A water-billing microservice must pull from a private container reg…

Question

A water-billing microservice must pull from a private container registry. What application-side configuration enables successful pulls?

Accepted Answer

Reference an imagePullSecret on the Pod or ServiceAccount that holds registry credentials — Private registries are locked doors—your Pod needs a keyring. Stick registry credentials in an imagePullSecret and hang that keyring on the Pod or its ServiceAccount so the kubelet can pull without you SSHing to nodes.

Answer

Open etcd to the registry so the control plane can store image layers directly

Answer

Install a CSI driver on every node to mount the registry as a block device

Answer

Add a ClusterRole that grants the default ServiceAccount cluster-admin for image pulls

A water-billing microservice must pull from a private container registry. What application-side configuration enables successful pulls?

Short Explanation

Full Explanation