{"action":"closed","issue":{"url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/7627","labels_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/7627/labels{/name}","comments_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/7627/comments","events_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/7627/events","html_url":"https://github.com/GoogleCloudPlatform/kubernetes/issues/7627","id":72472124,"number":7627,"title":"Image pull using secrets","user":{"login":"pmorie","id":366488,"avatar_url":"https://avatars.githubusercontent.com/u/366488?v=3","gravatar_id":"","url":"https://api.github.com/users/pmorie","html_url":"https://github.com/pmorie","followers_url":"https://api.github.com/users/pmorie/followers","following_url":"https://api.github.com/users/pmorie/following{/other_user}","gists_url":"https://api.github.com/users/pmorie/gists{/gist_id}","starred_url":"https://api.github.com/users/pmorie/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pmorie/subscriptions","organizations_url":"https://api.github.com/users/pmorie/orgs","repos_url":"https://api.github.com/users/pmorie/repos","events_url":"https://api.github.com/users/pmorie/events{/privacy}","received_events_url":"https://api.github.com/users/pmorie/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/labels/kind/design","name":"kind/design","color":"50cba5"},{"url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/labels/priority/P2","name":"priority/P2","color":"fbca04"},{"url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/labels/team/node","name":"team/node","color":"d2b48c"},{"url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/labels/team/UX","name":"team/UX","color":"d2b48c"}],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":13,"created_at":"2015-05-01T16:46:29Z","updated_at":"2015-05-29T05:02:12Z","closed_at":"2015-05-29T05:02:12Z","body":"There are a couple in-progress items currently that are going to touch the image pull with secret story, so I'm creating this issue to get everyone on the same page and hopefully do some productive design and factorings in front of the implementation work that will need to happen.\r\n\r\nOur long-term goal is to be able to use secrets to enable pull from private image repositories.  Those secrets will definitely come from service accounts; it seems possible to me that we'll want to enable a use-case where a secret can also be explicitly referenced in a pod's spec to enable image pull as well.\r\n\r\nOne key thing to figure out is exactly how we want to model this inside the kubelet.  Currently the container manager has a `Pull` method that simply takes the container's `image` field as input.  I think, regardless of how the kubelet ultimately models associations between credentials, pods, and images, that this signature will need to change to include:\r\n\r\n1.  Information about the pod\r\n2.  The credentials to be used for the pull\r\n\r\nSome random questions I can think of that we will need to sort out:\r\n\r\n1.  Say that two different pods are set up to pull that same image from the same private registry using different credentials.  If the kubelet pulls the image on behalf of pod X, and then pod Y is scheduled onto the same node, and the image is already present on the node, do we still have to test pod Y's credentials somehow?  I would say the answer is yes, but I don't believe there's a way to dry-test a set of credentials with a docker registry at this point.  Please correct me if I'm wrong -- I would love to be wrong about this.\r\n2.  Presumably the problem in (1) applies to each auth mode, credential type, registry type.\r\n3.  Will credentials be cached on the node?  If so we need to have tmpfs storage for these, since they shouldn't be allowed to come to rest on the node's fs.\r\n\r\n@liggitt @yifan-gu @smarterclayton @vmarmol \r\n\r\nTrying to keep the tagging minimal, feel free to tag your friends and coworkers."}}