|
| 1 | +--- |
| 2 | +title:"Accessing Docker registry from Kubernetes cluster" |
| 3 | +description:"Allow Kubernetes to pull Docker images from your registry" |
| 4 | +group:ci-cd-guides |
| 5 | +toc:true |
| 6 | +--- |
| 7 | + |
| 8 | +Kubernetes deployments are based on a "pull" approach. When you deploy your application to a Kubernetes |
| 9 | +cluster, instead of uploading the application itself, as in traditional deployments, Kubernetes pulls the Docker images to its nodes on its own. |
| 10 | + |
| 11 | + |
| 12 | + {% include |
| 13 | +image.html |
| 14 | +lightbox="true" |
| 15 | +file="/images/getting-started/quick-start-k8s/overview.png" |
| 16 | +url="/images/getting-started/quick-start-k8s/overview.png" |
| 17 | +alt="Kubernetes deployments" |
| 18 | +caption="Kubernetes deployments" |
| 19 | +max-width="80%" |
| 20 | +%} |
| 21 | + |
| 22 | +If your Docker images are in a public repository such as Docker Hub, Kubernetes can pull them right away. In most cases however your images are in a private Docker registry and Kubernetes must be given explicit access to it. |
| 23 | + |
| 24 | +Use[Docker registry secrets](https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/){:target="\_blank"} to give Kubernetes access to private Docker registries. When there is a deployment, each Kubernetes pod can pull Docker images directly from the target registry. |
| 25 | + |
| 26 | +##Giving access to a Docker Registry via the UI |
| 27 | + |
| 28 | +Codefresh allows you to easily create and pull secrets for your cluster. |
| 29 | + |
| 30 | +1. In the Codefresh UI, set up an integration with your[Docker registry in Codefresh]({{site.baseurl}}/docs/integrations/docker-registries/). |
| 31 | + Codefresh can work with any compliant Docker registry either in the cloud or behind the firewall. |
| 32 | + |
| 33 | +1. To view the Kubernetes dashboard, from the Ops section in the sidebar, select[**Kubernetes Services**](https://g.codefresh.io/kubernetes/services/){:target="\_blank"}. |
| 34 | +1. Click**Add Service**. |
| 35 | +1. Do the following: |
| 36 | +* Select your**Cluster** and**Namespace** from the respective lists. |
| 37 | +* From the**Image Pull Secret** dropdown with all the pull secrets for the selected namespace, select**Create Registry Pull secret**. |
| 38 | +* From the list of all the connected Docker registries in Codefresh, select the registry you want. |
| 39 | + Codefresh automatically creates a secret for you. |
| 40 | + |
| 41 | + {% include |
| 42 | +image.html |
| 43 | +lightbox="true" |
| 44 | +file="/images/guides/kubernetes/create-secret.png" |
| 45 | +url="/images/guides/kubernetes/create-secret.png" |
| 46 | +alt="Create Pull Secret" |
| 47 | +caption="Create Pull Secret" |
| 48 | +max-width="80%" |
| 49 | +%} |
| 50 | + |
| 51 | + |
| 52 | +>The secret is created as soon as you select your Docker registry from the dropdown. There is no need to actually deploy anything from this screen for the changes to take effect. |
| 53 | +
|
| 54 | + {% include |
| 55 | +image.html |
| 56 | +lightbox="true" |
| 57 | +file="/images/guides/kubernetes/secret-dropdown.png" |
| 58 | +url="/images/guides/kubernetes/secret-dropdown.png" |
| 59 | +alt="Docker Registry Access" |
| 60 | +caption="Docker Registry Access" |
| 61 | +max-width="80%" |
| 62 | +%} |
| 63 | + |
| 64 | +From now on, the cluster in this namespace can deploy Docker images from the selected registry. |
| 65 | +To apply the changed secret, you don't really need to finish the deployment. Feel free to |
| 66 | +close the screen and go to another Codefresh page. |
| 67 | + |
| 68 | +>Codefresh automatically uses the secret you defined in all deployments that are performed via the UI by dynamically creating the correct manifests for you behind the scenes. |
| 69 | +If you wish to use your own manifests, you need to include the secret yourself, as explained in the next section. |
| 70 | + |
| 71 | + |
| 72 | +##Giving access to a Docker Registry with kubectl |
| 73 | + |
| 74 | +You can also use the`kubectl` command directly to give access to a Docker registry. |
| 75 | +As this method is not specific to Codefresh, read the[official kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/){:target="\_blank"}. |
| 76 | + |
| 77 | + |
| 78 | +###Creating the Docker registry secret |
| 79 | + |
| 80 | +The credentials depend upon the[type of registry]({{site.baseurl}}/docs/integrations/docker-registries/) you use. |
| 81 | + |
| 82 | +- The Docker server to use is a domain such`gcr.io`,`azurecr.io` |
| 83 | +- The username is your account username. |
| 84 | +- The password is a specific Docker registry password or any other kind of token. You need to check the documentation of your registry provider for the exact details. |
| 85 | + |
| 86 | +>Be sure to create the secret in the namespace in which your application will run. |
| 87 | +Pull secrets are specific to a namespace. If you want to deploy to multiple namespaces, you need to create a secret for each one of them. |
| 88 | + |
| 89 | +This is an example of creating a pull secret to the Azure registry. You can use the same command for any other private registry. |
| 90 | + |
| 91 | +`Shell` |
| 92 | +{% highlight sh %} |
| 93 | +{% raw %} |
| 94 | + |
| 95 | +export DOCKER_REGISTRY_SERVER=mysampleregistry.azurecr.io |
| 96 | +export DOCKER_USER=myregistryname |
| 97 | +export DOCKER_PASSWORD=myregistrytoken |
| 98 | +export DOCKER_EMAIL=YOUR_EMAIL |
| 99 | + |
| 100 | +kubectl create secret docker-registry cfcr\ |
| 101 | + --docker-server=$DOCKER_REGISTRY_SERVER\ |
| 102 | + --docker-username=$DOCKER_USER\ |
| 103 | + --docker-password=$DOCKER_PASSWORD\ |
| 104 | + --docker-email=$DOCKER_EMAIL |
| 105 | +{% endraw %} |
| 106 | +{% endhighlight %} |
| 107 | + |
| 108 | +###Using the Docker registry secret |
| 109 | + |
| 110 | +To use the secret you just created, you need to include it, either in: |
| 111 | + |
| 112 | +* Your[pod manifests](https://kubernetes.io/docs/concepts/containers/#specifying-imagepullsecrets-on-a-pod){:target="\_blank"} |
| 113 | +* The[service account](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#add-imagepullsecrets-to-a-service-account){:target="\_blank"} |
| 114 | + |
| 115 | +For Docker registry secret usage, we recommend following the official Kubernetes documentation. |
| 116 | + |
| 117 | +##Giving access to a Docker Registry via the Codefresh CLI |
| 118 | + |
| 119 | +The Codefresh CLI can also create pull secrets in an automated manner. |
| 120 | + |
| 121 | +See[Image pull Secret](https://codefresh-io.github.io/cli/more/image-pull-secret/){:target="\_blank"}. |
| 122 | + |
| 123 | +##Related articles |
| 124 | +[Deploy to Kubernetes - quick start]({{site.baseurl}}/docs/getting-started/deployment-to-kubernetes-quick-start-guide/) |
| 125 | +[Managing your cluster]({{site.baseurl}}/docs/deployments/kubernetes/manage-kubernetes/) |
| 126 | + |
| 127 | + |