How to configure authentication to pull bundles from registries?

[abryant-hv]

I've been trying to get a pipelineRun to work with a pipelineRef to a bundle instead of a local pipeline definition, and I'm running into issues with an authenticated registry. Pushing to the registry is no problem, but I can't seem to get the pipeline run to work.

I've tried the steps in the docs for configuring authentication for docker, but they don't seem to do anything. I still get an error about authentication being required. (I have a service account with a basic user auth secret, just like the example, and I've separately tested the credentials to make sure they work)

The logs for the pipeline controller don't seem to show anything about credentials, other than the same error. I don't see any indication that it's trying to use them, but I'm not sure if that's expected.

Any tips for debugging this further or how I'm supposed to configure the auth? Thanks.

[afrittoli]

Hello @abryant-hv - since it's the tekton controller that pulls the bundle from the registry, you need to add the secret to the pullImageSecrets of tekton service account. Let me know if this helps!

[abryant-hv]

I don't see anything called a "tekton" controller... I have a "pipeline" controller, which seems relevant, and also a tekton-triggers-controller, which does not seem relevant.

Adding an imagePullSecret to the service account used by the pipeline controller (and restarting everything) does not appear to help.

[abryant-hv]

Oh, also, we're currently using v0.23.0. I've looked at the release notes covering versions since then, and don't see anything relevant, but I could be missing something.

[abryant-hv]

I read a bit of the pipeline code and have found a working solution:

• the pipelineRun needs to have a service account
• the service account needs to have an image pull secret for the registry
• the image pull secret must be a normal image pull secret, not the type of auth secret specified in the tekton docs.

Image pull secrets for the controller are not required/relevant.