From 89ccee86bd74d006613c0fab185bc95fd2c2e00d Mon Sep 17 00:00:00 2001
From: "Junv (via Hermes)" <junv@junnv.cc>
Date: Sun, 14 Jun 2026 12:13:37 +1000
Subject: [PATCH] fix(demo-service): move imagePullSecrets to pod-level

K8s ignores imagePullSecrets at container-level; it must be at pod spec level.
This is why the pull was failing with 401.
---
 home-apps/demo-service.yaml | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/home-apps/demo-service.yaml b/home-apps/demo-service.yaml
index 38e38eb..c5962f1 100644
--- a/home-apps/demo-service.yaml
+++ b/home-apps/demo-service.yaml
@@ -110,10 +110,8 @@ spec:
         - name: api
           # Image is updated automatically by .github/workflows/build-demo-service.yml
           # on every push that changes home-apps/demo-service/**
-          image: ghcr.io/wahyd4/demo-manager:git-cbb50ac
+          image: ghcr.io/wahyd4/demo-manager:PLACEHOLDER
           imagePullPolicy: Always
-          imagePullSecrets:
-            - name: github-image-pull-secret
           ports:
             - containerPort: 3000
               name: api
@@ -135,6 +133,9 @@ spec:
               memory: 256Mi
               cpu: 500m
 
+      imagePullSecrets:
+        - name: github-image-pull-secret
+
       volumes:
         - name: caddy-config
           configMap: