From 0220a051ed57b906cd0ca1b2a65d7bcb7e7ef737 Mon Sep 17 00:00:00 2001 From: jacobbmay <134300709+jacobbmay@users.noreply.github.com> Date: Wed, 1 Jul 2026 12:48:53 -0400 Subject: [PATCH 1/4] fix: add nerdctl login to tink-agent-setup Signed-off-by: jacobbmay <134300709+jacobbmay@users.noreply.github.com> --- mkosi.extra/usr/local/bin/tink-agent-setup | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/mkosi.extra/usr/local/bin/tink-agent-setup b/mkosi.extra/usr/local/bin/tink-agent-setup index bb51ee1..a97fb13 100755 --- a/mkosi.extra/usr/local/bin/tink-agent-setup +++ b/mkosi.extra/usr/local/bin/tink-agent-setup @@ -112,6 +112,21 @@ wait_for_containerd() { log_info "containerd is ready" } +# --- Log into the registry (if credentials were provided) --- +registry_login() { + if [[ -z "${REGISTRY_USERNAME:-}" || -z "${REGISTRY_PASSWORD:-}" ]]; then + return + fi + + local login_host="${DOCKER_REGISTRY:-${TINK_IMAGE%%/*}}" + log_info "logging into registry" "host" "${login_host}" + if ! printf '%s' "${REGISTRY_PASSWORD}" \ + | nerdctl login "${login_host}" -u "${REGISTRY_USERNAME}" --password-stdin; then + log_error "registry login failed" "host" "${login_host}" + exit 1 + fi +} + # --- Pull the tink-agent image --- pull_image() { log_info "pulling tink-agent image" "image" "${TINK_IMAGE}" @@ -126,6 +141,8 @@ pull_image() { return fi + registry_login + while true; do attempt=$((attempt + 1)) if nerdctl pull -q "${TINK_IMAGE}" 2>&1; then From 453644f619e00773c6a3be2b668e2df4d53d519a Mon Sep 17 00:00:00 2001 From: jacobbmay <134300709+jacobbmay@users.noreply.github.com> Date: Wed, 1 Jul 2026 14:34:03 -0400 Subject: [PATCH 2/4] fix: update insecure registry handling to support http and https registries Signed-off-by: jacobbmay <134300709+jacobbmay@users.noreply.github.com> --- README.md | 4 ++- captain/cli/_parser.py | 6 +++- mkosi.extra/usr/local/bin/tink-agent-setup | 38 ++++++++++++++++++---- 3 files changed, 40 insertions(+), 8 deletions(-) diff --git a/README.md b/README.md index 00e2a5b..8e3d33d 100644 --- a/README.md +++ b/README.md @@ -240,7 +240,9 @@ tinkerbell: --tink-worker-id ID machine / worker ID --tink-tls BOOL enable TLS to tink-server (default: false) --tink-insecure-tls BOOL allow insecure TLS (default: true) - --tink-insecure-registries LIST comma-separated insecure registries + --tink-insecure-registries LIST comma-separated insecure registries; each registry may be prefixed + with http:// (default) or https:// (HTTPS with skip TLS verify). + Example: foo.local,http://bar.local:5000,https://baz.local --tink-registry-username USER registry auth username --tink-registry-password PASS registry auth password --tink-syslog-host HOST remote syslog host diff --git a/captain/cli/_parser.py b/captain/cli/_parser.py index 4e6d129..47a90a6 100644 --- a/captain/cli/_parser.py +++ b/captain/cli/_parser.py @@ -522,7 +522,11 @@ def _add_tink_flags(parser: configargparse.ArgParser) -> None: env_var="TINK_INSECURE_REGISTRIES", metavar="LIST", default="", - help="comma-separated insecure registries", + help=( + "comma-separated insecure registries; each registry may be prefixed " + "with http:// (default) or https:// (HTTPS with skip TLS verify). " + "Example: foo.local,http://bar.local:5000,https://baz.local" + ), ) g.add_argument( "--tink-registry-username", diff --git a/mkosi.extra/usr/local/bin/tink-agent-setup b/mkosi.extra/usr/local/bin/tink-agent-setup index a97fb13..df1bd40 100755 --- a/mkosi.extra/usr/local/bin/tink-agent-setup +++ b/mkosi.extra/usr/local/bin/tink-agent-setup @@ -9,7 +9,12 @@ # registry_password= Registry auth password # tinkerbell_tls= Enable TLS for tink-server # tinkerbell_insecure_tls= Allow insecure TLS -# insecure_registries= Comma-separated insecure registries +# insecure_registries= Comma-separated insecure registries. Each +# registry may be prefixed with a scheme: +# http://host -> plain HTTP (no TLS) +# https://host -> HTTPS with skip_verify +# host -> plain HTTP (default, +# matches prior behaviour) set -euo pipefail @@ -83,15 +88,36 @@ configure_insecure_registries() { for registry in "${REGISTRIES[@]}"; do registry=$(echo "$registry" | xargs) # trim whitespace [[ -z "$registry" ]] && continue - mkdir -p "${certs_dir}/${registry}" - cat > "${certs_dir}/${registry}/hosts.toml" < "${certs_dir}/${host}/hosts.toml" < "${certs_dir}/${host}/hosts.toml" < Date: Tue, 7 Jul 2026 14:30:18 -0400 Subject: [PATCH 3/4] fix: set registry ports where needed in hosts.toml files --- mkosi.extra/usr/local/bin/tink-agent-setup | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/mkosi.extra/usr/local/bin/tink-agent-setup b/mkosi.extra/usr/local/bin/tink-agent-setup index df1bd40..64ae064 100755 --- a/mkosi.extra/usr/local/bin/tink-agent-setup +++ b/mkosi.extra/usr/local/bin/tink-agent-setup @@ -89,7 +89,7 @@ configure_insecure_registries() { registry=$(echo "$registry" | xargs) # trim whitespace [[ -z "$registry" ]] && continue - local scheme host + local scheme host port case "$registry" in https://*) scheme="https"; host="${registry#https://}" ;; http://*) scheme="http"; host="${registry#http://}" ;; @@ -97,13 +97,23 @@ configure_insecure_registries() { esac host="${host%/}" # strip any trailing slash + # If host has a port set, set the port var to that value otherwise use default 443 or 80 based on scheme + if [[ "$host" == *:* ]]; then + port="${host##*:}" + host="${host%:*}" + elif [[ "$scheme" == "https" ]]; then + port=443 + else + port=80 + fi + mkdir -p "${certs_dir}/${host}" if [[ "$scheme" == "https" ]]; then # HTTPS registry with an untrusted cert (private CA / self-signed). cat > "${certs_dir}/${host}/hosts.toml" < "${certs_dir}/${host}/hosts.toml" < Date: Wed, 8 Jul 2026 16:05:29 -0400 Subject: [PATCH 4/4] fix: add retry logic to tink-agent-setup to prevent transient errors from stalling tink-agent from starting --- .../etc/systemd/system/tink-agent-setup.service | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/mkosi.extra/etc/systemd/system/tink-agent-setup.service b/mkosi.extra/etc/systemd/system/tink-agent-setup.service index 6954014..b5724a7 100644 --- a/mkosi.extra/etc/systemd/system/tink-agent-setup.service +++ b/mkosi.extra/etc/systemd/system/tink-agent-setup.service @@ -6,6 +6,9 @@ Requires=containerd.service # Only start when Tinkerbell parameters are on the kernel command line ConditionKernelCommandLine=|tink_worker_image ConditionKernelCommandLine=|docker_registry +# Allow up to 10 restart attempts within 10 minutes before giving up. +StartLimitIntervalSec=600 +StartLimitBurst=10 [Service] Type=oneshot @@ -13,6 +16,16 @@ RemainAfterExit=yes ExecStart=/usr/local/bin/tink-agent-setup TimeoutStartSec=300 +# Retry to prevent transient failures from preventing tink-agent from starting +# with exponential backoff between attempts. +Restart=on-failure +RestartSec=5 +RestartMaxDelaySec=60 +RestartSteps=5 + +# When setup finally succeeds, explicitly restart tink-agent to get past tink-agent dependency error preventing it from starting +ExecStartPost=-/bin/systemctl --no-block start tink-agent.service + # Logging StandardOutput=journal StandardError=journal