WEBVTT

00:01.354 --> 00:05.687
-We will now walk through
the lab on image security.

00:05.839 --> 00:09.177
The first question is what secret type
must we choose for Docker Registry?

00:11.252 --> 00:16.268
If you look at the different types
of secrets that we can create,

00:16.268 --> 00:18.619
we see that we have Docker Registry,
Generic, and GLS.

00:18.619 --> 00:23.603
The Docker Registry is the one that
we're going to use for Docker Registry.

00:26.539 --> 00:29.815
Now we have an application running
on our cluster, let us explore it first.

00:29.815 --> 00:31.040
Let's do it.

00:32.504 --> 00:39.076
We deploy and we see that we have
an application by the name web,

00:39.365 --> 00:41.740
and what image is the application using?

00:42.638 --> 00:47.696
Let's take a look at the full set areas.

00:49.206 --> 00:55.555
Now let's take a look at
the deployment web and we see

00:55.555 --> 00:58.225
that it's using the NGINX Alpine image.

00:58.902 --> 01:00.423
Let's select that.

01:02.827 --> 01:05.786
Now we decided to use a modified
version of the application from

01:05.786 --> 01:07.346
an internal private registry.

01:07.346 --> 01:10.560
Update the image of the deployment
to use a new image from

01:10.560 --> 01:14.082
myprivateregistry.com:5000.

01:14.082 --> 01:18.424
We have a private registry,
and we know that if you do not

01:18.424 --> 01:20.585
specify a registry before
the image name,

01:20.585 --> 01:23.762
it's going to the default,
it's going to pull it from

01:23.762 --> 01:25.747
the default location on the Docker hub.

01:25.747 --> 01:30.793
What we want to do is we want
to edit the department

01:31.206 --> 01:37.894
and we wanted to pull the image
from the private registry.

01:37.894 --> 01:43.883
I'm just going to copy this
and paste it here and also add a slash.

01:46.032 --> 01:47.202
Let's save that.

01:47.877 --> 01:51.777
That's done, let's check it out.

01:52.392 --> 01:54.832
We see that the image
aim has been updated.

01:57.768 --> 01:59.201
Now don't worry about the status
for now because we're going to

01:59.201 --> 02:01.099
fix that in a bit.

02:01.247 --> 02:06.645
Let's see if the PODs are running.

02:07.174 --> 02:10.268
If you look at it, the POD,
this is the new POD that was graded.

02:11.630 --> 02:15.656
The rolling update kicked in
and the deployment created

02:15.656 --> 02:19.139
a new POD for the new image,
but it left the existing ones

02:19.139 --> 02:23.396
as is because only if the new POD
was successful and was in a ready state,

02:23.396 --> 02:25.629
it would kill the old POD
and then deploy,

02:25.629 --> 02:28.937
create the new POD because it's
following a rolling update strategy.

02:30.109 --> 02:33.031
In this case, it's not even
the new POD is not running.

02:33.031 --> 02:35.459
It's in an image, pull back off state.

02:36.056 --> 02:37.792
Let's check that out.

02:42.116 --> 02:49.031
It says fail to pull image
malformed response.

02:50.916 --> 02:53.602
That's basically because it doesn't
have the permissions

02:53.602 --> 02:56.519
to pull image from that depository.

02:56.540 --> 02:59.540
The answer to this question is
"No"

03:02.960 --> 03:05.357
Now create a secret object with
the credentials required

03:05.357 --> 03:06.942
to access the registry.

03:06.942 --> 03:11.875
Let's create a secret,
you cuddle creates secret,

03:12.939 --> 03:19.058
and this has to be a Docker registry.

03:20.159 --> 03:26.064
Let's take a look at the hub
and we see that here's a sample command.

03:28.767 --> 03:38.963
Let's run this command
along with the rest of it.

03:41.400 --> 03:43.900
Let's go and edit this.

04:01.835 --> 04:04.367
We have the name.

04:07.870 --> 04:17.852
I'm going to use the name as
Private Rate Grid, Docker server.

04:21.832 --> 04:30.838
Docker server is this
and the Docker user name,

04:32.265 --> 04:38.123
user and the password is doc password.

04:40.526 --> 04:43.026
The email is this.

04:44.539 --> 04:47.039
Yes, I'm going to remove the hash.

04:48.439 --> 04:50.300
That's being created.

04:53.944 --> 04:55.831
Now configure the deployment
to use credentials from

04:55.831 --> 04:58.811
the new secret to pull images
from the private registry.

04:59.139 --> 05:04.291
What we have to do is we have
to configure the deployment

05:04.291 --> 05:06.677
or the POD to use this image.

05:06.677 --> 05:10.565
Let's first look at the Kubernetes
recommendation page.

05:11.444 --> 05:17.596
Let's look at, image pull secret.

05:18.405 --> 05:19.742
That's what it's called.

05:19.879 --> 05:22.271
Pull an image from a private registry.

05:28.232 --> 05:29.301
This is what we need to do.

05:30.119 --> 05:35.962
Under the spec for the POD,
we must add the imagePullSecrets.

05:35.962 --> 05:37.236
Let's just copy that.

05:39.379 --> 05:44.377
Let's edit the deployment on web
that's going to

05:44.377 --> 05:48.917
the POD template right here.

05:51.852 --> 05:55.944
We're going to add imagePullSecrets.

05:55.944 --> 05:57.539
Let's align it.

05:59.877 --> 06:07.216
Let's give the secret name
which happens to be private-reg-cred.

06:08.588 --> 06:10.059
I'm going to save that.

06:11.652 --> 06:15.721
Let's check the status of the deployment.

06:18.126 --> 06:28.889
Now, we see that there are no changes.

06:29.340 --> 06:30.950
It looks like that worked.

06:32.278 --> 06:33.152
Clear by check.

06:33.558 --> 06:34.900
That's successful.

06:35.013 --> 06:37.582
Now, we're going to check
the status of the PODs.

06:38.441 --> 06:44.441
As you see, it's terminating
the old PODs and the new PODs are created.

06:46.439 --> 06:48.939
That has the new images.

06:49.440 --> 06:51.940
That's the end of that lab.