<p>I am new to kubernetes deployments so I wanted to know is it possible to pull images from private repo without using <code>imagePullSecrets</code> in the deployment yaml files or is it mandatory to create a docker registry secret and pass that secret in imagePullSecrets.
I also looked at adding imagePullSecrets to a service account but that is not the requirement I woul love to know that if I setup creds in variables can kubernetes use them to pull those images.
Also wanted to know how can it be achieved and reference to a document would work
Thanks in advance.</p>

Deepak Jotwani
<p>As long as you're using Docker on your Kubernetes nodes (please note that Docker support has itself <a href="https://kubernetes.io/blog/2020/12/02/dont-panic-kubernetes-and-docker/" rel="nofollow noreferrer">recently been deprecated in Kubernetes</a>), you can authenticate the Docker engine on your nodes itself against your private registry.</p>
<p>Essentially, this boils down to running <code>docker login</code> on your machine and then copying the resulting credentials JSON file directly onto your nodes. This, of course, only works if you have direct control over your node configuration.</p>
<p>See <a href="https://kubernetes.io/docs/concepts/containers/images/#configuring-nodes-to-authenticate-to-a-private-registry" rel="nofollow noreferrer">the documentation</a> for more information:</p>
<blockquote>
<p>If you run Docker on your nodes, you can configure the Docker container runtime to authenticate to a private container registry.</p>
<p>This approach is suitable if you can control node configuration.</p>
<p>Docker stores keys for private registries in the <code>$HOME/.dockercfg</code> or <code>$HOME/.docker/config.json</code> file. If you put the same file in the search paths list below, kubelet uses it as the credential provider when pulling images.</p>
<ul>
<li><code>{--root-dir:-/var/lib/kubelet}/config.json</code></li>
<li><code>{cwd of kubelet}/config.json</code></li>
<li><code>${HOME}/.docker/config.json</code></li>
<li><code>/.docker/config.json</code></li>
<li><code>{--root-dir:-/var/lib/kubelet}/.dockercfg</code></li>
<li><code>{cwd of kubelet}/.dockercfg</code></li>
<li><code>${HOME}/.dockercfg</code></li>
<li><code>/.dockercfg</code></li>
</ul>
<p>Note: You may have to set <code>HOME=/root</code> explicitly in the environment of the kubelet process.</p>
<p>Here are the recommended steps to configuring your nodes to use a private registry. In this example, run these on your desktop/laptop:</p>
<ul>
<li>Run <code>docker login [server]</code> for each set of credentials you want to use. This updates <code>$HOME/.docker/config.json</code> on your PC.</li>
<li>View <code>$HOME/.docker/config.json</code> in an editor to ensure it contains just the credentials you want to use.</li>
<li>Get a list of your nodes; for example:
<ul>
<li>if you want the names: <code>nodes=$( kubectl get nodes -o jsonpath='{range.items[*].metadata}{.name} {end}' )</code></li>
<li>if you want to get the IP addresses: <code>nodes=$( kubectl get nodes -o jsonpath='{range .items[*].status.addresses[?(@.type==&quot;ExternalIP&quot;)]}{.address} {end}' )</code></li>
</ul>
</li>
<li>Copy your local <code>.docker/config.json</code> to one of the search paths list above.
for example, to test this out: <code>for n in $nodes; do scp ~/.docker/config.json root@&quot;$n&quot;:/var/lib/kubelet/config.json; done</code></li>
</ul>
<p><strong>Note:</strong> For production clusters, use a configuration management tool so that you can apply this setting to all the nodes where you need it.</p>
</blockquote>
