Enable Vultr IAM authentication for Container Registry by attaching a policy and minting short-lived, IAM-scoped Docker credentials to log in with Docker.
Vultr Container Registry integrates with IAM, so registry access follows least-privilege policies instead of account-wide API keys. To enable it, attach a policy with container.registry.* actions to a user, group, or service user. That identity can then mint short-lived Docker credentials whose scope matches its effective IAM permissions.
Before enabling IAM authentication for Vultr Container Registry, you must have an IAM organization and a container registry provisioned. See How to Provision Vultr Container Registry.
Follow this guide to enable IAM authentication for a registry and log in to it with Docker using the Vultr API.
Attach a policy to the identity that defines what it can do on the registry.
Create a policy that grants the GetCredentials capability on * and the required registry actions on the target registry. The following example lets an identity pull and push to a single registry. Replace REGISTRY_ID with your registry's ID.
For a read-only CI runner, grant only container.registry.Pull and set Resource to registry:*.
Attach the policy to a user, group, or role using the Vultr Console or the IAM API endpoints. See How to Create a Policy for details.
Send a GET request to the credential endpoint to see which registries your effective IAM permissions allow you to mint credentials for.
Use the API key of the identity you are testing, not your own.
If you cannot mint credentials for any registry, the request returns 403. Verify that your policy grants container.registry.GetCredentials and Pull or Push on the target registry.
Send a POST request to the credential endpoint to mint a new set of credentials. Replace REGISTRY_ID with your registry's ID. Set read_write to true for push and pull access, which requires container.registry.Push on the registry. Omit it for read-only credentials.
A successful request returns an HTTP 201 Created response containing a Docker-compatible auths map keyed by registry host, along with minted and errors.
Use the minted credentials to authenticate Docker against the registry.
Extract the auth value for your registry host from creds.json. Replace REGISTRY_HOST with your registry host.
Decode the value.
Log in to the registry. Replace REGISTRY_HOST with the same registry host. Passing the password over stdin keeps it out of your shell history.
A successful login returns Login Succeeded. You can now pull images from the registry and push images if you have minted read/write credentials. Alternatively, merge the returned auths map directly into ~/.docker/config.json.
0 Comments
Be the first to comment and share your perspective with the community.