Question: I'm using macosx/Sierra, and I want to get write permissions in the `/System/Library/CoreServices` folder. I set myself to root via `sudo`, and all the directories in the tree have `drwxr-xr-x` permissions, but I still can't write in that directory.

```
% sudo -s
# cd /System/Library/CoreServices
# pwd
/System/Library/CoreServices
# whoami
root
# ls -ld .
0 drwxr-xr-x  160 root  wheel  5440 Feb 14 10:00 ./
# touch x
touch: x: Operation not permitted

```

Is there any way I can enable write access on this directory as `root`?

Thank you in advance.

Answer: 
using `docker pull` or `kubectl set image`

example yaml deployment

```
apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deployment
  labels:
    app: nginx
spec:
  replicas: 3
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx:1.14.2
        ports:
        - containerPort: 80

```

start container and show status deployment with `kubectl get deployments`

result

```
 NAME               READY   UP-TO-DATE   AVAILABLE   AGE
nginx-deployment   3/3     3            3           18s

```

and now update image in kubernetes using `set image`

```
kubectl set image deployment/nginx-deployment nginx=nginx:1.16.1

```

and show status update image with `rollout`

```
kubectl rollout status deployment/nginx-deployment

```

Note: `ngnix` is name of `container ->name`

```
  containers:
      - name: nginx
        image: nginx:1.14.2

```

`nginx:1.16.1` is image version in docker hub, is recommendable change version for update

if you decided remove update and rollback to the previous revision, use `rollout undo`

```
kubectl rollout undo deployment/nginx-deployment

```

for more information, use the [documentation](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#updating-a-deployment)
1. Create a docker registry secret:

```
#!/bin/bash

for ns in $(kubectl get namespaces |grep -v NAME|awk '{print $1}')
do
   kubectl create secret docker-registry docker.registry \
       --docker-username=<MyAccountName> \
       --docker-password='MyDockerHubPassword' -n $ns
done

```

2. Patch all the dynamic service accounts in all the namesapces with the secret you created in step 1

```
for ns in $(kubectl get namespaces|grep -v NAME|awk '{print $1}')
do
        for sa in $(kubectl -n $ns get sa|grep -v SECRETS|awk '{print $1}')
        do
           kubectl patch serviceaccount $sa -p '{"imagePullSecrets": [{"name": "docker.registry"}]}' -n $ns
           if [ $? -eq 0 ]; then
                echo $ns $sa patched
           else
                echo Error patching $ns $sa
           fi
        done
done

```

You can patch only specific namespaces, if you wish.

Let me know how it goes.