<p>I have create docker registry as a pod with a service and it's working login, push and pull. But when I would like to create a pod that use an image from this registry, the kubelet can't get the image from the registry.</p>

<p>My pod registry:</p>

<pre><code>apiVersion: v1
kind: Pod
metadata:
  name: registry-docker
  labels:
    registry: docker
spec:
  containers:
  - name: registry-docker
    image: registry:2
    volumeMounts:
    - mountPath: /opt/registry/data
      name: data
    - mountPath: /opt/registry/auth
      name: auth
    ports:
    - containerPort: 5000
    env:
    - name: REGISTRY_AUTH
      value: htpasswd
    - name: REGISTRY_AUTH_HTPASSWD_PATH
      value: /opt/registry/auth/htpasswd
    - name: REGISTRY_AUTH_HTPASSWD_REALM
      value: Registry Realm
  volumes:
  - name: data
    hostPath:
      path: /opt/registry/data
  - name: auth
    hostPath:
      path: /opt/registry/auth
</code></pre>

<p>pod I would like to create from registry:</p>

<pre><code>apiVersion: v1
kind: Pod
metadata:
  name: nginx
spec:
  containers:
  - name: nginx
    image: 10.96.81.252:5000/nginx:latest
  imagePullSecrets:
  - name: registrypullsecret
</code></pre>

<p>Error I get from my registry logs:</p>

<blockquote>
  <p>time="2018-08-09T07:17:21Z" level=warning msg="error authorizing
  context: basic authentication challenge for realm \"Registry Realm\":
  invalid authorization credential" go.version=go1.7.6
  http.request.host="10.96.81.252:5000"
  http.request.id=655f76a6-ef05-4cdc-a677-d10f70ed557e
  http.request.method=GET http.request.remoteaddr="10.40.0.0:59088"
  http.request.uri="/v2/" http.request.useragent="docker/18.06.0-ce
  go/go1.10.3 git-commit/0ffa825 kernel/4.4.0-130-generic os/linux
  arch/amd64 UpstreamClient(Go-http-client/1.1)"
  instance.id=ec01566d-5397-4c90-aaac-f56d857d9ae4 version=v2.6.2
  10.40.0.0 - - [09/Aug/2018:07:17:21 +0000] "GET /v2/ HTTP/1.1" 401 87 "" "docker/18.06.0-ce go/go1.10.3 git-commit/0ffa825
  kernel/4.4.0-130-generic os/linux arch/amd64
  UpstreamClient(Go-http-client/1.1)"</p>
</blockquote>

<p>The secret I use created from <code>cat ~/.docker/config.json | base64</code>:</p>

<pre><code>apiVersion: v1
kind: Secret
metadata:
 name: registrypullsecret
data:
 .dockerconfigjson: ewoJImF1dGhzIjogewoJCSJsb2NhbGhvc3Q6NTAwMCI6IHsKCQkJImF1dGgiOiAiWVdSdGFXNDZaRzlqYTJWeU1USXoiCgkJfQoJfSwKCSJIdHRwSGVhZGVycyI6IHsKCQkiVXNlci1BZ2VudCI6ICJEb2NrZXItQ2xpZW50LzE4LjA2$
type: kubernetes.io/dockerconfigjson
</code></pre>

<p>The modification I have made to my default serviceaccount:</p>

<pre><code>cat ./sa.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  creationTimestamp: 2018-08-03T09:49:47Z
  name: default
  namespace: default
#  resourceVersion: "51625"
  selfLink: /api/v1/namespaces/default/serviceaccounts/default
  uid: 8eecb592-9702-11e8-af15-02f6928eb0b4
secrets:
- name: default-token-rfqfp
imagePullSecrets:
- name: registrypullsecret
</code></pre>

<p>file ~/.docker/config.json:</p>

<pre><code>{
        "auths": {
                "localhost:5000": {
                        "auth": "YWRtaW46ZG9ja2VyMTIz"
                }
        },
        "HttpHeaders": {
                "User-Agent": "Docker-Client/18.06.0-ce (linux)"
        }
</code></pre>

<p>The <code>auths</code> data has login credentials for "localhost:5000", but your image is at "10.96.81.252:5000/nginx:latest".</p>
