<p>I've deployed my first app on my Kubernetes prod cluster a month ago.</p>

<p>I could deploy my 2 services (front / back) from gitlab registry.</p>

<p>Now, I pushed a new docker image to gitlab registry and would like to redeploy it in prod:</p>

<p>Here is my deployment file:</p>

<pre><code>apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  annotations:
    reloader.stakater.com/auto: "true"
  labels:
    app: espace-client-client
  name: espace-client-client
  namespace: espace-client
spec:
  replicas: 1
  strategy: {}
  template:
    metadata:
      labels:
        app: espace-client-client
    spec:
      containers:
      - envFrom:
        - secretRef:
           name: espace-client-client-env
        image: registry.gitlab.com/xxx/espace_client/client:latest
        name: espace-client-client
        ports:
        - containerPort: 3000
        resources: {}
      restartPolicy: Always
      imagePullSecrets:
        - name: gitlab-registry
</code></pre>

<p>I have no clue what is inside <code>gitlab-registry</code>. I didn't do it myself, and the people who did it left the crew :( Nevertheless, I have all the permissions, so, I only need to know what to put in the secret, and maybe delete it and recreate it.</p>

<p>It seems that secret is based on my .docker/config.json</p>

<pre><code>➜  espace-client git:(k8s) ✗ kubectl describe secrets gitlab-registry                                                                                
Name:         gitlab-registry
Namespace:    default
Labels:       &lt;none&gt;
Annotations:  &lt;none&gt;

Type:  kubernetes.io/dockerconfigjson

Data
====
.dockerconfigjson:  174 bytes
</code></pre>

<p>I tried to delete existing secret, logout with </p>

<pre><code>docker logout registry.gitlab.com
kubectl delete secret gitlab-registry
</code></pre>

<p>Then login again:</p>

<pre><code>docker login registry.gitlab.com -u myGitlabUser
Password: 
Login Succeeded
</code></pre>

<p>and pull image with:</p>

<pre><code>docker pull registry.gitlab.com/xxx/espace_client/client:latest
</code></pre>

<p>which worked.</p>

<p>file: <code>~/.docker/config.json</code> is looking weird:</p>

<pre><code>{
        "auths": {
                "registry.gitlab.com": {}
        },
        "HttpHeaders": {
                "User-Agent": "Docker-Client/18.09.6 (linux)"
        },
        "credsStore": "secretservice"
}
</code></pre>

<p>It doesn't seem to contain any credential... </p>

<p>Then I recreate my secret</p>

<pre><code>kubectl create secret generic gitlab-registry \
    --from-file=.dockerconfigjson=/home/julien/.docker/config.json \
    --type=kubernetes.io/dockerconfigjson
</code></pre>

<p>I also tried to do : </p>

<pre><code>kubectl create secret docker-registry gitlab-registry --docker-server=registry.gitlab.com --docker-username=&lt;your-name&gt; --docker-password=&lt;your-pword&gt; --docker-email=&lt;your-email&gt;
</code></pre>

<p>and deploy again:</p>

<pre><code>kubectl rollout restart deployment/espace-client-client -n espace-client
</code></pre>

<p>but I still have the same error:</p>

<pre><code>Error from server (BadRequest): container "espace-client-client" in pod "espace-client-client-6c8b88f795-wcrlh" is waiting to start: trying and failing to pull image
</code></pre>

<p>You have to update the <code>gitlab-registry</code> secret because this item is used to let Kubelet to pull the <em>protected</em> image using credentials.</p>

<p>Please, delete the old secret with <code>kubectl -n yournamespace delete secret gitlab-registry</code> and recreate it typing credentials:</p>

<pre><code>kubectl -n yournamespace create secret docker-registry my-secret --docker-server=DOCKER_REGISTRY_SERVER --docker-username=DOCKER_USER --docker-password=DOCKER_PASSWORD[ --docker-email=DOCKER_EMAIL]
</code></pre>

<p>where:
- <code>DOCKER_REGISTRY_SERVER</code> is the GitLab Docker registry instance
- <code>DOCKER_USER</code> is the username of the robot account to pull images
- <code>DOCKER_PASSWORD</code> is the password attached to the robot account</p>

<p>You could ignore <code>docker-email</code> since it's not mandatory (note the square brackets).</p>
