how to config imagePullSecrets in kubernetes pod with initial container - kubernetes

Question

I am pulling image from server in kubernetes(v1.15.2) pod, I am using this config to auth my access in containers:
"imagePullSecrets": [
{
"name": "regcred"
}
]
but it seems not work with the initial containers, when pulling initial container,the kubernetes pod throw this error:
Failed to pull image "registry.cn-hangzhou.aliyuncs.com/app_k8s/fat/alpine-bash:3.8": rpc error: code = Unknown desc = Error response from daemon: pull access denied for registry.cn-hangzhou.aliyuncs.com/dabai_app_k8s/dabai_fat/alpine-bash, repository does not exist or may require 'docker login': denied: requested access to the resource is denied
so how to specify the auth info with the initial containers of kubernetes pod to make it works? this is my full config:
kind: Deployment
apiVersion: apps/v1
metadata:
name: deployment-apollo-portal-server
namespace: sre
selfLink: /apis/apps/v1/namespaces/sre/deployments/deployment-apollo-portal-server
uid: bc8e94bb-524d-487e-b9bb-90624cfcace3
resourceVersion: '479747'
generation: 4
creationTimestamp: '2020-05-31T05:34:08Z'
labels:
app: deployment-apollo-portal-server
annotations:
deployment.kubernetes.io/revision: '4'
kubectl.kubernetes.io/last-applied-configuration: >
{"apiVersion":"apps/v1","kind":"Deployment","metadata":{"annotations":{},"labels":{"app":"deployment-apollo-portal-server"},"name":"deployment-apollo-portal-server","namespace":"sre"},"spec":{"replicas":3,"selector":{"matchLabels":{"app":"pod-apollo-portal-server"}},"strategy":{"rollingUpdate":{"maxSurge":1,"maxUnavailable":1},"type":"RollingUpdate"},"template":{"metadata":{"labels":{"app":"pod-apollo-portal-server"}},"spec":{"affinity":{"podAntiAffinity":{"preferredDuringSchedulingIgnoredDuringExecution":[{"podAffinityTerm":{"labelSelector":{"matchExpressions":[{"key":"app","operator":"In","values":["pod-apollo-portal-server"]}]},"topologyKey":"kubernetes.io/hostname"},"weight":100}]}},"containers":[{"env":[{"name":"APOLLO_PORTAL_SERVICE_NAME","value":"service-apollo-portal-server.sre"}],"image":"apollo-portal-server:v1.0.0","imagePullPolicy":"IfNotPresent","livenessProbe":{"initialDelaySeconds":120,"periodSeconds":15,"tcpSocket":{"port":8070}},"name":"container-apollo-portal-server","ports":[{"containerPort":8070,"protocol":"TCP"}],"readinessProbe":{"initialDelaySeconds":10,"periodSeconds":5,"tcpSocket":{"port":8070}},"securityContext":{"privileged":true},"volumeMounts":[{"mountPath":"/apollo-portal-server/config/application-github.properties","name":"volume-configmap-apollo-portal-server","subPath":"application-github.properties"},{"mountPath":"/apollo-portal-server/config/apollo-env.properties","name":"volume-configmap-apollo-portal-server","subPath":"apollo-env.properties"}]}],"dnsPolicy":"ClusterFirst","initContainers":[{"command":["bash","-c","curl
--connect-timeout 2 --max-time 5 --retry 60 --retry-delay 1
--retry-max-time 120
service-apollo-admin-server-dev.sre:8090"],"image":"alpine-bash:3.8","name":"check-service-apollo-admin-server-dev"},{"command":["bash","-c","curl
--connect-timeout 2 --max-time 5 --retry 60 --retry-delay 1
--retry-max-time 120
service-apollo-admin-server-test-alpha.sre:8090"],"image":"alpine-bash:3.8","name":"check-service-apollo-admin-server-alpha"},{"command":["bash","-c","curl
--connect-timeout 2 --max-time 5 --retry 60 --retry-delay 1
--retry-max-time 120
service-apollo-admin-server-test-beta.sre:8090"],"image":"alpine-bash:3.8","name":"check-service-apollo-admin-server-beta"},{"command":["bash","-c","curl
--connect-timeout 2 --max-time 5 --retry 60 --retry-delay 1
--retry-max-time 120
service-apollo-admin-server-prod.sre:8090"],"image":"alpine-bash:3.8","name":"check-service-apollo-admin-server-prod"}],"restartPolicy":"Always","volumes":[{"configMap":{"items":[{"key":"application-github.properties","path":"application-github.properties"},{"key":"apollo-env.properties","path":"apollo-env.properties"}],"name":"configmap-apollo-portal-server"},"name":"volume-configmap-apollo-portal-server"}]}}}}
spec:
replicas: 3
selector:
matchLabels:
