Skip to content

Commit 67f3aa9

Browse files
ashoknayak777ashoknayak777
authored
docs: Modified Existing Container Registry Doc (#4048)
* Modified Existing Container Registry Doc * Resolved Feedback * Mentioned Disallowed Protocols for URL
1 parent e7fb143 commit 67f3aa9

File tree

4 files changed

+208
-230
lines changed

4 files changed

+208
-230
lines changed

‎.gitbook.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -69,3 +69,4 @@ redirects:
6969
user-guide/use-cases/connect-expressjs-with-mongodb-database: resources/use-cases/connect-expressjs-with-mongodb-database
7070
user-guide/use-cases/connect-django-with-mysql-database: resources/use-cases/connect-django-with-mysql-database
7171
user-guide/telemetry: resources/telemetry
72+
user-guide/global-configurations/docker-registries: user-guide/global-configurations/container-registries.md

‎docs/SUMMARY.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@
2121
* [Projects](user-guide/global-configurations/projects.md)
2222
* [Cluster And Environments](user-guide/global-configurations/cluster-and-environments.md)
2323
* [Git Accounts](user-guide/global-configurations/git-accounts.md)
24-
* [Container Registries](user-guide/global-configurations/docker-registries.md)
24+
* [Container Registries](user-guide/global-configurations/container-registries.md)
2525
* [Chart Repositories](user-guide/global-configurations/chart-repo.md)
2626
* [Custom charts](user-guide/global-configurations/custom-charts.md)
2727
* [SSO Login Services](user-guide/global-configurations/sso-login.md)

