Adding imagePullSecrets to Kubernetes

1. Adding via `kubectl create`

1
kubectl create secret docker-registry mypullsecret --docker-server=harbor.chenshaowen.com --docker-username=robot-test --docker-password=xxxxxx

With kubectl create you can add credentials for pulling images directly.

2. Adding via `~/.docker/config.json`

1
docker login harbor.chenshaowen.com:5000

1
docker login harbor.chenshaowen.com

You can add more than one.

Inspect the credentials stored locally

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
cat ~/.docker/config.json

{
	"auths": {
		"harbor.chenshaowen.com:5000": {
			"auth": "xxxxxx"
		},
		"harbor.chenshaowen.com": {
			"auth": "xxxxxx"
		}
	}
}

Base64-encode the credentials

1
2
3
cat ~/.docker/config.json |base64 -w 0

base64XXXXXXXXXXXXXXXXXXXXXX

There is one detail here: if the encoding is missing the -w 0 argument, you may run into the error Failed to pull image "harbor.chenshaowen.com:5000/library/nginx:latest": illegal base64 data at input byte 60 when creating a workload.

-w 0 means that after encoding, the output is not wrapped and aligned, but emitted as one complete line of data.

Create the Kubernetes Secret credentials

Use the Base64-encoded credentials obtained above to create the Secret.

1
2
3
4
5
6
7
8
9
cat <<EOF | kubectl apply -f -
apiVersion: v1
kind: Secret
metadata:
  name: mypullsecret
data:
  .dockerconfigjson: base64XXXXXXXXXXXXXXXXXXXXXX
type: kubernetes.io/dockerconfigjson
EOF

3. Workload Test

Create the workloads

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
cat <<EOF | kubectl apply -f -
  apiVersion: apps/v1
  kind: Deployment
  metadata:
    name: a1
  spec:
    replicas: 1
    selector:
      matchLabels:
        app: a1
    template:
      metadata:
        labels:
          app: a1
      spec:
        containers:
        - name: a1
          image: harbor.chenshaowen.com:5000/library/nginx:latest
          imagePullPolicy: Always
        imagePullSecrets:
        - name: mypullsecret
EOF

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
cat <<EOF | kubectl apply -f -
  apiVersion: apps/v1
  kind: Deployment
  metadata:
    name: a2
  spec:
    replicas: 1
    selector:
      matchLabels:
        app: a2
    template:
      metadata:
        labels:
          app: a2
      spec:
        containers:
        - name: a2
          image: harbor.chenshaowen.com/library/nginx:latest
          imagePullPolicy: Always
        imagePullSecrets:
        - name: mypullsecret
EOF

Check whether the pull succeeds

1
kubectl get pod w

Clean up the test workloads

1
kubectl delete deployments.apps a2 a1