How do I configure the registry secret?

cyrilcros · February 12, 2021, 6:53pm

Hi, I set up a new Harbor registry. I am trying to understand the documentation (https://www.gitpod.io/docs/self-hosted/latest/install/docker-registry/ ), but it isn’t clear enough for me.
I start from a username and password for the registry, and I want to make an encrypted (bitnami sealed ) secret out of them the gitpod Helm chart will use.
I believe the value will be the contents of secrets/registry-auth.json from the docs after I use docker login and copy config.json, but I don’t know what is the key I should be using for this secret.
I also see posts like this: https://jimmyb.ninja/post/1607033505 who end up with a different looking secret (at the very end)… kubectl create secret docker-registry image-builder-registry-secret --docker-server=registry.mydomain --docker-username=$USERNAME --docker-password=$PASSWORD -n gitpod
What are the correct contents of this secret?

corneliusludmann · February 15, 2021, 10:48am

Hi @cyrilcros and welcome to the Gitpod community!

You need to set the path to your config.json (which is the thing that you get from docker login) as path and set an arbitrary name for secretName (e.g. that one in the docs you linked). The helm installer creates the K8s secret for your like this:

github.com

gitpod-io/gitpod/blob/e33ff3369dda3934ee16c805170de2d72963a108/chart/templates/_helpers.tpl#L300-L320


{{- define "gitpod.pull-secret" -}}
{{- $ := .root -}}
{{- if (and .secret .secret.secretName .secret.path (not (eq ($.Files.Get .secret.path) ""))) -}}
{{- $name := .secret.secretName -}}
{{- $path := .secret.path -}}
apiVersion: v1
kind: Secret
metadata:
  name: {{ $name }}
  labels:
    app: {{ template "gitpod.fullname" $ }}
    chart: "{{ $.Chart.Name }}-{{ $.Chart.Version }}"
    release: "{{ $.Release.Name }}"
    heritage: "{{ $.Release.Service }}"
  annotations:
    checksum/checksd-config: {{ $.Files.Get $path | b64enc | indent 2 | sha256sum }}
type: kubernetes.io/dockerconfigjson
data:
  .dockerconfigjson: "{{ $.Files.Get $path | b64enc }}"
{{- end -}}
{{- end -}}

I don’t know exactly what you mean by “key” and “value”. Please let me know if this does not answer your question.

cyrilcros · February 15, 2021, 7:06pm

Hi, thanks for your help. What I meant is that secrets have a data field with key-value pairs and I wasn’t sure what should go in them.
I didn’t understand that there was dedicated secret type (see https://kubernetes.io/docs/concepts/configuration/secret/#docker-config-secrets), and the gitpod docs should really just link to that and ask to create this secret like they show…