Pulling k8s installer images using Podman with new token policy for UCF

Products

• Network Observability

Issue/Introduction

You cannot pull Kubernetes installer images from the Broadcom registry using Podman due to the new pull token policy introduced in January 2026.․․․․​​​‌​‌​

ERROR MESSAGE (if applicable): "Natively, podman doesn't provide an obvious mechanism to support passing a secret as part of the pull request"

SYMPTOMS:

• Unified Communication Framework (UCF) installation fails in development environments.

• Podman lacks a clear mechanism to pass secrets during pull requests.

• Documentation does not specify the exact command syntax for the new token policy.

CONTEXT: Occurs during NetOps testing and preparation for planned upgrades.

IMPACT: Blocks urgent upgrade testing and installation of UCF in development environments.

Environment

 

• OS: RHEL 8 & 9

• Container Engine: Podman

• Platform: Kubernetes (k8s) / UCF

• Product Version: 25.4.4

 

Resolution

PREREQUISITES:

• Broadcom Support portal credentials (email and password).

• Access to the Broadcom container registry.

• Podman installed on RHEL 8 or 9.

STEPS:

1. IDENTIFY CREDENTIALS: Use your Broadcom Support Portal login details.

   • Username: Your support portal email address.

   • Password: Your Broadcom pull token (available via the support portal).

   NOTE: Do not use special characters or quotes around the userID/token unless specifically required by your shell environment.

2. EXECUTE IMAGE PULL: Use the standard Podman login and pull commands.

   Command: podman login [Registry_URL] Command: podman pull [Image_Path]

   EXPECTED: Podman authenticates using the email as the username and the token as the password.

3. CONFIGURE CREDENTIALS FILE (OPTIONAL): Use a JSON credentials file if manual pulls are not preferred.

   Path: /run/user/[UID]/auth.json or /etc/containers/auth.json

   EXPECTED: Podman references the JSON file for credentials during the pull process.

VERIFY SUCCESS:

• Image pulls successfully without authentication errors.

• UCF installation proceeds to the next stage.

Additional Information

The Broadcom pull token policy updated on January 26th changed how credentials must be passed. Podman requires the support email as the username and the generated token as the password.