How connect your on-prem k8s, docker or containerd deamon with IBM Cloud Container Registry

IBM cloud has a huge cloud offer that include also IBM Cloud container registry.

This registry works as private repository for your images, it’s pre-integrated with cloud tools and offer some advanced security features like a monitor for vulnerability.

If you need it’s possible connect ICR also to your tools like on-prem k8s environment, docker deamon on your laptop or containerd deamon.

The first step it’s create a token to grant the access, using IBM Cloud cli with Container registry plugin:

ic cr token-add — description “Token for my on-prem tools” — non-expiring — readwrite

This command will create the token ( in this case without expiration date and with read/write access) with an output similar to the following :

Requesting a registry token…

Token identifier Long-String-Of-Characters-AndNumbers
Token aVeryLongLongStringOfCharactersAndNumbers

If you like to check the token available on your account you could use:

ic cr token-list

Now you will be able to connect your on-prem tools and pull push the images in the following way.

Kubernetes

The first step is create a secret:

kubectl create secret docker-registry icr — docker-server=de.icr.io — docker-username=token — docker-password=aVeryLongLongStringOfCharactersAndNumbers — docker-email=devops@factor-y.com

now you could use the secret inside a yml to create a pod pulling your cloud images adding imagePullSecrets

imagePullSecrets:
— name: icr

Docker

From your local docker cli you could login to de.icr.io witht the following command:

docker login -u token -p aVeryLongLongStringOfCharactersAndNumbers de.icr.io

where aVeryLongLongStringOfCharactersAndNumbers is the token obtained at the beginning.

Containerd

You could use the token for example to pull an image using the following sintax:

ctr image pull — user token de.icr.io/domino/domino:10.0.1
Password:

The password is the aVeryLongLongStringOfCharactersAndNumbers obtained at the beginning.