Getting hosts able to pull.
WHAT IS NEEDED
Credentials configured where images are pulled.
WHERE THAT IS
Each host, or the cluster as a secret referenced by pods.
WHAT TO AVOID
Long-lived credentials with broad permissions.
WHAT TO PREFER
Tokens scoped to reading specific repositories.
WHAT CLOUD PROVIDERS OFFER
Identity attached to the node or workload, removing stored credentials entirely.
WHY THAT IS BETTER
There is nothing to leak or rotate.
WHAT TO DO WITH PULL SECRETS
Create them per namespace, and reference them explicitly.
WHAT PEOPLE FORGET
The reference, having created the secret.
WHAT THE SYMPTOM IS
An unauthorised error during pull, despite the secret existing.
WHAT TO CONSIDER
Attaching the secret to the service account, so every pod inherits it.
WHAT TO ROTATE
Registry credentials, on a schedule.
WHAT TO PLAN FOR
Rotation without an outage: two valid credentials briefly.
WHAT TO RESTRICT
Push access, which is far more dangerous than pull.
WHY
Push access permits replacing images that will be deployed.
WHAT TO GRANT PIPELINES
Push to specific repositories only.
WHAT TO AUDIT
Who and what can push.
