<p>How to you setup a <strong>private</strong> secure docker-registry.</p>

<p>I have installed via <a href="https://github.com/helm/charts/tree/master/stable/docker-registry" rel="nofollow noreferrer">helm</a></p>

<p>Now how can I make it secure(TLS certs), so I can push and pull to the registry from docker and from kubernetes deployment?</p>

<p>I can see that there is a Helm configuration:</p>

<pre><code>tlsSecretName   Name of secret for TLS certs
</code></pre>

<p><strong><em>Update - current status</em></strong>:
I was able to get <a href="https://github.com/jetstack/cert-manager" rel="nofollow noreferrer">cert-manager</a> working and install with TLS:</p>

<pre><code>helm install stable/docker-registry --set tlsSecretName=example-com-tls
</code></pre>

<p><em>I am not strong in certificates - but I am unclear about the following</em>:<br>
<strong>1.</strong> <br>
Can I now create an Ingress(with a secret to cert) that will only accept incomming request with that certificate? I will look at the suggested link from @xzesstence tomorrow<br>
<strong>2.</strong> <br>
I guess I need to tell <code>docker push</code> where to find the certificate?
Maybe this(<strong>I will try this tomorrow</strong>): <a href="https://docs.docker.com/engine/security/certificates/" rel="nofollow noreferrer">https://docs.docker.com/engine/security/certificates/</a></p>

Chris G.
<p>Check out the official Docker Tutorials
<a href="https://docs.docker.com/registry/deploying/" rel="nofollow noreferrer">https://docs.docker.com/registry/deploying/</a></p>

<p>and especially the point
<strong>Get a certificate</strong></p>

<p>So overall in short, you need to get a certificate and place it in /certs (or change the folder mount of the following docker run command -v /cert).
Also check the certificate name, either rename to domain.crt or change the filename in the docker run command</p>

<p>then run</p>

<p><div class="snippet" data-lang="js" data-hide="false" data-console="true" data-babel="false">
<div class="snippet-code">
<pre class="snippet-code-html lang-html prettyprint-override"><code>docker run -d \
  --restart=always \
  --name registry \
  -v "$(pwd)"/certs:/certs \
  -e REGISTRY_HTTP_ADDR=0.0.0.0:443 \
  -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/domain.crt \
  -e REGISTRY_HTTP_TLS_KEY=/certs/domain.key \
  -p 443:443 \
  registry:2</code></pre>
</div>
</div>
</p>

<p>If you don't have a certificate, you can use letsencrypt
<a href="https://letsencrypt.org/" rel="nofollow noreferrer">https://letsencrypt.org/</a></p>

<p>Maybe you want to checkout this startscript with letsencrypt certs. (untested from my side)
The advantage of this is, that you have the letsencrypt service integrated which can renew the license automatically
<a href="https://gist.github.com/PieterScheffers/63e4c2fd5553af8a35101b5e868a811e" rel="nofollow noreferrer">https://gist.github.com/PieterScheffers/63e4c2fd5553af8a35101b5e868a811e</a></p>

<p>Edit:
Since you are using Docker on a Kubernetes Cluster checkout this great tutorial
<a href="https://medium.com/@jmarhee/in-cluster-docker-registry-with-tls-on-kubernetes-758eecfe8254" rel="nofollow noreferrer">https://medium.com/@jmarhee/in-cluster-docker-registry-with-tls-on-kubernetes-758eecfe8254</a></p>
