Repository: jupyterhub/zero-to-jupyterhub-k8s

Issue:
Can't pull private image for SingleUser
I am using helm 0.9.0-alpha.1.  In pod/continuous-image-puller-2hlk8, it shows
```

 Normal  Scheduled  6m2s   default-scheduler                           Successfully assigned jupyterhub/continuous-image-puller-2hlk8 to aks-nodepool1-37655849-vmssXXXX3x
  Normal  Pulling    6m1s   kubelet, aks-nodepool1-37655849-vmssXXXX3x  Pulling image "<private_repo>.azurecr.io/jupyter-minimal-notebook:latest"
  Normal  Pulled     6m1s   kubelet, aks-nodepool1-37655849-vmssXXXX3x  Successfully pulled image "<private_repo>.azurecr.io/jupyter-minimal-notebook:latest"
  Normal  Created    6m     kubelet, aks-nodepool1-37655849-vmssXXXX3x  Created container image-pull-singleuser
  Normal  Started    6m     kubelet, aks-nodepool1-37655849-vmssXXXX3x  Started container image-pull-singleuser
  Normal
```

but when i use jupyther hub to spin up a user with similar private image <private_repo>.azurecr.io/jupyter-minimal-notebook:latest , i get 

```
  Normal   Pulling                 8s    kubelet, aks-nodepool1-37655849-vmssXXXX3x  Pulling image "<private_repo>.azurecr.io/jupyter-minimal-notebook:latest"
  Warning  Failed                  7s    kubelet, aks-nodepool1-37655849-vmssXXXX3x  Failed to pull image "<private_repo>.azurecr.io/jupyter-minimal-notebook:latest": rpc error: code = Unknown desc = Error response from daemon: Get https://<private_repo>.azurecr.io/v2/jupyter-minimal-notebook/manifests/latest: unauthorized: authentication required
  Warning  Failed                  7s    kubelet, aks-nodepool1-37655849-vmssXXXX3x  Error: ErrImagePull
  Normal   BackOff                 7s    kubelet, aks-nodepool1-37655849-vmssXXXX3x  Back-off pulling image "<private_repo>.azurecr.io/jupyter-minimal-notebook:latest"
  Warning  Failed                  7s    kubelet, aks-nodepool1-37655849-vmssXXXX3x  Error: ImagePullBackOff
```

In config.yml file, i have
```
singleuser:
  imagePullSecret: 
      name : my-existing-secret
```


Discussion:
removed pullPolicy: "Always" is the workaround for now. This is a bug when hub needs to pull the image

Resolving patch:
diff --git a/jupyterhub/files/hub/jupyterhub_config.py b/jupyterhub/files/hub/jupyterhub_config.py
--- a/jupyterhub/files/hub/jupyterhub_config.py
+++ b/jupyterhub/files/hub/jupyterhub_config.py
@@ -122,7 +122,7 @@ def camelCaseify(s):
     ('pod_name_template', None),
     ('start_timeout', None),
     ('image_pull_policy', 'image.pullPolicy'),
-    ('image_pull_secrets', 'image.pullSecrets'),
+    # ('image_pull_secrets', 'image.pullSecrets'), # Managed manually below
     ('events_enabled', 'events'),
     ('extra_labels', None),
     ('extra_annotations', None),
@@ -163,8 +163,19 @@ def camelCaseify(s):
 
     c.KubeSpawner.image = image
 
-if get_config('singleuser.imagePullSecret.enabled'):
-    c.KubeSpawner.image_pull_secrets = 'singleuser-image-credentials'
+# Combine imagePullSecret.create (single), imagePullSecrets (list), and
+# singleuser.image.pullSecrets (list).
+image_pull_secrets = []
+if get_config("imagePullSecret.automaticReferenceInjection") and (
+    get_config("imagePullSecret.create") or get_config("imagePullSecret.enabled")
+):
+    image_pull_secrets.append('image-pull-secret')
+if get_config('imagePullSecrets'):
+    image_pull_secrets.extend(get_config('imagePullSecrets'))
+if get_config('singleuser.image.pullSecrets'):
+    image_pull_secrets.extend(get_config('singleuser.image.pullSecrets'))
+if image_pull_secrets:
+    c.KubeSpawner.image_pull_secrets = image_pull_secrets
 
 # scheduling:
 if get_config('scheduling.userScheduler.enabled'):


Test patch: