Here’s how to integrate Esadax’s Private Container Registry with Kubernetes using imagePullSecrets — plus optional guidance on mirroring to GitHub Container Registry (GHCR).

---

🐳 Kubernetes: Pulling from Esadax’s Registry

To pull private container images hosted at esadax-registry.esadax.sh, you'll need to create a Kubernetes secret and reference it in your deployment or pod spec.

---

🔐 Step 1: Create a Docker Registry Secret

kubectl create secret docker-registry esadax-registry-creds \
  --docker-server=esadax-registry.esadax.sh \
  --docker-username=your_username \
  --docker-password=your_token \
  --docker-email=your@email.com

💡 Replace your_token with a personal access token or CI token from Esadax. You can rename esadax-registry-creds as needed for your environment.

---

📦 Step 2: Reference the Secret in a Deployment

apiVersion: apps/v1
kind: Deployment
metadata:
  name: private-app
spec:
  replicas: 1
  selector:
    matchLabels:
      app: private-app
  template:
    metadata:
      labels:
        app: private-app
    spec:
      containers:
        - name: app
          image: esadax-registry.esadax.sh/my-project/my-app:latest
          ports:
            - containerPort: 80
      imagePullSecrets:
        - name: esadax-registry-creds

✅ Once deployed, Kubernetes will use the referenced secret to authenticate with Esadax’s registry and pull your image.

---

🔁 Optional: Mirror to GitHub Container Registry (GHCR)

If you want to mirror your images to GHCR (e.g., for redundancy or public sharing), follow these steps.

Step 1: Authenticate and Push

# Authenticate to GHCR
echo $GHCR_TOKEN | docker login ghcr.io -u YOUR_GITHUB_USERNAME --password-stdin

# Tag the existing image
docker tag esadax-registry.esadax.sh/my-project/my-app:latest ghcr.io/YOUR_GITHUB_USERNAME/my-app:latest

# Push to GitHub
docker push ghcr.io/YOUR_GITHUB_USERNAME/my-app:latest

🔐 Make sure the GitHub repository is public or configured correctly for private access with fine-grained personal access tokens.

---

📌 Best Practices

• Use namespace-level secrets to share credentials across multiple deployments.
• Generate separate tokens for CI/CD pipelines and human access.
• Periodically rotate tokens and audit access for security compliance.
• Add imagePullSecrets globally using a ServiceAccount, if your environment supports it.