<p>We've just bought a docker hub pro user so that we don't have to worry about pull rate limits.</p>
<p>Now, I'm currently having a problem trying to to set the docker hub pro user. Is there a way to set the credentials for hub.docker.com globally?</p>
<p>In the kubernetes docs I found following article: <a href="https://kubernetes.io/docs/concepts/containers/images/#using-a-private-registry" rel="nofollow noreferrer">Kubernetes | Configure nodes for private registry</a></p>
<p>On every node I executed a docker login with the credentials, copied the config.json to /var/lib/kubelet and restarted kubelet. But I'm still getting an ErrImagePull because of those rate limits.</p>
<p>I've copied the config.json to the following places:</p>
<ul>
<li>/var/lib/kubelet/config.json</li>
<li>/var/lib/kubelet/.dockercfg</li>
<li>/root/.docker/config.json</li>
<li>/.docker/config.json</li>
</ul>
<p>There is an option to use a secret for authentification. The problem is, that we would need to edit hundreds of statefulsets, deployments and deamonsets. So it would be great to set the docker user globally.</p>
<p>Here's the config.json:</p>
<pre><code>{
        &quot;auths&quot;: {
                &quot;https://index.docker.io/v1/&quot;: {
                        &quot;auth&quot;: &quot;[redacted]&quot;
                }
        },
        &quot;HttpHeaders&quot;: {
                &quot;User-Agent&quot;: &quot;Docker-Client/19.03.13 (linux)&quot;
        }
}
</code></pre>
<p>To check if it actually logs in with the user I've created an access token in my account. There I can see the last login with said token. The last login was when I executed the docker login command. So the images that I try to pull aren't using those credentials.</p>
<p>Any ideas?</p>
<p>Thank you!</p>

Cédric Voit
<p>Kubernetes implements this using <a href="https://kubernetes.io/docs/concepts/containers/images/#specifying-imagepullsecrets-on-a-pod" rel="nofollow noreferrer">image pull secrets</a>. <a href="https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/" rel="nofollow noreferrer">This doc does a better job at walking through the process</a>.</p>
<p>Using the Docker config.json:</p>
<pre><code>kubectl create secret generic regcred \
    --from-file=.dockerconfigjson=&lt;path/to/.docker/config.json&gt; \
    --type=kubernetes.io/dockerconfigjson
</code></pre>
<p>Or you can pass the settings directly:</p>
<pre><code>kubectl create secret docker-registry &lt;name&gt; --docker-server=DOCKER_REGISTRY_SERVER --docker-username=DOCKER_USER --docker-password=DOCKER_PASSWORD --docker-email=DOCKER_EMAIL
</code></pre>
<p>Then use those secrets in your pod definitions:</p>
<pre><code>apiVersion: v1
kind: Pod
metadata:
  name: foo
  namespace: awesomeapps
spec:
  containers:
    - name: foo
      image: janedoe/awesomeapp:v1
  imagePullSecrets:
    - name: myregistrykey
</code></pre>
<p>Or to use the secret at a user level (<a href="https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#add-imagepullsecrets-to-a-service-account" rel="nofollow noreferrer">Add image pull secret to service account</a>)</p>
<ol>
<li><p><code>kubectl get serviceaccounts default -o yaml &gt; ./sa.yaml</code></p>
</li>
<li><p>open the sa.yaml file, delete line with key resourceVersion, add lines with imagePullSecrets: and save.</p>
<pre><code>kind: ServiceAccount
metadata:
  creationTimestamp: &quot;2020-11-22T21:41:53Z&quot;
  name: default
  namespace: default
  selfLink: /api/v1/namespaces/default/serviceaccounts/default
  uid: afad07eb-f58e-4012-9ccf-0ac9762981d5
secrets:
- name: default-token-gkmp7
imagePullSecrets:
- name: regcred

</code></pre>
</li>
<li><p>Finally replace the serviceaccount with the new updated sa.yaml file
<code>kubectl replace serviceaccount default -f ./sa.yaml</code></p>
</li>
</ol>
