Registry keys

A registry key is what docker pull presents to pull your organization's environments, and what a script presents to acquire one. It belongs to the organization, so any member can use it. It also records which member issued it, and that decides who may revoke it later.

Issuing a key

Any member can issue one from Keys in the header. Give it a label that says where it will live, such as a CI system or a particular cluster, and press Issue. Issue one key for each place that pulls, so that any of them can be revoked without disturbing the others.

The key is shown once, on that page, right after it is issued. Copy it then. Only a hash of it is stored, so there is no way to read it back later. If you lose a key, issue another and revoke the old one.

A key looks like regk_<id>_<secret>. The middle part is the key id, and the Keys page lists it beside each label so you can tell which row is which when you hold the key but not the label. The id on its own authenticates nothing.

Using it

For pulls, log in with the key as the password; the username is ignored:

echo "$SAVANTENVS_API_KEY" | docker login localhost:8080 -u x --password-stdin

For the API, send it as a bearer token. The quickstart takes you from the login to a running environment.

Revoking a key

Each live key you may revoke has a Revoke control on the Keys page. A member may revoke the keys they issued. An admin of the organization may revoke any key the organization has, including one that Savant staff issued for it.

Revoking is final. The key stays in the list, marked with the date it was revoked; issue a new one if the place it served still needs to pull. Pulls with a revoked key are refused within about a minute, which is how long the registry may go on trusting what it last read. The API refuses it at once.

If the page says the key was not revoked, it is either a key another member issued or one that does not exist in your organization. The message is the same in both cases on purpose, so a member cannot use it to find out which keys exist.