You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
@@ -31,7 +31,7 @@ Review the capabilities that {{site.data.keyword.codeengineshort}} provides to r
31
31
| Private workloads | Store your source code in private repositories and push your images to private registries and {{site.data.keyword.codeengineshort}} can access them. |
32
32
| Fully integrated | {{site.data.keyword.codeengineshort}} is fully integrated into IBM Cloud so that you can take advantage of the full catalog of IBM Cloud services. |
33
33
| Event-driven workloads | Extend the functionality of your applications with messages (events) from event producers. Your application can then react to those events and perform actions based on them. |
34
-
|Auto-scales - even to zero | {{site.data.keyword.codeengineshort}} automatically scales your workloads up and down, and even down to zero when no requests are active. You pay for only the resources that you consume. |
34
+
|Autoscales - even to zero | {{site.data.keyword.codeengineshort}} automatically scales your workloads up and down, and even down to zero when no requests are active. You pay for only the resources that you consume. |
35
35
| Control access | Assign platform and services access permissions to your projects in IBM Cloud Identity and Access Management to control who can provision and manage resources in your IBM Cloud account. |
36
36
| Based on open source | {{site.data.keyword.codeengineshort}} is built on a set of open source technologies such as Kubernetes, Knative, Istio, and Tekton, keeping your apps and jobs portable. |
Copy file name to clipboardExpand all lines: add-registry.md
+17-17
Original file line number
Diff line number
Diff line change
@@ -1,8 +1,8 @@
1
1
---
2
2
3
3
copyright:
4
-
years: 2020, 2021
5
-
lastupdated: "2021-12-15"
4
+
years: 2020, 2022
5
+
lastupdated: "2022-02-02"
6
6
7
7
keywords: registries, container registry, image registry, apikey, API key, access token, images, registry access, service id
8
8
@@ -42,7 +42,7 @@ Public registries, such as public Docker Hub, can be used to get started with Do
42
42
## Setting up authorities for image registries
43
43
{: #authorities-registry}
44
44
45
-
if your registry is public, you do not have to set up authorities in order to pull images. Note that pulling images from a public registry while you are getting started with {{site.data.keyword.codeengineshort}} is acceptable, use a private registry when it comes to your enterprise workloads.
45
+
If your registry is public, you do not have to set up authorities to pull images. Note that pulling images from a public registry while you are getting started with {{site.data.keyword.codeengineshort}} is acceptable. Use a private registry when it comes to your enterprise workloads.
46
46
47
47
**What authorities do I need?**
48
48
@@ -52,7 +52,7 @@ When you deploy apps or run jobs from the console, {{site.data.keyword.codeengin
52
52
|--------|-----------|---------------------|
53
53
| Pull images |`Read` access | When you deploy an image as an application or job, you must pull the image from a registry. To pull images, you need `read` access. Note that if the repository is public, you already have `read` access to the images. |
54
54
| Push images |`Read` and `write` access | When you build source code, you must push the image to a registry. To push images, you need `write` access to {{site.data.keyword.registryfull_notm}}. You cannot push images to a registry other than {{site.data.keyword.registryfull_notm}}. |
55
-
| Create a namespace |`Read`, `write`, and `Manager` access | To create a namespace in {{site.data.keyword.registrylong_notm}}, you must have `manager` access. In order to pull and push images, you must have `read` and `write` access. |
55
+
| Create a namespace |`Read`, `write`, and `Manager` access | To create a namespace in {{site.data.keyword.registrylong_notm}}, you must have `manager` access. To pull and push images, you must have `read` and `write` access. |
56
56
{: caption="Access authorities for image registry" caption-side="top"}
57
57
58
58
**Can I use a service ID?**
@@ -111,7 +111,7 @@ Now that you created your API key, [save it as registry access](#add-registry-ac
111
111
112
112
To create an {{site.data.keyword.cloud_notm}} IAM API key with the CLI, run the [**`iam api-key-create`**](/docs/account?topic=cli-ibmcloud_commands_iam#ibmcloud_iam_api_key_create) command. For example, to create an API key called `cliapikey` with a description of "My CLI APIkey" and save it to a file called `key_file`, run the following command:
113
113
114
-
```sh
114
+
```txt
115
115
ibmcloud iam api-key-create cliapikey -d "My CLI APIkey" --file key_file
116
116
```
117
117
{: pre}
@@ -124,7 +124,7 @@ Now that you created your API key, [save it as registry access](#add-registry-ac
124
124
## Accessing images in a shared account
125
125
{: #images-shared-account}
126
126
127
-
In order to access images from {{site.data.keyword.registryfull_notm}} in a shared account, you must be assigned the [proper authority](#authorities-registry).
127
+
To access images from {{site.data.keyword.registryfull_notm}} in a shared account, you must be assigned the [proper authority](#authorities-registry).
128
128
129
129
If you are planning to deploy apps and run jobs from the shared account, {{site.data.keyword.codeengineshort}} can pull or push images for you when you deploy your application or create your job.
130
130
@@ -177,14 +177,14 @@ To add {{site.data.keyword.registryfull_notm}} or Docker Hub access with the CLI
177
177
178
178
For example, the following **`registry create`** command creates registry access to an {{site.data.keyword.registryfull_notm}} instance called `myregistry` that is on the `us.icr.io` registry server:
@@ -210,7 +210,7 @@ When you create a service ID, you can restrict access to a regional {{site.data.
210
210
### Authorizing access to {{site.data.keyword.registryshort}} with service ID from the console
211
211
{: #authorize-console-service-id}
212
212
213
-
In order to pull or push images from or to {{site.data.keyword.registryfull_notm}}, you must create a service ID, create an access policy for the service ID, and then create an API key to store the credentials.
