opschain admin image-build-providers create
Included from Basic tier
Registers an image build provider. The code (the estate identifier actions reference as
image-build://<code>) and the kind are immutable after create; everything else can change through the
update verb. Supply the credential as a secret-vault:// reference to pin (--credential-ref,
resolved at write time — an unresolvable reference refuses by name), or inline through
--credential-env (the name of an environment variable holding it) or --credential-prompt
(a no-echo prompt), never on the command line: an inline value is held encrypted at rest on the
record itself (never written into a vault), and credential_ref stays empty.
opschain admin image-build-providers create buildkit-shared \
--kind buildkit --credential-kind client_cert \
--endpoint tcp://buildkitd.runners.internal:1234 \
--credential-ref secret-vault://infra/buildkit/client-cert \
--bind /projects
Created image build provider buildkit-shared (kind buildkit)
Bound to /projects
A record is usable nowhere until it is bound: --bind <path> declares the first binding in the
same call — / for estate-wide, or a node path such as /projects/web — and the verb says so
when none was declared.
The kind is refused before any call is made when it is gcp_cloud_build:
"no installed pack serves this kind". A provider of a kind whose content
pack is not entitled (the AWS and Azure kinds ride packs:aws and
packs:azure) is accepted here and refused at dispatch, so an
administrator may prepare ahead of a licence change.
The credential is write-only and its form is declared with
--credential-kind and checked against the kind: a buildkit provider
holds the daemon's mTLS client certificate, an aws_image_builder
provider a role to assume (assume_role: JSON with role_arn,
access_key_id, secret_access_key and optionally external_id) or a
static key pair (access_key: JSON with access_key_id,
secret_access_key), an azure_image_builder provider a service
principal (service_principal: JSON with client_id, client_secret,
tenant_id) or its certificate form (service_principal_cert: JSON with
client_id, tenant_id, certificate).
Flags
| Flag | Meaning |
|---|---|
--server <url> | Server base URL (default: the active context / OPSCHAIN_SERVER). |
--auth-token <token> | Admin bearer token override (default: your opschain login session, then $OPSCHAIN_ADMIN_TOKEN, then the token stored by opschain admin login). |
--kind <kind> | Provider kind: buildkit, packer, aws_image_builder or azure_image_builder (gcp_cloud_build is reserved). Immutable after create. |
--bind <path> | Declare the first binding in the same call: / (estate-wide) or a node path. |
--display-name <name> | Human-readable provider name. |
--description <text> | What this backend is for. |
--endpoint <url> | Backend address where one applies — required for buildkit (tcp://host:1234, unix:///run/buildkit/buildkitd.sock); empty for the cloud kinds, where --region decides. |
--region <region> | Cloud region for the cloud kinds (required for aws_image_builder). |
--credential-kind <form> | What the credential holds: client_cert (buildkit), service_principal_cert / service_principal (azure), assume_role / access_key (aws), service_account_key / workload_identity (gcp). Validated against the kind. |
--credential-ref <ref> | secret-vault:// reference to pin as the credential (mutually exclusive with the inline channel). |
--default <key=value> | A kind-specific default (registry, gallery, distribution, project…), injected into the step as IMAGE_BUILD_DEFAULT_<KEY>; repeatable. |
--ssl-verify | Verify the endpoint's TLS certificate (default true; --ssl-verify=false is an explicit opt-out). |
--ssl-ca-cert <path-or-pem> | CA trust anchor for the endpoint: a PEM block inline or a certificate file path on the server host. |
--enabled | Whether dispatch may resolve this provider (default true). |
--credential-env <name> | Environment variable holding the credential value (never the value itself on argv). |
--credential-prompt | Prompt for the credential value without echo. |
See also
opschain docs cli/admin-image-build-providers-update— rotation and enable/disable.opschain docs cli/admin-image-build-providers-bind— further bindings.