<p>I have a Job that runs migration for a Python service. Here is the job spec:</p>

<pre><code>apiVersion: batch/v1
kind: Job
metadata:
  name: migration
  annotations:
    buildId: "__buildId__"
    branchName: "__branchName__"
    commitId: "__commitId__"
spec:
  template:
    spec:
      containers:
      - name: service
        image: &lt;repo&gt;/service:__buildId__
        imagePullPolicy: Always
        imagePullSecrets:
        - name: acr-key
        command: ["/bin/sh","-c"]
        args: ["python manage.py migrate --noinput --database=default &amp;&amp; python manage.py migrate --noinput --database=data_001 &amp;&amp; python manage.py migrate --noinput --database=data_002"]
        envFrom:
        - configMapRef:
            name: configuration
        - secretRef:
            name: secrets
        resources:
          requests:
            memory: "200Mi"
            cpu: "250m"
          limits:
            memory: "4000Mi"
            cpu: "2000m"
      restartPolicy: Never
</code></pre>

<p>It doesn't look like there is an apiVersion that supports both, imagePullSecrets and kubernetes Job. Any ideas on how can I get this to work?</p>

<p>Here's my k8s configuration:</p>

<pre><code>Client Version: version.Info{Major:"1", Minor:"9", GitVersion:"v1.9.6", GitCommit:"9f8ebd171479bec0ada837d7ee641dec2f8c6dd1", GitTreeState:"clean", BuildDate:"2018-03-21T15:21:50Z", GoVersion:"go1.9.3", Compiler:"gc", Platform:"darwin/amd64"}
Server Version: version.Info{Major:"1", Minor:"9", GitVersion:"v1.9.6", GitCommit:"9f8ebd171479bec0ada837d7ee641dec2f8c6dd1", GitTreeState:"clean", BuildDate:"2018-03-21T15:13:31Z", GoVersion:"go1.9.3", Compiler:"gc", Platform:"linux/amd64"}
</code></pre>

<p><code>imagePullSecrets</code> should be outside of the <code>containers</code> scope. This works for me:</p>

<pre><code>apiVersion: batch/v1
kind: Job
metadata:
  name: migration
  annotations:
    buildId: "__buildId__"
    branchName: "__branchName__"
    commitId: "__commitId__"
spec:
  template:
    spec:
      imagePullSecrets:
      - name: acr-key
      containers:
      - name: service
        image: &lt;repo&gt;/service:__buildId__
        imagePullPolicy: Always
        command: ["/bin/sh","-c"]
        args: ["python manage.py migrate --noinput --database=default &amp;&amp; python manage.py migrate --noinput --database=data_001 &amp;&amp; python manage.py migrate --noinput --database=data_002"]
        envFrom:
        - configMapRef:
            name: configuration
        - secretRef:
            name: secrets
        resources:
          requests:
            memory: "200Mi"
            cpu: "250m"
          limits:
            memory: "4000Mi"
            cpu: "2000m"
      restartPolicy: Never
</code></pre>
