Ubuntu 22.04
Sponsored Link

Kubernetes : Configure Private Registry
2022/11/03
 
Configure Private Registry to pull container images from self Private Registry.
This example is based on the environment like follows.
-----------+---------------------------+--------------------------+------------
           |                           |                          |
       eth0|10.0.0.25              eth0|10.0.0.71             eth0|10.0.0.72
+----------+-----------+   +-----------+-----------+   +-----------+-----------+
|  [ ctrl.srv.world ]  |   |  [snode01.srv.world]  |   |  [snode02.srv.world]  |
|     Control Plane    |   |      Worker Node      |   |      Worker Node      |
+----------------------+   +-----------------------+   +-----------------------+

[1]
On a Node you'd like to run Private Registry Pod,
Configure Registry with basic authentication and HTTPS connection (with valid certificate), refer to here.
On this example, Registry Pod is runing on Control Plane Node.
[2] Add Secret in Kubernetes.
root@ctrl:~#
podman ps

CONTAINER ID  IMAGE                         COMMAND               CREATED         STATUS             PORTS                   NAMES
936e492dd7f5  docker.io/library/registry:2  /etc/docker/regis...  10 minutes ago  Up 10 minutes ago  0.0.0.0:5000->5000/tcp  sharp_khorana

# login to the Registry once with a user

root@ctrl:~#
podman login ctrl.srv.world:5000

Username:
ubuntu

Password:
Login Succeeded!
# then following file is generated

root@ctrl:~#
ll /run/user/0/containers/auth.json

-rw------- 1 root root 83 Nov 2 08:17 /run/user/0/containers/auth.json
# BASE64 encode of the file

root@ctrl:~#
cat /run/user/0/containers/auth.json | base64

ewoJImF1dGhzIjogewoJCSJjdHJsLnNy.....
root@ctrl:~#
vi regcred.yml
# create new

# specify contents of BASE64 encoding above with one line for [.dockerconfigjson] section

apiVersion: v1
kind: Secret
data:
  .dockerconfigjson: ewoJImF1dGhzIjogewoJCSJjdHJsLnNy.....
metadata:
  name: regcred
type: kubernetes.io/dockerconfigjson

root@ctrl:~#
kubectl create -f regcred.yml

secret "regcred" created
root@ctrl:~#
kubectl get secrets

NAME      TYPE                             DATA   AGE
regcred   kubernetes.io/dockerconfigjson   1      4s
[3] To pull images from self Private Registry, Specify private image and Secret when deploying pods like follows.
root@ctrl:~#
podman images

REPOSITORY                  TAG          IMAGE ID      CREATED      SIZE
docker.io/library/nginx     latest       76c69feac34e  7 days ago   146 MB
ctrl.srv.world:5000/nginx   my-registry  76c69feac34e  7 days ago   146 MB
docker.io/library/registry  2            dcb3d42c1744  3 weeks ago  24.7 MB

root@ctrl:~#
vi private-nginx.yml
apiVersion: v1
kind: Pod
metadata:
  name: private-nginx
spec:
  containers:
  - name: private-nginx
    # image on Private Registry
    image: ctrl.srv.world:5000/nginx:my-registry
  imagePullSecrets:
  # Secret name you added
  - name: regcred

root@ctrl:~#
kubectl create -f private-nginx.yml

pod "private-nginx" created
root@ctrl:~#
kubectl get pods

NAME            READY   STATUS    RESTARTS   AGE
private-nginx   1/1     Running   0          6s

root@ctrl:~#
kubectl describe pods private-nginx

Name:             private-nginx
Namespace:        default
Priority:         0
Service Account:  default
Node:             snode02.srv.world/10.0.0.72
Start Time:       Wed, 02 Nov 2022 08:19:37 +0000
Labels:           <none>
Annotations:      cni.projectcalico.org/containerID: 696cc6e7980beee30cc0930a8b7cc9dd2b1261c02eddfeb86fd8166f011f8425
                  cni.projectcalico.org/podIP: 192.168.211.129/32
                  cni.projectcalico.org/podIPs: 192.168.211.129/32
Status:           Running
IP:               192.168.211.129
IPs:
  IP:  192.168.211.129
Containers:
  private-nginx:
    Container ID:   containerd://e0bb44006608fab86ee24502313b1254a8f33b2974743d6a27bdb8f7eec311d3
    Image:          ctrl.srv.world:5000/nginx:my-registry
    Image ID:       ctrl.srv.world:5000/nginx@sha256:a267f796f427638a6dd897c76797c03edb7d1f5194abadbd338258a279d209d8
    Port:           <none>
    Host Port:      <none>
    State:          Running
      Started:      Wed, 02 Nov 2022 08:19:41 +0000
    Ready:          True
    Restart Count:  0
    Environment:    <none>
    Mounts:
      /var/run/secrets/kubernetes.io/serviceaccount from kube-api-access-8srxq (ro)
.....
.....
Matched Content