Pull images from a Kubernetes pod

A pod pulls a private image from your registry project with a Kubernetes secret that holds an access token. A secret is a Kubernetes object that keeps a small piece of sensitive data, such as a token, out of your pod specification and your images. You create the secret once in each namespace, and name it in every pod that pulls from the project.

Before you begin

You need:

• An image in your registry project. See Push and pull images.
• An access token for the project, and its Token Name and Token Value. A pull-only token is enough. See Create an access token.
• kubectl installed and connected to your Kubernetes cluster, and the name of the namespace your pod runs in.
• Nodes that can reach both registry.e2enetworks.net and objectstore.e2enetworks.net over HTTPS. The image layers download from the second address.

Create the secret

Run this command, with your own values:

kubectl create secret docker-registry <secret-name> \
  --namespace <namespace> \
  --docker-server=registry.e2enetworks.net \
  --docker-username=<token-name> \
  --docker-password=<token-value>

• <secret-name>: a name for the secret, such as registry-pull.
• <namespace>: the namespace of the pod that pulls the image. A pod can use only a secret in its own namespace.
• <token-name> and <token-value>: the token’s Token Name and Token Value, exactly as the Access Token dialog showed them.

Kubernetes prints secret/<secret-name> created.

Name the secret in the pod

1. Find the image’s path. In MyAccount, under Storage, click Container Registry, and click your project. On its Repositories tab, click the repository, and copy the artifact’s Pull Command. The image path is everything after docker pull, and it has the form registry.e2enetworks.net/<project-name>/<repository>@<digest>. A path by tag, registry.e2enetworks.net/<project-name>/<repository>:<tag>, works too.

2. Save this as private-image-pod.yaml, with the image path in image and your secret’s name under the pod’s image pull secrets:

   apiVersion: v1
   kind: Pod
   metadata:
     name: private-image-pod
     namespace: <namespace>
   spec:
     containers:
       - name: app
         image: registry.e2enetworks.net/<project-name>/<repository>@<digest>
     imagePullSecrets:
       - name: <secret-name>

3. Create the pod:

   kubectl apply -f private-image-pod.yaml

For a Deployment, put the image pull secrets under the pod template’s spec, next to its containers:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: web
  namespace: <namespace>
spec:
  replicas: 2
  selector:
    matchLabels:
      app: web
  template:
    metadata:
      labels:
        app: web
    spec:
      containers:
        - name: app
          image: registry.e2enetworks.net/<project-name>/<repository>:<tag>
      imagePullSecrets:
        - name: <secret-name>

Check that the pod pulled the image

kubectl get pod private-image-pod --namespace <namespace>

For the Deployment, list its pods by the label it gives them:

kubectl get pods --namespace <namespace> -l app=web

A pod reads Running once Kubernetes has pulled the image and started it. If it reads ImagePullBackOff or ErrImagePull, see Troubleshooting Container Registry.

Your pods can now pull images from your registry project. When you reset the token later, delete the secret with kubectl delete secret <secret-name> --namespace <namespace>, then create it again with the new value; see Manage an access token.