title: Pulling docker image from private github package using AWS EKS with AWS Fargate
body: <p>I wish to deploy a dockerized service with kubernetes on aws. To do so I'm using the recently released AWS EKS with AWS Fargate feature. The service's docker image is stored in a private package on github.</p>
  
  <p>To deploy my service I'm using a kubernetes manifest file containing a secret, a deployment and a service.</p>
  
  <p><strong>When locally deploying with kubectl on minikube, the deployment pods successfully pull the image from the private github package. I successfully reproduced the process for accessing a private dockerhub registry.</strong></p>
  
  <p>I then configured kubectl to connect to my eks cluster. <strong>When applying the manifest file I'm getting an ImagePullBackOff status for the deployment pods when pulling form github packages while it is working fine when pulling from dockerhub</strong>. The differences in the manifest file are as follow: </p>
  
  <p>Generating secret for github packages:</p>
  
  <pre><code>kubectl create secret docker-registry mySecret --dry-run=true --docker-server=https://docker.pkg.github.com --docker-username=myGithubUsername --docker-password=myGithubAccessToken -o yaml
  </code></pre>
  
  <p>Generating secret for dockerhub:</p>
  
  <pre><code>kubectl create secret docker-registry mySecret --dry-run=true --docker-server=https://index.docker.io/v1/ --docker-username=myDockerhubUsername --docker-password=myDockerhubPassword -o yaml
  </code></pre>
  
  <p>The deployment spec is referenced as follow: </p>
  
  <pre><code>spec:
    containers:
      # when pulling from github packages 
      - image: docker.pkg.github.com/myGithubUsername/myRepo/myPackage:tag
      # when pulling from dockerhub 
      - image: myDockerhubUsername/repository:tag
      ...
    imagePullSecrets:
      - name: mySecret
  </code></pre>
  
  <p>Trying to make this work <strong>specifically with github packages</strong> I had a try with AWS Secrets Manager.</p>
  
  <p>I created a secret "mySecret" as follows : </p>
  
  <pre><code>{
    "username" : "myGithubUsername",
    "password" : "myGithubAccessToken"
  }
  </code></pre>
  
  <p>I then created a policy to access this secret:</p>
  
  <pre><code>{
    "Version": "2012-10-17",
    "Statement": [
      {
          "Effect": "Allow",
          "Action": [
              "secretsmanager:GetSecretValue"
          ],
          "Resource": [
              "arn:aws:secretsmanager:eu-west-1:myAWSAccountId:secret:mySecret"
          ]
      }
    ]
  }
  </code></pre>
  
  <p>I then attached the policy to both the Cluster IAM Role of my eks cluster and the Pod Execution Role referenced in its fargate profile "fp-default". I'm only working in the default kubernetes namespace.
  My secret and cluster are both in the eu-west-1 region.</p>
  
  <p><strong>Still, I'm getting the ImagePullBackOff status when deploying.</strong> </p>
  
  <p>I'm having a hard time finding anything tackling this issue using AWS Fargate with AWS EKS, and would love some insight on this :)</p>
  
  <p><strong>Edit</strong>: The question was edited in order to present in a clearer maner that the issue is mainly related to using github packages as a registry provider.</p>