Using a private repository for user containers#69
Conversation
Document the use of a private repository for a user's containerized application, and the use of ImagePullSecrets to let k8s access that container. Create a basic NNF User Container doc to create a place to land the above doc. Signed-off-by: Dean Roehrich <dean.roehrich@hpe.com>
Signed-off-by: Dean Roehrich <dean.roehrich@hpe.com>
| ### Add the Secret to the NNFContainerProfile | ||
|
|
||
| The administrator must add an `imagePullSecrets` list to the NNFContainerProfile | ||
| resource that was created for this user's containerized application. |
There was a problem hiding this comment.
Maybe add that its being specifically added to the PodSpec
There was a problem hiding this comment.
That would belong in the section of the doc that explains the NNFContainerProfile's parts, which doesn't yet exist.
| ``` | ||
|
|
||
| Now any user can select this profile in their Workflow by specifying it in a | ||
| `#DW container` directive. |
There was a problem hiding this comment.
And the pod will be free from ImagePullBackOff errors.
| optional: true | ||
| ``` | ||
|
|
||
| Now any user can select this profile in their Workflow by specifying it in a |
There was a problem hiding this comment.
Could access to an NnfContainerProfile be optionally restricted?
There was a problem hiding this comment.
I don't yet have an idea of how that would be done in a k8s-way.
There was a problem hiding this comment.
Okay, we have some ideas. I'm going to checkin this PR and write up a separate idea to share.
| kind: NnfContainerProfile | ||
| metadata: | ||
| name: red-rock-slushy | ||
| namespace: nnf-system |
There was a problem hiding this comment.
Should this be the default namespace?
There was a problem hiding this comment.
The profile collection goes in the 'nnf-system' namespace. When the profile is picked, a temporary copy of it will be placed in the 'default' namespace while it is being used.
| ### About the Example | ||
|
|
||
| Each container registry will have its own way of letting its users create tokens to | ||
| be used with their repositories. Docker Hub will be used for the private repository in this example, and the user's account on Docker Hub will be "dean". |
There was a problem hiding this comment.
Is the equivalent here a GitHub access token and for GitLab a deploy token?
There was a problem hiding this comment.
Yes, that looks like the same usage.
3 participants
Document the use of a private repository for a user's containerized application, and the use of ImagePullSecrets to let k8s access that container.
Create a basic NNF User Container doc to create a place to land the above doc.