Pull Image from Private Docker Registry in Kubernetes cluster | Demo

in this video I will show you how to deploy your own application in covenants cluster so let's look at a common setup when deploying your own application in Co brandies you commit your code get that triggers jenkins bill that packages your application with its environmental configuration into a docker image and this docker image then gets pushed to a docker registry and this can be nexus it could be AWS container registry or some other private docker repository and now that you have your docker image in the private registry the question is how do you get this docker image on your communities cluster for images like MongoDB elastic some of them that I've shown you in other videos there it's pretty straightforward because they are hosted in a public repository like docker hub and anyone can access them so I can pull them on my machine without excess permission but your own application lives in a private repository and needs explicit access from the cluster so how do you pull their application images from private repository on cabinets cluster you do that using two steps the first one is you create secret component in kubernetes that contains access token or credentials to your daughter registry so that it can authenticate with the registry and second is you configure your deployment or your pod to use that secrets using a specific attribute which is called image pool secrets so I'm gonna show you all that in practice and in order to show you the demo I have my environment already set up so first of all I have a docker private repository which is hosted on AWS so this is the container registry and I have one repository there for my app which is a simple node.js application if you want to learn how to set up AWS container registry I have a separate video about that where I demo the whole process of tagging and building the image locally and then pushing it to AWS container registry so there you can basically learn how to get to this state and I will link that video here and in addition I also link the git repository of this my application if you want to use it and inside the repository I have three images with different version text so we're gonna use that for the demo and luckily I have a mini cube cluster setup which is currently empty so we're gonna start from a clean state so the first step as I said is to create a secret component which will have the access token or credentials to this private repository which will allow docker to actually pull that image inside the cluster so the first thing we need to do in order to create this secret is we need to login to this repository and for that there is a docker login command that looks like this so basically with dr. Logan you provides options which is username or password and you have the doctor repository in point there and the third one is password standard in which basically means that you don't type in the password on the command line but you take it from a standard input source this is more secure and I think this is a recent addition or or more recent decision in docker because you don't have your password written in the command line history so I recommend you use this one generally so for AWS if you see the view push commands there is a log in command here actually that gets the login password into a standard input and then you can do doctor login on that but what I'm gonna show you just for demonstration is I'm gonna show you the complete log in command that this will execute and this is the one so you have docker login the user name this is a password and I'm showing you the password because I'm gonna delete the repository afterwards this is the email flag which I believe is deprecated in the new docker version and there is this URL and this is basically the endpoint of my private repository which is this one right here okay so with this command I will be able to log in so if I execute that command so doctor log in with all the credentials I see log in succeeded and what it does in the background is it creates or it generates a convict JSON file that holds the authentication to my private repository so in dot docker directory and user folder you have a configuration and this holds the repository access now there are two ways that this config Jason will store the authentication either you will have the authentication directly here or you had the external credit stored this is more secure because your access token isn't stored in the file but in a credential store and this is the file that we need for the secret so now whenever docker tries to pull the image from my private repository like this image for example it will use those credentials for this private registry to pull that image to authenticate itself and pull that image however there is a small problem with this specific file which is that I am running my cluster in mini cube and mini cube doesn't have access to my creds store because it's running in a virtual box right so it cannot access my max credential store so this is not gonna work so when the docker which is packaged in the mini cube which I explained in another video you can check that out how mini cube is set up some mini cube has its own darker so when docker inside the mini cube tries to pull that image from this private repository it will see the Kratt store anyone be able to access that ok but I showed you this one who demonstrate how dr. login works with credit store so what I'm gonna do now is enter the mini cube so I'm going to SSH into mini cube which goes like this you can do this pretty easy and here I am in the directory of home docker and just check there is no dot docker here so what I'm gonna do is I'm gonna login to my private repository from mini cube doctor directly not from my laptop okay and