Rotate Image Pull Secrets Periodically

Create a new pull secret, patch the service account, and remove the old one so registry credentials rotate without a pod restart storm.

~25 minkubernetessecretsrotation

Task

Configure kubectl create secret docker-registry regcred --docker-server=... --docker-username=... --docker-password=$NEW so the cluster enforces the policy at admission time instead of relying on manual review.

When to use this

A developer deploys a pod without kubectl create secret docker-registry regcred --docker-server=... --docker-username=... --docker-password=$NEW and it disrupts a node, causing evictions on a production cluster.

Prerequisites

A Kubernetes cluster with kubectl access
Cluster admin or namespace edit RBAC

Steps

1. Configure kubectl create secret docker-registry regcred --docker-server=... --docker-username=... --docker-password=$NEW in the project configuration file with the recommended defaults.

kubectl create secret docker-registry regcred --docker-server=... --docker-username=... --docker-password=$NEW

Expected output: The configuration is accepted and kubectl create secret docker-registry regcred --docker-server=... --docker-username=... --docker-password=$NEW runs without errors on the first invocation.

2. Run the check locally to verify kubectl create secret docker-registry regcred --docker-server=... --docker-username=... --docker-password=$NEW produces the expected result before pushing.

pnpm test

Expected output: Local run matches CI behavior; no surprises after push.

3. Add the gate to the CI pipeline so kubectl create secret docker-registry regcred --docker-server=... --docker-username=... --docker-password=$NEW blocks merge on failure.

- name: Run add image pull secret rotation
  run: pnpm test

Expected output: Pull requests with failing kubectl create secret docker-registry regcred --docker-server=... --docker-username=... --docker-password=$NEW are blocked from merging.

Troubleshooting

Problem

The check passes locally but fails in CI

Solution

Pin dependency versions and the runtime to match CI exactly; reproduce with the same Docker image or act.

Problem

Configuration is rejected with a schema error

Solution

Check the tool version matches the config schema; older versions may not support newer fields.

Limitations

The gate only runs on events that trigger the workflow; locally pushed commits bypass it.
Configuration drift is possible if someone edits settings outside version control.

Enforce at admission

Start by measuring the problem. Create a new pull secret, patch the service account, and remove the old one so registry credentials rotate without a pod restart storm. The most common mistake is adding the gate without first confirming it catches the issue you care about. Run kubectl create secret docker-registry regcred –docker-server=… –docker-username=… –docker-password=$NEW against the current codebase and inspect the output before wiring it into CI.

kubectl create secret docker-registry regcred --docker-server=... --docker-username=... --docker-password=$NEW

Verify the policy

Once the gate is in place, make failures actionable. A failing kubectl create secret docker-registry regcred –docker-server=… –docker-username=… –docker-password=$NEW should point to the exact file and line, not a generic error. Pin the tool version in the lockfile so a upstream release does not silently change behavior. Review the gate output in every pull request just like a test result.