<p>Today is my first day playing with GCR and GKE. So apologies if my question sounds childish.</p>

<p>So I have created a new registry in GCR. It is private. Using <a href="https://cloud.google.com/container-registry/docs/advanced-authentication#access_token" rel="noreferrer">this</a>  documentation, I got hold of my Access Token using the command</p>

<pre><code>gcloud auth print-access-token
#&lt;MY-ACCESS_TOKEN&gt;
</code></pre>

<p>I know that my username is <code>oauth2accesstoken</code></p>

<p>On my local laptop when I try</p>

<pre><code>docker login https://eu.gcr.io/v2
Username: oauth2accesstoken
Password: &lt;MY-ACCESS_TOKEN&gt;
</code></pre>

<p>I get:</p>

<pre><code>Login Successful
</code></pre>

<p>So now its time to create a <code>docker-registry</code> secret in Kubernetes.</p>

<p>I ran the below command:</p>

<pre><code>kubectl create secret docker-registry eu-gcr-io-registry --docker-server='https://eu.gcr.io/v2' --docker-username='oauth2accesstoken' --docker-password='&lt;MY-ACCESS_TOKEN&gt;' --docker-email='&lt;MY_EMAIL&gt;'
</code></pre>

<p>And then my Pod definition looks like:</p>

<pre><code>apiVersion: v1
kind: Pod
metadata:
  name: my-app
spec:
  containers:
  - name: my-app
    image: eu.gcr.io/&lt;my-gcp-project&gt;/&lt;repo&gt;/&lt;my-app&gt;:latest
    ports:
    - containerPort: 8090
  imagePullSecrets:
  - name: eu-gcr-io-registry
</code></pre>

<p>But when I spin up the pod, I get the ERROR:</p>

<pre><code>Warning  Failed                 4m (x4 over 6m)   kubelet, node-3  Failed to pull image "eu.gcr.io/&lt;my-gcp-project&gt;/&lt;repo&gt;/&lt;my-app&gt;:latest": rpc error: code = Unknown desc = Error response from daemon: unauthorized: You don't have the needed permissions to perform this operation, and you may have invalid credentials. To authenticate your request, follow the steps in: https://cloud.google.com/container-registry/docs/advanced-authentication
</code></pre>

<p>I verified my secrets checking the YAML file and doing a <code>base64 --decode</code> on the <code>.dockerconfigjson</code> and it is correct.</p>

<p>So what have I missed here ? </p>

<p><strong>If your GKE cluster &amp; GCR registry are in the same project:</strong> You don't need to configure authentication. GKE clusters are authorized to pull from private GCR registries in the same project with no config. (Very likely you're this!)</p>

<hr>

<p><strong>If your GKE cluster &amp; GCR registry are in different GCP projects:</strong> Follow these instructions to give "service account" of your GKE cluster access to read private images in your GCR cluster: <a href="https://cloud.google.com/container-registry/docs/access-control#granting_users_and_other_projects_access_to_a_registry" rel="noreferrer">https://cloud.google.com/container-registry/docs/access-control#granting_users_and_other_projects_access_to_a_registry</a></p>

<p>In a nutshell, this can be done by:</p>

<pre><code>gsutil iam ch  serviceAccount:[PROJECT_NUMBER]-compute@developer.gserviceaccount.com:objectViewer gs://[BUCKET_NAME]
</code></pre>

<p>where <code>[BUCKET_NAME]</code> is the GCS bucket storing your GCR images (like <code>artifacts.[PROJECT-ID].appspot.com</code>) and <code>[PROJECT_NUMBER]</code> is the <strong>numeric</strong> GCP project ID hosting your GKE cluster.</p>
