How do I specify imagePullSecret for the task/workflow pods?

[kumare3]

What is the correct way to specify imagePullSecret for the task/workflow pods? I'm trying to use a private Docker registry and currently get the "Container with unready status" error

[kumare3]

There are a few ways to do this,

• Manually: Update the default service account (or if using a specific serviceaccount then update that account) to add the imagePullSecrets. As explained here
• Automatically: For every new project added to Flyte, Flyte runs a specific component called the ClusterResourceManager, which is responsible to keep the cluster in sync with these various requirements. This is an optional component. It essentially applies some K8s resource with a few templatable parameters to all namespaces that flyte will use.
  - For Helm an example can be seen here. The example shows how to patch the default service account.
  - For kustomize similarly - Add the template here and refer to it here.
• Lastly: You can use the K8sPod plugin (this is a very high quality almost core plugin in Flyte) to customize your pods in anyway. This executes the entire pod spec.

Note: If using cluster resource manager, then you can patch the default serviceaccount. But if you are using workload identity or IAM for service accounts, Flyte cannot create these service accounts and you should manage them outside of Flyte (like in a CI system, terraform or through console). This is where you should add the imagepullsecret and then just pass the serviceaccount to a flyte launch plan or when starting an execution.

[maximsmol]

What worked for me was patching the default service account ❗ but under the PROJECTNAME-development
namespace. The imagePullSecrets entry must, of course, also refer to a secret under the same namespace for this to work.

Note: I had to create the project namespace manually (just yet another Kustomize resource file) since otherwise k8s will refuse to apply the config. Flyte has no issues with the existing namespace when registering the project later.