Add ECIR project and robot account creation to the registry documentation

docs/services/registry/faq.md

@@ -1,4 +1,14 @@
-# FAQ
+# FAQ about the EIDF Container Image Registry
+
+## What credentials can I use for the registry in an automation?
+
+To access the registry in an automation, you should create a robot account for your project. Robot accounts are service accounts that can be used to access the registry without needing to use your personal credentials. They are configured with specific permissions (e.g., pull-only, push-pull) and have a limited validity period for security purposes.
+
+Instructions for using a robot account can be found in the [Working with the EIDF Container Image Registry](working-with.md#robot-accounts-for-automations-in-the-ecir) documentation.
+
+## My Robot Account credentials have been compromised, what should I do?
+
+If you believe your robot account credentials have been compromised, you should immediately refresh the robot account secret to invalidate the compromised secret. This can be done by a project PI or manager in the Image Registry section of your project. Instructions for refreshing the robot account secret can be found in the [Working with the Registry](working-with.md#robot-accounts-for-automations-in-the-ecir) documentation.
 
 ## Known Issues
 

docs/services/registry/index.md

@@ -1,4 +1,4 @@
-# Overview
+# Overview of the EIDF Container Image Registry
 
 EIDF Container Image Registry (ECIR) is an image registry for use in EIDF, EPCC and related services. ECIR uses [Harbor](https://goharbor.io) to provide services for image storage, vulnerability scanning and Software Bill of Materials (SBOM) generation.
 

docs/services/registry/projects.md

@@ -1,8 +1,8 @@
-# Projects
+# EIDF Container Image Registry Projects and Caches
 
 ## Projects within EIDF
 
-Every EIDF project can request that a ECIR project is created for them. An ECIR project is a namespace within the registry which contains repositories for container images private to users of that EIDF project.
+Every EIDF project can request that an EIDF Container Image Registry (ECIR) project is created for them. An ECIR project is a namespace within the registry which contains repositories for container images private to users of that EIDF project.
 
 !!! important "ECIR Projects"
 
@@ -51,6 +51,10 @@ ECIR Project maintainers **do not** have the permissions to:
 * Edit project configuration
 * Delete projects.
 
+If you are intending to use the ECIR in an automation you should make use of a robot account for your project. Robot accounts are service accounts that can be used to access the registry without needing to use your personal credentials. They are configured with specific permissions (e.g., pull-only or push-pull) and have a limited validity period for security purposes. To read more see [Working with the EIDF Container Image Registry](working-with.md#robot-accounts-for-automations-in-the-ecir) documentation.
+
+If you require a robot account with specific permissions you should submit a request via the [EIDF Portal](https://portal.eidf.ac.uk/queries/submit).
+
 ## The Library and Public Caches
 
 ECIR provides a common library of standard images. ECIR provides cache projects for four major registries which allow images to be stored for 7 days after use in ECIR for convenient access.

docs/services/registry/working-with.md

@@ -1,6 +1,6 @@
-# Working with ECIR
+# Working with EIDF Container Image Registry (ECIR)
 
-## The Registry Interface and Accounts
+## The ECIR Interface and Accounts
 
 EIDF Users can access the registry through their SAFE account.
 
@@ -13,6 +13,12 @@ User tokens can be accessed from the User Profile from the dropdown under your U
 
 See the FAQ section ['Unauthorised' error when logging into the registry from Docker](./faq.md#unauthorised-error-when-logging-into-the-registry-from-docker) for help with token expiry and authorisation issues.
 
+## Creating a Project Repository
+
+Each EIDF project can have a private space on the registry, this is called an Edinburgh Container Image Registry (ECIR) project. An ECIR project can be used to store images and artifacts that are private to the project.
+
+By default new EIDF projects will have an ECIR project created with the same name. If you have an existing project without a registry project, you can request one by contacting the EIDF Service Desk.
+
 ## Push Commands
 
 In your project, there is a PUSH Command option which will give you the command templates for pushing to the Project repositories from different clients.
@@ -26,6 +32,51 @@ Each repository in a project has a COPY PULL button option once an image/artifac
 
 Clicking on a tag in a repository will open up the information on the artifact, this can include an overview of the image, vulnerability summary, SBOM and build history.
 
