Pull images from Container Registry

Let your pods pull private images from TIR Container Registry by giving them the registry’s credentials in a pull secret. A Kubernetes Secret holds a small piece of sensitive data, such as a password, apart from your images and manifests. A secret of the docker-registry type holds registry credentials, and a pod names it under imagePullSecrets to use them when it pulls an image.

Before you begin

• A cluster in the Ready state and its kubeconfig set up for kubectl. See Connect to a Kubernetes cluster.
• A registry in TIR Container Registry with your image pushed to it. See Push an image.

Find the registry’s address and credentials

The registry address depends on the region the registry was created in:

• Delhi: registry.e2enetworks.net
• Chennai: in-south1-registry.e2enetworks.net

To find your registry’s address, open your project in TIR and, in the side menu under Storage, select Container Registry. Each registry’s address is its Endpoint, next to its Username. For the password, select Commands on the registry’s row: the Docker login command there has the username and password filled in.

An image address has the form <endpoint>/<namespace>/<image>:<tag>, where <namespace> is the registry’s name, for example registry.e2enetworks.net/my-namespace/my-app:v1.0.

Use the same address in two places: as --docker-server when you create the secret, and at the start of the pod’s image. Kubernetes uses the secret only for pulls from the exact address the secret names. For any other address, it tries the registry anonymously, and the pull fails even though the credentials are right.

Create the pull secret

Run this command, with your own values in the angle brackets:

kubectl create secret docker-registry <secret-name> \
  --docker-username=<username> \
  --docker-password=<password> \
  --docker-server=<endpoint>

• <secret-name>: any name for the secret. Pods refer to it by this name.
• <username>: the registry’s Username from Manage E2E Registries.
• <password>: the password from the login command in Docker Commands.
• <endpoint>: the registry address for its region, such as registry.e2enetworks.net in Delhi.

A secret belongs to one namespace, and only pods in that namespace can use it. Create it in every namespace that pulls from the registry, for example:

kubectl create secret docker-registry <secret-name> \
  --docker-username=<username> \
  --docker-password=<password> \
  --docker-server=<endpoint> \
  --namespace=my-app

Check that the secret exists and has the right type:

kubectl get secret <secret-name> -o jsonpath='{.type}'

The command prints kubernetes.io/dockerconfigjson.

Use the secret in a pod

Name the secret under imagePullSecrets so that the pod signs in to the registry when it pulls the image. Save this as node-hello.yaml, with your own image address in image:

apiVersion: v1
kind: Pod
metadata:
  name: node-hello
spec:
  containers:
    - name: node-hello-container
      image: registry.e2enetworks.net/my-namespace/my-app:v1.0
  imagePullSecrets:
    - name: <secret-name>

kubectl apply -f node-hello.yaml

In a Deployment, StatefulSet, DaemonSet, or Job, imagePullSecrets belongs in the pod template, rather than at the top of the controller’s own spec. Put it at the same level as containers:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: node-hello
spec:
  replicas: 2
  selector:
    matchLabels:
      app: node-hello
  template:
    metadata:
      labels:
        app: node-hello
    spec:
      containers:
        - name: node-hello-container
          image: registry.e2enetworks.net/my-namespace/my-app:v1.0
      imagePullSecrets:
        - name: <secret-name>

Check the pull

kubectl get pod node-hello
kubectl describe pod node-hello

A pod that reaches Running has pulled its image. If it stays in another state, the Events at the end of the describe output give the reason. To see only this pod’s events, run:

kubectl get events --field-selector involvedObject.name=node-hello

Your pods can now run images from your private registry. If a pod stays in ImagePullBackOff or ErrImagePull, see Troubleshooting TIR Kubernetes. To manage the registry’s images, see TIR Container Registry.