Practice of using private images in CCE clusters

A private image refers to a Docker image stored in a private registry. It can only be accessed after the user logs in (docker login) with the registry's username and password. In a K83S Cluster CCE, "ImagePullSecrets" must be configured for pods to use private images within the cluster.

1. Create a secret (imagePullSecrets) for private image pull

To create by the kubectl command line, you need to provide

• Image registry login username
• Image registry login password
• Email address
• Image registry server address

The created command is

1kubectl create secret docker-registry <secret name> \
2 --docker-server=<image registry server address> \
3 --docker-username=<image registry username> \
4 --docker-password=<image registry password> \
5 --docker-email=<email address>

Regarding the image registry server address (--docker-server parameter):

• For the private images stored in Cloud Container Registry (CCR) (image address: registry.baidubce.com/<namespace>/<name>:<tag>), the parameter of image registry server address must be specified as --docker-server='https://registry.baidubce.com'.
• For the private images stored in Baidu AI Cloud image registry (image address: hub.baidubce.com/<namespace>/<name>:<tag>), the parameter of image registry server address must be specified as --docker-server='https://hub.baidubce.com'.
• For other third-party image registries, complete configuration according to the actual server address, and refer to Community Description Document or consult the image service provider.

Note:

• The secret must reside in the same Kubernetes namespace as the pod referencing it.

It is recommended to use CCR afterward. The command to create a CCR image registry secret is as follows:

1kubectl create secret docker-registry private-repo-auth \
2  --docker-server=registry.baidubce.com \
3 --docker-username=<image registry username> \
4 --docker-password=<image registry password> \
5 --docker-email=<email address>

After creation, you can view a secret of type kubernetes.io/dockerconfigjson through kubectl get secret.

1$ kubectl get secret	
2NAME                  TYPE                                  DATA      AGE	
3default-token-bx894   kubernetes.io/service-account-token   3         4d	
4private-repo-auth     kubernetes.io/dockerconfigjson        1         2m	

2. Specify the secret of the pull image in pod spec

Specify the name of secret in pod.spec.imagePullSecrets, and then use the corresponding private image in the pod.

Take creating a deployment as an example. Suppose a secret named private-repo-auth has been created in the default namespace in the above way, the corresponding deployment YAML file is as follows:

1apiVersion: apps/v1	
2kind: Deployment	
3metadata:	
4  name: my-nginx	
5spec:	
6  replicas: 1	
7  selector:	
8    matchLabels:	
9      app: my-nginx	
10  template:	
11    metadata:	
12      name: my-nginx	
13      labels:	
14        app: my-nginx	
15    spec:	
16      imagePullSecrets:	
17      - name: private-repo-auth	
18      containers:	
19      - name: my-nginx	
20        image: nginx	

Note:

• You can define multiple pull image secrets in the same pod to pull private images from different sources specified within the pod.