For 1.0 RC3, how to setup GCR creds for private plugin pull

In first option, I am assuming we need to create the secret .dockerconfigjson for each repository using e.g. drone secret add --repository … command?

I suppose Option 2 can be used to solve this globally?