-
Task
-
Resolution: Unresolved
-
Minor
-
None
-
None
-
False
-
False
-
Undefined
-
Quay robot tokens do not span organizations. Some users however do want to pull across organizations using robot tokens. OpenShift permits multiple namespaces to be provided within a `dockerconfigjson` secret so this can theoretically be done via a single service account. For example:
{
"auths": {
"quay.io/org1":
{ "auth": "super secret", "email": "" }
,
"quay.io/org2":
{ "auth": "even more secret", "email": "" }
,
"quay.io/org3":
{ "auth": "oh-la-la-dont-look", "email": "" }
}
}
The single SA can then be used across Kube namespaces as needed to overcome the token scoping limitation. Docs should reflect this technique as a workaround for robot token scoping within a single namespace.
See comment below for email thread discussion.