Skip to content

How to pull helm-chart images for local registry

IECTL provides token fetch commands for registry, that allows you to retrieve authentication tokens. These tokens can be used to pull the helm chart images that are needed to onboard an IEM with a local container registry.

Prerequisites

  • Create Technical user on IEHUB. See the Create CLI User for detailed setup instructions.
  • Before fetching tokens, you must configure IECTL with the appropriate connection details for each service. See the Managing IEHUB Configurations for detailed setup instructions.

NOTICE

Make sure your technical user have privilege to Create / Manage IEM instances, this allows this user to pull images as well.

Adding Configurations

# Add IEHUB configuration  
iectl config add iehub --name my-iehub --url https://iehub.eu1.edge.siemens.cloud --user myuser@company.com --password-stdin

Fetch Registry Token Commands

iectl iehub token get-registry-token

This command fetches an authentication token for the configured IEHUB instance to pull IEM helm-chart images.

Pull Images using Auth Token

For automation scripts and CI/CD pipelines, you can fetch tokens once at the beginning of your workflow and reuse them throughout:

# Set variables
export AUTH_USER='<user email of the IEHub CLI user>'
export REG_URL='cr.eu1.edge.siemens.cloud'

# Get token (ensure iectl is in your PATH)
export AUTH_TOKEN="$AUTH_USER:"$(iectl iehub token  get-registry-token)
export AUTH_TOKEN_ENCODED=$(echo -n $AUTH_TOKEN | base64 -w0)
echo "{\"auths\":{\"$REG_URL\":{\"auth\":\"$AUTH_TOKEN_ENCODED\"}}}" > ~/.docker/config.json

# Set variables
$AUTH_USER = "<user email of the IEHub CLI user>"
$REG_URL = "cr.eu1.edge.siemens.cloud"

# Get token (ensure iectl is in your PATH)
$REGISTRY_TOKEN = iectl iehub token get-registry-token

# Construct the auth string and encode (format: username:token, base64 encoded)
$AUTH_TOKEN = "$AUTH_USER`:$REGISTRY_TOKEN"
$AUTH_TOKEN_ENCODED = [Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes($AUTH_TOKEN))
$CONFIG = "{`"auths`":{`"$REG_URL`":{`"auth`":`"$AUTH_TOKEN_ENCODED`"}}}"
$CONFIG | Set-Content -Path "$HOME\.docker\config.json"

Pull all container images and save them:

Pull an image using docker 
# Pull the image with Docker
docker pull '<helm-chart image>'
docker save '<helm-chart image>' --output ./myimage.tar
Pull an image using crane 
# Pull the same image using Google’s crane tool
crane pull '<helm-chart image>' ./myimage.tar  # Downloads the image and saves it as myimage.tar