cc @Marc Paquette

but basically the way these work on k8s is via imagepull secrets right?

https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ k8s has nice docs on how to create these

so these are created outside of flyte iirc (i’ll confirm this later). once they are created the way they are used by flyte is through the service account. so when you launch your flyte tasks and workflows, you always specify a service account (and possibly also an iam role but that’s irrelevant).

if you don’t specify one, then if a pod or any other K8s resources is run on the cluster, then you get the

default

service account

k8s service accounts can be tagged with an imagepullsecret

you can do this yourself…

or you can rely on the Flyte admin cluster cron job. this is a deployment that will go through and update settings on your linked k8s clusters.

that process, reads in a series of templates, that can look like this.

and when we say series of templates - this here has some more examples.

the command that is run that applies all these yaml templates to the known clusters is here.

cc @Alekhya