Helm Chart wont pull private image

JupyterHub Zero to JupyterHub on Kubernetes
1

Hi.

I’m getting a problem with my Jupyterhub deployment on k8s. The helm chart fails to launch when supplied with a private repository. So when I run:

helm upgrade --cleanup-on-fail \
--install jhub jupyterhub/jupyterhub   \
--namespace=jhub  \
--version=0.11.1  \
--values config.yaml

I get the error: ‘Error: UPGRADE FAILED: pre-upgrade hooks failed: timed out waiting for the condition’

Inspecting the pods in the namespace reveals that the hook-image-puller pods all show ‘Init:ImagePullBackOff’

Inspecting the pod reveals that it has the event:

Failed to pull image "<my_repo>/<my_image>:latest": rpc error: code = Unknown desc = Error response from daemon: pull access denied for <my_repo>/<my_image>, repository does not exist or may require 'docker login': denied: requested access to the resource is denied

Here is my config.yaml file:

proxy:
  secretToken: <some_token>
singleuser:
  defaultUrl: "/lab"
  image:
    name:<my_repo>/<my_image>
    tag: latest
    pullSecrets:
    - "regcred"
hub:
  config:
    Authenticator:
      admin_users:
        - <some_users>
      allowed_users:
        - <some_users>
    GitHubOAuthenticator:
      client_id: "<some_id>"
      client_secret: "<some_secret>"
      oauth_callback_url: "<my_url>/hub/oauth_callback"
    JupyterHub:
      authenticator_class: github

My dockerfile is literally just:

FROM jupyterhub/singleuser:latest

And should just act the same as if I had supplied it directly to the config file.

However, Kubernetes is able to use the ‘regcred’ secret to pull the image when NOT using the helm chart. I’ve build this little pod which kubernetes pulls and launches just fine:

apiVersion: v1
kind: Pod
metadata:
  name: tmp-pod
spec:
  containers:
  - name: tmp-pod-container
    image: <my_repo>/<my_image>:latest
  imagePullSecrets:
  - name: regcred

I’m trying to figure out why the helm chart wont pull the image, any help is appreciated. Thanks.

2

The k8s pod needs permission to pull the image, and you need to pass it to the Helm chart.

The option imagePullSecret or imagePullSecrets.

If you have not created a k8s Secret with credentials already, I suggest using imagePullSecret to both create one such k8s Secret for your and make all the Helm chart’s pod reference it.