<p>We are pulling images from a private ECR (AWS) running Kubernetes that ships with Docker for Mac (minikube). We have a secret called <code>aws-cred</code>. I created it using:</p>

<pre><code>kubectl create secret docker-registry aws-creds --docker-server=OUR-ACCOUNT.ecr.eu-central-1.amazonaws.com --docker-username=AWS --docker-password=SUPER_LONG_TOKEN --docker-email=foo@bar.com
</code></pre>

<p>together with this in my deployments:</p>

<pre><code>"imagePullSecrets":[{"name":"aws-creds"}]
</code></pre>

<p>SUPER_LONG_TOKEN I get from running:</p>

<pre><code>aws ecr get-login --region eu-central-1 --profile default --no-include-email
</code></pre>

<p>Of course the token expires after a few hours and I tried to refresh the secret. First I deleted the secret:</p>

<pre><code>kubectl delete secret aws-creds
</code></pre>

<p>Then basically repeated the steps above, fetching a fresh token. However I noticed, that I still cannot pull from our ECR getting a <code>AWS ECR: no basic auth credentials</code> error in minikube.</p>

<p>When I repeat the process, but I <strong>rename</strong> the secret, i.e. to <code>aws-creds-2</code>, everything works. I suspect there is some kind of caching in place. Indeed I verified this by using:</p>

<pre><code>kubectl get secret aws-cred --output="jsonpath={.data.\.dockerconfigjson}" | base64 --decode
</code></pre>

<p>and I can see that the <code>password</code> value stays the same, even after deleting and re-creating the secret. This is a bit unintuitive to me, how should I update my secret instead?</p>

<p>I've been using this solution for a few months without issues. It runs inside your cluster and keeps your secret refreshed.  <a href="https://github.com/upmc-enterprises/registry-creds" rel="nofollow noreferrer">https://github.com/upmc-enterprises/registry-creds</a></p>
