<p>I use a self-hosted instance of GitLab to store my Docker images. As we've recently set up Project Access Tokens, we want to pull images on AKS using individual Secrets for each registry. It means that we have specific credentials for each image in &quot;the same registry&quot;.</p>
<p>Problem is, Deployments have a global <code>imagePullSecrets</code> list that refers to multiple Secrets. And those Secrets, which essentially hold different credentials (one per GitLab Container Registry), share the same Docker Registry URL!</p>
<p>Put simply, here an example Deployment:</p>
<pre class="lang-yaml prettyprint-override"><code>spec:
  template:
    spec:
      containers:
        - name: one
          image: 'gitlab.company.com/project-one:1.0.0'
        - name: two
          image: 'gitlab.company.com/project-two:1.2.0'
      imagePullSecrets:
        - name: secret-project-one
        - name: secret-project-two
</code></pre>
<p>The Secret 1 (secret-project-one):</p>
<pre class="lang-json prettyprint-override"><code>{
  &quot;auths&quot;: {
    &quot;https://gitlab.company.com&quot;: {
      &quot;username&quot;: &quot;project_111_bot&quot;,
      &quot;password&quot;: &quot;password-project-one&quot;,
      &quot;auth&quot;: &quot;Password&quot;
    }
  }
}
</code></pre>
<p>And the Secret 2 (secret-project-two):</p>
<pre class="lang-json prettyprint-override"><code>{
  &quot;auths&quot;: {
    &quot;https://gitlab.company.com&quot;: {
      &quot;username&quot;: &quot;project_222_bot&quot;,
      &quot;password&quot;: &quot;password-project-two&quot;,
      &quot;auth&quot;: &quot;Password&quot;
    }
  }
}
</code></pre>
<p>How is Kubernetes supposed to differentiate which Secret to use? Does it assume you have different URLs and will match the right Secret based on the image name? Or will it just try every Secret until one works?</p>
<p>Documentations don't seem to cover this scenario. Any help would be appreciated!</p>

<p>In source code I have found that it just tries all one by one, and returns the first one that succeedes.</p>
<p>I am not going to explain the whole process of how I have found this, but here is some of explaination/proof:</p>
<p>When <a href="https://github.com/kubernetes/kubernetes/blob/a55bd631728590045b51a4f65bba31aed1415571/pkg/kubelet/kuberuntime/kuberuntime_image.go#L31" rel="nofollow noreferrer">PullImage</a> function is called, it <a href="https://github.com/kubernetes/kubernetes/blob/a55bd631728590045b51a4f65bba31aed1415571/pkg/kubelet/kuberuntime/kuberuntime_image.go#L38" rel="nofollow noreferrer">grabs the docker registry credentials</a> and <a href="https://github.com/kubernetes/kubernetes/blob/a55bd631728590045b51a4f65bba31aed1415571/pkg/kubelet/kuberuntime/kuberuntime_image.go#L59-L76" rel="nofollow noreferrer">loops over them</a> trying one by one to get an image, and <a href="https://github.com/kubernetes/kubernetes/blob/a55bd631728590045b51a4f65bba31aed1415571/pkg/kubelet/kuberuntime/kuberuntime_image.go#L72" rel="nofollow noreferrer">returns the first one that it finds</a> that <a href="https://github.com/kubernetes/kubernetes/blob/a55bd631728590045b51a4f65bba31aed1415571/pkg/kubelet/kuberuntime/kuberuntime_image.go#L71" rel="nofollow noreferrer">does not result in error</a>.</p>
