<p>I hope it's ok to ask for your advice.</p>
<p>The problem in a nutshell: my pipeline cannot pull private images from GHCR.IO into Okteto Kubernetes, but public images from the same private repo work.</p>
<p>I'm on Windows 10 and use WSL2-Ubuntu 20.04 LTS with kinD for development and tried minikube too.</p>
<p>I get an error in Okteto which says that the image pull is “unauthorized” -&gt; “imagePullBackOff”.</p>
<p>Things I did:browsed Stack Overflow, RTFM, Okteto FAQ, download the Okteto kubeconfig, pulled my hair out and spent more hours than I would like to admit – still no success yet.</p>
<p>For whatever reason I cannot create a “kubectl secret” that works. When logged-in to ghcr.io via “docker login --username” I can pull private images locally.</p>
<p>No matter what I’ve tried I still get the error “unauthorized” when trying to pull a private image in Okteto.</p>
<p>My Setup with latest updates:</p>
<ul>
<li>Windows 10 Pro</li>
<li>JetBrains Rider IDE</li>
<li>WSL2-Ubuntu 20.04 LTS</li>
<li>ASP.NET Core MVC app</li>
<li>.NET 6 SDK</li>
<li>Docker</li>
<li>kinD</li>
<li>minikube</li>
<li>Chocolatey</li>
<li>Homebrew</li>
</ul>
<p>Setup kinD</p>
<pre><code>kind create cluster --name my-name

kubectl create my-namespace

// create a secret to pull images from ghcr.io       
kubectl create secret docker-registry my-secret -n my-namespace --docker-username=&quot;my-username&quot; --docker-password=&quot;my-password&quot; --docker-email=&quot;my-email&quot; --docker-server=&quot;https://ghcr.io&quot;

// patch local service account
kubectl patch serviceaccount default -p '{&quot;imagePullSecrets&quot;: [{&quot;name&quot;: &quot;my-secret&quot;}]}'
</code></pre>
<p>kubernetes.yaml</p>
<pre><code>apiVersion: apps/v1
kind: Deployment
metadata:
  name: okteto-repo
  namespace: my-namespace
spec:
  replicas: 1
  selector:
    matchLabels:
      app: okteto-repo
  template:
    metadata:
      labels:
        app: okteto-repo
    spec:
      containers:
        - name: okteto-repo
          image: ghcr.io/user/okteto-repo:latest
          ports:
            - containerPort: 80
      imagePullSecrets:
        - name: my-secret
---
apiVersion: v1
kind: Service
metadata:
  name: okteto-repo
  annotations:
    dev.okteto.com/auto-ingress: &quot;true&quot;
spec:
  type: ClusterIP
  selector:
    app: okteto-repo
  ports:
    - protocol: TCP
      port: 8080
      targetPort: 80
</code></pre>
<p>Do you have an idea why it doesn't work and what I could do?</p>
<p>Thanks a lot my dear friends, every input is highly appreciated!</p>
<p>Hope you guys have great holidays.</p>
<p>Cheers,
Michael</p>

<p>I was able to pull a private image by doing the following:</p>
<ol>
<li>Create a personal token in GitHub with <code>repo</code> access.</li>
<li>Build and push the image to GitHub's Container registry (I used <code>okteto build -t ghcr.io/rberrelleza/go-getting-started:0.0.1</code>)</li>
<li>Download my <a href="https://okteto.com/docs/reference/cli/#update-kubeconfig" rel="noreferrer">kubeconfig credentials</a> from Okteto Cloud by running <code>okteto context update-kubeconfig</code>.</li>
<li>Create a secret with my credentials: <code>kubectl create secret docker-registry gh-regcred --docker-server=ghcr.io --docker-username=rberrelleza --docker-password=ghp_XXXXXX</code></li>
<li>Patched the default account to include the secret as an image pull secret: <code>kubectl patch serviceaccount default -p '{&quot;imagePullSecrets&quot;: [{&quot;name&quot;: &quot;gh-regcred&quot;}]}'</code></li>
<li>Updated the image name in the kubernetes manifest</li>
<li>Created the deployment (<code>kubectl apply -f k8s.yaml</code>)</li>
</ol>
<p>These is what my kubernetes resources looks like, in case it helps:</p>
<pre><code># k8s.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: hello-world
spec:
  replicas: 1
  selector:
    matchLabels:
      app: hello-world
  template:
    metadata:
      labels:
        app: hello-world
    spec:
      containers:
      - image: ghcr.io/rberrelleza/go-getting-started:0.0.1
        name: hello-world

---

apiVersion: v1
kind: Service
metadata:
  name: hello-world
  annotations:
    dev.okteto.com/auto-ingress: &quot;true&quot;
spec:
  type: ClusterIP  
  ports:
  - name: &quot;hello-world&quot;
    port: 8080
  selector:
    app: hello-world
</code></pre>
<pre><code># default SA
apiVersion: v1
imagePullSecrets:
- name: gh-regcred
- name: okteto-regcred
kind: ServiceAccount
metadata:
  creationTimestamp: &quot;2021-05-21T22:26:38Z&quot;
  name: default
  namespace: rberrelleza
  resourceVersion: &quot;405042662&quot;
  uid: 2b6a6eef-2ce7-40d3-841a-c0a5497279f7
secrets:
- name: default-token-7tm42
</code></pre>
