A Docker registry Secret stores credentials that Kubernetes uses to pull images from a private container registry. Without those credentials, Pods using private images cannot start. section 8.3.2
Create and attach a pull Secret in two steps:
- Create credentials with kubectl create secret docker-registry, supplying the registry server, username, password, and email. section 8.3.2
- Alternatively, create the Secret from the local $HOME/.docker/config.json file. section 8.3.2
- Reference the Secret by name in the Pod's spec.imagePullSecrets field. section 8.3.2
Attach a pull Secret to a Pod
Set spec.imagePullSecrets to pull-secret, then configure the container to use a private image such as docker.io/me/my-private-image. section 8.3.2
$ kubectl create secret docker-registry pull-secret \ --docker-server=<your-container-registry-server> \ --docker-username=<your-name> \ --docker-password=<your-password> \ --docker-email=<your-email>
View the kubectl command for creating a Docker registry Secret from explicit registry credentials. section 8.3.2
Listing 8.14 Adding a pull secret to a pod
apiVersion: v1
kind: Pod
metadata:
name: private-image
spec:
imagePullSecrets: #1
- name: pull-secret #1
containers: #2
- name: private #2
image: docker.io/me/my-private-image #2
View the Pod manifest that names the pull Secret and uses a private image. section 8.3.2
