<p>Can someone please help me troubleshoot an issue I'm having with my deployed apps on my Kubernetes cluster? I am attempting to split them into different namespaces, but I am encountering an error when trying to deploy an app with the same settings, except for the namespace. Currently, I am working with a K3s on-prem cluster and pulling my images from a private registry (Gitlab Registry) using a secret to access it. The apps are currently working fine in the default namespace, but when I try to deploy an app to a custom namespace, I get the following error message:</p>
<p><code>Failed to pull image &quot;&lt;image-path&gt;&quot;: rpc error: code = Unknown desc = failed to pull and unpack image &quot;&lt;image-path&gt;&quot;: failed to resolve reference &quot;&lt;image-path&gt;&quot;: failed to authorize: failed to fetch anonymous token: unexpected status: 403 Forbidden</code></p>
<p>I'm looking for a more efficient solution to grant access to a private Docker registry in Kubernetes without having to manually create a Secret and a ServiceAccount in every namespace I create.</p>
<p>I have already tried the following approach, which works but is time-consuming:</p>
<ol>
<li>Create the <code>Secret</code> in the namespace where the Docker credentials are stored:</li>
</ol>
<pre><code>kubectl create secret docker-registry &lt;secret-name&gt; \
    --docker-server=&lt;registry-url&gt; \
    --docker-username=&lt;username&gt; \
    --docker-password=&lt;access-token&gt; \
    --docker-email=&lt;email&gt; \
    --namespace=&lt;namespace&gt;
</code></pre>
<ol start="2">
<li>Create a <code>ServiceAccount</code> to access the private registry:</li>
</ol>
<pre><code>kubectl create serviceaccount &lt;service-account-name&gt; -n &lt;namespace&gt;
</code></pre>
<ol start="3">
<li>Create and apply a role and a role binding that grants the necessary permissions to access the private registry:</li>
</ol>
<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: &lt;role-name&gt;
rules:
- apiGroups: [&quot;&quot;]
  resources: [&quot;pods&quot;]
  verbs: [&quot;get&quot;, &quot;watch&quot;, &quot;list&quot;]
- apiGroups: [&quot;&quot;]
  resources: [&quot;pods/log&quot;]
  verbs: [&quot;get&quot;]
- apiGroups: [&quot;extensions&quot;]
  resources: [&quot;deployments&quot;]
  verbs: [&quot;get&quot;, &quot;watch&quot;, &quot;list&quot;]
- apiGroups: [&quot;apps&quot;]
  resources: [&quot;deployments&quot;]
  verbs: [&quot;get&quot;, &quot;watch&quot;, &quot;list&quot;]
- apiGroups: [&quot;batch&quot;]
  resources: [&quot;jobs&quot;]
  verbs: [&quot;get&quot;, &quot;watch&quot;, &quot;list&quot;]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: &lt;role-binding-name&gt;
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: &lt;role-name&gt;
subjects:
- kind: ServiceAccount
name: &lt;service-account-name&gt;
namespace: &lt;namespace&gt;
</code></pre>
<ol start="4">
<li>Add the <code>Secret</code> to the <code>ServiceAccount</code> in the respective namespace:</li>
</ol>
<pre><code>kubectl patch serviceaccount &lt;service-account-name&gt; -p '{&quot;imagePullSecrets&quot;: [{&quot;name&quot;: &quot;&lt;secret-name&gt;&quot;}]}' -n &lt;namespace&gt;
</code></pre>
<p>Is there a way to set up the permissions to access a private registry globally, so that any new namespace I create automatically has access to the registry without me having to manually create the Secret and ServiceAccount in each one?</p>
<p>I appreciate any advice or guidance on how to achieve this!</p>

Duarte
<p>You could either use a Kyverno ClusterPolicy or imagepullsecret-patcher</p>
<p>This is documented very well in the posts below:</p>
<p><a href="https://devopstales.github.io/kubernetes/k8s-imagepullsecret-patcher/" rel="nofollow noreferrer">https://devopstales.github.io/kubernetes/k8s-imagepullsecret-patcher/</a>
<a href="https://kubesandclouds.com/index.php/2021/12/13/cluster-wide-registry-auth/" rel="nofollow noreferrer">https://kubesandclouds.com/index.php/2021/12/13/cluster-wide-registry-auth/</a></p>
