<p>Is it possible to globally (or at least per namespace), configure kubernetes to always use an image pull secret when connecting to a private repo? 
There are two use cases: </p>

<ol>
<li>when a user specifies a container in our private registry in a deployment</li>
<li>when a user points a Helm chart at our private repo (and so we have no control over the image pull secret tag).</li>
</ol>

<p>I know it is possible to do this on a <a href="https://kubernetes.io/docs/concepts/containers/images/#using-a-private-registry" rel="noreferrer">service account basis</a> but without writing a controller to add this to every new service account created it would get a bit of a mess.</p>

<p>Is there are way to set this globally so if kube tries to pull from registry X it uses secret Y?</p>

<p>Thanks</p>

apr_1985
<p>As far as I know, usually the <strong>default</strong> serviceAccount is responsible for pulling the images.
To easily add imagePullSecrets to a serviceAccount you can use the <strong>patch command</strong>:</p>

<pre><code>kubectl patch serviceaccount default -p '{"imagePullSecrets": [{"name": "mySecret"}]}'
</code></pre>

<p>It's possible to use <code>kubectl patch</code> in a script that inserts imagePullSecrets on serviceAccounts across all namespaces.</p>

<p>If it´s too complicated to manage multiple namespaces you can have look at <a href="https://github.com/mittwald/kubernetes-replicator" rel="noreferrer">kubernetes-replicator</a>, which syncs resources between namespaces.</p>

<p><strong>Solution 2:</strong><br>
<a href="https://kubernetes.io/docs/concepts/containers/images/#configuring-nodes-to-authenticate-to-a-private-registry" rel="noreferrer">This section of the doc</a> explains how you can set the private registry on a node basis:</p>

<blockquote>
  <p>Here are the recommended steps to configuring your nodes to use a
  private registry. In this example, run these on your desktop/laptop:</p>
  
  <ol>
  <li>Run <code>docker login [server]</code> for each set of credentials you want to use. This updates <code>$HOME/.docker/config.json</code>.</li>
  <li>View <code>$HOME/.docker/config.json</code> in an editor to ensure it contains just the credentials you want to use.</li>
  <li><p>Get a list of your nodes, for example:</p>
  
  <ul>
  <li><p>If you want the names:<br>
  nodes=$(kubectl get nodes -o jsonpath='{range.items[*].metadata}{.name} {end}')</p></li>
  <li><p>If you want to get the IPs:<br>
  nodes=$(kubectl get nodes -o jsonpath='{range .items[*].status.addresses[?(@.type=="ExternalIP")]}{.address} {end}')</p></li>
  </ul></li>
  <li><p>Copy your local .docker/config.json to one of the search paths list above. for example: </p>
  
  <p>for n in $nodes; do scp ~/.docker/config.json root@$n:/var/lib/kubelet/config.json; done</p></li>
  </ol>
</blockquote>

<p><strong>Solution 3:</strong><br>
A (very dirty!) way I discovered to not need to set up an imagePullSecret on a deployment / serviceAccount basis is to:</p>

<ol>
<li>Set ImagePullPolicy: IfNotPresent</li>
<li>Pulling the image in each node<br>
2.1. manually using <code>docker pull myrepo/image:tag</code>.<br>
2.2. using a script or a tool like <a href="https://github.com/glowdigitalmedia/docker-puller" rel="noreferrer">docker-puller</a> to automate that process.</li>
</ol>

<p>Well, I think I don't need to explain how ugly is that.</p>

<p><strong>PS</strong>: If it helps, I found <a href="https://github.com/kubernetes/kops/issues/2505" rel="noreferrer">an issue</a> on kubernetes/kops about the feature of creating a global configuration for private registry.</p>
