Private GHCR Authentication

[jaydeepappas]

I'm testing out Kargo (v1.5.1) as part of our GitOps setup with Argo and am running into issues authenticating with GHCR. Looking specifically at this part of the docs: https://docs.kargo.io/user-guide/security/managing-credentials#github-authentication-options I feel that it is a bit unclear how to approach this.

For auth I'm using a classic GitHub PAT that has full repo and read/write package permissions. I can successfully authenticate via:

docker login ghcr.io/MY_ORG/services -u <username> -p <PAT>

and pull images manually.

I have Repo Credentials of type git which point to the URL of my private repositories, with an empty username and PAT as password. This works fine. However for GHCR, it is unclear whether to use a git or image type of Repo Credential to authenticate with GHCR, and how that corresponds to the git or image subscription type in my warehouse. That being said, I have tried all combinations of this - I cannot create a Repo Credential that allows me to authenticate with GHCR, whether the GHCR is of type git or image in my warehouse. Nothing seems to work, and I am thrown the error:

error listing tags for repo URL ghcr.io/MY_ORG/services: GET https://ghcr.io/token?... DENIED: requested access to the resource is denied

Here is a simple version of the warehouse I am using:

apiVersion: kargo.akuity.io/v1alpha1
kind: Warehouse
metadata:
  name: test-ghcr
  namespace: services
spec:
  freightCreationPolicy: Automatic
  interval: 5m
  subscriptions:
    - image:
        repoURL: ghcr.io/MY_ORG/services
        imageSelectionStrategy: SemVer

And here is a screenshot of the secret I am configuring (keep in mind I have tried both type git and image):

This clearly seems to be a Kargo config issue that I am unable to figure out. Hopefully I am just missing something obvious. Thank you!

[krancour]

I am closing this as you seem to have opened it as an issue now as well.

In the future, please refrain from opening both a discussion and an issue. One or the other will do.

[krancour]

#4293