Create Docker Registry Secret with kubectl
A pod is using a Secret to authenticate to a private registry. The Secret type must be 'kubernetes.io/dockerconfigjson'. Which of the following is the correct way to create such a Secret using kubectl?
Quick Answer
The answer is to use `kubectl create secret docker-registry` with the required flags. This is the correct approach because it is the dedicated kubectl command for creating a Secret of type `kubernetes.io/dockerconfigjson`, automatically generating the properly formatted `.dockerconfigjson` field with base64-encoded credentials. The kubelet reads this exact field to authenticate against a private registry when pulling container images, making it essential for any pod that needs to access a non-public image repository. On the CKAD exam, this tests your ability to handle image pull secrets efficiently under time pressure; a common trap is manually crafting a generic Secret with the wrong type or incorrect JSON structure, which will cause image pull failures. Remember that the `docker-registry` subcommand handles all the encoding and formatting for you, so never try to build the JSON by hand. A simple memory tip: think "docker-registry" as the one-word shortcut to avoid the complex `dockerconfigjson` type name.
⚠ Common exam trap
Candidates often think any Secret with a `.dockerconfigjson` key works, but without the correct `kubernetes.io/dockerconfigjson` type, the kubelet will not interpret the data properly, leading to image pull failures.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
kubectl create secret docker-registry regcred --docker-server=my-registry.example.com --docker-username=myuser --docker-password=mypassword --docker-email=myemail@example.com
`kubectl create secret docker-registry` is the dedicated command to create a Secret of type `kubernetes.io/dockerconfigjson`. It automatically generates the required `.dockerconfigjson` field with the base64-encoded Docker credentials in the correct JSON format, which the kubelet uses to authenticate to a private registry when pulling images.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
kubectl create secret generic regcred --type=kubernetes.io/dockercfg --from-literal=.dockercfg=...
Why it's wrong here
The type should be kubernetes.io/dockerconfigjson, not dockercfg.
- ✗
kubectl create secret generic regcred --from-file=.dockerconfigjson=/root/.docker/config.json
Why it's wrong here
This creates a generic Secret, not the dockerconfigjson type.
- ✗
kubectl create secret tls regcred --cert=cert.crt --key=key.key
Why it's wrong here
This creates a TLS Secret, not a docker registry Secret.
- ✓
kubectl create secret docker-registry regcred --docker-server=my-registry.example.com --docker-username=myuser --docker-password=mypassword --docker-email=myemail@example.com
Why this is correct
This correctly creates a dockerconfigjson Secret.
Go deeper
Related to this question
About these practice questions
This CKAD question is part of Courseiva's 160-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CKAD
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A developer needs to create a Kubernetes Secret for Docker registry authentication. The registry URL is 'myregistry.io', username 'user', password 'pass', email 'user@example.com'. Which command creates this Secret?
easy- A.kubectl create secret tls regcred --cert=cert --key=key
- B.kubectl create secret generic regcred --from-literal=username=user --from-literal=password=pass
- C.kubectl create secret registry regcred --server=myregistry.io --username=user --password=pass
- ✓ D.kubectl create secret docker-registry regcred --docker-server=myregistry.io --docker-username=user --docker-password=pass --docker-email=user@example.com
Why D: `kubectl create secret docker-registry` is the dedicated command for creating a Docker registry authentication secret, which automatically encodes the provided credentials into a `.dockerconfigjson` format. This secret type is specifically designed for pulling images from private registries, and the flags `--docker-server`, `--docker-username`, `--docker-password`, and `--docker-email` match the required fields for registry authentication.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKAD practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKAD exam.