Question: I'm using macosx/Sierra, and I want to get write permissions in the `/System/Library/CoreServices` folder. I set myself to root via `sudo`, and all the directories in the tree have `drwxr-xr-x` permissions, but I still can't write in that directory.

```
% sudo -s
# cd /System/Library/CoreServices
# pwd
/System/Library/CoreServices
# whoami
root
# ls -ld .
0 drwxr-xr-x  160 root  wheel  5440 Feb 14 10:00 ./
# touch x
touch: x: Operation not permitted

```

Is there any way I can enable write access on this directory as `root`?

Thank you in advance.

Answer: 
Kubernetes run `docker pull pseudo/your-image:latest` under the hood. `image` field in Kubernetes resources is simply the docker image to run.

```
spec:
  containers:
  - name: app
    image: pseudo/your-image:latest
[...]

```

As the docker image name contains no specific docker registry url, the default is [docker.io](http://docker.io). Your image is in fact `docker.io/pseudo/your-image:latest`

If your image is hosted in a **private docker hub repo**, you need to specify an image pull secret in the spec field.

```
spec:
  containers:
  - name: app
    image: pseudo/your-image:latest
  imagePullSecrets:
  - name: dockerhub-credential

```

Here is the documentation to create the secret containing your docker hub login: <https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/>
1. Create a docker registry secret:

```
#!/bin/bash

for ns in $(kubectl get namespaces |grep -v NAME|awk '{print $1}')
do
   kubectl create secret docker-registry docker.registry \
       --docker-username=<MyAccountName> \
       --docker-password='MyDockerHubPassword' -n $ns
done

```

2. Patch all the dynamic service accounts in all the namesapces with the secret you created in step 1

```
for ns in $(kubectl get namespaces|grep -v NAME|awk '{print $1}')
do
        for sa in $(kubectl -n $ns get sa|grep -v SECRETS|awk '{print $1}')
        do
           kubectl patch serviceaccount $sa -p '{"imagePullSecrets": [{"name": "docker.registry"}]}' -n $ns
           if [ $? -eq 0 ]; then
                echo $ns $sa patched
           else
                echo Error patching $ns $sa
           fi
        done
done

```

You can patch only specific namespaces, if you wish.

Let me know how it goes.