<p>I am having an issue configuring GCR with ImagePullSecrets in my deployment.yaml file.  It cannot download the container due to permission </p>

<pre><code>Failed to pull image "us.gcr.io/optimal-jigsaw-185903/syncope-deb": rpc error: code = Unknown desc = Error response from daemon: denied: Permission denied for "latest" from request "/v2/optimal-jigsaw-185903/syncope-deb/manifests/latest".
</code></pre>

<p>I am sure that I am doing something wrong but I followed this tutorial (and others like it) but with still no luck.</p>

<p><a href="https://ryaneschinger.com/blog/using-google-container-registry-gcr-with-minikube/" rel="noreferrer">https://ryaneschinger.com/blog/using-google-container-registry-gcr-with-minikube/</a></p>

<p>The pod logs are equally useless:</p>

<pre><code>"syncope-deb" in pod "syncope-deployment-64479cdcf5-cng57" is waiting to start: trying and failing to pull image
</code></pre>

<p>My deployment looks like:</p>

<pre><code>apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  # Unique key of the Deployment instance
  name: syncope-deployment
  namespace: default
spec:
  # 3 Pods should exist at all times.
  replicas: 1
  # Keep record of 2 revisions for rollback
  revisionHistoryLimit: 2
  template:
    metadata:
      labels:
        # Apply this label to pods and default
        # the Deployment label selector to this value
        app: syncope-deb
    spec:
      imagePullSecrets:
      - name: mykey
      containers:
      - name: syncope-deb
        # Run this image
        image: us.gcr.io/optimal-jigsaw-185903/syncope-deb
        ports:
        - containerPort: 9080
</code></pre>

<p>Any I have a key in my default namespace called "mykey" that looks like (Edited out the Secure Data):</p>

<pre><code>{"https://gcr.io":{"username":"_json_key","password":"{\n  \"type\": \"service_account\",\n  \"project_id\": \"optimal-jigsaw-185903\",\n  \"private_key_id\": \"EDITED_TO_PROTECT_THE_INNOCENT\",\n  \"private_key\": \"-----BEGIN PRIVATE KEY-----\\EDITED_TO_PROTECT_THE_INNOCENT\\n-----END PRIVATE KEY-----\\n\",\n  \"client_email\": \"bobs-service@optimal-jigsaw-185903.iam.gserviceaccount.com\",\n  \"client_id\": \"109145305665697734423\",\n  \"auth_uri\": \"https://accounts.google.com/o/oauth2/auth\",\n  \"token_uri\": \"https://accounts.google.com/o/oauth2/token\",\n  \"auth_provider_x509_cert_url\": \"https://www.googleapis.com/oauth2/v1/certs\",\n  \"client_x509_cert_url\": \"https://www.googleapis.com/robot/v1/metadata/x509/bobs-service%40optimal-jigsaw-185903.iam.gserviceaccount.com\"\n}","email":"redfalconinc@gmail.com","auth":"EDITED_TO_PROTECT_THE_INNOCENT"}}
</code></pre>

<p>I even loaded that user up with the permissions of:</p>

<ul>
<li>Editor Cloud Container </li>
<li>Builder Cloud Container </li>
<li>Builder Editor Service</li>
<li>Account Actor Service </li>
<li>Account Admin Storage </li>
<li>Admin Storage Object</li>
<li>Admin Storage Object Creator </li>
<li>Storage Object Viewer</li>
</ul>

<p>Any help would be appreciated as I am spending a lot of time on seemingly a very simple problem.</p>

<p>The issue is most likely caused by you using a secret of type <code>dockerconfigjson</code> and having valid <code>dockercfg</code> in it. The <code>kubectl</code> command changed at some point that causes this.</p>

<p>Can you check what it is marked as <code>dockercfg</code> or <code>dockerconfigjson</code> and then check if its valid <code>dockerconfigjson</code>.</p>

<p>The json you have provided is <code>dockercfg</code> (not the new format)</p>

<p>See <a href="https://github.com/kubernetes/kubernetes/issues/12626#issue-100691532" rel="nofollow noreferrer">https://github.com/kubernetes/kubernetes/issues/12626#issue-100691532</a> for info about the formats</p>
