Create Workload Using Private Image

A private image refers to a Docker image stored in a private registry. It can only be accessed after the user logs in (docker login) with the registry's username and password. In a K83S Cluster CCE, "ImagePullSecrets" must be configured for pods to use private images within the cluster.

1. Create a secret (imagePullSecrets) for private image pull

To create via the kubectl command line, the following information is required:

• Image registry login username
• Image registry login password
• Image registry address

• Email address (optional)

  kubectl create secret docker-registry --docker-username= --docker-password= --docker-server= --docker-email=<email address (optional)>

For private images stored in Baidu AI Cloud CCR enterprise image registry (with the image address: {instance ID}-vpc (or pub).cnc.{regrion}.baidubce.com/<namespace>/<image>:<tag>), the image registry address parameter must be filled in as --docker-server='https://registry address'.

Note:

• The secret must reside in the same Kubernetes namespace as the pod referencing it.

After creation, you can run kubectl get secret to verify that a secret of type kubernetes.io/dockerconfigjson has been created.

1$ kubectl get secret	
2NAME                  TYPE                                  DATA      AGE	
3default-token-bx894   kubernetes.io/service-account-token   3         4d	
4private-repo-auth     kubernetes.io/dockerconfigjson        1         2m	

2. Specify the secret of the pull image in pod spec

Specify the name of the secret in pod.spec.imagePullSecrets; the corresponding private image can then be used in the Pod.

Take creating a deployment as an example: Assume a secret named private-repo-auth has been created in the default namespace using the above method. The corresponding deployment YAML file is as follows:

1apiVersion: apps/v1	
2kind: Deployment	
3metadata:	
4  name: my-nginx	
5spec:	
6  replicas: 1	
7  selector:	
8    matchLabels:	
9      app: my-nginx	
10  template:	
11    metadata:	
12      name: my-nginx	
13      labels:	
14        app: my-nginx	
15    spec:	
16      imagePullSecrets:	
17      - name: private-repo-auth	
18      containers:	
19      - name: my-nginx	
20        image: nginx	

Note:

• Users can assign multiple secrets within the same pod to pull private images from different registries.

3. Use registry access credentials

During workload creation, users can enter registry access credentials under the advanced settings to enable the use of private images.

Click "+ Add Registry Access Credential" to use an existing credential or create a new one. To create a new credential, fill in the credential's name, registry address, username, and password.