Support registry token for VPN image pulls

production/scripts/docker-prod-common.sh

@@ -117,10 +117,16 @@ load_prod_env_exports() {
     REGISTRY_HOST \
     REGISTRY_USER \
     REGISTRY_PASSWORD \
+    REGISTRY_TOKEN \
     VPN_CONTAINER
   do
     export_env_value_if_unset "${key}"
   done
+
+  if [[ -z "${REGISTRY_PASSWORD:-}" && -n "${REGISTRY_TOKEN:-}" ]]; then
+    REGISTRY_PASSWORD="${REGISTRY_TOKEN}"
+    export REGISTRY_PASSWORD
+  fi
 }
 
 validate_prod_env_file() {
@@ -228,6 +234,11 @@ require_release_image() {
 login_registry_if_configured() {
   local archive_disabled="${IMAGE_ARCHIVE_DISABLED:-false}"
 
+  if [[ -z "${REGISTRY_PASSWORD:-}" && -n "${REGISTRY_TOKEN:-}" ]]; then
+    REGISTRY_PASSWORD="${REGISTRY_TOKEN}"
+    export REGISTRY_PASSWORD
+  fi
+
   if [[ "${IMAGE_ARCHIVE_REQUIRED:-false}" == "true" || "${IMAGE_ARCHIVE_REQUIRED:-0}" == "1" ]]; then
     if [[ "${archive_disabled}" != "true" && "${archive_disabled}" != "1" ]]; then
       echo "IMAGE_ARCHIVE_REQUIRED is enabled; skipping docker login."
@@ -258,7 +269,7 @@ login_registry_if_configured() {
   fi
 
   if [[ -z "${REGISTRY_HOST:-}" || -z "${REGISTRY_USER:-}" || -z "${REGISTRY_PASSWORD:-}" ]]; then
-    echo "REGISTRY_HOST, REGISTRY_USER, and REGISTRY_PASSWORD are all required when registry credentials are configured." >&2
+    echo "REGISTRY_HOST, REGISTRY_USER, and REGISTRY_PASSWORD or REGISTRY_TOKEN are required when registry credentials are configured." >&2
     exit 1
   fi