Clarify image pull secret documentation (#48718)

* Clarify image pull secret documentation

The statement about missing pull secrets is incorrect, the kubelet will still attempt to pull the image if a pull secret is missing.

Added some information about how multiple pull secrets are handled.

Signed-off-by: James Hewitt <[email protected]>

* Update content/en/docs/tasks/configure-pod-container/pull-image-private-registry.md

Co-authored-by: Xander Grzywinski <[email protected]>

* Clarify what happens if no pull secret matches

---------

Signed-off-by: James Hewitt <[email protected]>
Co-authored-by: Xander Grzywinski <[email protected]>

Author: Jamstah

content/en/docs/concepts/containers/images.md

@@ -261,7 +261,7 @@ Credentials can be provided in several ways:
   - all pods can use any images cached on a node
   - requires root access to all nodes to set up
 - Specifying ImagePullSecrets on a Pod
-  - only pods which provide own keys can access the private registry
+  - only pods which provide their own keys can access the private registry
 - Vendor-specific or local extensions
   - if you're using a custom node configuration, you (or your cloud
     provider) can implement your mechanism for authenticating the node

content/en/docs/tasks/configure-pod-container/pull-image-private-registry.md

@@ -227,8 +227,6 @@ kubectl describe pod private-reg
 
 If you then see an event with the reason set to `FailedToRetrieveImagePullSecret`,
 Kubernetes can't find a Secret with name (`regcred`, in this example).
-If you specify that a Pod needs image pull credentials, the kubelet checks that it can
-access that Secret before attempting to pull the image.
 
 Make sure that the Secret you have specified exists, and that its name is spelled properly.
 ```shell
@@ -238,6 +236,14 @@ Events:
   ...  FailedToRetrieveImagePullSecret  ...  Unable to retrieve some image pull secrets (<regcred>); attempting to pull the image may not succeed.
 ```
 
+## Using images from multiple registries
+
+A pod can have multiple containers, each container image can be from a different registry.
+You can use multiple `imagePullSecrets` with one pod, and each can contain multiple credentials.
+
+The image pull will be attempted using each credential that matches the registry.
+If no credentials match the registry, the image pull will be attempted without authorization or using custom runtime specific configuration.
+
 ## {{% heading "whatsnext" %}}
 
 * Learn more about [Secrets](/docs/concepts/configuration/secret/)