diff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 0000000..110be7a
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1 @@
+*.secret filter=git-crypt diff=git-crypt
\ No newline at end of file
diff --git a/k8s/README.md b/k8s/README.md
index 5deafc5..eeb7012 100644
--- a/k8s/README.md
+++ b/k8s/README.md
@@ -8,14 +8,11 @@ This folder holds all the services required for my private infrastructure. Follo
 
 ## namespaces
 
-```yaml
-k create ns flux
-k create ns cert-manager
-k create ns nginx-ingress
-k create ns infrapuzzle
-k create ns kuard
-k create ns auth
-k create nextcloud
+```sh
+namespaces="flux cert-manager nginx-ingress infrapuzzle kuard auth nextcloud datalab"
+for i in $( echo $NAMESPACES ) ; do
+  k create ns $i
+done
 ```
 
 ## [helm-operator](https://github.com/fluxcd/helm-operator/blob/master/chart/helm-operator/README.md)
@@ -93,13 +90,18 @@ Create credentials secret [according to docu](https://kubernetes.io/docs/tasks/c
 
 ```sh
 namespaces="datalab"
-for i in $namespaces ; do
-  kubectl create secret docker-registry regcred \
+for i in $( echo $namespaces ) ; do
+  kubectl create secret docker-registry hub-moritzgraf-de \
+    -n $i \
     --docker-server=hub.moritzgraf.de:5000 \
     --docker-username=moritz \
     --docker-password='xxx' \
     --docker-email=moritz@moritzgraf.de \
     --dry-run -o yaml > ./${i}/docker-pull.yaml.secret
 done
+# apply
+for i in $( echo $namespaces ) ; do
+  kubectl apply -f ${i}/docker-pull.yaml.secret
+done
 ```
 
diff --git a/k8s/datalab/docker-pull.yaml.secret b/k8s/datalab/docker-pull.yaml.secret
index 3d4d389..6e44b7c 100644
Binary files a/k8s/datalab/docker-pull.yaml.secret and b/k8s/datalab/docker-pull.yaml.secret differ