Kubernetes : Use Private Registry2023/10/20 |
|
Configure Private Registry to pull container images from self Private Registry. This example is based on the environment like follows.
+----------------------+ +----------------------+
| [ mgr.srv.world ] | | [ dlp.srv.world ] |
| Manager Node | | Control Plane |
+-----------+----------+ +-----------+----------+
eth0|10.0.0.25 eth0|10.0.0.30
| |
------------+--------------------------+-----------
| |
eth0|10.0.0.51 eth0|10.0.0.52
+-----------+----------+ +-----------+----------+
| [ node01.srv.world ] | | [ node02.srv.world ] |
| Worker Node#1 | | Worker Node#2 |
+----------------------+ +----------------------+
|
| [1] |
On a Node you'd like to run Private Registry Pod, |
| [2] | Add Secret in Kubernetes. |
|
[root@mgr ~]# podman ps CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES de3fb2145bb3 docker.io/library/registry:2 /etc/docker/regis... About a minute ago Up About a minute 0.0.0.0:5000->5000/tcp nifty_booth # login to the Registry once with a user [root@mgr ~]# podman login mgr.srv.world:5000 Username: serverworld Password: Login Succeeded! # then following file is generated [root@mgr ~]# ll /run/user/0/containers/auth.json -rw-------. 1 root root 91 Oct 20 13:20 /run/user/0/containers/auth.json # BASE64 encode of the file [root@mgr ~]# cat /run/user/0/containers/auth.json | base64 ewoJImF1dGhzIjogewoJCSJjdHJsLnNy.....
[root@mgr ~]#
vi regcred.yml # create new # specify contents of BASE64 encoding above with one line for [.dockerconfigjson] section apiVersion: v1 kind: Secret data: .dockerconfigjson: ewoJImF1dGhzIjogewoJCSJjdHJsLnNy..... metadata: name: regcred type: kubernetes.io/dockerconfigjson kubectl create -f regcred.yml secret "regcred" created [root@mgr ~]# kubectl get secrets AME TYPE DATA AGE regcred kubernetes.io/dockerconfigjson 1 5s |
| [3] | To pull images from self Private Registry, Specify private image and Secret when deploying pods like follows. |
|
[root@mgr ~]# podman images REPOSITORY TAG IMAGE ID CREATED SIZE quay.io/centos/centos stream9 0dc5b436b6ca 2 days ago 160 MB mgr.srv.world:5000/nginx my-registry bc649bab30d1 8 days ago 191 MB docker.io/library/registry 2 0ae1560ca86f 2 weeks ago 26 MB
[root@mgr ~]#
vi private-nginx.yml
apiVersion: v1
kind: Pod
metadata:
name: private-nginx
spec:
containers:
- name: private-nginx
# image on Private Registry
image: mgr.srv.world:5000/nginx:my-registry
imagePullSecrets:
# Secret name you added
- name: regcred
[root@mgr ~]#
[root@mgr ~]# kubectl create -f private-nginx.yml pod "private-nginx" created kubectl get pods NAME READY STATUS RESTARTS AGE private-nginx 1/1 Running 0 6s[root@mgr ~]# kubectl describe pods private-nginx
Name: private-nginx
Namespace: default
Priority: 0
Service Account: default
Node: node02.srv.world/10.0.0.52
Start Time: Fri, 20 Oct 2023 13:28:22 +0900
Labels: <none>
Annotations: cni.projectcalico.org/containerID: 12faabd4ee02acbaf7683e147912bd15c94a1d4dc15280e871135f8c698734b6
cni.projectcalico.org/podIP: 192.168.241.137/32
cni.projectcalico.org/podIPs: 192.168.241.137/32
Status: Running
IP: 192.168.241.137
IPs:
IP: 192.168.241.137
Containers:
private-nginx:
Container ID: cri-o://0aea8f2a9eeefa43d2c2affacd09aecc89aa38dced40e845f48f1df9bfe07350
Image: mgr.srv.world:5000/nginx:my-registry
Image ID: mgr.srv.world:5000/nginx@sha256:3a12fc354e3c4dd62196a809e52a5d2f8f385b52fcc62145b0efec5954bb8fa1
Port: <none>
Host Port: <none>
State: Running
Started: Fri, 20 Oct 2023 13:28:24 +0900
Ready: True
Restart Count: 0
Environment: <none>
Mounts:
/var/run/secrets/kubernetes.io/serviceaccount from kube-api-access-vlncf (ro)
.....
.....
|
| Sponsored Link |