opschain admin image-build-providers update
Included from Basic tier
Partially updates an image build provider: every field flag passed replaces the stored value; omitted
flags leave it as it was. A supplied --credential-ref re-pins the reference (resolved at write
time); an inline credential via --credential-env or --credential-prompt rotates the vault
value and the audit event carries credential_rotated. Code and kind are immutable.
Passing --default replaces the whole defaults map with the pairs given.
opschain admin image-build-providers update buildkit-shared --enabled=false
Updated image build provider buildkit-shared
Flags
| Flag | Meaning |
|---|---|
--server <url> | Server base URL (default: the active context / OPSCHAIN_SERVER). |
--auth-token <token> | Admin bearer token override (default: your opschain login session, then $OPSCHAIN_ADMIN_TOKEN, then the token stored by opschain admin login). |
--display-name <name> | Human-readable provider name. |
--description <text> | What this backend is for. |
--endpoint <url> | Backend address where one applies — required for buildkit (tcp://host:1234, unix:///run/buildkit/buildkitd.sock); empty for the cloud kinds, where --region decides. |
--region <region> | Cloud region for the cloud kinds (required for aws_image_builder). |
--credential-kind <form> | What the credential holds: client_cert (buildkit), service_principal_cert / service_principal (azure), assume_role / access_key (aws), service_account_key / workload_identity (gcp). Validated against the kind. |
--credential-ref <ref> | secret-vault:// reference to pin as the credential (mutually exclusive with the inline channel). |
--default <key=value> | A kind-specific default (registry, gallery, distribution, project…), injected into the step as IMAGE_BUILD_DEFAULT_<KEY>; repeatable. |
--ssl-verify | Verify the endpoint's TLS certificate (default true; --ssl-verify=false is an explicit opt-out). |
--ssl-ca-cert <path-or-pem> | CA trust anchor for the endpoint: a PEM block inline or a certificate file path on the server host. |
--enabled | Whether dispatch may resolve this provider (default true). |
--credential-env <name> | Environment variable holding the credential value (never the value itself on argv). |
--credential-prompt | Prompt for the credential value without echo. |
See also
opschain docs cli/admin-image-build-providers-create— the credential forms per kind.