Dockerhub creds for image pulls

[jferr]

In light of the recent dockerhub pull limits https://www.docker.com/increase-rate-limits?utm_source=docker&utm_medium=web%20referral&utm_campaign=pull%20limits%20home%20page&utm_budget= how would I pass dockerhub creds to kubespray for it to use when pulling images to our nodes when creating a cluster?

[jseguillon]

I think best way would be to add some custom playbook to render a /root/.docker/config.json, before running cluster.yaml, with something like this :

{
	"auths": {
		"https://index.docker.io/v1/": {
			"auth": "BASE64_ENCODE_USER_AND_PASS"
		}
}

Since containers are download via plain docker pull command lines via user root, this should work.

[Miouge1]

Adding API credentials bumps the rate limiting from 100 to 200. Possibly more if Docker hub adds an exception for open source projects (conditions might apply).

Another option that someone (@EppO I think?) mentioned in Slack could be to add a caching proxy registry in the CI cluster.

A number of projects have been publishing images to several repos (gcr, docker hub, quay, ...). I suppose we should continue efforts to avoid docker hub images whenever possible.

At the moment I do not have bandwidth to work on the topic, but thanks to the open source nature of the project anyone can contribute.

[hafe]

Kubespray is not only docker

[LuckySB]

you may use free dockerhub proxy mirror on https://mirror.gcr.io
docker_registry_mirrors:

[LuckySB]

containerd

containerd_config:
  grpc:
    max_recv_message_size: 16777216
    max_send_message_size: 16777216
  registries:
    "docker.io":
      - "https://mirror.gcr.io"
      - "https://registry-1.docker.io"

[LuckySB]

crio #6977 coming soon )

[soakes]

This wasn't working for me using containerd as I was still hitting API limits due to most of my infrastuctre is NATTED so I have to provide dockerhub user/pass.

Also using the mirror.gcr.io solution was not working with 2.14.2 tag, probbaly the images are removed, idk.

However, I managed to add a mini patch which does allow for this support, im sure it can be done better but it does work and may give an idea how to do this.

modified: roles/container-engine/containerd/templates/config.toml.j2

{% if 'dockerhub' in containerd_config %}
[plugins.cri.registry.mirrors]
  [plugins.cri.registry.mirrors."docker.io"]
    endpoint = ["https://index.docker.io/v2"]
[plugins.cri.registry.auths]
  [plugins.cri.registry.auths."docker.io"]
{% for param, value in containerd_config.dockerhub.items() %}
    {{ param }} = "{{ value }}"
{% endfor %}
{% endif %}

inventory/sample/group_vars/all/containerd.yml

containerd_config:
  grpc:
    max_recv_message_size: 16777216
    max_send_message_size: 16777216
  debug:
    level: ""
  dockerhub:
    username: "myuser"
    password: "mypass"
  max_container_log_line_size: -1

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-contributor-experience at kubernetes/community.
/lifecycle stale

[fejta-bot]

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Send feedback to sig-contributor-experience at kubernetes/community.
/lifecycle rotten

[fejta-bot]

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-contributor-experience at kubernetes/community.
/close

[k8s-ci-robot]

@fejta-bot: Closing this issue.

In response to this:

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-contributor-experience at kubernetes/community.
/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.