Image registry

We provide a Google Cloud service-account JSON key. The Helm chart turns it into a Kubernetes image-pull secret named after the release, with a -docker suffix. You do not need to run docker login on the cluster nodes. A laptop login is optional and is only useful to confirm that the key can pull an image.

Registries covered by the key

europe-west6-docker.pkg.dev hosts the Phonemos application images (global.phonemosImageBase). eu.gcr.io/linkyard-191615/linkyard-cloud hosts shared images such as postgres-wait.

Add the key to your values

Start from the defaults in the chart values.yaml and set:

global:
  docker:
    gcr:
      username: _json_key
      email: ops@example.com
      password: |
        {
          "type": "service_account",
          "project_id": "...",
          ...
        }
    linkyard:
      username: unused
      email: unused@example.com
      password: unused

The chart template also writes an entry for docker.linkyard.ch. Phonemos images for this installation do not come from that registry. Leave placeholder values so Helm can render the secret. Do not use docker.linkyard.ch for production pulls.

Optional check from a laptop

cat key.json | docker login -u _json_key --password-stdin europe-west6-docker.pkg.dev
docker pull europe-west6-docker.pkg.dev/linkyard-191615/phonemos-docker/phonemos/frontend:<tag-from-values>

Existing secrets

If you create the pull secret yourself, set global.useExistingSecrets to true and also create every other secret the chart would have created (Hasura, Redis, S3, Keycloak, and backend keys). Unless you already have a secret-management workflow, it is simpler to let the chart create the secrets from values.

Public images

Redis, BusyBox, and Envoy are pulled from public registries. They are not covered by the GCR key. Allow those pulls, or mirror the tags into a registry the cluster can reach.

Phonemos User Guide

Image registry