<p>How can I pull <code>docker.pkg.github.com</code> Docker images from within Kubernetes cluster?</p>

<p>Currently, the Github Docker registry requires authentication even for packages from public Github repositories.</p>

<ol>
<li>Create new Github Personal Access Token with <code>read:packages</code> scope at <a href="https://github.com/settings/tokens/new" rel="noreferrer">https://github.com/settings/tokens/new</a>.</li>
<li><p>Base-64 encode <code>&lt;your-github-username&gt;:&lt;TOKEN&gt;</code>, ie.:</p>

<pre><code>$ echo -n VojtechVitek:4eee0faaab222ab333aa444aeee0eee7ccc555b7 | base64
&lt;AUTH&gt;
</code></pre>

<p><em>Note: Make sure not to encode a newline character at the end of the string.</em></p></li>
<li><p>Create kubernetes.io/dockerconfigjson secret</p>

<p>A) Create secret manually:</p>

<pre><code>$ echo '{"auths":{"docker.pkg.github.com":{"auth":"&lt;AUTH&gt;"}}}' | kubectl create secret generic dockerconfigjson-github-com --type=kubernetes.io/dockerconfigjson --from-file=.dockerconfigjson=/dev/stdin
</code></pre>

<p>B) Or, create .yml file that can be used in <code>kubectl apply -f</code>:</p>

<pre><code>kind: Secret
type: kubernetes.io/dockerconfigjson
apiVersion: v1
metadata:
  name: dockerconfigjson-github-com
stringData:
  .dockerconfigjson: {"auths":{"docker.pkg.github.com":{"auth":"&lt;AUTH&gt;"}}}
</code></pre>

<p><em>Note for GitOps: I strongly recommend not to store the above file in plain-text in your git repository. Hydrate the value in your CD pipeline or encrypt/seal the file with tools like <a href="https://github.com/mozilla/sops" rel="noreferrer">https://github.com/mozilla/sops</a> or <a href="https://github.com/bitnami-labs/sealed-secrets" rel="noreferrer">https://github.com/bitnami-labs/sealed-secrets</a>.</em></p></li>
<li><p>Now, you can reference the above secret from your pod's spec definition via <code>imagePullSecrets</code> field:</p>

<pre><code>spec:
  containers:
  - name: your-container-name
    image: docker.pkg.github.com/&lt;ORG&gt;/&lt;REPO&gt;/&lt;PKG&gt;:&lt;TAG&gt;
  imagePullSecrets:
  - name: dockerconfigjson-github-com
</code></pre></li>
</ol>
