<p>I got problem with connecting my k3s cluster to GitLab Docker Registry.</p>
<p>On cluster I got created secret in default namespace like this</p>
<pre><code>kubectl create secret docker-registry regcred --docker-server=https://gitlab.domain.tld:5050 --docker-username=USERNAME --docker-email=EMAIL --docker-password=TOKEN
</code></pre>
<p>Then in Deployment config I got this secret included, my config:</p>
<pre><code>apiVersion: apps/v1
kind: Deployment
metadata:
  name: app
  labels:
    app.kubernetes.io/name: &quot;app&quot;
    app.kubernetes.io/version: &quot;1.0&quot;
  namespace: default
spec:
  template:
    metadata:
      labels:
        app: app
    spec:
      imagePullSecrets:
        - name: regcred
      containers:
      - image: gitlab.domain.tld:5050/group/appproject:1.0
        name: app
        imagePullPolicy: Always
        ports:
        - containerPort: 80
</code></pre>
<p>But the created pod is still unable to pull this image.
There is still error message of:</p>
<pre><code>failed to authorize: failed to fetch anonymous token: unexpected status: 403 Forbidden
</code></pre>
<p>Can you help me, where the error may be?
If I try connect to this GitLab registry via secrets above on local docker, it working fine, docker login is right, also a pulling of this image.</p>
<p>Thanks</p>

<p>To pull from a private container registry on Gitlab you must first create a <code>Deploy Token</code> similar to how the pipeline or similar &quot;service&quot; would access it. Go to the repository  then go to <code>Settings</code> -&gt; <code>Repository</code> -&gt; <code>Deploy Tokens</code></p>
<p>Give the deploy token a <code>name</code>, and a <code>username</code>(it says optional but we'll be able to use this custom username with the token) and make sure it has read_registry access. That is all it needs to pull from the registry. If you later need to push then you would need write_registry. Once you click <code>create deploy token</code> it will show you the token be sure to copy it as you won't see it again.</p>
<p>Now just recreate your secret in your k8s cluster.</p>
<pre><code> kubectl create secret docker-registry regcred --docker-server=&lt;private gitlab registry&gt; --docker-username=&lt;deploy token username&gt; --docker-password=&lt;deploy token&gt;
</code></pre>
<p>Make sure to apply the secret to the same namespace as your deployment that is pulling the image.</p>
<p>[See Docs] <a href="https://docs.gitlab.com/ee/user/project/deploy_tokens/#gitlab-deploy-token" rel="nofollow noreferrer">https://docs.gitlab.com/ee/user/project/deploy_tokens/#gitlab-deploy-token</a></p>
