: "/etc/foreman/registry-auth.json"
Copy link
Contributor

@pablomh pablomh Jan 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe drop the " to keep consistency with the rest of vars files.

Loading