CentOS Stream 9
Sponsored Link

Kubernetes : Use Private Registry2023/10/20

 

Configure Private Registry to pull container images from self Private Registry.

This example is based on the environment like follows.

+----------------------+   +----------------------+
|   [ mgr.srv.world ]  |   |   [ dlp.srv.world ]  |
|     Manager Node     |   |     Control Plane    |
+-----------+----------+   +-----------+----------+
        eth0|10.0.0.25             eth0|10.0.0.30
            |                          |
------------+--------------------------+-----------
            |                          |
        eth0|10.0.0.51             eth0|10.0.0.52
+-----------+----------+   +-----------+----------+
| [ node01.srv.world ] |   | [ node02.srv.world ] |
|     Worker Node#1    |   |     Worker Node#2    |
+----------------------+   +----------------------+

[1]

On a Node you'd like to run Private Registry Pod,
Configure Registry with basic authentication and HTTPS connection (with valid certificate), refer to here.
On this example, Registry Pod is running on Manager Node.

[2] Add Secret in Kubernetes.
[root@mgr ~]#
podman ps

CONTAINER ID  IMAGE                         COMMAND               CREATED             STATUS             PORTS                   NAMES
de3fb2145bb3  docker.io/library/registry:2  /etc/docker/regis...  About a minute ago  Up About a minute  0.0.0.0:5000->5000/tcp  nifty_booth

# login to the Registry once with a user

[root@mgr ~]#
podman login mgr.srv.world:5000

Username:
serverworld

Password:
Login Succeeded!
# then following file is generated

[root@mgr ~]#
ll /run/user/0/containers/auth.json

-rw-------. 1 root root 91 Oct 20 13:20 /run/user/0/containers/auth.json
# BASE64 encode of the file

[root@mgr ~]#
cat /run/user/0/containers/auth.json | base64

ewoJImF1dGhzIjogewoJCSJjdHJsLnNy.....
[root@mgr ~]#
vi regcred.yml
# create new

# specify contents of BASE64 encoding above with one line for [.dockerconfigjson] section

apiVersion: v1
kind: Secret
data:
  .dockerconfigjson: ewoJImF1dGhzIjogewoJCSJjdHJsLnNy.....
metadata:
  name: regcred
type: kubernetes.io/dockerconfigjson

[root@mgr ~]#
kubectl create -f regcred.yml

secret "regcred" created
[root@mgr ~]#
kubectl get secrets

AME      TYPE                             DATA   AGE
regcred   kubernetes.io/dockerconfigjson   1      5s
[3] To pull images from self Private Registry, Specify private image and Secret when deploying pods like follows.
[root@mgr ~]#
podman images

REPOSITORY                  TAG          IMAGE ID      CREATED      SIZE
quay.io/centos/centos       stream9      0dc5b436b6ca  2 days ago   160 MB
mgr.srv.world:5000/nginx    my-registry  bc649bab30d1  8 days ago   191 MB
docker.io/library/registry  2            0ae1560ca86f  2 weeks ago  26 MB

[root@mgr ~]#
vi private-nginx.yml
apiVersion: v1
kind: Pod
metadata:
  name: private-nginx
spec:
  containers:
  - name: private-nginx
    # image on Private Registry
    image: mgr.srv.world:5000/nginx:my-registry
  imagePullSecrets:
  # Secret name you added
  - name: regcred

[root@mgr ~]#
kubectl create -f private-nginx.yml

pod "private-nginx" created
[root@mgr ~]#
kubectl get pods

NAME            READY   STATUS    RESTARTS   AGE
private-nginx   1/1     Running   0          6s

[root@mgr ~]#
kubectl describe pods private-nginx

Name:             private-nginx
Namespace:        default
Priority:         0
Service Account:  default
Node:             node02.srv.world/10.0.0.52
Start Time:       Fri, 20 Oct 2023 13:28:22 +0900
Labels:           <none>
Annotations:      cni.projectcalico.org/containerID: 12faabd4ee02acbaf7683e147912bd15c94a1d4dc15280e871135f8c698734b6
                  cni.projectcalico.org/podIP: 192.168.241.137/32
                  cni.projectcalico.org/podIPs: 192.168.241.137/32
Status:           Running
IP:               192.168.241.137
IPs:
  IP:  192.168.241.137
Containers:
  private-nginx:
    Container ID:   cri-o://0aea8f2a9eeefa43d2c2affacd09aecc89aa38dced40e845f48f1df9bfe07350
    Image:          mgr.srv.world:5000/nginx:my-registry
    Image ID:       mgr.srv.world:5000/nginx@sha256:3a12fc354e3c4dd62196a809e52a5d2f8f385b52fcc62145b0efec5954bb8fa1
    Port:           <none>
    Host Port:      <none>
    State:          Running
      Started:      Fri, 20 Oct 2023 13:28:24 +0900
    Ready:          True
    Restart Count:  0
    Environment:    <none>
    Mounts:
      /var/run/secrets/kubernetes.io/serviceaccount from kube-api-access-vlncf (ro)
.....
.....
Matched Content