wrangler containers registries configure always resolves the private credential (stdin in CI, or an interactive prompt) before it checks whether the target Secrets Store secret already exists. When the secret already exists, the value is reused by reference and the supplied value is discarded. So a user who already stored their credential in Secrets Store must still supply it again only to have it thrown away, and there is no way to configure a registry purely by reference to a pre-existing, self-managed secret.
Current behavior:
Non-interactive: --secret-name= with no piped value → errors (No input provided…), even though the value would be discarded on reuse.
Interactive: prompts Enter : first, then asks whether to reuse the existing secret — i.e. it asks for a value it will not use.
Desired behavior:
Check secret existence first, for all providers:
Secret exists → reuse by reference; do not require the private credential.
Secret does not exist → require it and store it (unchanged).
FedRAMP High (--disable-secrets-store, inline credential) → no store to check, so the private credential is always required (unchanged).
Jira ticket CC-7994
wrangler containers registries configurealways resolves the private credential (stdin in CI, or an interactive prompt) before it checks whether the target Secrets Store secret already exists. When the secret already exists, the value is reused by reference and the supplied value is discarded. So a user who already stored their credential in Secrets Store must still supply it again only to have it thrown away, and there is no way to configure a registry purely by reference to a pre-existing, self-managed secret.Current behavior:
Non-interactive: --secret-name= with no piped value → errors (No input provided…), even though the value would be discarded on reuse.
Interactive: prompts Enter : first, then asks whether to reuse the existing secret — i.e. it asks for a value it will not use.
Desired behavior:
Check secret existence first, for all providers:
Secret exists → reuse by reference; do not require the private credential.
Secret does not exist → require it and store it (unchanged).
FedRAMP High (--disable-secrets-store, inline credential) → no store to check, so the private credential is always required (unchanged).
Jira ticket CC-7994