Red Hat OpenShift Container Platform

Authentication enabled Red Hat registry

All container images available through the Container images section of the Red Hat Ecosystem Catalog are hosted on an image registry, registry.redhat.io. The registry, registry.redhat.io, requires authentication for access to images and hosted content on Red Hat OpenShift Container Platform.

Red Hat OpenShift Container Platform pulls images from registry.redhat.io, so you must configure your cluster to use it.

The new registry uses standard OAuth mechanisms for authentication, with the following methods:

Authentication token. Tokens, which are generated by administrators, are service accounts that give systems the ability to authenticate against the container image registry. Service accounts are not affected by changes in user accounts, so the token authentication method is reliable and resilient. This is the only supported authentication option for production clusters.
Web username and password. This is the standard set of credentials you use to log in to resources such as access.redhat.com. While you could use this authentication method with Red Hat OpenShift Container Platform, Red Hat does not support the method for production deployments. Restrict this authentication method to standalone projects outside Red Hat OpenShift Container Platform.

You can use podman login with your credentials, either username and password or authentication token, to access content on the new registry.

All image streams point to the new registry, which uses the installation pull secret to authenticate.

You must place your credentials in either of the following places:

openshift namespace. Your credentials must exist in the openshift namespace so that the image streams in the openshift namespace can import.
Your host. Your credentials must exist on your host because Kubernetes uses the credentials from your host when it goes to pull images.