Authentication in a private registry

In the current implementation, there are two options for setting up authentication in a private registry: by changing the ContainerD config (for cluster-admin) and using ImagePullSecrets (for namespace-admin).

Advantages and disadvantages #

Changing ContainerD configuration:

Benefits:

1. This method is easy to implement and understand.
2. Ability to manage the registry in a simplified form.
3. Convenient for a large number of projects using a private registry.

Disadvantages:

1. If there is a need to update or modify the registry, you will have to edit and restart ContainerD again.
2. This method may not provide a sufficient level of security, since user credentials are stored in completely clear form.

Using ImagePullSecrets:

Benefits:

1. Greater security compared to directly editing the ContainerD configuration.
2. Secrets management provides flexibility and control.

Disadvantages:

1. More steps to configure compared to editing ContainerD configuration.

Let’s take a closer look at the steps to configure authentication:

Changing the ContainerD configuration #

On each cluster node, you need to change the ContainerD config. It can be edited along the path /etc/containerd/config.toml

In the config file, find the line

[plugins."io.containerd.grpc.v1.cri".registry.configs]

After it, change the following contents in your configuration file, specify information about your registry:

[plugins."io.containerd.grpc.v1.cri".registry.configs."myprivateregisrty.domain.ltd".auth]
username = "myLogin"
password = "myPassword"

Save and close the file.

Restart the ContainerD service systemctl restart containerd.

Using ImagePullSecrets #

The second way to set up authentication in a private registry involves using ImagePullSecrets:

Create a file in json format with authentication data in the registry.

{
"auths": {
"my-registry.example:5000":
{ "username": "tiger", "password": "pass1234", "email": "tiger@acme.example", "auth": "dGlnZXI6cGFzczEyMzQ=" }

}
}

Go to the namespace, in the workloads of which you need to use a private registry. In the Storage/Secrets section, create a Secret with type dockerconfigjson.

In the Keys block, click on +. In the side window that opens, upload the created json file with authentication data to the registry.

When creating a load, in the ImagePullSecrets field, select a secret with authentication data.

You can also create secrets using the command in the cli:

kubectl create secret docker-registry NAME \
--docker-email=Example@docker.email \
--docker-username=Username \
--docker-password=Pass1234 \
--docker-server=my-registry.example:5000
-n NAMESPACE_NAME

Substitute the required values into the parameters highlighted in capital letters.

Please note! The created secret can only be used in this namespace. If you need to authenticate to this registry in a different namespace, create a new secret.