213
+
To pull or push images from or to {{site.data.keyword.registryfull_notm}}, you must create a service ID, create an access policy for the service ID, and then create an API key to store the credentials.
214
214
215
215
#### Step 1 Create the service ID and authorize it to the {{site.data.keyword.registryfull_notm}} service
216
216
{: #create-service-id}
@@ -252,19 +252,19 @@ Now that our service ID is created and is granting access to {{site.data.keyword
252
252
5. Click **Add** and then **Assign**.
253
253
254
254
255
-
Now that you have your access policies in place for your service ID and your API key created, you can [add access to {{site.data.keyword.codeengineshort}}](#add-registry-access-ce)in order to pull images from your container registry.
255
+
Now that you have your access policies in place for your service ID and your API key created, you can [add access to {{site.data.keyword.codeengineshort}}](#add-registry-access-ce) to pull images from your container registry.
256
256
257
257
### Authorizing access to {{site.data.keyword.registryshort}} with the CLI
258
258
{: #authorize-cr-cli}
259
259
260
-
In order to pull images from {{site.data.keyword.registryfull_notm}} in a different account, you must create a service ID, create access policies for the service ID, and then create an API key to store your credentials.
260
+
To pull images from {{site.data.keyword.registryfull_notm}} in a different account, you must create a service ID, create access policies for the service ID, and then create an API key to store your credentials.
261
261
{: shortdesc}
262
262
263
263
1. Create an {{site.data.keyword.cloud_notm}} IAM service ID for your project that is used for the IAM policies and API key credentials in the image pull secret with the **`iam service-id-create`** command. Be sure to give the service ID a description that helps you retrieve the service ID later, such as including the project name. For a complete listing of the **`iam service-id-create`** command and its options, see the [**`ibmcloud iam service-id-create`**](/docs/account?topic=cli-ibmcloud_commands_iam#ibmcloud_iam_service_id_create) command.
264
264
265
265
For example, the following command creates a service ID called `codeengine-myproject-id` with the description `Service ID for IBM Cloud Container Registry in {{site.data.keyword.codeengineshort}} project myproject`:
266
266
267
-
```sh
267
+
```txt
268
268
ibmcloud iam service-id-create codeengine-myproject-id --description "Service ID for IBM Cloud Container Registry in {{site.data.keyword.codeengineshort}} project my proj"
269
269
```
270
270
{: pre}
@@ -273,7 +273,7 @@ In order to pull images from {{site.data.keyword.registryfull_notm}} in a differ
273
273
274
274
For example, the following command creates a policy for `codeengine-myproject-id` service ID with the role of `Reader`:
275
275
276
-
```sh
276
+
```txt
277
277
ibmcloud iam service-policy-create codeengine-myproject-id --roles Reader --service-name container-registry
278
278
```
279
279
{: pre}
@@ -292,7 +292,7 @@ In order to pull images from {{site.data.keyword.registryfull_notm}} in a differ
292
292
293
293
For example, create a policy for `codeengine-myproject-id` service ID with the role of `Operator`:
294
294
295
-
```sh
295
+
```txt
296
296
ibmcloud iam service-policy-create codeengine-myproject-id --roles Operator --service-name iam-identity
297
297
```
298
298
{: pre}
@@ -311,14 +311,14 @@ In order to pull images from {{site.data.keyword.registryfull_notm}} in a differ
311
311
312
312
For example, the following command creates a key called `codeengine-myproject-key` for the `codeengine-myproject-id` service ID with a description of `API key for service ID codeengine-myproject-id for {{site.data.keyword.codeengineshort}} myproject`:
313
313
314
-
```sh
314
+
```txt
315
315
ibmcloud iam service-api-key-create codeengine-myproject-key codeengine-myproject-id --description "API key for service ID codeengine-myproject-id for {{site.data.keyword.codeengineshort}} myproject"
316
316
```
317
317
{: pre}
318
318
319
319
**Example output**
320
320
321
-
```sh
321
+
```txt
322
322
Please preserve the API key! It cannot be retrieved after it's created.
323
323
324
324
Name codeengine-myproject-key
@@ -334,4 +334,4 @@ In order to pull images from {{site.data.keyword.registryfull_notm}} in a differ
334
334
You won’t be able to see this API key again, so be sure to record it in a safe place.
335
335
{: important}
336
336
337
-
Now that you have your access policies in place for your service ID and your API key created, you can [add access to {{site.data.keyword.codeengineshort}}](#add-registry-access-ce) in order to pull images from your container registry.
337
+
Now that you have your access policies in place for your service ID and your API key created, you can [add access to {{site.data.keyword.codeengineshort}}](#add-registry-access-ce) to pull images from your container registry.
1. Log in into {{site.data.keyword.cloud_notm}} and target a region, account, and resource group.
116
116
117
-
```sh
117
+
```txt
118
118
ibmcloud login target -r REGION -c ACCOUNT_ID -g RESOURCE_GROUP
119
119
```
120
120
{: pre}
121
121
122
122
2. Create your {{site.data.keyword.codeengineshort}} project:
123
123
124
-
```sh
124
+
```txt
125
125
ibmcloud ce project create --name PROJECT
126
126
```
127
127
{: pre}
128
128
129
129
3. Select your {{site.data.keyword.codeengineshort}} project as the current context and append the project to the default Kubernetes configuration file.
130
130
131
-
```sh
131
+
```txt
132
132
ibmcloud ce project select --name PROJECT --kubecfg
0 commit comments