<p>I am using <a href="https://cloud.ibm.com/docs/terraform?topic=terraform-manage_resources" rel="nofollow noreferrer">IBM Cloud and its Terraform provider</a>. Now, I would like to deploy a container image off the <a href="https://cloud.ibm.com/docs/containers?topic=containers-registry#planning_images" rel="nofollow noreferrer">IBM Cloud Container Registry and need to provide pull secrets</a>. How can I do that using Terraform?</p>

data_henrik
<p>Creating pull secrets via Terraform and then using them to pull a container image off the IBM Cloud Container Registry is possible with some configuration.</p>
<p>First, I have a template file for the Docker configuration named <strong>docker_config.json</strong>:</p>
<pre><code>{&quot;auths&quot;:{&quot;${docker-server}&quot;:{&quot;username&quot;:&quot;${docker-username}&quot;,&quot;password&quot;:&quot;${docker-password}&quot;,&quot;email&quot;:&quot;${docker-email}&quot;,&quot;auth&quot;:&quot;${auth}&quot;}}}
</code></pre>
<p>That file is referenced from the Terraform code:</p>
<pre><code># template for container registry secrets
data &quot;template_file&quot; &quot;docker_config_script&quot; {
  template = file(&quot;${path.module}/docker_config.json&quot;)
  vars = {
    docker-username = &quot;iamapikey&quot;
    docker-password = var.ibmcloud_api_key
    docker-server   = var.docker-server
    docker-email    = var.docker-email
    auth            = base64encode(&quot;iamapikey:${var.ibmcloud_api_key}&quot;)
  }
}

# Create secrets to access IBM Container Registry to pull container image
resource &quot;kubernetes_secret&quot; &quot;registry_secrets&quot; {
  metadata {
    name      = &quot;my-docker-registry&quot;
    namespace = var.iks_namespace
  }

  data = {
    &quot;.dockerconfigjson&quot; = data.template_file.docker_config_script.rendered
  }

  type = &quot;kubernetes.io/dockerconfigjson&quot;
}
</code></pre>
<p>The above code first reads the template and fills it with values from environment variables or current state. Thereafter, it creates a Kubernetes secret <strong>my-docker-registry</strong> of type Docker configuration. Later on, that secret can be referenced as <strong>image_pull_secret</strong> in the deployment configuration.</p>
<p>The above is a generic approach. Depending on your account setup, individual user and service ID privileges in that account and how the Kubernetes cluster was created, you may be able to use a pre-created pull secret. <a href="https://cloud.ibm.com/docs/containers?topic=containers-registry#cluster_registry_auth" rel="nofollow noreferrer">See this part in the IBM Cloud Kubernetes Service docs on how to authorize pulling images from private registries</a>.</p>