let's see how that looks like so I'm gonna copy that command like this and by the way mini cube has a recent more recent version of docker that's why it doesn't recognize the email flag because it got deprecated so I'm gonna remove that so you have the same username password and the private repository URL so I'm gonna execute that remember I'm in the mini cube login succeeded and now if I do - eh I see the dot docker directory created and now we can see what's inside the conflict Jason so you see config Jason doesn't have a credential store anymore but it has this is the repository URL it's the same one here and the credentials or the authorization is inside those brackets so right here you have the authorization token which is this whole thing so depending on your setup it might look like this for you or like this but as I said mini cube can't access my credit store on my operating system so that's why I'm logging in directly from the mini cube talker now what we gonna do is we're gonna use that file so this file right here to create the secret for kubernetes cluster and this is a secret configuration so basically I have a secret kind the name of the secret and note the type here so it's darker config Jason which is its own secret type for this specific use case and the dot docker config Jason the value of this attribute will contain the base64 encoded contents of this config JSON file so all this basics before encoded will be assigned as a value here now since I have my cube CTL setup on my laptop not in the mini cube what I'm gonna do is I'm gonna copy that file from inside the mini cube to my host so that I can use it for my cube CTL command so I'm gonna clear this up and I'm gonna secure copied from mini cube and by the way I'm gonna collect all these commands and the configuration files and I'm gonna put them in its repository and link it in the video description so you can check that out if you want to follow along the video so I'm gonna type out the whole command and I'm gonna explain it so what I'm gonna do is I'm gonna secure copy and for that I'm gonna need SSH key which you have in a variable like this so it will be the same for you can directly copy this command and this is the source so we want to copy it from mini cube this is a user inside mini cube and this is the IP address so this is the server IP you can also login on your console and you can see what the value of it is and inside that I want to copy dot docker slash config Jason and I want to copy now its destination I want to copied in my docker config so I'm gonna replace the one that I have and as I mentioned directly having the authorization inside the configuration file is not as secure as having it in credit or so if you are running your kubernetes cluster on some servers you may want to use credential store inside but this is just for mini cube demonstration so I'm gonna execute that and now if I check my own docker config see I have replaced the content now I can go and create a secret from this file so as I said this should be basics different Kodi content so what I'm gonna do is pipe that and base64 encode it and I'm gonna paste it directly in here okay so this is my secret or if you want to spare yourself this you know base64 encoding it on the command line and then copying the contents there you can actually do that with cube CTL command as well right so let's clear that up and I'm gonna show you that keep city away as well so the cube CTO command will be like this keeps it will create secret and this is the secret type generic so let's name of the secret and let's break the line to have it structured from file attribute from which file the secret content should be created and this is the same attribute that we have in the secret file docker config Jason this is the same as this one here and now we have to specify the file which it should base64 encode and finally we specify the type which is darker config Jason type so it's gonna create the secret of docker config Jason type from these files contents and set it as a valley for these attributes so I'm gonna apply that so this will do the same as applying this configuration file here so we have our secret my registry key in the cluster so just to review now we did talk her login in this case I did from mini cube Stoker and then we use that file first of all I copied that file from mini cube to my host where execute the cube CTL and I use that file to create the secret which now has contents like this let's actually see that gets secret this is output Y mo file that was created and I have my data here doctor config jason and this is the basics de for encoded contents now there is a second way to create this docker config jason secret where you don't have to do it in two steps you don't have to do doctor login and then create the secret from that convict JSON file you can do both in one step so let's see that as well so it's gonna be keep CTL create secret and now instead of generic I'm gonna specify docker registry the secret type and let's give it Oh let's give it name my registry key - and here I have different flags which are specific for docker registry right so I have docker server and I'm actually gonna execute this command again so that I see the values so I have docker server which is my AWS private registry URL so I'm gonna that here then I have docker username which is AWS I have docker password which is this whole thing here and this is basically it so this command will do both steps in one so it's gonna do docker login and it's gonna create a secret based on the login authentication so if I execute this I have both secrets and I can use any of those for my deployment now you may be asking why there are two different ways to do the same thing can we just go with one but there's a difference between the two and