# Use with Pipelines and Kubernetes
Source: https://docs.infraista.com/en/developer-tools/container-registry/use-with-pipelines-and-kubernetes



## Push from Pipelines [#push-from-pipelines]

The Container Registry is built in to Pipelines as the `infraista` registry. Each job gets its own
short-lived login, removed when the job ends, so there are no secrets to set up.

```yaml
- uses: infraista/docker-build-push@v1
  with:
    registry: infraista
    image: registry.infraista.cloud/northwind-labs/web-app
    tags: $GIT_SHORT_SHA
```

* The image must be under your organization's namespace.
* Pushing to a new repository name creates it.
* Pull request runs never push.

A repository's **Build with a pipeline** opens a new pipeline with that image filled in.

## Deploy to a server [#deploy-to-a-server]

Add `registry: infraista` to `deploy-ssh`, `deploy-instance`, `deploy-agent` or `deploy-docker`: the
job gets a pull-only login, and the server is signed in to the registry before the step runs.

```yaml
- uses: infraista/deploy-docker@v1
  with:
    target: web-servers
    registry: infraista
    image: registry.infraista.cloud/northwind-labs/web-app:$GIT_SHORT_SHA
    containers:
      - name: web
        ports: ["80:3000"]
```

See [Deploy targets](/en/developer-tools/pipelines/deploy-targets) and the
[file reference](/en/developer-tools/pipelines/pipeline-file-reference#deploying).

## Pull from Kubernetes [#pull-from-kubernetes]

Connect a Kubernetes cluster to the registry, and its pods can pull your private images with no
`imagePullSecrets` of your own:

1. On the **Container Registry** page, under **Connected to Kubernetes**, connect the cluster. Or, in a
   repository's **Settings** > **Pull access**, choose which clusters can pull it.
2. Infraista puts a pull secret named `infraista-registry` in the cluster and adds it to the `default`
   namespace's default service account.
3. Each `infraista/deploy-kubernetes` run does the same for the namespace it deploys to.

<Shot name="developer-tools/container-registry/clusters" alt="Connected to Kubernetes, with the web-prod cluster allowed to pull" />

The cluster can pull only the repositories it's connected to, plus public ones. Disconnecting it from
every repository deletes its login, so every copy of the secret stops working.

```yaml
# No imagePullSecrets needed
spec:
  containers:
    - name: web
      image: registry.infraista.cloud/northwind-labs/web-app:2.4.0
```

## Related [#related]

* [Push and pull images](/en/developer-tools/container-registry/push-and-pull-images)
* [Deploy targets](/en/developer-tools/pipelines/deploy-targets)