|
| 1 | +--- |
| 2 | +title: Pulling the Ingress Controller Image |
| 3 | +description: |
| 4 | +weight: 1600 |
| 5 | +doctypes: [""] |
| 6 | +toc: true |
| 7 | +--- |
| 8 | + |
| 9 | +This document explains how to pull an NGINX Plus Ingress Controller image from the F5 Docker registry. Please see [here](/nginx-ingress-controller/installation/building-ingress-controller-image) for information on how to build an Ingress Controller image using the source code and your NGINX Plus license certificate and key. Note that for NGINX Ingress Controller based on NGINX OSS, we provide the image through [DockerHub](https://hub.docker.com/r/nginx/nginx-ingress/). |
| 10 | + |
| 11 | +## Prerequisites |
| 12 | + |
| 13 | +Before you can pull the image, make sure that the following software is installed on your machine: |
| 14 | +* [Docker](https://www.docker.com/products/docker) v18.09+ |
| 15 | +* For NGINX Plus, you must hav
9E12
e the NGINX Plus Ingress Controller license -- the certificate (`nginx-repo.crt`) and the key (`nginx-repo.key`). |
| 16 | + |
| 17 | +## Pulling the Image using Docker and Pushing It to the Private Registry |
| 18 | + |
| 19 | +1. First, configure the Docker environment to use certificate-based client-server authentication with the F5 Container registry - `docker-registry.nginx.com`. |
| 20 | + To do so in a Linux based environment, create a `docker-registry.nginx.com` directory under `/etc/docker/certs.d` and create a certificate `client.cert` (using `nginx-repo.crt` - please note that the certificate MUST have the `.cert` suffix, not `.crt`) and a key `client.key` (using `nginx-repo.key`). See [this document](https://docs.docker.com/engine/security/certificates/) for more details. |
| 21 | + |
| 22 | + ``` |
| 23 | + # mkdir /etc/docker/certs.d/docker-registry.nginx.com |
| 24 | + # cp nginx-repo.crt /etc/docker/certs.d/docker-registry.nginx.com/client.cert |
| 25 | + # cp nginx-repo.key /etc/docker/certs.d/docker-registry.nginx.com/client.key |
| 26 | + ``` |
| 27 | + |
| 28 | + > **Note**: The preceding example is operating-system specific and is for illustrative purposes only. You should consult your operating system documentation for creating an os-provided bundled certificate chain. For example, to configure this for Docker Desktop for Mac or Docker Desktop for Windows, see [this document](https://docs.docker.com/docker-for-mac/#add-client-certificates) or [this document](https://docs.docker.com/docker-for-windows/#how-do-i-add-client-certificates) for more details. |
| 29 | +
|
| 30 | +2. Use docker to pull the required image from `docker-registry.nginx.com`. |
| 31 | + For NGINX Plus Ingress Controller, pull from `docker-registry.nginx.com/nginx-ic/nginx-plus-ingress`: |
| 32 | + ``` |
| 33 | + $ docker pull docker-registry.nginx.com/nginx-ic/nginx-plus-ingress:1.12.0 |
| 34 | + ``` |
| 35 | + |
| 36 | + `1.12.0` will pull down the Debian based image. Other available image tags are `1.12.0-alpine` for the Alpine based image, `1.12.0-ot` for the Debian based image with OpenTracing, and `1.12.0-ubi` for the UBI based image. |
| 37 | + |
| 38 | + For NGINX Plus Ingress Controller with App Protect, pull from `docker-registry.nginx.com/nginx-ic-nap/nginx-plus-ingress`: |
| 39 | + ``` |
| 40 | + $ docker pull docker-registry.nginx.com/nginx-ic-nap/nginx-plus-ingress:1.12.0 |
| 41 | + ``` |
| 42 | + |
| 43 | + `1.12.0` will pull down the Debian based image. The other available image tag is `1.12.0-ubi` for the UBI based image. |
| 44 | + |
| 45 | + To list the available image tags for the repositories, you can use the Docker registry API, e.g.: |
| 46 | + ``` |
| 47 | + $ curl https://docker-registry.nginx.com/v2/nginx-ic/nginx-plus-ingress/tags/list --key <path-to-client.key> --cert <path-to-client.cert> | jq |
| 48 | + { |
| 49 | + "name": "nginx-ic/nginx-plus-ingress", |
| 50 | + "tags": [ |
| 51 | + "1.12.0-alpine", |
| 52 | + "1.12.0-ot", |
| 53 | + "1.12.0-ubi", |
| 54 | + "1.12.0" |
| 55 | + ] |
| 56 | + } |
| 57 | +
|
| 58 | + $ curl https://docker-registry.nginx.com/v2/nginx-ic-nap/nginx-plus-ingress/tags/list --key <path-to-client.key> --cert <path-to-client.cert> | jq |
| 59 | + { |
| 60 | + "name": "nginx-ic-nap/nginx-plus-ingress", |
| 61 | + "tags": [ |
| 62 | + "1.12.0-ubi", |
| 63 | + "1.12.0" |
| 64 | + ] |
| 65 | + } |
| 66 | + ``` |
| 67 | + |
| 68 | +3. Tag and push the image to your private registry. |
| 69 | + Make sure to run the `docker login` command first to log in to the registry. |
| 70 | + ``` |
| 71 | + $ docker tag docker-registry.nginx.com/nginx-ic/nginx-plus-ingress:1.12.0 <my-docker-registry>/nginx-ic/nginx-plus-ingress:1.12.0 |
| 72 | + $ docker push <my-docker-registry>/nginx-ic/nginx-plus-ingress:1.12.0 |
| 73 | + ``` |
| 74 | + |
| 75 | + or for NGINX App Protect enabled image |
| 76 | + ``` |
| 77 | + $ docker tag docker-registry.nginx.com/nginx-ic-nap/nginx-plus-ingress:1.12.0 <my-docker-registry>/nginx-ic-nap/nginx-plus-ingress:1.12.0 |
| 78 | + $ docker push <my-docker-registry>/nginx-ic-nap/nginx-plus-ingress:1.12.0 |
| 79 | + ``` |
0 commit comments