+## Robot Accounts for Automations in the ECIR
+
+If you are regularly using a repository from a project where you are sharing resources and need automated, read-only access (for example, pulling images into compute jobs), it is recommended to create a robot account with limited pull-only privileges.
+
+If you also need to publish images (for example, as part of an automated build or CI/CD pipeline), you should instead create a robot account with push-pull permissions for the project.
+
+!!! Note
+
+    Project Robot account management is only available to PIs and project administrators. If you are not a PI or project administrator, please contact your PI to request a robot account.
+
+### Creating Robot Accounts for the Registry
+
+Robot accounts can be added by a project administrator as follows:
+
+!!! Note
+
+    Only available in the new project interface. If you are using the old project interface, please select "Try new view" in the top right corner of the project page.
+
+1. Navigate to the Image Registry section of your project
+1. Select "Add Pull Only Token" or "Add Pull and Push Token" depending on your needs as described above
+1. A form will appear which allows you to trigger creation of the robot account, progress of which will be shown in the Image Registry section of your project. You will not be able to add, delete or refresh robot secrets whilst this action is in progress.
+1. Once the robot account has been created, you will be able to view the robot account and its secret in the Image Registry section of your project. The secret will be visible whenever you return to this page.
+
+### Refreshing the Token of Robot Accounts
+
+!!! Note
+
+    Only available in the new project interface. If you are using the old project interface, please select "Try new view" in the top right corner of the project page.
+
+Robot accounts with push-pull permissions have a default validity period of 30 days after which they will expire and need to be renewed. This is to ensure that access is regularly reviewed and maintained. Should the robot account's credentials be compromised the secret can be refreshed to invalidate the compromised secret preventing its use.
+
+When a robot push-pull account is created, it will have a default validity period of 30 days. The expiry date of the robot account is shown in the Image Registry section of a project. When the robot account expires the date will be displayed in red. On expiry the existing robot account's secret will be invalidated and the robot account will need to be refreshed to continue use.
+
+The robot account can be refreshed by a project PI or manager by selecting the "Refresh" button next to the robot account. When the robot account is refreshed a job will run to create a new secret for the robot account. If the robot account is refreshed before the expiry date, the existing secret will be invalidated and only the new secret will be usable to authenticate the robot account to the registry. After the job has completed the new secret will be displayed and the expiry date will be updated. The new secret will need to be used in any jobs or scripts that use the robot account to access the registry.
+
+### Deleting a Robot Account
+
+If a robot account is no longer required it should be deleted to reduce the risk of unauthorised access to your Harbor project.
+
+!!! Note
+
+    Only available in the new project interface. If you are using the old project interface, please select "Try new view" in the top right corner of the project page.
+
+ A robot account can be deleted by a project PI or manager by selecting the "Delete" button next to the robot account. When a robot account is deleted, it will no longer be able to access the registry and any existing secrets will be invalidated. If a robot account is deleted in error, a new robot account can be created to replace it.
+
 ## Using from the Command Line with Docker
 
 Important: Run these commands on a system that has Docker installed and has access to the ECIR.
@@ -62,19 +113,12 @@ https://docs.docker.com/engine/reference/commandline/login/#credentials-store
 Login Succeeded
 ```
 
+To pull images from the registry, from private or authenticated projects, you will need to add a secret to the namespace you are using and reference it in your job definition. Note that user tokens have a limited validity period and therefore, robot accounts are recommended for long-term use. See the section on [Creating a Robot Account](#creating-robot-accounts-for-the-registry) for more details.
 From your command line, you can now push and pull images to the registry.
 
 ## Kubernetes/GPU Service Access
 
-To pull images from the registry, from private or authenticated projects, you will need to add a secret to the namespace you are using and reference it in your job definition. Note that user tokens have a limited validity period.
-
-If you are regularly using a repository from a project where you are sharing resources, it is recommended to create a robot account with limited read only privileges, this can be requested via a Helpdesk Request for your project.
-
-!!! important "Portal Management"
-
-    There will be new functionality soon added to the EIDF Portal to allow for project users to create read only robot accounts and for PI/Managers to create read/write robot accounts for use in CI/CD pipelines for image building.
-
-This is then treated like a normal user secret when you have the robot credentials.
+To pull images from the registry, from private or authenticated projects, you will need to add a secret to the namespace you are using and reference it in your job definition. Note that user tokens have a limited validity period and hence robots are recommended for long term use. See the section on [Creating a Robot Account](#creating-robot-accounts-for-the-registry) for more details.
 
 Secrets can be created in one of two ways, as detailed below, either directly via kubectl from your Docker config.json file, or by creating a YAML file.
 

mkdocs.yml

@@ -98,10 +98,10 @@ nav:
     - "Code Collaboration":
       - "Gitlab Overview": services/gitlab/index.md
       - "Gitlab Quickstart": services/gitlab/quickstart.md
-      - "Container Image Registry Overview": services/registry/index.md
-      - "Container Image Registry Projects and Caches": services/registry/projects.md
-      - "Container Image Registry Use": services/registry/working-with.md
-      - "Container Image Registry FAQ": services/registry/faq.md
+      - "EIDF Container Image Registry Overview": services/registry/index.md
+      - "EIDF Container Image Registry Projects and Caches": services/registry/projects.md
+      - "Working with the EIDF Container Image Registry": services/registry/working-with.md
+      - "EIDF Container Image Registry FAQ": services/registry/faq.md
   - "Safe Haven Services":
      - "Overview": safe-haven-services/overview.md
      - "Access": safe-haven-services/safe-haven-access.md