#Managing images

With Alauda Container Platform you can interact with images, depending on where the registries of the images are located, any authentication requirements around those registries, and how you want your builds and deployments to behave.

#Image pull policy

Each container in a pod has a container image. After you have created an image and pushed it to a registry, you can then refer to it in the pod.

#Image pull policy overview

When Alauda Container Platform creates containers, it uses the container imagePullPolicy to determine if the image should be pulled prior to starting the container. There are three possible values for imagePullPolicy:

Table imagePullPolicy values:

If a container imagePullPolicy parameter is not specified, Alauda Container Platform sets it based on the image tag:

1. If the tag is latest, Alauda Container Platform defaults imagePullPolicy to Always.
2. Otherwise, Alauda Container Platform defaults imagePullPolicy to IfNotPresent.

#Using image pull secrets

If you are using the Alauda Container Platform image registry, then your pod service account should already have the correct permissions and no additional action should be required.

However, for other scenarios, such as referencing images across Alauda Container Platform projects or from secured registries, additional configuration steps are required.

#Allowing pods to reference images from other secured registries

To pull a secured container from other private or secured registries, you must create a pull secret from your container client credentials, such as Docker, and add it to your service account.

Docker use a configuration file to store authentication details to log in to secured or insecure registry:

By default, Docker uses $HOME/.docker/config.json.

These files store your authentication information if you have previously logged in to a secured or insecure registry.

#Creating a pull secret

You can obtain the image pull secret to pull an image from a private container image registry or repository. You can refer to Pull an Image from a Private Registry.

#Using a pull secret in a workload

You can use a pull secret to allow workloads to pull images from a private registry with one of the following methods:

• By linking the secret to a ServiceAccount, which automatically applies the secret to all pods using that service account.
• By defining imagePullSecrets in the pod specification, which is useful for environments like GitOps or ArgoCD.

You can use a secret for pulling images for pods by adding the secret to your service account. Note that the name of the service account should match the name of the service account that pod uses.

Example output:

apiVersion: v1
imagePullSecrets:
- name: default-dockercfg-123456
- name: <pull_secret_name>
kind: ServiceAccount
metadata:
  name: default
  namespace: default
secrets:
- name: <pull_secret_name>

Instead of linking the secret to a service account, you can alternatively reference it directly in your pod or workload definition. This is useful for GitOps workflows such as ArgoCD. For example:

Example pod specification:

apiVersion: v1
kind: Pod
metadata:
  name: <secure_pod_name>
spec:
  containers:
  - name: <container_name>
    image: your.registry.io/my-private-image
  imagePullSecrets:
  - name: <pull_secret_name>

Example ArgoCD workflow:

apiVersion: argoproj.io/v1alpha1
kind: Workflow
metadata:
  generateName: <example_workflow>
spec:
  entrypoint: <main_task>
  imagePullSecrets:
  - name: <pull_secret_name>