Learn how Vultr Container Registry derives Docker credential scope from IAM policy, mints credentials for one or many registries, and structures the response.
Account-wide API keys and long-lived registry passwords are difficult to scope and rotate. A leaked key or password exposes every registry it can reach until someone notices and replaces it. Vultr Container Registry avoids this by issuing short-lived Docker credentials on demand, with a scope that matches the caller's IAM policy.
Follow this guide to understand how scope is determined, how requests for one or many registries are handled, and how to read the response when you mint credentials using the Vultr API.
This guide assumes you have already enabled IAM authentication for your registry. See How to Enable IAM Authentication for Vultr Container Registry for the setup steps.
When you send a mint request, Vultr Container Registry evaluates the caller's effective IAM permissions and issues credentials that match them. Policy evaluation has already resolved any Deny statements, so the scope reflects only what the caller is allowed to do.
Two kinds of permission are involved:
container.registry.GetCredentials is a resource-independent capability gate. It allows the caller to use the discover and mint endpoints, and you grant it on *, not per registry.container.registry.Pull or container.registry.Push on a registry determines the scope of the credentials minted for that registry. Pull gives read-only credentials, and Push gives read/write credentials.Credentials are allow-only. The endpoint never grants more than the caller's IAM permissions allow.
The mint endpoint accepts three forms of request, depending on how many registries you want credentials for.
To mint for a single registry, pass registry with the registry's ID. Replace REGISTRY_ID with your registry's ID.
To mint for a specific set of registries, pass registries as a list of IDs. Replace REGISTRY_ID_1 and REGISTRY_ID_2 with your registry IDs.
To mint for every registry the caller can access, omit both registry and registries. Vultr Container Registry issues one credential per grantable registry, with no fixed cap.
A successful mint returns an HTTP 201 Created response, including when you mint credentials for multiple registries in a single request.
The response contains three fields.
REGISTRY_HOST. You can merge this map into ~/.docker/config.json or decode an entry to log in.["pull"] or ["pull", "push"].When a request covers more than one registry, Vultr Container Registry authorizes each registry independently. If a registry's grant can't satisfy the requested scope, Vultr Container Registry skips it and reports it in errors, and the mint still succeeds for the remaining registries. If every registry fails, the request returns 502.
0 Comments
Be the first to comment and share your perspective with the community.