On-cluster build pipelines - private container registry credentials

[HanBrol0]

Hello,

I'm trying to configure Knative on my cluster to perform on-cluster builds and deploy functions.

I run the following:
kn func deploy --remote --registry=harbor.domain/repo
I'm prompted for credentials which successfully authenticates (using the harbor admin account). The pipeline pulls from my git server, but when it comes to reading the image registry during the analyze stage, I get the following:

ERROR: failed to initialize analyzer: validating registry read access: ensure registry read access to harbor.domain/repo/helloworld-py:latest

The Harbor registry is running on the same cluster, so I've attempted to change from "harbor.domain" to "harbor-core.harbor.svc.cluster.local" as well with no luck. Since I'm using the 'kn func deploy' command, I haven't built a custom Tekton pipeline, so everything is being done with whatever the default is.

Is there a way to view or modify this default pipeline, such as adding my registry credentials to it?

[lkingland]

I think you need to configure your namespace with the authentication mechanism for accessing the registry. For example, assuming you have your password in the env var FUNC_REGISTRY_TOKEN and you're deploying Functions to the default namespace, you can create a "registry credential" secret named, for example "regcred":

$ kubectl create secret docker-registry regcred \
    --docker-server=registry.example.com \
    --docker-username=myuser \
    --docker-password=$FUNC_REGISTRY_TOKEN \
    --namespace=default

Then patch the service account, instructing it to use the "regcred" secret for authentication:

kubectl patch serviceaccount default -p '{"imagePullSecrets": [{"name": "regcred"}]}'