# Authenticating Job pods to private registry

**URL:** <https://community.replicated.com/t/authenticating-job-pods-to-private-registry/969>\
**Category:** How do I?\
**Created:** [September 9, 2022, 3:23am UTC](https://community.replicated.com/t/authenticating-job-pods-to-private-registry/969 "2022-09-09T03:23:38Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![anyweez](https://yyz2.discourse-cdn.com/flex030/user_avatar/community.replicated.com/anyweez/32/544_2.png) [@anyweez](https://community.replicated.com/u/anyweez)\
**Post date:** [September 9, 2022, 3:23am UTC](https://community.replicated.com/t/authenticating-job-pods-to-private-registry/969/1 "2022-09-09T03:23:38Z")

</div>

I’m using Replicated’s [private image registry](https://docs.replicated.com/vendor/packaging-private-images#push-images-to-the-replicated-private-registry) to host images for my application. This works well for all resources that are created at installation time, but I’m running into permission issues when I run a Kubernetes job that needs to retrieve an image from the same repository.

```auto
Message: Failed to pull image "registry.replicated.com/subsalt/runner-full:v0.7.9": rpc error: code = Unknown desc = failed to pull and unpack image "registry.replicated.com/subsalt/runner-full:v0.7.9": 
failed to resolve reference "registry.replicated.com/subsalt/runner-full:v0.7.9": 
failed to authorize: failed to fetch anonymous token: unexpected status: 401 Unauthorized

```

We’re running a Kubernetes Job that kicks off several pods to actually complete the pipeline tasks. The pipeline tasks (pods) are what are currently failing with the error above.

How would I update the pod spec for a Job so it got access to the necessary access credentials? It looks like the installer creates an [`imagePullSecret`](https://docs.replicated.com/vendor/packaging-private-images#push-images-to-the-replicated-private-registry) during installation time, but I’m not sure how to access that post-installation.

---

<div class="post-metadata">

**Author:** ![anyweez](https://yyz2.discourse-cdn.com/flex030/user_avatar/community.replicated.com/anyweez/32/544_2.png) [@anyweez](https://community.replicated.com/u/anyweez)\
**Post date:** [September 10, 2022, 1:16am UTC](https://community.replicated.com/t/authenticating-job-pods-to-private-registry/969/2 "2022-09-10T01:16:09Z")

</div>

Solved it! The solution that worked for me is based on [these instructions](https://docs.replicated.com/vendor/operator-referencing-images#determining-the-imagepullsecret) – I created a new Secret that contained the registry pull secret (see `LocalRegistryImagePullSecret`), and then added this as the `imagePullSecret` to the jobs & pods that were failing before. [These instructions](https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/#create-a-pod-that-uses-your-secret) were helpful as well.

Thanks to the Replicated team (especially @jdewinne!) for the assistance resolving this offline.

---

<div class="post-metadata">

**Author:** ![dex](https://yyz2.discourse-cdn.com/flex030/user_avatar/community.replicated.com/dex/32/26_2.png) [@dex](https://community.replicated.com/u/dex)\
**Post date:** [September 18, 2022, 12:35pm UTC](https://community.replicated.com/t/authenticating-job-pods-to-private-registry/969/3 "2022-09-18T12:35:29Z")

</div>

For posterity, adding a few other links that will be useful for folks who stumble across this post:

[Defining Additional Images](https://docs.replicated.com/vendor/operator-defining-additional-images) - for when you want to include images in your airgap bundle that cannot be auto-detected from your YAML

```auto
apiVersion: kots.io/v1beta1
kind: Application
metadata:
  name: my-operator
spec:
  additionalImages:
    - elasticsearch:7.6.0
    - registry.replicated.com/my-operator/my-private-image:abd123f
    - quay.io/orgname/private-image:v1.2.3

```

[Referencing Images](https://docs.replicated.com/vendor/operator-referencing-images#adding-a-reference-to-the-local-registry) - for when you want to tell downstream workloads (e.g. those generated by an operator) where to get their images from with something like

```auto
repl{{ LocalImageName "elasticsearch:7.6.0" }}

```