<p>I have specified a certain <a href="http://kubernetes.io/v1.1/docs/user-guide/images.html#specifying-imagepullsecrets-on-a-pod" rel="nofollow">image pull secret</a> for my replication controller, but it doesn't appear to be applied when downloading the Docker image:</p>

<pre><code>$ ~/.local/bin/kubectl --kubeconfig=/etc/kubernetes/kube.conf get events
FIRSTSEEN   LASTSEEN   COUNT     NAME                                             KIND      SUBOBJECT              REASON           SOURCE                                                        MESSAGE
8h          8s         3074      web-73na4                                        Pod       spec.containers{web}   Pulling          {kubelet ip-172-31-29-110.eu-central-1.compute.internal}      Pulling image "quay.io/aknuds1/realtime-music"
8h          5s         3074      web-73na4                                        Pod       spec.containers{web}   Failed           {kubelet ip-172-31-29-110.eu-central-1.compute.internal}      Failed to pull image "quay.io/aknuds1/realtime-music": image pull failed for quay.io/aknuds1/realtime-music, this may be because there are no credentials on this request.  details: (Error: Status 403 trying to pull repository aknuds1/realtime-music: "{\"error\": \"Permission Denied\"}")
</code></pre>

<p>How do I make the replication controller use the image pull secret "quay.io" when downloading the image? The replication controller spec looks as follows:</p>

<pre><code>{
  "kind": "ReplicationController",
  "apiVersion": "v1",
  "metadata": {
    "name": "web",
    "labels": {
      "app": "web"
    }
  },
  "spec": {
    "replicas": 1,
    "selector": {
      "app": "web"
    },
    "template": {
      "metadata": {
        "labels": {
          "app": "web"
        }
      },
      "spec": {
        "containers": [
          {
            "name": "web",
            "image": "quay.io/aknuds1/realtime-music",
            "ports": [
              {
                "name": "http-server",
                "containerPort": 80
              }
            ]
          }
        ],
        "imagePullSecrets": [
          {
            "name": "quay.io"
          }
        ]
      }
    }
  }
}
</code></pre>

<h1>Edit</h1>

<p>I created the quay.io secret like this: <code>~/.local/bin/kubectl --kubeconfig=/etc/kubernetes/kube.conf create -f /tmp/image-pull-secret.yaml</code>. The content of /tmp/image-pull-secret.yaml is basically like this:</p>

<pre><code>apiVersion: v1
kind: Secret
metadata:
  name: quay.io
data:
  .dockercfg: &lt;base64 encoded dockercfg&gt;
type: kubernetes.io/dockercfg
</code></pre>

<h1>Output from <code>kubectl get pods web-73na4 -o yaml</code>, in response to @PaulMorie</h1>

<pre><code>apiVersion: v1
kind: Pod
metadata:
  annotations:
    kubernetes.io/created-by: |
      {"kind":"SerializedReference","apiVersion":"v1","reference":{"kind":"ReplicationController","namespace":"default","name":"web","uid":"e1b7a3f0-e349-11e5-a136-02420a022e02","apiVersion":"v1","resourceVersion":"31503"}}
  creationTimestamp: 2016-03-06T03:16:56Z
  generateName: web-
  labels:
    app: web
  name: web-73na4
  namespace: default
  resourceVersion: "31516"
  selfLink: /api/v1/namespaces/default/pods/web-73na4
  uid: e1b89066-e349-11e5-a136-02420a022e02
spec:
  containers:
  - image: quay.io/aknuds1/realtime-music
    imagePullPolicy: IfNotPresent
    name: web
    ports:
    - containerPort: 80
      name: http-server
      protocol: TCP
    resources: {}
    terminationMessagePath: /dev/termination-log
    volumeMounts:
    - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
      name: default-token-5s7kd
      readOnly: true
  dnsPolicy: ClusterFirst
  nodeName: ip-172-31-29-110.eu-central-1.compute.internal
  restartPolicy: Always
  serviceAccount: default
  serviceAccountName: default
  terminationGracePeriodSeconds: 30
  volumes:
  - name: default-token-5s7kd
    secret:
      secretName: default-token-5s7kd
status:
  conditions:
  - lastProbeTime: null
    lastTransitionTime: null
    status: "False"
    type: Ready
  containerStatuses:
  - image: quay.io/aknuds1/realtime-music
    imageID: ""
    lastState: {}
    name: web
    ready: false
    restartCount: 0
    state:
      waiting:
        message: 'image pull failed for quay.io/aknuds1/realtime-music, this may be
          because there are no credentials on this request.  details: (Error: Status
          403 trying to pull repository aknuds1/realtime-music: "{\"error\": \"Permission
          Denied\"}")'
        reason: PullImageError
  hostIP: 172.31.29.110
  phase: Pending
  podIP: 10.2.2.3
  startTime: 2016-03-06T03:16:56Z
</code></pre>

<p><strong>Update</strong> (That is what I did to use a private image):</p>

<p>First log in quay.io:</p>

<pre><code>$ docker login quay.io
Username (username):
Password:
WARNING: login credentials saved in /Users/user/.docker/config.json
Login Succeeded
</code></pre>

<p>Then I created a new file (my-credentials.json) that only had the quay.io credentials that docker added in the config.json file (I realized that it had more credentials apart from the quay.io).</p>

<pre><code>$ cat config.json
{
  "quay.io": {
    "auth": "xxxxxxxxxxxxxxxxxxxxx",
    "email": "user@example.com"
  }
}
</code></pre>

<p>After that, I generated the base64:</p>

<pre><code> $ cat ./my-credentials.json | base64
 &lt;base64-value&gt;
</code></pre>

<p>And I created the secret resource:</p>

<pre><code>apiVersion: v1
kind: Secret
metadata:
  name: myregistrykey
data:
  .dockercfg: &lt;base64-value&gt;
type: kubernetes.io/dockercfg

$ kubectl create -f image-pull-secret.yaml
</code></pre>

<p>Finally, I created the pod:</p>

<pre><code>{
  "kind": "ReplicationController",
  "apiVersion": "v1",
  "metadata": {
    "name": "web",
    "labels": {
      "app": "web"
    }
  },
  "spec": {
    "replicas": 1,
    "selector": {
      "app": "web"
    },
    "template": {
      "metadata": {
        "labels": {
          "app": "web"
        }
      },
      "spec": {
        "containers": [
          {
            "name": "web",
            "image": "quay.io/username/myimage",
            "ports": [
              {
                "name": "http-server",
                "containerPort": 80
              }
            ]
          }
        ],
        "imagePullSecrets": [
          {
            "name": "myregistrykey"
          }
        ]
      }
    }
  }
}

$ kubectl create -f pod.yaml
</code></pre>

<p>I have used <code>myregistrykey</code> as the name of the <code>imagePullSecrets</code> instead of <code>quay.io</code>, but I don't think that the issue is for that.</p>

<hr>

<p>The issue seems to be due to you didn't create a <code>secret</code> to save your credentials.</p>

<p>Note that the value of the <code>name</code> key in the <code>imagePullSecrets</code> section (in your case "quay.io") should be the same that you specified in your <code>secret</code> resource.</p>
