Introduction

Kubernetes and GitLab are two powerful tools commonly used in the DevOps field. Kubernetes is an open-source container orchestration platform that automates many of the manual processes involved in deploying, managing, and scaling containerized applications. GitLab, on the other hand, is a DevOps platform that facilitates version control, CI/CD pipelines, and more.

One of the frequent scenarios when using Kubernetes with GitLab involves the need to pull images from a private container registry. This necessity arises as a part of deploying Docker containers to a Kubernetes environment during the CI/CD process. A common challenge in this context is securely storing and accessing private registry credentials in both Kubernetes and GitLab.

Private Registry Password Storage

To authenticate Kubernetes clusters to private registries securely, a common practice is to store credentials (such as username and password or a token). Below are the methods to achieve secure password storage:

Kubernetes Secrets

Kubernetes Secrets offer a built-in way to store sensitive data such as passwords, OAuth tokens, and SSH keys. Using Secrets can help mitigate the risk of exposing sensitive information in configurations or command arguments.

1. Create a Docker Registry Secret
   You can create a Docker registry secret by using the `kubectl` command:
   • ```<registry-server>```: URL of your private registry
   • ```<your-username>```: Username for the registry
   • ```<your-password>```: Password for the registry
   • ```<your-email>```: Email associated with the Docker registry account
     • name: mycontainer
     • name: my-registry-secret
   • Go to Settings > CI/CD.
   • Expand the Variables section.
   • Add variables like `DOCKER_REGISTRY_USER`, `DOCKER_REGISTRY_PASSWORD`, and optionally `DOCKER_REGISTRY`.
     • build
       • docker:dind
       • docker login -u $DOCKER_REGISTRY_USER -p$DOCKER_REGISTRY_PASSWORD $DOCKER_REGISTRY
       • docker build -t $DOCKER_REGISTRY/my-image:$CI_COMMIT_SHORT_SHA .
       • docker push $DOCKER_REGISTRY/my-image:$CI_COMMIT_SHORT_SHA

• Always use the least privileges necessary for registry accounts.
• Regularly update passwords and tokens to minimize risks.
• Leverage Vault systems such as HashiCorp Vault for added security if required.
• Kubernetes Secrets are base64 encoded but not encrypted by default. Consider setting up encryption-at-rest for Kubernetes Secrets.