Kubernetes : Configure Private Registry2022/11/03 |
|
Configure Private Registry to pull container images from self Private Registry.
This example is based on the environment like follows.
-----------+---------------------------+--------------------------+------------
| | |
eth0|10.0.0.25 eth0|10.0.0.71 eth0|10.0.0.72
+----------+-----------+ +-----------+-----------+ +-----------+-----------+
| [ ctrl.srv.world ] | | [snode01.srv.world] | | [snode02.srv.world] |
| Control Plane | | Worker Node | | Worker Node |
+----------------------+ +-----------------------+ +-----------------------+
|
| [1] |
On a Node you'd like to run Private Registry Pod,
Configure Registry with basic authentication and HTTPS connection (with valid certificate), refer to here. On this example, Registry Pod is running on Control Plane Node. |
| [2] | Add Secret in Kubernetes. |
|
root@ctrl:~# podman ps CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES 936e492dd7f5 docker.io/library/registry:2 /etc/docker/regis... 10 minutes ago Up 10 minutes ago 0.0.0.0:5000->5000/tcp sharp_khorana # login to the Registry once with a user root@ctrl:~# podman login ctrl.srv.world:5000 Username: ubuntu Password: Login Succeeded! # then following file is generated root@ctrl:~# ll /run/user/0/containers/auth.json -rw------- 1 root root 83 Nov 2 08:17 /run/user/0/containers/auth.json # BASE64 encode of the file root@ctrl:~# cat /run/user/0/containers/auth.json | base64 ewoJImF1dGhzIjogewoJCSJjdHJsLnNy.....
root@ctrl:~#
vi regcred.yml # create new # specify contents of BASE64 encoding above with one line for [.dockerconfigjson] section apiVersion: v1 kind: Secret data: .dockerconfigjson: ewoJImF1dGhzIjogewoJCSJjdHJsLnNy..... metadata: name: regcred type: kubernetes.io/dockerconfigjson kubectl create -f regcred.yml secret "regcred" created root@ctrl:~# kubectl get secrets NAME TYPE DATA AGE regcred kubernetes.io/dockerconfigjson 1 4s |
| [3] | To pull images from self Private Registry, Specify private image and Secret when deploying pods like follows. |
|
root@ctrl:~# podman images REPOSITORY TAG IMAGE ID CREATED SIZE docker.io/library/nginx latest 76c69feac34e 7 days ago 146 MB ctrl.srv.world:5000/nginx my-registry 76c69feac34e 7 days ago 146 MB docker.io/library/registry 2 dcb3d42c1744 3 weeks ago 24.7 MB
root@ctrl:~#
vi private-nginx.yml
apiVersion: v1
kind: Pod
metadata:
name: private-nginx
spec:
containers:
- name: private-nginx
# image on Private Registry
image: ctrl.srv.world:5000/nginx:my-registry
imagePullSecrets:
# Secret name you added
- name: regcred
root@ctrl:~#
root@ctrl:~# kubectl create -f private-nginx.yml pod "private-nginx" created kubectl get pods NAME READY STATUS RESTARTS AGE private-nginx 1/1 Running 0 6sroot@ctrl:~# kubectl describe pods private-nginx
Name: private-nginx
Namespace: default
Priority: 0
Service Account: default
Node: snode02.srv.world/10.0.0.72
Start Time: Wed, 02 Nov 2022 08:19:37 +0000
Labels: <none>
Annotations: cni.projectcalico.org/containerID: 696cc6e7980beee30cc0930a8b7cc9dd2b1261c02eddfeb86fd8166f011f8425
cni.projectcalico.org/podIP: 192.168.211.129/32
cni.projectcalico.org/podIPs: 192.168.211.129/32
Status: Running
IP: 192.168.211.129
IPs:
IP: 192.168.211.129
Containers:
private-nginx:
Container ID: containerd://e0bb44006608fab86ee24502313b1254a8f33b2974743d6a27bdb8f7eec311d3
Image: ctrl.srv.world:5000/nginx:my-registry
Image ID: ctrl.srv.world:5000/nginx@sha256:a267f796f427638a6dd897c76797c03edb7d1f5194abadbd338258a279d209d8
Port: <none>
Host Port: <none>
State: Running
Started: Wed, 02 Nov 2022 08:19:41 +0000
Ready: True
Restart Count: 0
Environment: <none>
Mounts:
/var/run/secrets/kubernetes.io/serviceaccount from kube-api-access-8srxq (ro)
.....
.....
|
| Sponsored Link |