Container Registry

Use Jitera ACR as the image source for all container images, eliminating the need for Docker Hub access

By default, several in-cluster services pull container images from Docker Hub:

Service	Default Registry	Image
Kong	Docker Hub	kong:3.7
Kong Ingress Controller	Docker Hub	kubernetes-ingress-controller:3.3
PostgreSQL	Docker Hub	pgvector:pg14
PGVector	Docker Hub	pgvector:pg16
Redis	Docker Hub	bitnami/redis:6.2.16-debian-12-r3
MongoDB	Docker Hub	bitnami/mongodb:5.0.24-debian-11-r20
RabbitMQ	Docker Hub	bitnami/rabbitmq:3.8.35-debian-11-r5

If your environment restricts Docker Hub access — for example, due to firewall rules or air-gapped network policies — you can redirect all image pulls to the Jitera ACR registry instead.

---

Configuration

Add the following overrides to your Helm values file:

kong:
  image:
    repository: jiteradockerimage.azurecr.io/jiteradockerimage/kong
    tag: "3.7"
    pullSecrets:
      - jitera-regcred
  ingressController:
    image:
      repository: jiteradockerimage.azurecr.io/jiteradockerimage/kubernetes-ingress-controller
      tag: "3.3"

postgresql:
  image:
    repository: jiteradockerimage.azurecr.io/jiteradockerimage/pgvector
    tag: pg14
    pullSecrets:
      - jitera-regcred

pgvector:
  image:
    repository: jiteradockerimage.azurecr.io/jiteradockerimage/pgvector
    tag: pg16
    pullSecrets:
      - jitera-regcred

redis:
  image:
    registry: jiteradockerimage.azurecr.io
    repository: jiteradockerimage/redis
    tag: 6.2.16-debian-12-r3
    pullSecrets:
      - jitera-regcred

mongodb:
  image:
    registry: jiteradockerimage.azurecr.io
    repository: jiteradockerimage/mongodb
    tag: 5.0.24-debian-11-r20
    pullSecrets:
      - jitera-regcred

rabbitmq:
  image:
    registry: jiteradockerimage.azurecr.io
    repository: jiteradockerimage/rabbitmq
    tag: 3.8.35-debian-11-r5
    pullSecrets:
      - jitera-regcred

Some Bitnami-based charts (redis, mongodb, rabbitmq) use separate registry and repository fields, while others (kong, postgresql, pgvector) use a single repository field that includes the full registry path.

---

Firewall Impact

With this configuration, the Docker Hub endpoints listed in the firewall requirements are no longer required:

• docker.io
• registry-1.docker.io
• auth.docker.io
• production.cloudflare.docker.com

The Jitera ACR endpoints (jiteradockerimage.azurecr.io, *.data.azurecr.io, *.blob.core.windows.net) are always required regardless of this setting.

---

Related Documentation

Network and Firewall

Inbound and outbound firewall rules for all required endpoints

Helm Values Reference

Complete list of image registry and tag overrides