Container Registry Config Generator

An imagePullSecret is a Kubernetes Secret that holds container registry credentials. When specified in a Pod spec, Kubernetes uses it to authenticate with a private registry before pulling images. Without it, pulling from private registries returns 401 Unauthorized (ImagePullBackOff). Create it with: kubectl create secret docker-registry.

ECR (Elastic Container Registry) is AWS's managed registry, integrated with IAM. GCR (Google Container Registry) / Artifact Registry is GCP's registry. ACR (Azure Container Registry) is Azure's registry. GHCR (GitHub Container Registry) is GitHub's free registry for public/private images. Each has different auth methods: ECR uses AWS tokens (short-lived), others typically use static credentials or service accounts.

AWS ECR tokens expire after 12 hours, which breaks static imagePullSecrets. Solutions: (1) Use ECR credential helper (aws-ecr-credential-provider as a node plugin), (2) Use a CronJob to refresh the secret every 6 hours, or (3) Use IAM roles for service accounts (IRSA) with kube2iam/KIAM on EKS. Option 3 is the production-grade approach.

GHCR integrates natively with GitHub Actions via GITHUB_TOKEN (no PAT needed for same-repo images). Use: echo ${{ secrets.GITHUB_TOKEN }} | docker login ghcr.io -u ${{ github.actor }} --password-stdin. Then push to ghcr.io/<org>/<image>:<tag>. For pulling from other repos, create a PAT with read:packages scope.

For production, always use service accounts / machine credentials, never personal tokens. PATs are tied to individual users — if that person leaves, access breaks. Use: Docker Hub organization access tokens, AWS IAM roles, GCP Service Accounts with Workload Identity, or ACR service principals. Store credentials in Kubernetes Secrets, never in Dockerfiles or source code.

Attach the imagePullSecret to the default ServiceAccount in the namespace: kubectl patch serviceaccount default -p '{"imagePullSecrets": [{"name": "regcred"}]}' -n <namespace>. All pods that don't specify a serviceAccountName will inherit it. This avoids adding imagePullSecrets to every Deployment manually.