---
title: "Pull images from Container Registry"
description: "Let pods on a TIR Kubernetes cluster pull private images from TIR Container Registry with a docker-registry pull secret and imagePullSecrets."
content_type: "how-to"
product: "tir-kubernetes"
platform: "TIR"
url: "/tir/tir-kubernetes/how-to/pull-from-container-registry/"
topic: ["workloads"]
---

# Pull images from Container Registry

<!-- cspell:ignore kubeconfig kubectl dockerconfigjson -->

Let your pods pull private images from TIR Container Registry by giving them the registry's
credentials in a pull secret. A Kubernetes Secret holds a small piece of sensitive data, such as a
password, apart from your images and manifests. A secret of the `docker-registry` type holds
registry credentials, and a pod names it under `imagePullSecrets` to use them when it pulls an
image.

## Before you begin

- A cluster in the **Ready** state and its kubeconfig set up for `kubectl`. See
  [Connect to a Kubernetes cluster](/tir/tir-kubernetes/how-to/connect-to-a-cluster/).
- A registry in TIR Container Registry with your image pushed to it. See
  [Push an image](/tir/tir-container-registry/how-to/push-an-image/).

## Find the registry's address and credentials

The registry address depends on the region the registry was created in:

- Delhi: `registry.e2enetworks.net`
- Chennai: `in-south1-registry.e2enetworks.net`

To find your registry's address, open your project in TIR and, in the side menu under **Storage**, select
**Container Registry**. Each registry's address is its **Endpoint**, next to its **Username**.
For the password, select **Commands** on the registry's row: the Docker login command there has the
username and password filled in.

An image address has the form `<endpoint>/<namespace>/<image>:<tag>`, where `<namespace>` is the
registry's name, for example `registry.e2enetworks.net/my-namespace/my-app:v1.0`.

Use the same address in two places: as `--docker-server` when you create the secret, and at the
start of the pod's `image`. Kubernetes uses the secret only for pulls from the exact address the
secret names. For any other address, it tries the registry anonymously, and the pull fails even
though the credentials are right.

## Create the pull secret

Run this command, with your own values in the angle brackets:

```bash
kubectl create secret docker-registry <secret-name> \
  --docker-username=<username> \
  --docker-password=<password> \
  --docker-server=<endpoint>
```

- `<secret-name>`: any name for the secret. Pods refer to it by this name.
- `<username>`: the registry's **Username** from **Manage E2E Registries**.
- `<password>`: the password from the login command in **Docker Commands**.
- `<endpoint>`: the registry address for its region, such as `registry.e2enetworks.net` in Delhi.

A secret belongs to one namespace, and only pods in that namespace can use it. Create it in every
namespace that pulls from the registry, for example:

```bash
kubectl create secret docker-registry <secret-name> \
  --docker-username=<username> \
  --docker-password=<password> \
  --docker-server=<endpoint> \
  --namespace=my-app
```

Check that the secret exists and has the right type:

```bash
kubectl get secret <secret-name> -o jsonpath='{.type}'
```

The command prints `kubernetes.io/dockerconfigjson`.

## Use the secret in a pod

Name the secret under `imagePullSecrets` so that the pod signs in to the registry when it pulls the
image. Save this as `node-hello.yaml`, with your own image address in `image`:

```yaml
apiVersion: v1
kind: Pod
metadata:
  name: node-hello
spec:
  containers:
    - name: node-hello-container
      image: registry.e2enetworks.net/my-namespace/my-app:v1.0
  imagePullSecrets:
    - name: <secret-name>
```

```bash
kubectl apply -f node-hello.yaml
```

In a Deployment, StatefulSet, DaemonSet, or Job, `imagePullSecrets` belongs in the pod template,
rather than at the top of the controller's own spec. Put it at the same level as `containers`:

```yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: node-hello
spec:
  replicas: 2
  selector:
    matchLabels:
      app: node-hello
  template:
    metadata:
      labels:
        app: node-hello
    spec:
      containers:
        - name: node-hello-container
          image: registry.e2enetworks.net/my-namespace/my-app:v1.0
      imagePullSecrets:
        - name: <secret-name>
```

## Check the pull

```bash
kubectl get pod node-hello
kubectl describe pod node-hello
```

A pod that reaches `Running` has pulled its image. If it stays in another state, the **Events** at the end of the
`describe` output give the reason. To see only this pod's events, run:

```bash
kubectl get events --field-selector involvedObject.name=node-hello
```

Your pods can now run images from your private registry. If a pod stays in ImagePullBackOff or
ErrImagePull, see
[Troubleshooting TIR Kubernetes](/tir/tir-kubernetes/troubleshooting/tir-kubernetes/#a-pod-stays-in-imagepullbackoff-or-errimagepull).
To manage the registry's images, see [TIR Container Registry](/tir/tir-container-registry/).