‎docs/user-guide/global-configurations/container-registries.md‎

Lines changed: 206 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,206 @@
1+
# Container/OCI Registry
2+
3+
While [container registries](https://docs.devtron.ai/resources/glossary#container-registry) are typically used for storing [images](https://docs.devtron.ai/resources/glossary#image) built by the CI Pipeline, an OCI registry can store container images as well as other artifacts such as [helm charts](https://docs.devtron.ai/resources/glossary#helm-charts-packages). In other words, all container registries are OCI registries, but not all OCI registries are container registries.
4+
5+
You can configure a container registry using any registry provider of your choice. It allows you to build, deploy, and manage your container images or charts with easy-to-use UI.
6+
7+
8+
## Add Container Registry
9+
10+
1. From the left sidebar, go to **Global Configurations** → **Container/OCI Registry**.
11+
12+
![Figure 1: Container/OCI Registry](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/container-registries/add-registry.jpg)
13+
14+
2. Click **Add Registry**.
15+
16+
![Figure 2: Add a Registry](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/container-registries/add-container-registry-1.jpg)
17+
18+
3. Choose a provider from the **Registry provider** dropdown. View the [Supported Registry Providers](#supported-registry-providers).
19+
20+
4. Choose the Registry type:
21+
* **Private Registry**: Choose this if your images or artifacts are hosted or should be hosted on a private registry restricted to authenticated users of that registry. Selecting this option requires you to enter your registry credentials (username and password/token).
22+
* **Public Registry**: Unlike private registry, this doesn't require your registry credentials. Only the registry URL and repository name(s) would suffice.
23+
24+
5. Assuming your registry type is private, here are few of the common fields you can expect:
25+
26+
| Fields | Description |
27+
| --- | --- |
28+
| **Name** | Provide a name to your registry, this name will appear in the **Container Registry** drop-down list available within the [Build Configuration](https://docs.devtron.ai/usage/applications/creating-application/docker-build-configuration) section of your application|
29+
| **Registry URL** | Provide the URL of your registry in case it doesn't come prefilled (do not include `oci://`, `http://`, or `/https://` in the URL) |
30+
| **Authentication Type** | The credential input fields may differ depending on the registry provider, check [Registry Providers](#supported-registry-providers) |
31+
| **Push container images** | Tick this checkbox if you wish to use the repository to push container images. This comes selected by default and you may untick it if you don't intend to push container images after a CI build. If you wish to to use the same repository to pull container images too, read [Registry Credential Access](#registry-credential-access). |
32+
| **Push helm packages** | Tick this checkbox if you wish to push helm charts to your registry |
33+
| **Use as chart repository** | Tick this checkbox if you want Devtron to pull helm charts from your registry and display them on its chart store. Also, you will have to provide a list of repositories (present within your registry) for Devtron to successfully pull the helm charts. |
34+
| **Set as default registry** | Tick this checkbox to set your registry as the default registry hub for your images or artifacts |
35+
36+
6. Click **Save**.
37+
38+
39+
## Supported Registry Providers
40+
41+
### ECR
42+
43+
Amazon ECR is an AWS-managed container image registry service.
44+
The ECR provides resource-based permissions to the private repositories using AWS Identity and Access Management (IAM). ECR allows both Key-based and Role-based authentications.
45+
46+
Before you begin, create an [IAM user](https://docs.aws.amazon.com/AmazonECR/latest/userguide/get-set-up-for-amazon-ecr.html) and attach the ECR policy according to the authentication type.
47+
48+
Provide the following additional information apart from the common fields:
49+
50+
| Fields | Description |
51+
| --- | --- |
52+
| **Registry URL** | Example of URL format: `xxxxxxxxxxxx.dkr.ecr.<region>.amazonaws.com` where `xxxxxxxxxxxx` is your 12-digit AWS account ID |
53+
| **Authentication Type** | Select one of the authentication types:<ul><li>**EC2 IAM Role**: Authenticate with workernode IAM role and attach the ECR policy (AmazonEC2ContainerRegistryFullAccess) to the cluster worker nodes IAM role of your Kubernetes cluster.</li></ul><ul><li>**User Auth**: It is a key-based authentication, attach the ECR policy (AmazonEC2ContainerRegistryFullAccess) to the [IAM user](https://docs.aws.amazon.com/AmazonECR/latest/userguide/get-set-up-for-amazon-ecr.html).<ul><li>`Access key ID`: Your AWS access key</li></ul><ul><li>`Secret access key`: Your AWS secret access key ID</li></ul> |
54+
55+
56+
### Docker
57+
58+
Provide the following additional information apart from the common fields:
59+
60+
| Fields | Description |
61+
| --- | --- |
62+
| **Username** | Provide the username of the Docker Hub account you used for creating your registry. |
63+
| **Password/Token** | Provide the password/[Token](https://docs.docker.com/docker-hub/access-tokens/) corresponding to your docker hub account. It is recommended to use `Token` for security purpose. |
64+
65+
66+
### Azure
67+
68+
For Azure, the service principal authentication method can be used to authenticate with username and password. Visit this [link](https://docs.microsoft.com/en-us/azure/container-registry/container-registry-auth-service-principal) to get the username and password for this registry.
69+
70+
Provide the following additional information apart from the common fields:
71+
72+
| Fields | Description |
73+
| --- | --- |
74+
| **Registry URL/Login Server** | Example of URL format: `xxx.azurecr.io` |
75+
| **Username/Registry Name** | Provide the username of your Azure container registry |
