<p>I want to run my application that is hosted in a private container registry on a Kubernetes cluster. I followed the instructions <a href="https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/" rel="nofollow noreferrer">here</a> and created a secret like this:</p>

<pre><code>kubectl create secret docker-registry regcred --docker-server=&lt;your-registry-server&gt; \
      --docker-username=&lt;your-name&gt; \
      --docker-password=&lt;your-pword&gt; \
      --docker-email=&lt;your-email&gt;
</code></pre>

<p>which is used in my deployment like this:</p>

<pre><code>      containers:
      - image: registry.gitlab.com/xxxxx/xxxx
        name: dockerdemo
        resources: {}
      imagePullSecrets:
      - name: regcred
</code></pre>

<p>K8s is now able to pull the image from my private registry. Anyhow I don't feel comfortable that my user and password are stored in plain text in the cluster. Is there a better/more secure way to give the K8s cluster access to the registry maybe by a token?</p>

<p>Hence I am using <a href="https://www.gitlab.com" rel="nofollow noreferrer">Gitlab</a> the solution for me know is not to store my user credentials in Kubernetes. Instead I am using a Deploy Token that can be removed any time and that only has access to the container registry.</p>

<p>The following steps are necessary here:</p>

<ul>
<li>Open Gitlab and go to your project</li>
<li>Settings > Repository > Deploy Tokens</li>
<li>Create a token with scope <code>read_registry</code></li>
<li>Create secret in K8S: <code>kubectl create secret docker-registry regcred --docker-server=registry.gitlab.com --docker-username=&lt;token_username&gt; --docker-password=&lt;token&gt;</code></li>
</ul>

<p>Thank you @Jonas for your links but this solution is what I was looking for.</p>
