@ancient-wolf-19325 how to provide ImagePullSecrets to flyte task in sdkv2 ?

To provide ImagePullSecrets for pulling private container images in Flyte SDK v2, you must first create a Flyte secret of type image_pull containing your registry credentials (e.g., from your Docker config). Then, reference this secret in both your flyte.Image definition (using the registry_secret parameter) and your TaskEnvironment (using the secrets parameter). This ensures Flyte can authenticate and pull the image at runtime. Example:

# Create the secret (run in shell)
flyte create secret --type image_pull my-secret --from-file ~/.docker/config.json

# In Python
image = flyte.Image.from_debian_base(
    name="my-image",
    registry="registry.example.com/my-org",
    registry_secret="my-secret"
)
env = flyte.TaskEnvironment(
    name="my_task_env",
    image=image,
    secrets="my-secret"
)

According to Union.ai Docs, the secret name must match in both places, and the secret must be of type image_pull. Would you like more detail on secret creation or usage? Sources: - Union.ai Docs: Container images - Remote ImageBuilder 👍 0 button 👎 0 button 💡 Hint: Mention @herald in the thread for followups.

Even tho I specify the secret it fails to pull the Image with 401 auth for ghcr.io. I am using flytev2 oss version @ancient-wolf-19325

For Flyte OSS, specifying the secret in your Flyte task or image definition is not sufficient by itself. You must also configure Kubernetes to use your imagePullSecrets, either by attaching the secret to the service account used by Flyte tasks or by using a custom pod template. Without this, Flyte OSS cannot pull private images and you will get 401 errors, even if the secret exists in Flyte. See the official guidance: you need to create a Kubernetes secret and then either (1) add it to the service account used by Flyte, or (2) configure a custom pod template that includes imagePullSecrets. Refer to Flyte OSS docs on private images for step-by-step instructions. Would you like detailed steps for either the service account or pod template method? Sources: - Flyte OSS docs: Private images 👍 0 button 👎 0 button 💡 Hint: Mention @herald in the thread for followups.

I am using v2 of flyte oss @ancient-wolf-19325

In Flyte OSS v2, you still need to configure Kubernetes with imagePullSecrets for private registries. Creating a Flyte secret alone is not enough—Kubernetes must be able to use the secret to pull images. You should create a Kubernetes secret with your registry credentials and attach it to the service account used by Flyte tasks, or use a custom pod template that includes imagePullSecrets, as described in the Flyte OSS private images guide. Would you like a step-by-step example for setting up imagePullSecrets in Kubernetes for Flyte OSS v2? Sources: - Flyte OSS docs: Private images 👍 0 button 👎 0 button 💡 Hint: Mention @herald in the thread for followups.

@ancient-wolf-19325 yes an example will be amazing, thanks !

Certainly! Here’s a step-by-step example for Flyte OSS v2 using Kubernetes imagePullSecrets: 1. Create a Kubernetes secret with your registry credentials (replace values as needed):

kubectl create secret docker-registry my-ghcr-secret \
  --docker-server=ghcr.io \
  --docker-username=<your-username> \
  --docker-password=<your-personal-access-token> \
  --docker-email=<your-email> \
  -n <your-flyte-namespace>

2. Attach the secret to the service account used by Flyte tasks (default is usually

default

or

flyte

):

kubectl patch serviceaccount default \
  -p '{"imagePullSecrets": [{"name": "my-ghcr-secret"}]}' \
  -n <your-flyte-namespace>

3. Now, when Flyte launches a task, Kubernetes will use the imagePullSecret to pull from ghcr.io. No changes are needed in your Flyte SDK code for imagePullSecrets—just specify your private image as usual. For more details and alternative methods (like custom pod templates), see the Flyte OSS private images guide. Would you like an example for the custom pod template method as well? Sources: - Flyte OSS docs: Private images 👍 0 button 👎 0 button 💡 Hint: Mention @herald in the thread for followups.

@ancient-wolf-19325 can you give an example via podTemplates ?

Yes! To use imagePullSecrets via pod templates in Flyte OSS v2, create a Kubernetes secret as before, then define a custom pod template in your Flyte code that references this secret. Here’s a minimal example:

import flyte
from kubernetes.client import V1Container, V1PodSpec, V1LocalObjectReference

# Create the pod template referencing your imagePullSecret
pod_template = flyte.PodTemplate(
    primary_container_name="primary",
    pod_spec=V1PodSpec(
        containers=[V1Container(name="primary")],
        image_pull_secrets=[V1LocalObjectReference(name="my-ghcr-secret")],
    ),
)

env = flyte.TaskEnvironment(
    name="with_secret",
    image="ghcr.io/your-org/your-image:tag",
    pod_template=pod_template,
)

@env.task
async def my_task():
    ...

This ensures the pod running your task uses the specified imagePullSecret. For more, see the Flyte OSS pod templates guide. Would you like more detail on customizing the pod template? Sources: - Flyte OSS docs: Pod templates 👍 1 button 👎 0 button 💡 Hint: Mention @herald in the thread for followups.