<p>I created a Secret in Vault in Kubernetes instead of using K8s API. And would like to use the Secret in Vault to pull images from a private registry. I am unable to find a way to do so. The following is the example code, assuming I used all the labels for Vault access by the Deployment.</p>
<pre><code>apiVersion: apps/v1
kind: Deployment
metadata:
  name: test-app-exporter
  namespace: monitoring
spec:
  replicas: 1
  selector:
    matchLabels:
      app: test-app-exporter
  template:
    metadata:
      labels:
        app: test-app-exporter
    spec:
      containers:
      - name: test-app-exporter
        image: index.docker.io/xxxxx/test-app-exporter:3
        imagePullPolicy: Always
        resources:
          limits:
            memory: &quot;128Mi&quot;
            cpu: &quot;500m&quot;
        ports:
        - name: http
          containerPort: 5000
      imagePullSecrets:
        - name: [myregistrykey--Secret From Vault]
</code></pre>

Padmaja
<p>You can use the external secret or write a custom <strong>CRD</strong> solution also which ideally should sync or copy the secret from the <strong>vault</strong> to the Kubernetes <strong>secret</strong>.</p>
<p><strong>Option: 1</strong></p>
<p>You have multiple options to use <a href="https://external-secrets.io/v0.7.1/" rel="nofollow noreferrer">External Secret</a></p>
<p><strong>steps for external secret</strong></p>
<ul>
<li>helm repo add external-secrets</li>
<li>helm install k8s-external-secrets external-secrets/kubernetes-external-secrets</li>
</ul>
<p><strong>Example ref</strong></p>
<pre><code>apiVersion: 'kubernetes-client.io/v1'
kind: ExternalSecret
metadata:
 name: imagepull-secret
 namespace: default
spec:
 kvVersion: 1
 backendType: vault
 vaultMountPoint: kubernetes
 vaultRole: user-role
 data:
 - name: IMAGE_PULL
 ...
</code></pre>
<p><strong>Option : 2</strong></p>
<p>i have used this CRD personally and easy way to integrate <a href="https://vault.koudingspawn.de/" rel="nofollow noreferrer">Vault-CRD</a></p>
<p><a href="https://vault.koudingspawn.de/install-vault-crd" rel="nofollow noreferrer">Installation guide</a> &amp; <a href="https://vault.koudingspawn.de/supported-secret-types/secret-type-dockercfg" rel="nofollow noreferrer">Dockercfg</a></p>
<ul>
<li>Create a secret in vault first</li>
<li>Create vault-crd YAML file</li>
</ul>
<p><strong>Example</strong></p>
<pre><code>apiVersion: &quot;koudingspawn.de/v1&quot;
kind: Vault
metadata:
  name: image-secret
spec:
  path: &quot;secret/docker-hub&quot;
  type: &quot;DOCKERCFG&quot;
</code></pre>
<ul>
<li>Apply YAML file to the cluster</li>
</ul>
<p>it will fetch the secret from vault and create new secret in Kubernetes and you can directly use that secret to Deployment</p>
