<p>We're making use of ServiceAccounts for RBAC, and so have multiple SAs in play to allow us us to tune accesses via RoleBindings appropriately.</p>

<p>We're also using a private registry, and thus have imagePullSecrets to use for pulling images from the private registry.  I'm trying to come up with a solution by which all SAs created within a namespace would by default get the list of imagePullSecrets applied to the default SA added to them, so that when we deploy the pods making use of the service (typically right after the SA), the serviceAccount is already configured to use the imagePullSecrets to retrieve the images.  </p>

<p>Has anyone devised an elegant way to handle this?  I did check to see whether pods could have more than one serviceAccount applied - N to hold imageSecrets, and 1 to map to RBAC.  And/or, can someone suggest an alternate way to look at the problem?</p>

<p>[UPDATE: Clarifying - the challenge is to share the set of imagePullSecrets across multiple service accounts, preferably without explicitly needing to add them to each ServiceAccount definition.  The private registry should be considered akin to dockerhub: the user accessing the registry is generally intended to be able to pull, with the user info then used to track who's pulling images and occasionally to keep users from pulling images they shouldn't have access to for 'this thing just isn't intended for broader consumption' reasons.]</p>

<p>As I answered <a href="https://stackoverflow.com/a/55230340/8971507">in another thread</a>: </p>

<blockquote>
  <p>To easily add imagePullSecrets to a serviceAccount you can use the
  patch command:</p>

<pre><code>kubectl patch serviceaccount default -p '{"imagePullSecrets": [{"name": "mySecret"}]}'
</code></pre>
</blockquote>
