---
title: "Pull images from a Kubernetes pod"
description: "Create a Kubernetes secret from a Container Registry access token so your pods can pull private images from a registry project."
content_type: "how-to"
product: "container-registry"
platform: "MyAccount"
url: "/myaccount/container-registry/how-to/pull-images-from-a-kubernetes-pod/"
topic: ["create-and-connect"]
relationships: {"requires":["/myaccount/container-registry/how-to/create-an-access-token/"]}
---

# Pull images from a Kubernetes pod

A pod pulls a private image from your registry project with a Kubernetes secret that holds an access
token. A secret is a Kubernetes object that keeps a small piece of sensitive data, such as a token,
out of your pod specification and your images. You create the secret once in each namespace, and
name it in every pod that pulls from the project.

## Before you begin

You need:

- An image in your registry project. See
  [Push and pull images](/myaccount/container-registry/how-to/push-and-pull-images/).
- An access token for the project, and its **Token Name** and **Token Value**. A pull-only token is
  enough. See
  [Create an access token](/myaccount/container-registry/how-to/create-an-access-token/).
- `kubectl` installed and connected to your Kubernetes cluster, and the name of the namespace your
  pod runs in.
- Nodes that can reach both `registry.e2enetworks.net` and `objectstore.e2enetworks.net` over HTTPS.
  The image layers download from the second address.

## Create the secret

Run this command, with your own values:

```bash
kubectl create secret docker-registry <secret-name> \
  --namespace <namespace> \
  --docker-server=registry.e2enetworks.net \
  --docker-username=<token-name> \
  --docker-password=<token-value>
```

- `<secret-name>`: a name for the secret, such as `registry-pull`.
- `<namespace>`: the namespace of the pod that pulls the image. A pod can use only a secret in its
  own namespace.
- `<token-name>` and `<token-value>`: the token's **Token Name** and **Token Value**, exactly as the
  **Access Token** dialog showed them.

Kubernetes prints `secret/<secret-name> created`.

## Name the secret in the pod

1. Find the image's path. In MyAccount, under **Storage**, click **Container Registry**, and click
   your project. On its **Repositories** tab, click the repository, and copy the artifact's
   **Pull Command**. The image path is everything after `docker pull`, and it has the form
   `registry.e2enetworks.net/<project-name>/<repository>@<digest>`. A path by tag,
   `registry.e2enetworks.net/<project-name>/<repository>:<tag>`, works too.
2. Save this as `private-image-pod.yaml`, with the image path in `image` and your secret's name
   under the pod's image pull secrets:

   ```yaml
   apiVersion: v1
   kind: Pod
   metadata:
     name: private-image-pod
     namespace: <namespace>
   spec:
     containers:
       - name: app
         image: registry.e2enetworks.net/<project-name>/<repository>@<digest>
     imagePullSecrets:
       - name: <secret-name>
   ```

3. Create the pod:

   ```bash
   kubectl apply -f private-image-pod.yaml
   ```

For a Deployment, put the image pull secrets under the pod template's spec, next to its containers:

```yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: web
  namespace: <namespace>
spec:
  replicas: 2
  selector:
    matchLabels:
      app: web
  template:
    metadata:
      labels:
        app: web
    spec:
      containers:
        - name: app
          image: registry.e2enetworks.net/<project-name>/<repository>:<tag>
      imagePullSecrets:
        - name: <secret-name>
```

## Check that the pod pulled the image

```bash
kubectl get pod private-image-pod --namespace <namespace>
```

For the Deployment, list its pods by the label it gives them:

```bash
kubectl get pods --namespace <namespace> -l app=web
```

A pod reads `Running` once Kubernetes has pulled the image and started it. If it reads
ImagePullBackOff or ErrImagePull, see
[Troubleshooting Container Registry](/myaccount/container-registry/troubleshooting/container-registry/#a-pod-reads-imagepullbackoff-or-the-pull-returns-401-unauthorized).

Your pods can now pull images from your registry project. When you reset the token later, delete the
secret with `kubectl delete secret <secret-name> --namespace <namespace>`, then create it again with
the new value; see
[Manage an access token](/myaccount/container-registry/how-to/manage-an-access-token/).