Using Third-Party Images

To create a secret on the console and pull a third-party image to create a workload, follow these steps.

1. Create a cluster secret to authenticate and pull images from a third-party repository if authentication is required.
   1. Log in to the CCE console.
   2. Click the name of the target cluster to access the cluster.
   3. In the navigation pane, choose ConfigMaps and Secrets. On the Secrets tab, click Create Secret.
   4. In the Create Secret dialog box, configure parameters based on Figure 1 and Table 1. For more details, see Creating a Secret.
   Figure 1 Creating a secret
   

   Table 1 Parameters for creating a secret

   Parameter	Example Value	Description
   Name	test	Name for the secret. Enter up to 253 characters, starting and ending with a lowercase letter or digit. Only lowercase letters, digits, hyphens (-), and periods (.) are allowed.
   Secret Type	kubernetes.io/dockerconfigjson	Type of the secret. The value is fixed at kubernetes.io/dockerconfigjson, indicating that the secret is used for authentication when third-party images are pulled.
   Data	Image Repository Address: www.example.com Username: ssl Password: xxx	Image Repository Address: Enter the address of the third-party image repository. Username: Enter the username for accessing the third-party image repository. Password: Enter the password for accessing the third-party image repository.

2. In the navigation pane, choose Workloads. In the upper right corner of the displayed page, click Create Workload. On the Create Workload page, set Image Name (Container Settings > Container Information > Basic Info) to the third-party image path. Select the secret created in 1 for Image Access Credential.
   Figure 2 Third-party image path
   

3. Configure other parameters and click Create Workload. If the workload status is Running, the third-party image has been pulled.

1. Use kubectl to access the cluster. For details, see Accessing a Cluster Using kubectl.
2. If the third-party image repository has an account and password, you need to create a secret in the cluster as the identity credential for pulling images.
   1. Create a secret. The secret type is kubernetes.io/dockerconfigjson by default, which indicates that the secret is used for authentication when third-party images are pulled.

      kubectl create secret docker-registry test  -n default --docker-server=www.example.com --docker-username=ssl --docker-password=xxx --docker-email=example@123.com

      In the command, test indicates the secret name, default indicates the namespace where the secret is located, and other parameters are described in the following table.

      Table 2 Secret parameters

      Parameter	Example Value	Description
      docker-server	www.example.com	Enter the address of the third image repository.
      docker-username	ssl	Enter the username for accessing the third-party image repository.
      docker-password	xxx	Enter the password for accessing the third-party image repository.
      docker-email	example@123.com	Email address of the third-party image repository. This parameter is optional.

      Information similar to the following is displayed:

      secret/test created

   2. Check whether the secret has been created.

      kubectl get secret

      If the following information is displayed, the secret has been created:

      NAME             TYPE                             DATA   AGE
      default-secret   kubernetes.io/dockerconfigjson   1      41h
      paas.elb         cfe/secure-opaque                1      41h
      test             kubernetes.io/dockerconfigjson   1      16s

3. Create a workload using a third-party image.
   1. Create a YAML file for creating a workload. In this example, the file name is deployment.yaml. You can change it as needed.

      vim deployment.yaml

      The file content is as follows:

      apiVersion: apps/v1
      kind: Deployment
      metadata:
        name: foo
        namespace: default
      spec:
        replicas: 1
        selector:
          matchLabels:
            app: foo
        strategy:
          type: RollingUpdate
        template:
          metadata:
            labels:
              app: foo
          spec:
            containers:
            - image: www.example.com/janedoe/awesomeapp:v1    # Third-party image path
              imagePullPolicy: Always
              name: foo
            imagePullSecrets:
            - name: test    # Use the created secret for identity authentication when images are pulled.

   2. Create the workload.

      kubectl create -f deployment.yaml

      If information similar to the following is displayed, the workload is being created:

      deployment.apps/foo created

   3. Check the workload status.

      kubectl get deployment

      If all the pods of the workload are available, the workload has been created.

      NAME     READY   UP-TO-DATE   AVAILABLE   AGE
      foo      1/1     1            1           4m59s