opschain admin image-registries update
Included from Basic tier
Partially updates an image registry: every field flag passed replaces the stored value; omitted
flags leave it as it was. A supplied --credential-ref re-pins the reference (resolved at write
time); an inline credential via --credential-env or --credential-prompt rotates the vault
value and the audit event carries credential_rotated. Code and kind are immutable.
opschain admin image-registries update acr-payments --repository payments/v2
Updated image registry acr-payments
Flags
| Flag | Meaning |
|---|---|
--server <url> | Server base URL (default: the active context / OPSCHAIN_SERVER). |
--auth-token <token> | Admin bearer token override (default: your opschain login session, then $OPSCHAIN_ADMIN_TOKEN, then the token stored by opschain admin login). |
--display-name <name> | Human-readable registry name. |
--description <text> | What this registry holds. |
--host <host> | The registry host (fixed to ghcr.io for ghcr — leave it empty; the gallery or account identifier for gallery and ami). Required otherwise. |
--repository <prefix> | The repository path prefix inside the registry (payments, platform/web); the step names only the image name and tag beneath it. |
--credential-kind <form> | What the credential holds: basic / token (oci), github_connection / token (ghcr), assume_role / access_key (ecr, ami), service_principal / service_principal_cert (acr, gallery), service_account_key / workload_identity (gar). Validated against the kind. |
--credential-ref <ref> | secret-vault:// reference to pin as the credential (mutually exclusive with the inline channel). |
--github-connection <code> | The GitHub connection a ghcr registry pushes through (--credential-kind github_connection): the connection's App must hold the packages write permission; the installation token is minted at dispatch. |
--ssl-verify | Verify the registry's TLS certificate (default true; --ssl-verify=false is an explicit opt-out). |
--ssl-ca-cert <path-or-pem> | CA trust anchor for a private registry: a PEM block inline or a certificate file path on the server host. |
--enabled | Whether dispatch may resolve this registry (default true). |
--credential-env <name> | Environment variable holding the credential value (never the value itself on argv). |
--credential-prompt | Prompt for the credential value without echo. |
See also
opschain docs cli/admin-image-registries-create— the credential forms per kind.