$ oc policy add-role-to-user \
system:image-puller system:serviceaccount:project-a:default \
--namespace=project-b
×
Image Pull Secrets
Overview
Docker registries can be secured to prevent unauthorized parties from accessing certain images. If you are using OpenShift’s integrated Docker registry and are pulling from image streams located in the same project, then your pod’s service account should already have permissions and no additional action should be required. If this is not the case, then additional configuration steps are required.
Integrated Registry Authentication and Authorization
OpenShift’s integrated Docker registry authenticates using the same
tokens
as the OpenShift API. To perform a docker login against the integrated
registry, you can choose any user name and email, but the password must be a
valid OpenShift token.
In order to pull an image, the authenticated user must have get rights on the
requested imagestreams/layers. In order to push an image, the authenticated
user must have update rights on the requested imagestreams/layers.
By default, all service accounts in a project have rights to pull any image in the same project, and the builder service account has rights to push any image in the same project.
Allowing Pods to Reference Images Across Projects
When using the integrated registry, to allow pods in project-a to reference
images in project-b, a service account in project-a must be bound to the
system:image-puller role in project-b:
After adding that role, the pods in project-a that reference the default service account will be able to pull images from project-b.
To allow access for any service account in project-a, use the group:
$ oc policy add-role-to-group \
system:image-puller system:serviceaccounts:project-a \
--namespace=project-b
Allowing Pods to Reference Images from Other Secured Registries
To pull a secured Docker image that is not from OpenShift’s integrated registry, you must create a secret and add it to your service account.
|
Docker configuration files for storage of secrets has changed formats from .dockercfg to .docker/config.json |
If you already have a file for the secured registry, you can create a secret from that file by running the following for .docker/config.json:
# oc secrets new <pull_secret_name> \
.dockerconfigjson=path/to/.docker/config.json
Alternatively, run the following for .dockercfg:
$ oc secrets new <pull_secret_name> \
.dockercfg=<path/to/.dockercfg>
If you do not already have a file for the secured registry, you can create a secret by running:
$ oc secrets new-dockercfg <pull_secret_name> \
--docker-server=<registry_server> --docker-username=<user_name> \
--docker-password=<password> --docker-email=<email>
To use a secret for pulling images for pods, you must add the secret to your service account. The name of the service account in this example should match the name of the service account the pod will use; default is the default service account:
$ oc secrets add serviceaccount/default secrets/<pull_secret_name> --for=pull
To use a secret for pushing and pulling build images, the secret must be mountable inside of a pod. You can do this by running:
$ oc secrets add serviceaccount/builder secrets/<pull_secret_name>