Skip to content

ensure-secret-pulled-images: document incompatible CRI versions #54879

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
stlaz wants to merge 1 commit into
base: main
Choose a base branch
from
+23 −1
Open

ensure-secret-pulled-images: document incompatible CRI versions #54879

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 23 additions & 1 deletion content/en/docs/concepts/containers/images.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -412,6 +412,14 @@ Access to pre-pulled images may be authorized according to [image pull credentia
### Ensure image pull credential verification {#ensureimagepullcredentialverification}

{{< feature-state feature_gate_name="KubeletEnsureSecretPulledImages" >}}
{{< warning >}}
This feature is not compatible with the following container runtime versions:
- cri-o < v1.36.0
Comment thread
stlaz marked this conversation as resolved.
- cri-dockerd - no known supported version to date.
Comment thread
stlaz marked this conversation as resolved.

If you're switching from these versions to a version that is compatible, make sure to
follow the steps from [Switching to a container runtime version compatible with `KubeletEnsureSecretPulledImages`](#ensuresecretpulledimagesincompatiblecrversion).
{{</ warning >}}

If the `KubeletEnsureSecretPulledImages` feature gate is enabled for your cluster,
Kubernetes will validate image credentials for every image that requires credentials
Expand Down Expand Up @@ -446,7 +454,7 @@ will continue to verify without the need to access the registry. New or rotated
will require the image to be re-pulled from the registry.
{{< /note >}}

#### Enabling `KubeletEnsureSecretPulledImages` for the first time
#### Enabling `KubeletEnsureSecretPulledImages` for the first time {#enableensuresecretpulledimagesfirsttime}

When the `KubeletEnsureSecretPulledImages` gets enabled for the first time, either
by a kubelet upgrade or by explicitly enabling the feature, if a kubelet is able to
Expand All @@ -462,6 +470,20 @@ Note that removing the directory holding the image pulled records will have the
effect on kubelet restart, particularly the images currently cached in the nodes by
the container runtime will all be considered pre-pulled.

#### Switching to a container runtime version compatible with `KubeletEnsureSecretPulledImages` {#ensuresecretpulledimagesincompatiblecrversion}

Some container runtimes were incompatible with the feature, namely:
- cri-o before v1.36.0
- cri-dockerd - no known supported version to date.

If you would like to use the feature and are switching from an incompatible container
runtime version to a compatible one, make sure to:
1. stop the kubelet
2. remove the directory at `<kubelet-directory>/image_manager` (e.g. `/var/lib/kubelet/image_manager`)

After that, follow the [same steps](enableensuresecretpulledimagesfirsttime) as if you were enabling
the feature for the first time.

### Creating a Secret with a Docker config

You need to know the username, registry password and client email address for authenticating
Expand Down