Registry
The default registry is Docker Hub, but you can change it using registry/server
.
A reference to a secret (in this case, DOCKER_REGISTRY_TOKEN
) will look up the secret
in the local environment:
registry:
server: registry.digitalocean.com
username:
- DOCKER_REGISTRY_TOKEN
password:
- DOCKER_REGISTRY_TOKEN
Using AWS ECR as the container registry
You will need to have the AWS CLI installed locally for this to work.
AWS ECR’s access token is only valid for 12 hours. In order to avoid having to manually regenerate the token every time, you can use ERB in the deploy.yml
file to shell out to the AWS CLI command and obtain the token:
registry:
server: <your aws account id>.dkr.ecr.<your aws region id>.amazonaws.com
username: AWS
password: <%= %x(aws ecr get-login-password) %>
Using GCP Artifact Registry as the container registry
To sign into Artifact Registry, you need to
create a service account
and set up roles and permissions.
Normally, assigning the roles/artifactregistry.writer
role should be sufficient.
Once the service account is ready, you need to generate and download a JSON key and base64 encode it:
base64 -i /path/to/key.json | tr -d "\\n"
You’ll then need to set the KAMAL_REGISTRY_PASSWORD
secret to that value.
Use the environment variable as the password along with _json_key_base64
as the username.
Here’s the final configuration:
registry:
server: <your registry region>-docker.pkg.dev
username: _json_key_base64
password:
- KAMAL_REGISTRY_PASSWORD
Validating the configuration
You can validate the configuration by running:
kamal registry login