Support registry token for VPN image pulls

scripts/docker-prod-common.sh

@@ -111,10 +111,16 @@ load_prod_env_exports() {
     IMAGE_ARCHIVE_REQUIRED \
     REGISTRY_HOST \
     REGISTRY_USER \
-    REGISTRY_PASSWORD
+    REGISTRY_PASSWORD \
+    REGISTRY_TOKEN
   do
     export_env_value_if_unset "${key}"
   done
+
+  if [[ -z "${REGISTRY_PASSWORD:-}" && -n "${REGISTRY_TOKEN:-}" ]]; then
+    REGISTRY_PASSWORD="${REGISTRY_TOKEN}"
+    export REGISTRY_PASSWORD
+  fi
 }
 
 validate_prod_env_file() {
@@ -239,6 +245,11 @@ require_release_image() {
 }
 
 login_registry_if_configured() {
+  if [[ -z "${REGISTRY_PASSWORD:-}" && -n "${REGISTRY_TOKEN:-}" ]]; then
+    REGISTRY_PASSWORD="${REGISTRY_TOKEN}"
+    export REGISTRY_PASSWORD
+  fi
+
   if [[ "${IMAGE_ARCHIVE_REQUIRED:-false}" == "true" || "${IMAGE_ARCHIVE_REQUIRED:-0}" == "1" ]]; then
     echo "IMAGE_ARCHIVE_REQUIRED is enabled; skipping docker login."
     return 0
@@ -267,7 +278,7 @@ login_registry_if_configured() {
   fi
 
   if [[ -z "${REGISTRY_HOST:-}" || -z "${REGISTRY_USER:-}" || -z "${REGISTRY_PASSWORD:-}" ]]; then
-    echo "REGISTRY_HOST, REGISTRY_USER, and REGISTRY_PASSWORD are all required when registry credentials are configured." >&2
+    echo "REGISTRY_HOST, REGISTRY_USER, and REGISTRY_PASSWORD or REGISTRY_TOKEN are required when registry credentials are configured." >&2
     exit 1
   fi