<p>Trying to following the use-case examples given in the official Kubernetes documentation for using secrets as environment variables (referenced <a href="https://kubernetes.io/docs/concepts/configuration/secret/#use-case-as-container-environment-variables" rel="nofollow noreferrer">here</a> ), I made both my secret and my deployment yaml (which includes a pod spec) as follows:</p>
<p>Secret yaml:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: v1
kind: Secret
metadata:
  name: my-secret
type: Opaque
data:
  LOCAL_UID: dsdgvreRBRBBsdd=
  LOCAL_PWD: MmSDkfKDODbOU4NCg==
</code></pre>
<p>which is written to the namespace by doing:
<code>kubectl apply -f my-secret.yaml</code></p>
<p>Likewise, here is the deployment Yaml:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-app
  labels:
    app: my-app
spec:
  replicas: 3
  selector:
    matchLabels:
      app: my-app
  template:
    metadata:
      labels:
        app: my-app
    spec:
      terminationGracePeriodSeconds: 30
      containers:
        - name: my-app
          env:
            - name: REPO_APP_URL
              value: https://repo.myco.com/project.tar.gz
          envFrom:
            - secretRef:
                name: my-secret
          image: repo.myco.com/images/node-alpine:0.1.6
          imagePullPolicy: Always
          ports:
            - containerPort: 8080
          readinessProbe:
            httpGet:
              path: /
              port: 8080
            initialDelaySeconds: 15
            periodSeconds: 15
          securityContext:
            runAsUser: 1000
      imagePullSecrets:
        - name: regcredepg
</code></pre>
<ul>
<li>note shown above (but is in the deployment yaml) are the Service and Ingress specs.</li>
</ul>
<p>This is run by doing the following</p>
<p><code>kubectl apply -f my-app.yaml</code></p>
<p>This actually works great given:</p>
<ol>
<li><p>the <code>imagePullSecrets</code> directive is included in the deployment YAML.</p>
</li>
<li><p>that the <code>name</code> value given in the <code>imagePullSecrets</code> section is <strong>not</strong> the actual secret used in the  <code>envFrom: - secretRef:</code> section.</p>
</li>
</ol>
<p>If I try to set the name of the <code>imagePullSecrets</code> name field to <code>my-secret</code>, the pod fails to load (saying <code>Error from server (BadRequest): container &quot;my-app&quot; in pod &quot;my-app-597bb6c9b4-lh8rg&quot; is waiting to start: image can't be pulled</code>).</p>
<p>Also, it won't allow me to simply remove the <code>imagePullSecrets</code> section of the YAML in the pod spec, even though the documentation claims it its optional.</p>
<p>So, the only way this will work is if I include the <code>imagePullSecrets</code> reference to a valid secrets that I am <strong>not</strong> using in my <code>envFrom: - secretRef:</code> section. I am sure I am missing some logical obvious issue here. Can anyone shed light on this??</p>

<p><code>imagePullSecrets</code> has a different format than just the ID and password. You need to specify the registry FQDN and the username and password. You can find more information in <a href="https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/" rel="nofollow noreferrer">Pull an Image from a Private Registry</a>.</p>
