Obtaining docker images from Red Hat registry

[honza-kasik]

Is there a known way how to obtain product container images from Red Hat container registry? The authentication is needed to pull these images.

Motivation

This is needed because I want to replace Keycloak project image by RH SSO image in integration test.

Main problem is how and where to obtain credentials for this registry, how to use them and if we really want it.

Suggested implementation

Prerequisite is that testsuite is supplied the credentials as a configuration property (system property).
Authentication itself will be implemented as a JUnit's ExternalResource which we can wrap around existing Docker rule to ensure working authentication during test run using rule chain:

1. Authentication's before is run after which the docker command can pull images from Red Hat registry. docker login [CREDENTIALS] [SERVER]
2. Docker's before is run and container image is pulled from Red Hat docker registry and started.
3. Docker's after is run and container is stopped and removed.
4. Authentication's after is run and user is logged out from the Red Hat registry: docker logout [SERVER]

Do you have some tips? Do you know if someone solved this before?

[mnovak1]

I would not bind login to ExternalResource as there are tests which do not use it because some tests are working with docker container lifecycle (killing and restarting container).

What about to use our own config.json file which would be supplied into docker -config config.json .. command? It should be possible to supply authentication secrets directly into this file.

[honza-kasik]

I would not bind login to ExternalResource as there are tests which do not use it because some tests are working with docker container lifecycle (killing and restarting container).

It can also has the public interface for login/logout exposed. EDIT: Rule is in my opinion preffered because it takes care about the lifecycle and cleans up after itself.

What about to use our own config.json file which would be supplied into docker -config config.json .. command? It should be possible to supply authentication secrets directly into this file.

+1. JSON sounds like a great idea. Another problem is if we want to include this test in "run all tests" profile.

[mnovak1]

Looks like there issue using config.json and podman (containers/podman#4357). Docker login will be more robust then.

[mnovak1]

Here is token for eap-qe-testing-account:

docker login -u='6340056|eap-qe-testing-account' -p=eyJhbGciOiJSUzUxMiJ9.eyJzdWIiOiIzYjVlNGYzYzY4OWE0MjY0YTMyOTA3MGQ0NzE1ZDEyNCJ9.A2J0jcrUNWUAydmxLot8T40c-PTjbHjIJo4-ng5jqQ3Qqzlo57sP00H4nu5EfEvMAZIC7o_wdnq0AFaNnlodHIv6pBPnZDNKiuU-KazQEqwOt1drZbNoufZYSyxlt8H_5Etk_fj7sd-FwKxKEr1jjjSSOZbzJx15Xwvoy7Uu5Dw8jQlmfHqpU0ealwYrz5nWpfLDIXFZSKEM003ju61rTShITciJbLbO0Q5cpfVQEwFagzqZsfE3kAXzH4-Z69LodPcD40OdCl0K8f7PbXI8KOlu7gGq7QcbS692l8pRPRVa920RUrrztaPSN0A7YQYd6yTLFmzz2IvYz5eDzssEu5mRSQhkhPNDhZUtdUBewB3v5UUvBvR8dMSQqZaOM--4sPmjzLKa4hGpJ3eFmJ5qzw0WdYMaAXgEDr1fwuMJzYk_jE1xBqSWI9830CX4FIhVpl4x-kZlLeXsqnCML2BUhs4e-BNBuyIFaX5A43P45R45ivzGE6z-Ddi3_izXy15KQbG46uPkz2E2ZhX-0zTWeFfX99HjliaqOPWQYyeITeH96AeIibfviir7Ridr_zgHKGTT-zMGXk3WTcieQe8GcbV4CghFMtbev6CLH3M9vI99SVhOG75m3AsYblEGHzVClrxfOz0I2GrqIdWAxP15nn_25-_tSp7pTp6216a4Tp0 registry.redhat.io