last day (15 days later) » 

8:28 AM
0
A: How do I make jupyter-hub access my private docker image repository?

Suresh VishnoiImage pull secret can be used to pull a image from private registry.

 
Where will I use it?
 
As of now, I have access to a k8s cluster, I am able to deploy jhub on it. What else should I do in order to make the image registry, say secret-aviral/image1 available to my jhub?
 
in values.yaml file, you will enable it and provide the values for registry, user and password
 
i think its the second one, in the singleuser. testing it with second one at first.
 
8:28 AM
yea, that's what I was thinking
did you solve your issue with yamls yesterday ?
 
yes that was done
thanks :)
also, tahnk you for taking time out today
so, right now, my provider told me to use tokens instead of username and password.
any help in that?
 
no worries :)
yaa you can use token as well
you just need to create a secret and reference it to the deployment
now we need to check how it will be done in helm chart
 
yes, i am confused in helm chart only
 
where are you running it ?
which provider ?
 
8:41 AM
they have json blob
as a password
 
who? aws?
or the json blob in the jhub yaml file?
 
yea
aws
 
so, for aws ecr registry, i have the access and have pushed to the registry using my credentials
what about pulling?
How can i get the username and password?
 
8:47 AM
when you put your credentials in your values.yaml
it will become a secret
and it is referenced
you can try it
 
my credentials?
my username and password for aws?
 
your creditals are stored in a secret, which is stored in etcd, and when the pod is schdeuled , kubelet on the nodes fetch your credentials from etcd and pull the image from private regirstry
let me read how does it work for AWS
 
so what should i place in the username and pw?
```
imagePullSecret:
enabled: true
registry: <some_no>.dkr.ecr.ap-south-1.amazonaws.com
username:
email: aviral@atlan.com
password:
```
"let me read how does it work for AWS"
Yea, sure
 
its the password for ecr registry
how do you pull using docker ?
cat ~/.docker/config.json
 
i havent pulled yet, just pushed.
I ran the command `$(aws ecr get-login --no-include-email --region ap-south-1)` and then built -> tag -> pused to registry
 
8:52 AM
```
ACCOUNT=1234567890
REGION=my-region-1
SECRET_NAME=${REGION}-ecr-registry
EMAIL=anymail.doesnt.matter@email.com
TOKEN=`aws ecr get-login --region ${REGION} --registry-ids ${ACCOUNT} | cut -d' ' -f6`
echo "ENV variables setup done."
kubectl delete secret --ignore-not-found $SECRET_NAME
kubectl create secret docker-registry $SECRET_NAME \
--docker-server=https://${ACCOUNT}.dkr.ecr.${REGION}.amazonaws.com \
--docker-username=AWS \
--docker-password="${TOKEN}" \
--docker-email="${EMAIL}"
echo "Secret created by name. $SECRET_NAME"
here is the reference
TOKEN=aws ecr get-login --region ${REGION} --registry-ids ${ACCOUNT} | cut -d' ' -f6 will be your password
 
I got this from docker's config.json -> pastebin.com/4R7XeQNb
 
credsStore": "osxkeychain" it use other helper
 
didnt get you
 
aws ecr get-login --region ${REGION} --registry-ids ${ACCOUNT} | cut -d' ' -f6
will be your password
 
and username? AWS?
so, i do not need to run the commands that you pasted above? Just run the password one and thats it?
 
8:56 AM
I am trying to understand why did that guys use AWS as userename
as its convention
 
ok, take your time sir
 
0
Q: Kubernetes pull private external amazon ECR images

Fred MériotI have an Amazon account with a K8S cluster which is able to pull images from the same account's ECR repository. But, my company have another account with another ECR repository. How can I pull image from this "external" ECR repository ? I'am also a Rancher user and I used to do this by install...

there is also another way to do, I am no expert on AWS though
 
My aws user has full ecr access
btw, i ran the command:
`aws ecr get-login --region ap-south-1 --registry-ids some_no | cut -d' ' -f6` and got a very long string.
If that is the password, I think the `some_no` which makes the ecr address will be the username. checking with it right now
 
tried, its not working
changed the user to `aviral` with same password:
got the error:
```
Error: no Secret with the name "singleuser-image-credentials" found
Error: UPGRADE FAILED: no Secret with the name "singleuser-image-credentials" found
```
 
9:04 AM
did you enable it ?
kubectl get secret
 
no
i just changed the config and ran the helm command
 
imagePullSecret:
enabled: true
registry:
username:
email:
password:
 
are you saying, i need to run the following:
```
ACCOUNT=1234567890
REGION=my-region-1
SECRET_NAME=${REGION}-ecr-registry
EMAIL=anymail.doesnt.matter@email.com
TOKEN=`aws ecr get-login --region ${REGION} --registry-ids ${ACCOUNT} | cut -d' ' -f6`
echo "ENV variables setup done."
kubectl delete secret --ignore-not-found $SECRET_NAME
kubectl create secret docker-registry $SECRET_NAME \
--docker-server=https://${ACCOUNT}.dkr.ecr.${REGION}.amazonaws.com \
--docker-username=AWS \
--docker-password="${TOKEN}" \
> enabled: true

