Overcoming Docker Hub Pull Limits by Authenticating

CloudCasa agent images will by default be pulled from Catalogic Software’s repo on Docker Hub. Currently (as of September 2023) Docker Hub enforces download rate limiting for anonymous users to 100 pulls per 6 hours per IP address. For some customers, this limit may cause issues when installing or updating CloudCasa agents on a large number of clusters.

There are two ways to get around this limit. The first is to simply authenticate to Docker Hub. For authenticated free Docker Hub users, the pull limit is doubled to 200 per 6 hours per IP address, and for authenticated users with a paid subscription it is increased further to 5000 per day or more.

The second way is to copy the CloudCasa agent images to your own repository (ECR, ACR, GCR, etc.) and access them there. This method is outside the scope of this KB article.

To configure CloudCasa to authenticate to Docker Hub when pulling agent images, you will need to do the following:

For a new cluster

Create the cloudcasa-io namespace on the client cluster using the command kubectl create namespace cloudcasa-io.

Create a secret resource containing your authentication info in the cloudcasa-io namespace. For example:

kubectl create secret docker-registry my-docker-secret \
  --docker-server=https://index.docker.io/v1/ \
  --docker-username=<docker username> \
  --docker-password=<docker password> \
  --docker-email=<email registered with docker> \
  --namespace=cloudcasa-io

Add the cluster to CloudCasa by going to the Clusters/Overview page and selecting Add Cluster. Enter the name of the secret you created (e.g. my-docker-secret) in the Image Pull Secret field under Advanced options.
Install the agent using any supported installation method.

For an existing cluster

For clusters that are already configured in CloudCasa and have the agent installed, you will need to update the configuration and re-install the agent. Use the following procedure:

Remove the CloudCasa agent by deleting the cloudcasa-io namespace with kubectl delete namespace cloudcasa-io.
Re-create the cloudcasa-io namespace on the client cluster and create a secret by following steps 1 and 2 in the section above.
Edit the cluster configuration by selecting Edit under Clusters/Overview and enter the name of the secret you created in the Image Pull Secret field under Advanced options.
Click the Install button at the top of the Edit Cluster pane, and re-install the agent using any supported installation method. The kubectl method can be used by running the command displayed in the Manual (kubectl) tab.