Skip to content

Commit cc65683

Browse files
stevsmitstevsmit
authored
Merge pull request #89487 from stevsmit/OCPBUGS-52219-ir-bug
Updates imagepullsecret field in IR docs
2 parents c844f45 + cbf6e95 commit cc65683

File tree

5 files changed

+126
-41
lines changed

5 files changed

+126
-41
lines changed

‎modules/creating-pull-secrets.adoc

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
// Module included in the following assemblies:
2+
// * openshift_images/using-image-pull-secrets
3+
// * openshift_images/managing-image-streams.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="creating-pull-secret_{context}"]
7+
= Creating a pull secret
8+
9+
.Procedure
10+
11+
* Create a secret from an existing authentication file:
12+
13+
** For Docker clients using `.docker/config.json`, enter the following command:
14+
+
15+
[source,terminal]
16+
----
17+
$ oc create secret generic <pull_secret_name> \
18+
--from-file=.dockerconfigjson=<path/to/.docker/config.json> \
19+
--type=kubernetes.io/dockerconfigjson
20+
----
21+
22+
** For Podman clients using `.config/containers/auth.json`, enter the following command:
23+
+
24+
[source,terminal]
25+
----
26+
$ oc create secret generic <pull_secret_name> \
27+
--from-file=<path/to/.config/containers/auth.json> \
28+
--type=kubernetes.io/podmanconfigjson
29+
----
30+
31+
* If you do not already have a Docker credentials file for the secured registry, you can create a secret by running the following command:
32+
+
33+
[source,terminal]
34+
----
35+
$ oc create secret docker-registry <pull_secret_name> \
36+
--docker-server=<registry_server> \
37+
--docker-username=<user_name> \
38+
--docker-password=<password> \
39+
--docker-email=<email>
40+
----

‎modules/images-allow-pods-to-reference-images-from-secure-registries.adoc

Lines changed: 0 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -55,44 +55,4 @@ metadata:
5555
resourceVersion: "37676"
5656
uid: e2851531-01bc-48ba-878c-de96cfe31020
5757
type: Opaque
58-
----
59-
60-
.Procedure
61-
62-
* Create a secret from an existing authentication file:
63-
64-
** For Docker clients using `.docker/config.json`, enter the following command:
65-
+
66-
[source,terminal]
67-
----
68-
$ oc create secret generic <pull_secret_name> \
69-
--from-file=.dockerconfigjson=<path/to/.docker/config.json> \
70-
--type=kubernetes.io/dockerconfigjson
71-
----
72-
73-
** For Podman clients using `.config/containers/auth.json`, enter the following command:
74-
+
75-
[source,terminal]
76-
----
77-
$ oc create secret generic <pull_secret_name> \
78-
--from-file=<path/to/.config/containers/auth.json> \
79-
--type=kubernetes.io/podmanconfigjson
80-
----
81-
82-
* If you do not already have a Docker credentials file for the secured registry, you can create a secret by running:
83-
+
84-
[source,terminal]
85-
----
86-
$ oc create secret docker-registry <pull_secret_name> \
87-
--docker-server=<registry_server> \
88-
--docker-username=<user_name> \
89-
--docker-password=<password> \
90-
--docker-email=<email>
91-
----
92-
93-
* To use a secret for pulling images for pods, you must add the secret to your service account. The name of the service account in this example should match the name of the service account the pod uses. The default service account is `default`:
94-
+
95-
[source,terminal]
96-
----
97-
$ oc secrets link default <pull_secret_name> --for=pull
9858
----

‎modules/using-pull-secret.adoc

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
// Module included in the following assemblies:
2+
// * openshift_images/using-image-pull-secrets
3+
// * openshift_images/managing-image-streams.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="using-pull-secret_{context}"]
7+
= Using a pull secret in a workload
8+
9+
You can use a pull secret to allow workloads to pull images from a private registry with one of the following methods:
10+
11+
* By linking the secret to a `ServiceAccount`, which automatically applies the secret to all pods using that service account.
12+
* By defining `imagePullSecrets` directly in workload configurations, which is useful for environments like GitOps or ArgoCD.
13+
14+
.Procedure
15+
16+
* You can use a secret for pulling images for pods by adding the secret to your service account. Note that the name of the service account should match the name of the service account that pod uses. The default service account is `default`.
17+
18+
** Enter the following command to link the pull secret to a `ServiceAccount`:
19+
+
20+
[source,terminal]
21+
----
22+
$ oc secrets link default <pull_secret_name> --for=pull
23+
----
24+
25+
** To verify the change, enter the following command:
26+
+
27+
[source,terminal]
28+
----
29+
$ oc get serviceaccount default -o yaml
30+
----
31+
+
32+
.Example output
33+
+
34+
[source,yaml]
35+
----
36+
apiVersion: v1
37+
imagePullSecrets:
38+
- name: default-dockercfg-123456
39+
- name: <pull_secret_name>
40+
kind: ServiceAccount
41+
metadata:
42+
annotations:
43+
openshift.io/internal-registry-pull-secret-ref: <internal_registry_pull_secret>
44+
creationTimestamp: "2025-03-03T20:07:52Z"
45+
name: default
46+
namespace: default
47+
resourceVersion: "13914"
48+
uid: 9f62dd88-110d-4879-9e27-1ffe269poe3
49+
secrets:
50+
- name: <pull_secret_name>
51+
----
52+
53+
* Instead of linking the secret to a service account, you can alternatively reference it directly in your pod or workload definition. This is useful for GitOps workflows such as ArgoCD. For example:
54+
+
55+
.Example pod specification
56+
+
57+
[source,yaml]
58+
----
59+
apiVersion: v1
60+
kind: Pod
61+
metadata:
62+
name: <secure_pod_name>
63+
spec:
64+
containers:
65+
- name: <container_name>
66+
image: quay.io/my-private-image
67+
imagePullSecrets:
68+
- name: <pull_secret_name>
69+
----
70+
+
71+
.Example ArgoCD workflow
72+
+
73+
[source,yaml]
74+
----
75+
apiVersion: argoproj.io/v1alpha1
76+
kind: Workflow
77+
metadata:
78+
generateName: <example_workflow>
79+
spec:
80+
entrypoint: <main_task>
81+
imagePullSecrets:
82+
- name: <pull_secret_name>
83+
----

‎openshift_images/image-streams-manage.adoc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ include::modules/images-imagestream-import.adoc[leveloffset=+2]
3939
The following sections describe how to import, and work with, image streams.
4040

4141
include::modules/images-imagestream-import-images-private-registry.adoc[leveloffset=+2]
42-
include::modules/images-allow-pods-to-reference-images-from-secure-registries.adoc[leveloffset=+3]
42+
//include::modules/images-allow-pods-to-reference-images-from-secure-registries.adoc[leveloffset=+3]
4343

4444

4545
include::modules/images-imagestream-import-import-mode.adoc[leveloffset=+2]

‎openshift_images/managing_images/using-image-pull-secrets.adoc

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,8 @@ You use this pull secret to authenticate with the services that are provided by
1717
include::modules/images-allow-pods-to-reference-images-across-projects.adoc[leveloffset=+1]
1818

1919
include::modules/images-allow-pods-to-reference-images-from-secure-registries.adoc[leveloffset=+1]
20+
include::modules/creating-pull-secrets.adoc[leveloffset=+2]
21+
include::modules/using-pull-secret.adoc[leveloffset=+2]
2022

2123
include::modules/images-pulling-from-private-registries.adoc[leveloffset=+2]
2224

0 commit comments

Comments
 (0)