<p>Is it possible, to pull private images from Docker Hub to a Google Cloud Kubernetes cluster?
Is this recommended, or do I need to push my private images also to Google Cloud?</p>

<p>I read the documentation, but I found nothing that could explain me this clearly. It seems that it is possible, but I don´t know if it's recommended.</p>

John John Pichler
<p>There is no restriction to use any registry you want. If you just use the image name, (e.g., image: nginx) in pod specification, the image will be pulled from public docker hub registry with tag assumed as :latest</p>

<p>As mentioned in the Kubernetes <a href="https://kubernetes.io/docs/concepts/containers/images/" rel="nofollow noreferrer">documentation</a>:</p>

<blockquote>
  <p>The image property of a container supports the same syntax as the
  docker command does, including private registries and tags. Private
  registries may require keys to read images from them.</p>
  
  <h2>Using Google Container Registry</h2>
  
  <p>Kubernetes has native support for the <a href="https://cloud.google.com/tools/container-registry/" rel="nofollow noreferrer">Google Container Registry (GCR)</a>, when running on Google
  Compute Engine (GCE). If you are running your cluster on GCE or Google
  Kubernetes Engine, simply use the full image name (e.g.
  gcr.io/my_project/image:tag). All pods in a cluster will have read
  access to images in this registry.</p>
  
  <h2>Using AWS EC2 Container Registry</h2>
  
  <p>Kubernetes has native support for the <a href="https://aws.amazon.com/ecr/" rel="nofollow noreferrer">AWS EC2 Container Registry</a>, when nodes are AWS EC2 instances.
  Simply use the full image name (e.g.
  ACCOUNT.dkr.ecr.REGION.amazonaws.com/imagename:tag) in the Pod
  definition. All users of the cluster who can create pods will be able
  to run pods that use any of the images in the ECR registry.</p>
  
  <h2>Using Azure Container Registry (ACR)</h2>
  
  <p>When using <a href="https://azure.microsoft.com/en-us/services/container-registry/" rel="nofollow noreferrer">Azure Container Registry</a> you can authenticate using either an admin user or a
  service principal. In either case, authentication is done via standard
  Docker authentication. These instructions assume the azure-cli command
  line tool.</p>
  
  <p>You first need to create a registry and generate credentials, complete
  documentation for this can be found in the <a href="https://learn.microsoft.com/en-us/azure/container-registry/container-registry-get-started-azure-cli" rel="nofollow noreferrer">Azure container registry
  documentation</a>.</p>
  
  <h2>Configuring Nodes to Authenticate to a Private Repository</h2>
  
  <p>Here are the recommended steps to configuring your nodes to use a private
  registry. In this example, run these on your desktop/laptop:</p>
  
  <ol>
  <li>Run docker login [server] for each set of credentials you want to use. This updates <code>$HOME/.docker/config.json</code>.</li>
  <li>View <code>$HOME/.docker/config.json</code> in an editor to ensure it contains just the credentials you want to use.</li>
  <li>Get a list of your nodes, for example:
  
  <ul>
  <li>if you want the names: <code>nodes=$(kubectl get nodes -o jsonpath='{range.items[*].metadata}{.name} {end}')</code></li>
  <li>if you want to get the IPs: <code>nodes=$(kubectl get nodes -o jsonpath='{range
  .items[*].status.addresses[?(@.type=="ExternalIP")]}{.address}
  {end}')</code></li>
  </ul></li>
  <li>Copy your local .docker/config.json to the home directory of root on each node.
  
  <ul>
  <li>for example: <code>for n in $nodes; do scp ~/.docker/config.json root@$n:/root/.docker/config.json; done</code></li>
  </ul></li>
  </ol>
</blockquote>

<h2>Use cases:</h2>

<blockquote>
  <p>There are a number of solutions for configuring private registries.
  Here are some common use cases and suggested solutions.</p>
  
  <ol>
  <li>Cluster running only non-proprietary (e.g. open-source) images. No need to hide images.
  
  <ul>
  <li>Use public images on the Docker hub.
  
  <ul>
  <li>No configuration required.</li>
  <li>On GCE/Google Kubernetes Engine, a local mirror is automatically used for improved speed and availability.</li>
  </ul></li>
  </ul></li>
  <li>Cluster running some proprietary images which should be hidden to those outside the company, but visible to all cluster users.
  
  <ul>
  <li>Use a hosted private Docker registry.
  
  <ul>
  <li>It may be hosted on the Docker Hub, or elsewhere.</li>
  <li>Manually configure <code>.docker/config.json</code> on each node as described above.</li>
  </ul></li>
  <li>Or, run an internal private registry behind your firewall with open read access.
  
  <ul>
  <li>No Kubernetes configuration is required.</li>
  </ul></li>
  <li>Or, when on GCE/Google Kubernetes Engine, use the project’s Google Container Registry.
  
  <ul>
  <li>It will work better with cluster autoscaling than manual node configuration.</li>
  </ul></li>
  <li>Or, on a cluster where changing the node configuration is inconvenient, use <strong>imagePullSecrets</strong>.</li>
  </ul></li>
  <li>Cluster with a proprietary images, a few of which require stricter access control.
  
  <ul>
  <li>Ensure AlwaysPullImages admission controller is active. Otherwise, all Pods potentially have access to all images.</li>
  <li>Move sensitive data into a “Secret” resource, instead of packaging it in an image.</li>
  </ul></li>
  <li>A multi-tenant cluster where each tenant needs own private registry.
  
  <ul>
  <li>Ensure <code>AlwaysPullImages</code> admission controller is active. Otherwise, all Pods of all tenants potentially have access to all
  images.</li>
  <li>Run a private registry with authorization required.</li>
  <li>Generate registry credential for each tenant, put into secret, and populate secret to each tenant namespace.</li>
  <li>The tenant adds that secret to <code>imagePullSecrets</code> of each namespace.</li>
  </ul></li>
  </ol>
</blockquote>

<p>Consider reading the <a href="https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/" rel="nofollow noreferrer">Pull an Image from a Private Registry</a> document if you decide to use a private registry.  </p>
