How to provide an image pull secret when using "--image-repository" with an internal registry that does not allow anonymous pull requests?

[jgoeres]

After a bit of a hiatus, I have been revisiting the whole topic of running minikube from purely local sources (i.e., any images should come from our own private registry). I revisted the issue #8298 that I created in June. The first problem I am running into is that our internal registry does not support anonymous pull access.
In the above mentioned issue, @tstromberg mentioned two sources on how to provide a pull secret - but all of the already require a running cluster, as they both boil down to enabling the registry-creds plugin:

minikube addons configure registry-creds

But at that point all the infrastructure images would already have to be there, no?
Further, this add-on only allows me to specify creds for ECR, GCR, Dockerhub or ACR - what about my own registry?

[medyagh]

good idea, I would like to fully support this and possibly add integraiton test for it, there is a WIP PR for making addons possible with custom image.

#10111

[medyagh]

Further, this add-on only allows me to specify creds for ECR, GCR, Dockerhub or ACR - what about my own registry?

that is a good point, do u know if other simmilar tools using a specific tool that minikube could take advantage of ?
in the past I have seen people deploy a kubertnes secret to their Pod, that will let the pod be able to pull from a specific registery, have u already that ?

[jgoeres]

Forour own product deployment (in an already running cluster) we simply provide allow to provide the registry creds, which go into a secret passed to all pods as an image pull secret. But from my understanding, since we are in the process of bootstrapping the cluster, this probably has to be an "out of band" mechanism.

[sharifelgamal]

Yeah we don't currently support doing this with an arbitrary registry other than just running some sort of kubectl apply once all the pods are up. The way it works for the registry-creds addon is that there is a webhook that supplies the image pull secret to all service accounts as they get created. Adding that as a step to a deployment shouldn't be too difficult.

We would also absolutely accept any PR that adds this feature directly into minikube as an addon.

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-contributor-experience at kubernetes/community.
/lifecycle stale

[k8s-triage-robot]

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Send feedback to sig-contributor-experience at kubernetes/community.
/lifecycle rotten

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle stale
• Mark this issue or PR as rotten with /lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[k8s-triage-robot]

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

[sharifelgamal]

Freezing this as this is definitely a feature we would accept a PR for.