From eadd11cbdd9cb403e68486fe8a339ef3c609fc71 Mon Sep 17 00:00:00 2001
From: Thanatat Tamtan <acoshift@gmail.com>
Date: Wed, 28 Oct 2026 16:08:33 +0700
Subject: [PATCH] Document that same-project images still need a pull secret

The deploy form can create the registry-pull account and secret for the
selected location. The platform does not inject those credentials.

Prompter: ACS
---
 content/registry/overview.md     | 12 ++++++------
 content/registry/pull-secrets.md |  3 ++-
 2 files changed, 8 insertions(+), 7 deletions(-)

diff --git a/content/registry/overview.md b/content/registry/overview.md
index f466efc..f95369f 100644
--- a/content/registry/overview.md
+++ b/content/registry/overview.md
@@ -3,7 +3,7 @@ title: 'Registry overview'
 linkTitle: 'Overview'
 weight: 1
 description: 'A private container registry at registry.deploys.app, one namespace per project.'
-lead: 'Every project gets a private slice of registry.deploys.app for its own application images. Push from CI, pull from your deployments — no extra credentials to plumb around.'
+lead: 'Every project gets a private slice of registry.deploys.app for its own application images. Push from CI. A deployment in the same project still needs a pull secret to pull them.'
 ---
 
 ## The Registry page
@@ -93,15 +93,15 @@ repository implicitly. There's no separate "create repository" step.
 
 ## Pulling from a deployment
 
-Deployments in the same project pull from `registry.deploys.app` automatically
-— the platform injects the right credentials at deploy time. You set
-`image: registry.deploys.app/<project>/<name>:<tag>` in the deploy config and
-that's it.
+A same-project image still needs a pull secret. On the deploy form, New creates
+the registry-pull account and secret for the selected location. Set the image
+and select that secret:
 
 ```json
 {
   "name": "api",
-  "image": "registry.deploys.app/acme/api:v1.8.0"
+  "image": "registry.deploys.app/acme/api:v1.8.0",
+  "pullSecret": "registry-pull"
 }
 ```
 
diff --git a/content/registry/pull-secrets.md b/content/registry/pull-secrets.md
index 1191555..5858daa 100644
--- a/content/registry/pull-secrets.md
+++ b/content/registry/pull-secrets.md
@@ -11,7 +11,8 @@ lead: 'A pull secret holds the credentials a deployment uses to pull an image fr
 Three cases:
 
 - Image in **`registry.deploys.app/<project>/...`** within the *same* project →
-  no pull secret needed.
+  a pull secret is still required. On the deploy form, New creates the
+  registry-pull account and secret for the selected location.
 - Image in `registry.deploys.app/<otherProject>/...` → create a pull secret
   with credentials that have read access to that project's registry.
 - Image in a **third-party registry** (Docker Hub private, GHCR, GCR, ECR,