<p>I wish to deploy a dockerized service with kubernetes on aws. To do so I'm using the recently released AWS EKS with AWS Fargate feature. The service's docker image is stored in a private package on github.</p>

<p>To deploy my service I'm using a kubernetes manifest file containing a secret, a deployment and a service.</p>

<p><strong>When locally deploying with kubectl on minikube, the deployment pods successfully pull the image from the private github package. I successfully reproduced the process for accessing a private dockerhub registry.</strong></p>

<p>I then configured kubectl to connect to my eks cluster. <strong>When applying the manifest file I'm getting an ImagePullBackOff status for the deployment pods when pulling form github packages while it is working fine when pulling from dockerhub</strong>. The differences in the manifest file are as follow: </p>

<p>Generating secret for github packages:</p>

<pre><code>kubectl create secret docker-registry mySecret --dry-run=true --docker-server=https://docker.pkg.github.com --docker-username=myGithubUsername --docker-password=myGithubAccessToken -o yaml
</code></pre>

<p>Generating secret for dockerhub:</p>

<pre><code>kubectl create secret docker-registry mySecret --dry-run=true --docker-server=https://index.docker.io/v1/ --docker-username=myDockerhubUsername --docker-password=myDockerhubPassword -o yaml
</code></pre>

<p>The deployment spec is referenced as follow: </p>

<pre><code>spec:
  containers:
    # when pulling from github packages 
    - image: docker.pkg.github.com/myGithubUsername/myRepo/myPackage:tag
    # when pulling from dockerhub 
    - image: myDockerhubUsername/repository:tag
    ...
  imagePullSecrets:
    - name: mySecret
</code></pre>

<p>Trying to make this work <strong>specifically with github packages</strong> I had a try with AWS Secrets Manager.</p>

<p>I created a secret "mySecret" as follows : </p>

<pre><code>{
  "username" : "myGithubUsername",
  "password" : "myGithubAccessToken"
}
</code></pre>

<p>I then created a policy to access this secret:</p>

<pre><code>{
  "Version": "2012-10-17",
  "Statement": [
    {
        "Effect": "Allow",
        "Action": [
            "secretsmanager:GetSecretValue"
        ],
        "Resource": [
            "arn:aws:secretsmanager:eu-west-1:myAWSAccountId:secret:mySecret"
        ]
    }
  ]
}
</code></pre>

<p>I then attached the policy to both the Cluster IAM Role of my eks cluster and the Pod Execution Role referenced in its fargate profile "fp-default". I'm only working in the default kubernetes namespace.
My secret and cluster are both in the eu-west-1 region.</p>

<p><strong>Still, I'm getting the ImagePullBackOff status when deploying.</strong> </p>

<p>I'm having a hard time finding anything tackling this issue using AWS Fargate with AWS EKS, and would love some insight on this :)</p>

<p><strong>Edit</strong>: The question was edited in order to present in a clearer maner that the issue is mainly related to using github packages as a registry provider.</p>

<p>I think you need to create your secret in the same namespace as your deployment. I was able to get this work by creating a secret</p>

<pre><code>kubectl create secret docker-registry mySecret --dry-run=true --docker-server=https://docker.pkg.github.com --docker-username=myGithubUsername --docker-password=myGithubAccessToken --namespace=my-api -o yaml
</code></pre>

<p>in my deployment.yaml, I referenced it like</p>

<pre><code>    spec:
      containers:
        - name: my-api
          image: docker.pkg.github.com/doc-api:0.0.0
          ports:
          - containerPort: 5000
          resources: {}
      imagePullSecrets:
        - name: mySecret
</code></pre>
