Blaine Gardner
1391228b1d
mkdocs uses a markdown renderer that is hardcoded to 4 spaces per tab
for detecting indentation levels, including ordered- and
unordered-lists. Since we cannot easily change the renderer, begin using
a markdown linter in CI that will fail if official docs do not adhere to
the spacing rules.
As a starting point, the markdownlint config does not begin with the
default set of checks, which might overwhelm attempts to fix them.
Instead, focus on list-tab-spacing rules and a few other highly useful
checks.
markdownlint also has some gaps in its abilities that allow common Rook
doc issues to pass acceptance. However, it allows creating custom
linting plugins. Create 2 such linting plugins to check 2 things:
- all doc lines (except code blocks) must be aligned to a 4-space
boundary, without exception. This ensures that markdown will render
correctly with mkdocs. This unfortunately makes it possible to create
lists that are internally aligned strangely.
- admonitions must all follow the same format of
```
!!! header
body
```
For the strange lists, this is allowed and renders correctly, but it
looks strange:
```md
- first bullet
- second bullet
still second bullet
- third bullet
has a paragraph
of text inside
- last bullet
Signed-off-by: Blaine Gardner <blaine.gardner@ibm.com>
(cherry picked from commit c9d99e01a0)
55 lines
2.4 KiB
Markdown
55 lines
2.4 KiB
Markdown
---
|
|
title: Authenticated Container Registries
|
|
---
|
|
|
|
If you want to use an image from authenticated docker registry (e.g. for image cache/mirror), you'll need to
|
|
add an `imagePullSecret` to all relevant service accounts. See the next section for the required service accounts.
|
|
|
|
The whole process is described in the [official kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#add-imagepullsecrets-to-a-service-account).
|
|
|
|
## Example setup for a ceph cluster
|
|
|
|
To get you started, here's a quick rundown for the ceph example from the [quickstart guide](../quickstart.md).
|
|
|
|
First, we'll create the secret for our registry as described [here](https://kubernetes.io/docs/concepts/containers/images/#specifying-imagepullsecrets-on-a-pod) (the secret will be created in the `rook-ceph` namespace, make sure to change it if your Rook Ceph Operator/Cluster is in another namespace):
|
|
|
|
```console
|
|
kubectl -n rook-ceph create secret docker-registry my-registry-secret --docker-server=DOCKER_REGISTRY_SERVER --docker-username=DOCKER_USER --docker-password=DOCKER_PASSWORD --docker-email=DOCKER_EMAIL
|
|
```
|
|
|
|
Next we'll add the following snippet to all relevant service accounts as described [here](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#add-imagepullsecrets-to-a-service-account):
|
|
|
|
```yaml
|
|
imagePullSecrets:
|
|
- name: my-registry-secret
|
|
```
|
|
|
|
The service accounts are:
|
|
|
|
* `rook-ceph-system` (namespace: `rook-ceph`): Will affect all pods created by the rook operator in the `rook-ceph` namespace.
|
|
* `rook-ceph-default` (namespace: `rook-ceph`): Will affect most pods in the `rook-ceph` namespace.
|
|
* `rook-ceph-mgr` (namespace: `rook-ceph`): Will affect the MGR pods in the `rook-ceph` namespace.
|
|
* `rook-ceph-osd` (namespace: `rook-ceph`): Will affect the OSD pods in the `rook-ceph` namespace.
|
|
* `rook-ceph-rgw` (namespace: `rook-ceph`): Will affect the RGW pods in the `rook-ceph` namespace.
|
|
|
|
Since it's the same procedure for all service accounts, here is just one example:
|
|
|
|
```console
|
|
kubectl -n rook-ceph edit serviceaccount rook-ceph-default
|
|
```
|
|
|
|
```yaml
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: rook-ceph-default
|
|
namespace: rook-ceph
|
|
secrets:
|
|
- name: default-token-12345
|
|
# Add the highlighted lines:
|
|
imagePullSecrets:
|
|
- name: my-registry-secret
|
|
```
|
|
|
|
After doing this for all service accounts all pods should be able to pull the image from your registry.
|