Images and pull secrets

Public images

Nothing to configure. Name the image and the tag:

image: nginx:1.29

Pin a real version rather than latest. With latest you cannot tell which build is running, and a restarted pod can quietly come back on a different one.

The ITSH registry

registry.itsh.dev is available as part of your account. You create repositories and access tokens in the Registry section of the portal, which also shows you the docker login line to use.

The path is your account slug, not your namespace

Image paths are registry.itsh.dev/<your-slug>/<image>:<tag>. The portal shows this value in the Registry section, labelled Registry Namespace, and despite that label it is not your Kubernetes namespace. Substituting the Kubernetes namespace gives you an ImagePullBackOff.

Your namespace usually already has a pull secret for it, named itsh-registry:

kubectl get secret itsh-registry

It is not attached to the default service account, so having it is not enough. Reference it in the pod template:

spec:
  imagePullSecrets:
    - name: itsh-registry
  containers:
    - name: myapp
      image: registry.itsh.dev/<your-slug>/myapp:1.0.0

If the secret is not there

It is created for you, but creation is best-effort and is not retried, so a namespace can end up without one. Nothing repairs it later. Create it yourself with a registry token from the portal:

kubectl create secret docker-registry itsh-registry \
  --docker-server=registry.itsh.dev \
  --docker-username='<token-name>' \
  --docker-password='<token>'

The name does not matter as long as your pod template and the secret agree.

Another private registry

Exactly the same shape, pointed somewhere else:

kubectl create secret docker-registry my-registry \
  --docker-server=registry.example.com \
  --docker-username='<user>' \
  --docker-password='<password-or-token>'

Then reference my-registry under imagePullSecrets.

Use a token or deploy key scoped to reading that one repository, never a password with broader access. The secret sits in your namespace and anyone with your kubeconfig can read it.

On the free tier, registries must speak HTTPS

Outbound traffic is limited to HTTP and HTTPS, so a registry on a non-standard port cannot be reached. See Free tier.

When a pull fails

ImagePullBackOff is covered under A pod will not start. The short version: kubectl describe pod <name> names the registry and the reason, and for a private registry it is nearly always a missing or unreferenced pull secret.

What's next

• Your first deployment for the full manifest
• Deploying from Git to build and ship automatically