5.4.2.2. Using a pull secret in a workload

Procedure

1. Link the pull secret to a service account by entering the following command. Note that the name of the service account should match the name of the service account that pod uses. The default service account is default.

   $ oc secrets link default <pull_secret_name> --for=pull

2. Verify the change by entering the following command:

   $ oc get serviceaccount default -o yaml

   Example output

   apiVersion: v1
   imagePullSecrets:
   - name: default-dockercfg-123456
   - name: <pull_secret_name>
   kind: ServiceAccount
   metadata:
     annotations:
       openshift.io/internal-registry-pull-secret-ref: <internal_registry_pull_secret>
     creationTimestamp: "2025-03-03T20:07:52Z"
     name: default
     namespace: default
     resourceVersion: "13914"
     uid: 9f62dd88-110d-4879-9e27-1ffe269poe3
   secrets:
   - name: <pull_secret_name>

3. Optional: Instead of linking the secret to a service account, you can alternatively reference it directly in your pod or workload definition. This is useful for GitOps workflows such as ArgoCD. For example:

   Example pod specification

   apiVersion: v1
   kind: Pod
   metadata:
     name: <secure_pod_name>
   spec:
     containers:
     - name: <container_name>
       image: quay.io/my-private-image
     imagePullSecrets:
     - name: <pull_secret_name>

   Example ArgoCD workflow

   apiVersion: argoproj.io/v1alpha1
   kind: Workflow
   metadata:
     generateName: <example_workflow>
   spec:
     entrypoint: <main_task>
     imagePullSecrets:
     - name: <pull_secret_name>