<p>To use a docker container from a private docker repo, kubernetes recommends creating a secret of type 'docker-registry' and referencing it in your deployment. </p>

<p><a href="https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/" rel="noreferrer">https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/</a></p>

<pre><code>kubectl create secret docker-registry regcred --docker-server=&lt;your-registry-server&gt; --docker-username=&lt;your-name&gt; --docker-password=&lt;your-pword&gt; --docker-email=&lt;your-email&gt;
</code></pre>

<p>Then in your helm chart or kubernetes deployment file, use <code>imagePullSecrets</code></p>

<pre><code>apiVersion: apps/v1beta1
kind: Deployment
metadata:
  name: foo
spec:
  replicas: {{ .Values.replicaCount }}
  template: 
    spec:
      imagePullSecrets:
      - name: regcred
      containers:
      - name: foo
        image: foo.example.com
</code></pre>

<p>This works, but requires that all containers be sourced from the same registry. </p>

<p><strong>How would you pull 2 containers from 2 registries</strong> (e.g. when using a sidecar that is stored separate from the primary container) ? </p>

<pre><code>apiVersion: apps/v1beta1
kind: Deployment
metadata:
  name: foo
spec:
  replicas: {{ .Values.replicaCount }}
  template: 
    spec:
      containers:
      - name: foo
        image: foo.example.com
        imagePullSecrets:
        - name: foo-secret
      - name: bar
        image: bar.example.com
        imagePullSecrets:
        - name: bar-secret
</code></pre>

<p>I've tried creating 2 secrets <code>foo-secret</code> and <code>bar-secret</code> and referencing each appropriately, but I find it fails to pull both containers. </p>

<p>You have to include <code>imagePullSecrets:</code> directly at the pod level, but you can have multiple secrets there.</p>

<pre><code>apiVersion: apps/v1beta1
kind: Deployment
metadata:
  name: foo
spec:
  replicas: {{ .Values.replicaCount }}
  template: 
    spec:
      imagePullSecrets:
      - name: foo-secret
      - name: bar-secret
      containers:
      - name: foo
        image: foo.example.com/foo-image
      - name: bar
        image: bar.example.com/bar-image
</code></pre>

<p>The <a href="https://kubernetes.io/docs/concepts/containers/images/#specifying-imagepullsecrets-on-a-pod" rel="noreferrer">Kubernetes documentation on this</a> notes:</p>

<blockquote>
  <p>If you need access to multiple registries, you can create one secret for each registry. Kubelet will merge any <code>imagePullSecrets</code> into a single virtual <code>.docker/config.json</code> when pulling images for your Pods.</p>
</blockquote>
