A Helm chart for creating multiple Docker registry secrets with dockerconfigjson format in Kubernetes.
This chart allows you to create multiple Docker registry authentication secrets from a single configuration. It's useful for managing access to various container registries like:
- Docker Hub
- Azure Container Registry (ACR) - Specialized support for multiple ACR instances
- AWS Elastic Container Registry (ECR)
- Google Container Registry (GCR)
- Custom private registries
For Azure Container Registry users: See AZURE-ACR-GUIDE.md for specialized documentation and examples for working with multiple ACR instances, including Azure Workload Identity support.
- Create multiple registry secrets from a single chart
- Support for different registry types
- Configurable namespaces per secret
- Custom labels and annotations
- Optional RBAC support
- Helm templating for dynamic configuration
# Install with default values
helm install registry-secrets ./registryconfigjson
# Install in a specific namespace
helm install registry-secrets ./registryconfigjson --namespace my-namespaceCreate a custom values file (my-values.yaml):
registries:
docker-hub:
enabled: true
namespace: default
secretName: docker-hub-secret
username: "my-dockerhub-username"
password: "my-dockerhub-password"
email: "[email protected]"
registry: "https://index.docker.io/v1/"
azure-acr:
enabled: true
namespace: production
secretName: azure-acr-secret
username: "my-acr-username"
password: "my-acr-password"
email: "[email protected]"
registry: "myregistry.azurecr.io"Install with custom values:
helm install registry-secrets ./registryconfigjson -f my-values.yaml| Parameter | Description | Default |
|---|---|---|
global.namespace |
Default namespace for secrets | default |
global.secretType |
Kubernetes secret type | kubernetes.io/dockerconfigjson |
Each registry entry supports the following parameters:
| Parameter | Description | Required |
|---|---|---|
enabled |
Whether to create this secret | true |
namespace |
Kubernetes namespace for the secret | default |
secretName |
Name of the Kubernetes secret | Auto-generated |
username |
Registry username | Yes |
password |
Registry password/token | Yes |
email |
Registry email | Yes |
registry |
Registry URL | Yes |
labels:
app: registry-config-secrets
environment: production
annotations:
description: "Docker registry authentication secret"
managed-by: helmrbac:
enabled: true
serviceAccount:
create: true
name: "registry-config-secrets"
annotations:
eks.amazonaws.com/role-arn: "arn:aws:iam::123456789012:role/my-role"registries:
docker-hub:
enabled: true
namespace: default
secretName: docker-hub-secret
username: "your-dockerhub-username"
password: "your-dockerhub-password"
email: "[email protected]"
registry: "https://index.docker.io/v1/"registries:
azure-acr:
enabled: true
namespace: production
secretName: azure-acr-secret
username: "your-acr-username"
password: "your-acr-password"
email: "[email protected]"
registry: "your-registry.azurecr.io"For multiple ACR instances and Azure Workload Identity support, see AZURE-ACR-GUIDE.md
registries:
aws-ecr:
enabled: true
namespace: default
secretName: aws-ecr-secret
username: "AWS"
password: "your-ecr-token"
email: "[email protected]"
registry: "your-account.dkr.ecr.region.amazonaws.com"registries:
gcr:
enabled: true
namespace: default
secretName: gcr-secret
username: "_json_key"
password: "your-gcr-json-key"
email: "[email protected]"
registry: "gcr.io"Once the secrets are created, you can reference them in your deployments:
apiVersion: apps/v1
kind: Deployment
metadata:
name: my-app
spec:
template:
spec:
imagePullSecrets:
- name: docker-hub-secret
- name: azure-acr-secret
containers:
- name: my-app
image: myregistry.azurecr.io/my-app:latest- Never commit sensitive credentials to version control
- Use Kubernetes secrets or external secret management tools
- Consider using service accounts with IAM roles (AWS ECR)
- Rotate credentials regularly
- Use least privilege principle for registry access
# List all secrets created by the chart
kubectl get secrets -l app=registry-config-secrets
# Check a specific secret
kubectl describe secret docker-hub-secret# Decode and validate the dockerconfigjson
kubectl get secret docker-hub-secret -o jsonpath='{.data.\.dockerconfigjson}' | base64 -d | jq .- Invalid registry URL: Ensure the registry URL is correct and accessible
- Authentication failed: Verify username/password credentials
- Namespace issues: Ensure the target namespace exists
- Secret name conflicts: Use unique secret names across namespaces
- Fork the repository
- Create a feature branch
- Make your changes
- Add tests if applicable
- Submit a pull request
This project is licensed under the MIT License - see the LICENSE file for details.