1

I am using kubernetes with virtual-kubelet to deploy module to Iot Edge. Everything works perfect with public image. I can't figure out how to pass credentials to my private registry.

This documentation https://github.com/MicrosoftDocs/azure-docs/blob/master/articles/iot-edge/iot-edge-runtime.md says:

settings.image – The container image that the IoT Edge agent uses to start the module. The IoT Edge agent must be configured with credentials for the container registry if the image is protected by a password. Credentials for the container registry can be configured remotely using the deployment manifest, or on the IoT Edge device itself by updating the config.yaml file in the IoT Edge program folder.

Seems very easy but can't find how to modify config.yaml to add my credentials. I think that it should be added in below section but there is no example how to do that.

###############################################################################
# Edge Agent module spec
###############################################################################
#
# Configures the initial Edge Agent module.
#
# The daemon uses this definition to bootstrap the system. The Edge Agent can
# then update itself based on the Edge Agent module definition present in the
# deployment in IoT Hub.
#
###############################################################################

agent:
  name: "edgeAgent"
  type: "docker"
  env:
    RuntimeLogLevel: debug
  config:
    image: "mcr.microsoft.com/azureiotedge-agent:1.0"
    auth: {}

YAML

apiVersion: apps/v1beta2
kind: Deployment
metadata:
  name: matrix
spec:
  selector:
    matchLabels:
      app: matrix
  replicas: 1
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 0%
      maxUnavailable: 100%
  template:
    metadata:
      labels:
        app: matrix
      annotations:
        isEdgeDeployment: "true"
        targetCondition: "tags.type='gpu'"
        priority: "151"
        loggingOptions: ""
    spec:
      affinity:
          podAntiAffinity:
            requiredDuringSchedulingIgnoredDuringExecution:
            - labelSelector:
                matchExpressions:
                - key: app
                  operator: In
                  values:
                  - matrix
              topologyKey: "kubernetes.io/hostname"
      containers:
      - name: matrix
        image: "registry.xxx.xx/image/xxx-frontend"
        env:
        - name: DISPLAY
          value: ":0.0"
      nodeSelector:
        type: virtual-kubelet
      tolerations:
      - key: virtual-kubelet.io/provider
        operator: Equal
        value: iotedge
        effect: NoSchedule

---
kind: ConfigMap
apiVersion: v1
metadata:
  name: matrix
data:
  status: running
  restartPolicy: always
  version: "1.0"
  createOptions: |
    {
      "HostConfig": {
        "Privileged": "true",
        "Mounts": [{"Target": "/tmp/.X11-unix/","Source": "/tmp/.X11-unix/","Type": "bind"}],
        "network": "host"
      }
    }
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: edgeagent
data:
  desiredProperties: |
    {
      "runtime": {
        "settings": {
          "registryCredentials": {
            "docker": {
              "address": "registry.xxx.xx",
              "password": "xxxxxxxxxxxxxxx",
              "username": "user"
            }
          }
        }
      },
      "systemModules": {
        "edgeHub": {
          "env": {
            "OptimizeForPerformance": {
              "value": "false"
            }
          }
        }
      }
    }
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: edgehub
data:
  desiredProperties: |
    {
      "routes": {
        "route": "FROM /* INTO $upstream",
      },
      "storeAndForwardConfiguration": {
        "timeToLiveSecs": 6
      }
    }
Bartosz
  • 11
  • 4

1 Answers1

0

You can add this to edgeAgent configMap like so:

---
apiVersion: v1
kind: ConfigMap
metadata:
  name: edgeagent
data:
  desiredProperties: |
    {
      "runtime": {
        "settings": {
          "registryCredentials": {
            "docker": {
              "address": "preview.azurecr.io",
              "password": "xyz",
              "username": "abc"
            }
          }
        }
      }
    }
---
Venkat Yalla
  • 558
  • 2
  • 9
  • Hello. I've edited my question and added my yaml. Still see "denied: access forbidden" in edgeAgent logs. – Bartosz Feb 12 '19 at 16:44
  • Image names need to have tag, for example: "registry.xxx.xx/image/xxx-frontend:latest" or "registry.xxx.xx/image/xxx-frontend:1.0" – Venkat Yalla Feb 14 '19 at 04:38
  • Also, if you want to put the container on the host network, please use these create options: `{ "NetworkingConfig": { "EndpointsConfig": { "host": {} } }, "HostConfig": { "NetworkMode": "host" } }` – Venkat Yalla Feb 14 '19 at 04:43