app: pod-apollo-portal-server
template:
metadata:
creationTimestamp: null
labels:
app: pod-apollo-portal-server
spec:
volumes:
- name: volume-configmap-apollo-portal-server
configMap:
name: configmap-apollo-portal-server
items:
- key: application-github.properties
path: application-github.properties
- key: apollo-env.properties
path: apollo-env.properties
defaultMode: 420
initContainers:
- name: check-service-apollo-admin-server-dev
image: >-
registry.cn-hangzhou.aliyuncs.com/dabai_app_k8s/dabai_fat/alpine-bash:3.8
command:
- bash
- '-c'
- >-
curl --connect-timeout 2 --max-time 5 --retry 60 --retry-delay 1
--retry-max-time 120 service-apollo-admin-server-dev.sre:8090
resources: {}
terminationMessagePath: /dev/termination-log
terminationMessagePolicy: File
imagePullPolicy: IfNotPresent
- name: check-service-apollo-admin-server-alpha
image: >-
registry.cn-hangzhou.aliyuncs.com/dabai_app_k8s/dabai_fat/alpine-bash:3.8
command:
- bash
- '-c'
- >-
curl --connect-timeout 2 --max-time 5 --retry 60 --retry-delay 1
--retry-max-time 120
service-apollo-admin-server-test-alpha.sre:8090
resources: {}
terminationMessagePath: /dev/termination-log
terminationMessagePolicy: File
imagePullPolicy: IfNotPresent
- name: check-service-apollo-admin-server-beta
image: >-
registry.cn-hangzhou.aliyuncs.com/dabai_app_k8s/dabai_fat/alpine-bash:3.8
command:
- bash
- '-c'
- >-
curl --connect-timeout 2 --max-time 5 --retry 60 --retry-delay 1
--retry-max-time 120
service-apollo-admin-server-test-beta.sre:8090
resources: {}
terminationMessagePath: /dev/termination-log
terminationMessagePolicy: File
imagePullPolicy: IfNotPresent
- name: check-service-apollo-admin-server-prod
image: >-
registry.cn-hangzhou.aliyuncs.com/dabai_app_k8s/dabai_fat/alpine-bash:3.8
command:
- bash
- '-c'
- >-
curl --connect-timeout 2 --max-time 5 --retry 60 --retry-delay 1
--retry-max-time 120 service-apollo-admin-server-prod.sre:8090
resources: {}
terminationMessagePath: /dev/termination-log
terminationMessagePolicy: File
imagePullPolicy: IfNotPresent
containers:
- name: container-apollo-portal-server
image: >-
registry.cn-hangzhou.aliyuncs.com/dabai_app_k8s/dabai_fat/apollo-portal-server:v1.0.0
ports:
- containerPort: 8070
protocol: TCP
env:
- name: APOLLO_PORTAL_SERVICE_NAME
value: service-apollo-portal-server.sre
resources: {}
volumeMounts:
- name: volume-configmap-apollo-portal-server
mountPath: /apollo-portal-server/config/application-github.properties
subPath: application-github.properties
- name: volume-configmap-apollo-portal-server
mountPath: /apollo-portal-server/config/apollo-env.properties
subPath: apollo-env.properties
livenessProbe:
tcpSocket:
port: 8070
initialDelaySeconds: 120
timeoutSeconds: 1
periodSeconds: 15
successThreshold: 1
failureThreshold: 3
readinessProbe:
tcpSocket:
port: 8070
initialDelaySeconds: 10
timeoutSeconds: 1
periodSeconds: 5
successThreshold: 1
failureThreshold: 3
terminationMessagePath: /dev/termination-log
terminationMessagePolicy: File
imagePullPolicy: IfNotPresent
securityContext:
privileged: true
restartPolicy: Always
terminationGracePeriodSeconds: 30
dnsPolicy: ClusterFirst
securityContext: {}
imagePullSecrets:
- name: regcred
affinity:
podAntiAffinity:
preferredDuringSchedulingIgnoredDuringExecution:
- weight: 100
podAffinityTerm:
labelSelector:
matchExpressions:
- key: app
operator: In
values:
- pod-apollo-portal-server
topologyKey: kubernetes.io/hostname
schedulerName: default-scheduler
strategy:
type: RollingUpdate
rollingUpdate:
maxUnavailable: 1
maxSurge: 1
revisionHistoryLimit: 10
progressDeadlineSeconds: 600
status:
observedGeneration: 4
replicas: 4
updatedReplicas: 2
unavailableReplicas: 4
conditions:
- type: Available
status: 'False'
lastUpdateTime: '2020-05-31T05:34:08Z'
lastTransitionTime: '2020-05-31T05:34:08Z'
reason: MinimumReplicasUnavailable
message: Deployment does not have minimum availability.
- type: Progressing
status: 'False'
lastUpdateTime: '2020-05-31T06:08:24Z'
lastTransitionTime: '2020-05-31T06:08:24Z'
reason: ProgressDeadlineExceeded
message: >-
ReplicaSet "deployment-apollo-portal-server-dc65dcf6b" has timed out
progressing.