Use with Pipelines and Kubernetes

Push from Pipelines

The Container Registry is built in to Pipelines as the infraista registry. Each job gets its own short-lived login, removed when the job ends, so there are no secrets to set up.

- uses: infraista/docker-build-push@v1
  with:
    registry: infraista
    image: registry.infraista.cloud/northwind-labs/web-app
    tags: $GIT_SHORT_SHA

• The image must be under your organization's namespace.
• Pushing to a new repository name creates it.
• Pull request runs never push.

A repository's Build with a pipeline opens a new pipeline with that image filled in.

Deploy to a server

Add registry: infraista to deploy-ssh, deploy-instance, deploy-agent or deploy-docker: the job gets a pull-only login, and the server is signed in to the registry before the step runs.

- uses: infraista/deploy-docker@v1
  with:
    target: web-servers
    registry: infraista
    image: registry.infraista.cloud/northwind-labs/web-app:$GIT_SHORT_SHA
    containers:
      - name: web
        ports: ["80:3000"]

See Deploy targets and the file reference.

Pull from Kubernetes

Connect a Kubernetes cluster to the registry, and its pods can pull your private images with no imagePullSecrets of your own:

1. On the Container Registry page, under Connected to Kubernetes, connect the cluster. Or, in a repository's Settings > Pull access, choose which clusters can pull it.
2. Infraista puts a pull secret named infraista-registry in the cluster and adds it to the default namespace's default service account.
3. Each infraista/deploy-kubernetes run does the same for the namespace it deploys to.

The cluster can pull only the repositories it's connected to, plus public ones. Disconnecting it from every repository deletes its login, so every copy of the secret stops working.

# No imagePullSecrets needed
spec:
  containers:
    - name: web
      image: registry.infraista.cloud/northwind-labs/web-app:2.4.0

Related

• Push and pull images
• Deploy targets