the difference is that with this command you can only create one secret that has access token for one dollar registering for this specific registry for example but it's convenient because you do doctor login and secret creation in one step however if in your cluster you're using more than one private registry where you pull the images from then it will be more practical more convenient to go with other option the first one because for example if you have five private repositories that I want to pull the images from I can do docker login in each one of them and all the access tokens will get stored in this config JSON file like this so you're gonna have a list of them and if you use that file in your secret then with one secret you can have access to all the reports so this is a difference so depending on your use case you may prefer to use one or the other okay so now I've cleared everything and we see that we have our two secrets and now the second step is to configure deployment for my app application so I have a deployment configuration here and this is just the minimum configuration you need for deployment and this is our pot specification I have one container the name is my app and this is the image and the image name of the application has to be the complete name which includes the repository URL and the image name so it's going to be the complete image URL I'm gonna copy that and paste it so this is the repository URL this is the image name and this is the image version because if you just write this one doctor won't know which repository to pull it from and I have the port 3000 because that's why my application runs is that no J's application and now since I already built this all locally on my laptop I have that image available locally show that so 1.3 with this version I have it locally however because we are testing pulling the image from the private repository I want to force docker to pull that image from a repository instead of taking it from the local docker repository which is on my laptop and to do that you can force it by image pull policy attribute and here you can say always and every time pod is created this will force docker to reap all the image even if it already exists locally on your localhost so that's what we're gonna do and the next step will be to configure these employment with the secret so I have to give this deployment access to the secret that I created so that it will be able to pull that image from the stream however I just want to demonstrate what its gonna do or how it's going to behave without that secret configuration so I'm just gonna leave it like this and let's actually apply this configuration apply have any documents like this and if I do cube CTL pod I see image pull back off and it can connect to the container because it's waiting trying and failing to pull the image because it doesn't have authorization so the pot started but container can't be pulled so it's gonna retry now multiple times so I'm gonna delete that and all let's actually add that secret reference to the docker authentication and the way to do that is in the pod specification so on the same level as containers we're gonna configure attribute which is called image pull secrets image pull secrets and here we provide a name of the secret and this is it these two lines will configure deployment with access to the secret that contains docker registry access okay so let's apply that configuration again documents and let's see the pot and you see it's running because it was able to pull the image so so here we see pulling image successfully pulled image so that's how you configure that plumbing now since we have the second secret as well it's actually make sure that both are working so I'm gonna rename my deployment let's call it like this and I'm gonna use the second secret here and let's execute that again as well so this is how you configure your cluster to be able to pull the images from private repository there is one important note here the secret has to be in the same namespace as the deployment or stateful set or any other component that you're creating that needs to pull the image from that repository it has to be in the same namespace which means we have three applications in three different namespaces that all pull images from the private repository you have to create the secret three times in each namespace so to quickly wrap up in order to configure that you have to create a secret there's two ways to creating a secret either you can do dr. Logan manually and use the generated config JSON file to create the secret out of it or you can do it in one step using cube CTL create secret of docker registry type where you provide all the credentials in that command and the second step you will use that secret in the deployment or any other component that needs to pull the image from the docker registry I hope this was helpful and you learned something from this video if you want to see other videos about kubernetes you can subscribe to my channel and follow all my tutorials thank you for watching and see you in the next video

Channel: TechWorld with Nana

Views: 31,293

Rating: 4.9463086 out of 5

Keywords: kubernetes docker login, private docker registry kubernetes, kubernetes docker registry, kubernetes deploy docker image, kubernetes private docker registry, kubernetes pull image from private registry, kubernetes deploy application, kubernetes secrets, imagepullsecrets, kubernetes, kubernetes demo, kubernetes docker, kubernetes deployment, kubernetes practical, kubernetes practical tutorial, kubernetes private registry, techworld with nana, deploy docker image on kubernetes

Id: asIS4KIs40M

Length: 21min 44sec (1304 seconds)

Published: Sat May 30 2020

Reddit Comments

[u/latest_ali]

That’s exactly what I was looking for! Thank you!