-We will now walk through the lab on image security.
The first question is what secret type must we choose for Docker Registry?
If you look at the different types of secrets that we can create,
we see that we have Docker Registry, Generic, and GLS.
The Docker Registry is the one that we're going to use for Docker Registry.
Now we have an application running on our cluster, let us explore it first.
Let's do it.
We deploy and we see that we have an application by the name web,
and what image is the application using?
Let's take a look at the full set areas.
Now let's take a look at the deployment web and we see
that it's using the NGINX Alpine image.
Let's select that.
Now we decided to use a modified version of the application from
an internal private registry.
Update the image of the deployment to use a new image from
myprivateregistry.com:5000.
We have a private registry, and we know that if you do not
specify a registry before the image name,
it's going to the default, it's going to pull it from
the default location on the Docker hub.
What we want to do is we want to edit the department
and we wanted to pull the image from the private registry.
I'm just going to copy this and paste it here and also add a slash.
Let's save that.
That's done, let's check it out.
We see that the image aim has been updated.
Now don't worry about the status for now because we're going to
fix that in a bit.
Let's see if the PODs are running.
If you look at it, the POD, this is the new POD that was graded.
The rolling update kicked in and the deployment created
a new POD for the new image, but it left the existing ones
as is because only if the new POD was successful and was in a ready state,
it would kill the old POD and then deploy,
create the new POD because it's following a rolling update strategy.
In this case, it's not even the new POD is not running.
It's in an image, pull back off state.
Let's check that out.
It says fail to pull image malformed response.
That's basically because it doesn't have the permissions
to pull image from that depository.
The answer to this question is "No"
Now create a secret object with the credentials required
to access the registry.
Let's create a secret, you cuddle creates secret,
and this has to be a Docker registry.
Let's take a look at the hub and we see that here's a sample command.
Let's run this command along with the rest of it.
Let's go and edit this.
We have the name.
I'm going to use the name as Private Rate Grid, Docker server.
Docker server is this and the Docker user name,
user and the password is doc password.
The email is this.
Yes, I'm going to remove the hash.
That's being created.
Now configure the deployment to use credentials from
the new secret to pull images from the private registry.
What we have to do is we have to configure the deployment
or the POD to use this image.
Let's first look at the Kubernetes recommendation page.
Let's look at, image pull secret.
That's what it's called.
Pull an image from a private registry.
This is what we need to do.
Under the spec for the POD, we must add the imagePullSecrets.
Let's just copy that.
Let's edit the deployment on web that's going to
the POD template right here.
We're going to add imagePullSecrets.
Let's align it.
Let's give the secret name which happens to be private-reg-cred.
I'm going to save that.
Let's check the status of the deployment.
Now, we see that there are no changes.
It looks like that worked.
Clear by check.
That's successful.
Now, we're going to check the status of the PODs.
As you see, it's terminating the old PODs and the new PODs are created.
That has the new images.
That's the end of that lab.