diff --git a/src/go/k8s/api/vectorized/v1alpha1/console_types.go b/src/go/k8s/api/vectorized/v1alpha1/console_types.go
index cdc0d58f..3a59aa4a 100644
--- a/src/go/k8s/api/vectorized/v1alpha1/console_types.go
+++ b/src/go/k8s/api/vectorized/v1alpha1/console_types.go
@@ -157,6 +157,13 @@ type Schema struct {
 type Deployment struct {
 	Image string `json:"image"`
 
+	// +optional
+	// Specifies credentials for a private image repository. For details, see https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/.
+	ImagePullSecrets []corev1.LocalObjectReference `json:"imagePullSecrets,omitempty"`
+
+	// +optional
+	ImagePullPolicy corev1.PullPolicy `json:"imagePullPolicy,omitempty"`
+
 	// +kubebuilder:default=1
 	Replicas int32 `json:"replicas,omitempty"`
 
diff --git a/src/go/k8s/api/vectorized/v1alpha1/zz_generated.deepcopy.go b/src/go/k8s/api/vectorized/v1alpha1/zz_generated.deepcopy.go
index 68479390..e07c4b4d 100644
--- a/src/go/k8s/api/vectorized/v1alpha1/zz_generated.deepcopy.go
+++ b/src/go/k8s/api/vectorized/v1alpha1/zz_generated.deepcopy.go
@@ -616,6 +616,11 @@ func (in *ConsoleStatus) DeepCopy() *ConsoleStatus {
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *Deployment) DeepCopyInto(out *Deployment) {
 	*out = *in
+	if in.ImagePullSecrets != nil {
+		in, out := &in.ImagePullSecrets, &out.ImagePullSecrets
+		*out = make([]v1.LocalObjectReference, len(*in))
+		copy(*out, *in)
+	}
 	if in.Resources != nil {
 		in, out := &in.Resources, &out.Resources
 		*out = new(v1.ResourceRequirements)
diff --git a/src/go/k8s/config/crd/bases/redpanda.vectorized.io_consoles.yaml b/src/go/k8s/config/crd/bases/redpanda.vectorized.io_consoles.yaml
index 080670aa..a462bb6f 100644
--- a/src/go/k8s/config/crd/bases/redpanda.vectorized.io_consoles.yaml
+++ b/src/go/k8s/config/crd/bases/redpanda.vectorized.io_consoles.yaml
@@ -343,6 +343,24 @@ spec:
                 properties:
                   image:
                     type: string
+                  imagePullPolicy:
+                    description: PullPolicy describes a policy for if/when to pull
+                      a container image
+                    type: string
+                  imagePullSecrets:
+                    description: Specifies credentials for a private image repository.
+                      For details, see https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/.
+                    items:
+                      description: LocalObjectReference contains enough information
+                        to let you locate the referenced object inside the same namespace.
+                      properties:
+                        name:
+                          description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                            TODO: Add other useful fields. apiVersion, kind, uid?'
+                          type: string
+                      type: object
+                      x-kubernetes-map-type: atomic
+                    type: array
                   maxSurge:
                     default: 1
                     format: int32
diff --git a/src/go/k8s/pkg/console/deployment.go b/src/go/k8s/pkg/console/deployment.go
index 49f36c53..e50d5a0b 100644
--- a/src/go/k8s/pkg/console/deployment.go
+++ b/src/go/k8s/pkg/console/deployment.go
@@ -89,6 +89,7 @@ func (d *Deployment) Ensure(ctx context.Context) error {
 					Containers:                    containers,
 					TerminationGracePeriodSeconds: getGracePeriod(d.consoleobj.Spec.Server.ServerGracefulShutdownTimeout.Duration),
 					ServiceAccountName:            sa,
+					ImagePullSecrets:              d.consoleobj.Spec.Deployment.ImagePullSecrets,
 				},
 			},
 			Strategy: v1.DeploymentStrategy{
@@ -555,9 +556,10 @@ func (d *Deployment) getContainers(ctx context.Context, ss map[string]string) ([
 
 	return []corev1.Container{
 		{
-			Name:  ConsoleContainerName,
-			Image: d.consoleobj.Spec.Deployment.Image,
-			Args:  []string{fmt.Sprintf("--config.filepath=%s/%s", configMountPath, "config.yaml")},
+			Name:            ConsoleContainerName,
+			Image:           d.consoleobj.Spec.Deployment.Image,
+			ImagePullPolicy: d.consoleobj.Spec.Deployment.ImagePullPolicy,
+			Args:            []string{fmt.Sprintf("--config.filepath=%s/%s", configMountPath, "config.yaml")},
 			Ports: []corev1.ContainerPort{
 				{
 					Name:          "http",