This I did.
 
can you run kubectl get secret
 
default-token-9qzmf kubernetes.io/service-account-token 3 22d
replicated-sidecar-tls Opaque 2 22d
replicatedlibrarykey kubernetes.io/dockerconfigjson 1 22d
replicatedregistrykey kubernetes.io/dockerconfigjson 1 3d
retraced Opaque 3 22d
retraced-jwt Opaque 2 22d
trying with the namespace, since this is in jhub
kubectl get secret -n jhub
```
NAME TYPE DATA AGE
default-token-ctzfh kubernetes.io/service-account-token 3 7d
hub-secret Opaque 2 7d
hub-token-j4v57 kubernetes.io/service-account-token 3 7d
singleuser-image-credentials kubernetes.io/dockerconfigjson 1 3m
```
 
9:07 AM
singleuser-image-credentials kubernetes.io/dockerconfigjson 1 3m
 
Error: no Secret with the name "singleuser-image-credentials" found
why its not finding it
 
and this is the output of kubectl describe secret singleuser....credentials -n jhub:

Name: singleuser-image-credentials
Namespace: jhub
Labels: app=jupyterhub
chart=jupyterhub-0.8.0
component=singleuser-image-credentials
heritage=Tiller
release=jhub
Annotations: <none>

Type: kubernetes.io/dockerconfigjson

Data
====
.dockerconfigjson: 4746 bytes
 
yea
it seems fine to me
I would expect different error if the password is wrong
 
helm errors are many a times not good
 
9:11 AM
kubectl descrive pod $POD_NAME
paste it in pastebin
its beautiful over there
 
btw, do i need to run the following command:
```
ACCOUNT=1234567890
REGION=my-region-1
SECRET_NAME=${REGION}-ecr-registry
EMAIL=anymail.doesnt.matter@email.com
TOKEN=`aws ecr get-login --region ${REGION} --registry-ids ${ACCOUNT} | cut -d' ' -f6`
echo "ENV variables setup done."
kubectl delete secret --ignore-not-found $SECRET_NAME
kubectl create secret docker-registry $SECRET_NAME \
--docker-server=https://${ACCOUNT}.dkr.ecr.${REGION}.amazonaws.com \
--docker-username=AWS \
--docker-password="${TOKEN}" \
 
noo
we will put token in your values.yaml
 
so, there are the following pods:
```
➜ sc-athena-airflow git:(jupyter-notebooks-v1) ✗ kubectl get pods -n jhub
NAME READY STATUS RESTARTS AGE
hook-image-awaiter-2c5x7 1/1 Running 0 3m
hook-image-puller-4dlqc 0/1 Init:ImagePullBackOff 0 3m
hook-image-puller-7z5xc 0/1 Init:ImagePullBackOff 0 3m
hook-image-puller-qnxvc 0/1 Init:ImagePullBackOff 0 3m
hook-image-puller-rn9rr 0/1 Init:ImagePullBackOff 0 3m
 
hook-image-puller-4dlqc
descive this pod
 
I described one pod, pastebin.com/XDFij6B0
 
9:15 AM
Error response from daemon: repository demo not found: does not exist or no pull access
can you post your values.yaml ?
jupyter-hub-config.yaml
 
can you use username : aws ?
this guys is also using AWS as a user
its strange
 
nothing changed, again the same error
so, as of now, we dont know what to use in the place of username and password
 
yea
that's we are trying to figure out
 
what to take this from file?
i got one name and some step to create and deploy a secret on k8s
 
couldn't make out anything from the above link, sorry
 
our issue is authentication
 
we do not know how to represent username and password for the AWS
 
is there any other way? like using sts method for this?
 
9:28 AM
as we know that, kubelet is hitting the ecr
can you make sure sure
that your tag for the image is right
 
ok
just checked
the tag is latest
and the image is demo
 
can you pull it using docker
docker pull imageName:latest
 
on it
done
i was making one mistake
in the image, i should have specified -> `some_no.dkr.ecr.ap-south-1.amazonaws.com/demo` instead of `demo`
 
name: demo
yea
 
can you post the ans?
 
9:35 AM
sure
 
so that i can accept and upvote it? :p
Also, upvote my ques, :p
and thanks again, sir
 
i did
I will try to deploy jupyterhub on my cluster now
 
sure
thanks :)
 
no worries
 

last day (15 days later) »