76+
| **Password** | Provide the password of your Azure container registry |
77+
78+
79+
### Artifact Registry (GCP)
80+
81+
JSON key file authentication method can be used to authenticate with username and service account JSON file. Visit this [link](https://cloud.google.com/artifact-registry/docs/docker/authentication#json-key) to get the username and service account JSON file for this registry.
82+
83+
{% hint style="warning" %}
84+
Remove all the white spaces from JSON key and wrap it in a single quote before pasting it in `Service Account JSON File` field
85+
{% endhint %}
86+
87+
Provide the following additional information apart from the common fields:
88+
89+
| Fields | Description |
90+
| --- | --- |
91+
| **Registry URL** | Example of URL format: `region-docker.pkg.dev` |
92+
| **Service Account JSON File** | Paste the content of the service account JSON file |
93+
94+
95+
### Google Container Registry (GCR)
96+
97+
JSON key file authentication method can be used to authenticate with username and service account JSON file. Please follow [link](https://cloud.google.com/container-registry/docs/advanced-authentication#json-key) to get the username and service account JSON file for this registry.
98+
99+
{% hint style="warning" %}
100+
Remove all the white spaces from JSON key and wrap it in single quote before pasting it in `Service Account JSON File` field
101+
{% endhint %}
102+
103+
### Quay
104+
105+
Provide the following additional information apart from the common fields:
106+
107+
| Fields | Description |
108+
| --- | --- |
109+
| **Username** | Provide the username of your Quay account |
110+
| **Token** | Provide the password of your Quay account |
111+
112+
113+
### Other
114+
115+
Provide below information if you select the registry type as `Other`.
116+
117+
| Fields | Description |
118+
| --- | --- |
119+
| **Registry URL** | Enter the URL of your private registry |
120+
| **Username** | Provide the username of your account where you have created your registry |
121+
| **Password/Token** | Provide the password or token corresponding to the username of your registry |
122+
| **Advanced Registry URL Connection Options** | <ul><li>**Allow Only Secure Connection**: Tick this option for the registry to allow only secure connections</li></ul><ul><li>**Allow Secure Connection With CA Certificate**: Tick this option for the registry to allow secure connection by providing a private CA certificate (ca.crt)</li></ul><ul><li>**Allow Insecure Connection**: Tick this option to make an insecure communication with the registry (for e.g., when SSL certificate is expired)</li></ul> |
123+
124+
{% hint style="info" %}
125+
You can use any registry which can be authenticated using `docker login -u <username> -p <password> <registry-url>`. However these registries might provide a more secured way for authentication, which we will support later.
126+
{% endhint %}
127+
128+
129+
## Registry Credential Access
130+
131+
You can create a Pod that uses a [Secret](https://docs.devtron.ai/resources/glossary#secrets) to pull an image from a private container registry. You can use any private container registry of your choice, for e.g., [Docker Hub](https://www.docker.com/products/docker-hub).
132+
133+
Super-admin users can decide if they want to auto-inject registry credentials or use a secret to pull an image for deployment to environments on specific clusters.
134+
135+
1. To manage the access of registry credentials, click **Manage**.
136+
137+
There are two options to manage the access of registry credentials:
138+
139+
| Fields | Description |
140+
| --- | --- |
141+
| **Do not inject credentials to clusters** | Select the clusters for which you do not want to inject credentials |
142+
| **Auto-inject credentials to clusters** | Select the clusters for which you want to inject credentials |
143+
144+
2. You can choose one of the two options for defining credentials:
145+
146+
* [Use Registry Credentials](#use-registry-credentials)
147+
* [Specify Image Pull Secret](#specify-image-pull-secret)
148+
149+
### Use Registry Credentials
150+
151+
If you select **Use Registry Credentials**, the clusters will be auto-injected with the registry credentials of your registry type. As an example, If you select `Docker` as Registry Type, then the clusters will be auto-injected with the `username` and `password/token` which you use on the Docker Hub account.
152+
153+
Click **Save**.
154+
155+
![Figure 3: Using Registry Credentials](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/container-registries/use-registry-credentials-1.jpg)
156+
157+
158+
### Specify Image Pull Secret
159+
160+
You can create a Secret by providing credentials on the command line.
161+
162+
![Figure 4: Using Image Pull Secret](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/container-registries/specify-image-pull-secret-1.jpg)
163+
164+
Create this Secret and name it `regcred` (let's say):
165+
166+
```bash
167+
kubectl create -n <namespace> secret docker-registry regcred --docker-server=<your-registry-server> --docker-username=<your-name> --docker-password=<your-pword> --docker-email=<your-email>
168+
```
169+
170+
where,
171+
172+
* **namespace** is your sub-cluster, e.g., devtron-demo
173+
* **your-registry-server** is your Private Docker Registry FQDN. Use https://index.docker.io/v1/ for Docker Hub.
174+
* **your-name** is your Docker username
175+
* **your-pword** is your Docker password
176+
* **your-email** is your Docker email
177+
178+
You have successfully set your Docker credentials in the cluster as a Secret called `regcred`.
179+
180+
{% hint style="warning" %}
181+
Typing secrets on the command line may store them in your shell history unprotected, and those secrets might also be visible to other users on your PC during the time when kubectl is running.
182+
{% endhint %}
183+
184+
Enter the Secret name in the field and click **Save**.
185+
186+
187+
188+
189+
190+
191+
192+
193+
194+
195+
196+
197+
198+
199+
200+
201+
202+
203+
204+
205+
206+

0 commit comments

Comments
 (0)