Set up GHCR credentials

This assumes you can already reach your cluster with kubectl (see the kubectl quickstart).

To run your own images you need credentials in two places: locally, to push images to a registry, and in the cluster, to pull them back down. This sets up both for GitHub Container Registry (ghcr.io), which serves private packages by default.

Create a token

1. Go to github.com/settings/tokens.
2. Click Generate new token, then Generate new token (classic).
3. Give it a name and an expiry.
4. Under Select scopes, check write:packages. This automatically includes read:packages, which together cover both directions:
   • write:packages lets you push from your machine.
   • read:packages lets the cluster pull.
5. Click Generate token and copy the value now, GitHub won’t show it again.

Caution

Treat the token like a password. Don’t commit it or share it in plaintext.

Log in locally

So you can push images from your machine:

docker login ghcr.io -u <github-username>

Paste the token at the Password: prompt. Tools that build images, including ko, read this Docker login.

Create the cluster pull secret

Create a namespace and a pull secret in it:

kubectl create namespace demo

kubectl create secret docker-registry ghcr \
  --docker-server=ghcr.io \
  --docker-username=<github-username> \
  --docker-password=<github-pat> \
  -n demo

Attach it to the namespace’s default ServiceAccount so every pod uses it automatically:

kubectl patch serviceaccount default -n demo \
  -p '{"imagePullSecrets":[{"name":"ghcr"}]}'

Alternatively, reference it on a single workload instead of the whole namespace:

spec:
  template:
    spec:
      imagePullSecrets:
        - name: ghcr
      containers:
        - name: app
          image: ghcr.io/<you>/<private-image>:<tag>