Creating a Service Account to Access OpenShift Container Registry

Let’s say you want to create an OpenShift Container Registry account to be used by your CI/CD tooling. The recommended approach is to use a ServiceAccount instead of a regular user account. Here’s how you can do it.

First, create a ServiceAccount,

$ oc create serviceaccount david-susugigi-sa

Next, generate a token for this ServiceAccount. In this example, we create a long-lived token with a lifespan of two years

$ oc create token david-susugigi-sa --duration=16760h

eyJhbGciOiJ.....Gog8tY

Then, assign the appropriate role to the ServiceAccount

$ oc policy add-role-to-user system:image-builder -z david-susugigi-sa

Finally, use the ServiceAccount to log in to the registry, using the token as the password

$ podman login default-route-openshift-image-registry.apps-crc.testing \
      --tls-verify=false \ 
      -u david-susugigi-sa \ 
      -p eyJhbGciOiJ.....Gog8tY

Login Succeeded!