How do you let Pods pull from a private registry?

WHAT THIS TESTS Whether you understand that pulling an image happens in the kubelet before any container runs, so credentials must be available to the kubelet through a specifically typed Secret, not inside the container.

A GOOD ANSWER COVERS You create a Secret of type kubernetes.io/dockerconfigjson, which stores a .dockerconfigjson key containing the registry hostname, username, password, and optionally email, in the same format Docker writes to config.json. The easiest path is kubectl create secret docker-registry regcred with the server, username, and password flags. You then attach it through imagePullSecrets. You can list it directly in a Pod or template spec, but the cleaner pattern is to patch the namespace's ServiceAccount so every Pod that uses that account automatically inherits the pull secret, avoiding per-Pod boilerplate. At pull time the kubelet selects matching credentials by registry host. Secrets are namespaced, so the credential must live in the same namespace as the Pods.

COMMON WRONG ANSWERS Using a generic Opaque Secret and expecting Kubernetes to know it is registry auth. Passing credentials via environment variables, which the kubelet never sees during pull. Embedding credentials in the Dockerfile. Forgetting that the Secret must exist in the consuming namespace.

LIKELY FOLLOW-UPS How do you avoid repeating imagePullSecrets across Pods? How would you rotate registry credentials? How does this differ on managed clusters that integrate cloud IAM for ECR or GCR?

ONE CONCRETE EXAMPLE kubectl create secret docker-registry regcred --docker-server=registry.example.com --docker-username=ci --docker-password=$TOKEN, then kubectl patch serviceaccount default -p '{"imagePullSecrets":[{"name":"regcred"}]}'. Now Pods in that namespace pull private images with no per-Pod changes.