Kata Container And Private Image Registry

[Eludendil]

Hello, I am having some issue while trying to use kata runtimeclass ( To be precise the kata-snp one) I managed to make it run correctly and pull any public image. But as soon as I try to pull from a private registry it fails with:

Error: CreateContainer failed: failed to pull manifest Not authorized: url https://xxxxxx/xxxx/manifests/whisper-updated-xxxx Stack backtrace: 0: <unknown> 1: <unknown> 2: <unknown> 3: <unknown> 4: <unknown> 5: <unknown> 6: <unknown> 7: <unknown> 8: <unknown> 9: <unknown> 10: <unknown> 11: <unknown> 12: <unknown> 13: <unknown> 14: <unknown> 15: start_thread 16: clone3: unknown

Pull secrets are correct and properly working outside of kata runtimeclass.

Is there any special setup to do to make that work ?

Best,

[bpradipt]

For kata-snp class, pulling from authenticated requires either embedding the registry secret in the initrd and providing the file path in the kernel params or providing the details via initdata (authenticated_registry_credentials_uri param).
Initdata is preferred - https://docs.redhat.com/en/documentation/openshift_sandboxed_containers/1.11/html/deploying_confidential_containers/deploying-cc_metal-cc#creating-initdat_metal-cc

Following is an example

# initdata.toml
algorithm = "sha256"
version = "0.1.0"

[data]
"aa.toml" = '''
[token_configs]
[token_configs.coco_as]
url = "$TRUSTEE_ROUTE"

[token_configs.kbs]
url = "$TRUSTEE_ROUTE"
'''

"cdh.toml"  = '''
socket = 'unix:///run/confidential-containers/cdh.sock'
credentials = []

[kbc]
name = "cc_kbc"
url = "$TRUSTEE_ROUTE"

[image]

authenticated_registry_credentials_uri = 'kbs:///default/credential/regcred'

"policy.rego" = '''
'''

The secret credential must be available in Trustee.

oc create secret generic credential \
  --from-file=regcred=./auth.json \
  -n trustee-operator-system