From 9109cfb7a1f5bb1dc3eeb5864798492fb8f0f0d2 Mon Sep 17 00:00:00 2001 From: "A. F. Dudley" Date: Fri, 20 Mar 2026 19:30:44 +0000 Subject: [PATCH] feat: add token-file option for image-pull-secret registry auth Adds token-file key to image-pull-secret spec config. Reads the registry token from a file on disk instead of requiring an environment variable. File path supports ~ expansion. Falls back to token-env if token-file is not set or file doesn't exist. This lets operators store the GHCR token in ~/.credentials/ alongside other secrets, removing the need for ansible to pass REGISTRY_TOKEN as an env var. Co-Authored-By: Claude Opus 4.6 (1M context) --- .../deploy/deployment_create.py | 23 +++++++++++++++---- 1 file changed, 18 insertions(+), 5 deletions(-) diff --git a/stack_orchestrator/deploy/deployment_create.py b/stack_orchestrator/deploy/deployment_create.py index 725bf21f..dd71a9cd 100644 --- a/stack_orchestrator/deploy/deployment_create.py +++ b/stack_orchestrator/deploy/deployment_create.py @@ -602,16 +602,29 @@ def create_registry_secret( server = registry_config.get("server") username = registry_config.get("username") token_env = registry_config.get("token-env") + token_file = registry_config.get("token-file") - if not all([server, username, token_env]): + if not server or not username: + return None + if not token_env and not token_file: return None - # Type narrowing for pyright - we've validated these aren't None above - assert token_env is not None - token = os.environ.get(token_env) + # Resolve token: file takes precedence over env var + token = None + if token_file: + token_path = os.path.expanduser(token_file) + if os.path.exists(token_path): + with open(token_path) as f: + token = f.read().strip() + else: + print(f"Warning: Registry token file '{token_path}' not found") + if not token and token_env: + token = os.environ.get(token_env) + if not token: + source = token_file or token_env print( - f"Warning: Registry token env var '{token_env}' not set, " + f"Warning: Registry token not available from '{source}', " "skipping registry secret" ) return None