Upgrade my OS with custom image in my private container registry.

[PaSharks9]

I'm quite new with k3s and Kairos OS, so maybe the question could be stupid. I'm trying to upgrade my Kairos OS through my k3s single-cluster using a docker image in my private Container Registry on GitLab. To do so, i'm trying to apply this Secret/Plan yaml file

apiVersion: v1
kind: Secret
metadata:
  name: regcred
  namespace: system-upgrade
data:
  .dockerconfigjson: <Project Access Token>
type: kubernetes.io/dockerconfigjson

---

apiVersion: upgrade.cattle.io/v1
kind: Plan
metadata:
  name: os-upgrade
  namespace: system-upgrade
  labels:
    k3s-upgrade: server
spec:
  concurrency: 1
  serviceAccountName: system-upgrade
  nodeSelector:
    matchExpressions:
      - {key: kubernetes.io/hostname, operator: Exists}
  secrets:
    - name: regcred
      path: /host/run/system-upgrade/secrets/.docker/config.json
  drain:
    force: false
    disableEviction: false
  cordon: false
  version: "<tag-i-would-like-to-use>"
  upgrade:
    image: registry.gitlab.com/path/to/my/custom/image
    command:
    - "/usr/sbin/suc-upgrade"

The error that appears is 403: Forbiddend during the pull of the image, so the auth fails.
The Secret that contains the credential is succesfully mounted into the Plan pod, the token i use is correct (with the read-repository scope). Is the use of private registries supported? Maybe the gitlab credentials are stored in the wrong path? Alternatively, I also tried unsuccessfully using this path /root/.docker/config.json.

[brandond]

data:
  .dockerconfigjson: <Project Access Token>
type: kubernetes.io/dockerconfigjson

I don't think that's how that works. Check the upstream docs for what the docker config.json file is supposed to contain. Its not just the bare token.

https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/#log-in-to-docker-hub