Working with Thalassa Container Registry from Kubernetes

You’ve pushed an image to Thalassa Cloud Container Registry. Now you want your Kubernetes cluster to pull it. Good news: there’s nothing exotic about this. It’s the same imagePullSecrets flow you’d use with any private registry - Docker Hub, ECR, whatever you’ve worked with before.

This post walks you through it step by step, from credentials to a running pod. If you want the full reference, the Kubernetes guide has that covered. Think of this as the short version you can follow along with.

Before you start

Make sure you have these three things ready:

1. An image in the registry. If you haven’t pushed one yet, start with the Getting started guide. You’ll need a namespace, a docker login, and at least one tagged image.
2. A Kubernetes cluster. Yours on Thalassa Cloud, or any cluster that can reach the regional registry endpoint over the network.
3. Pull credentials; an access credential or service account that can pull images (containerRegistry:pull or containerRegistry scope, or IAM pull permission). The Access control docs explain how to set this up with least privilege.

Your image URL follows this pattern:

registry.nl-01.thalassa.cloud/acme-platform/my-app:v1.0.0

That’s {registry-host}/{namespace}/{repository}:{tag}.

Step by Step

Step 1: Create an imagePullSecret

Kubernetes needs a secret to authenticate against the registry. Create one with the same credentials you’d use for docker login:

kubectl create secret docker-registry thalassa-registry \
  --docker-server=registry.nl-01.thalassa.cloud \
  --docker-username=<access-credential-key> \
  --docker-password=<access-credential-secret>

Step 2: Reference the image in a Deployment

Now wire up your Deployment. Point at the registry image and tell Kubernetes which secret to use:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-app
spec:
  replicas: 2
  selector:
    matchLabels:
      app: my-app
  template:
    metadata:
      labels:
        app: my-app
    spec:
      imagePullSecrets:
        - name: thalassa-registry
      containers:
        - name: my-app
          image: registry.nl-01.thalassa.cloud/acme-platform/my-app:v1.0.0
          ports:
            - containerPort: 8080

That imagePullSecrets line is the important bit. Without it - and without a default on the service account - Kubernetes has no way to log in. Your pod will sit in ImagePullBackOff until you fix it.

Step 3: Apply and verify

Apply the manifest and check that pods come up:

kubectl apply -f my-app-deployment.yaml
kubectl get pods
kubectl describe pod <pod-name>

If something goes wrong, these are the usual suspects:

kubectl describe pod is your friend here. The kubelet error message usually tells you whether it’s auth, a missing tag, or a network problem.

What comes next

• Getting started - create a namespace and push your first image
• CI/CD - build and push from pipelines without long-lived secrets in Git
• Service accounts - credentials for cluster automation and pull-only access
• Deploying applications - general Kubernetes deployment guidance on Thalassa Cloud

Running Kubernetes on Thalassa Cloud? Container Registry keeps your images in Europe, close to your clusters.