<p>I have an off-the-shelf Kubernetes cluster running on AWS, installed with the <code>kube-up</code> script. I would like to run some containers that are in a private Docker Hub repository. But I keep getting a "not found" error:</p>

<pre><code> &gt; kubectl get pod
NAME                      READY     STATUS                                        RESTARTS   AGE
maestro-kubetest-d37hr    0/1       Error: image csats/maestro:latest not found   0          22m
</code></pre>

<p>I've created a secret containing a <code>.dockercfg</code> file. I've confirmed it works by running the script posted <a href="https://github.com/kubernetes/kubernetes/issues/499#issuecomment-131162957" rel="noreferrer">here</a>:</p>

<pre><code> &gt; kubectl get secrets docker-hub-csatsinternal -o yaml | grep dockercfg: | cut -f 2 -d : | base64 -D &gt; ~/.dockercfg
 &gt; docker pull csats/maestro
latest: Pulling from csats/maestro
</code></pre>

<p>I've confirmed I'm not using <a href="https://github.com/kubernetes/kubernetes/issues/12626" rel="noreferrer">the new format of .dockercfg script</a>, mine looks like this:</p>

<pre><code>&gt; cat ~/.dockercfg
{"https://index.docker.io/v1/":{"auth":"REDACTED BASE64 STRING HERE","email":"eng@csats.com"}}
</code></pre>

<p>I've tried <a href="https://github.com/kubernetes/kubernetes/issues/499#issuecomment-132504379" rel="noreferrer">running the Base64 encode on Debian instead of OS X</a>, no luck there. (It produces the same string, as might be expected.)</p>

<p>Here's the YAML for my Replication Controller:</p>

<pre><code>---
kind: "ReplicationController"
apiVersion: "v1"
metadata:
  name: "maestro-kubetest"
spec:
  replicas: 1
  selector:
    app: "maestro"
    ecosystem: "kubetest"
    version: "1"
  template:
    metadata:
      labels:
        app: "maestro"
        ecosystem: "kubetest"
        version: "1"
    spec:
      imagePullSecrets:
        - name: "docker-hub-csatsinternal"
      containers:
        - name: "maestro"
          image: "csats/maestro"
          imagePullPolicy: "Always"

      restartPolicy: "Always"
      dnsPolicy: "ClusterFirst"
</code></pre>

<p><code>kubectl version</code>:</p>

<pre><code>Client Version: version.Info{Major:"1", Minor:"0", GitVersion:"v1.0.3", GitCommit:"61c6ac5f350253a4dc002aee97b7db7ff01ee4ca", GitTreeState:"clean"}
Server Version: version.Info{Major:"1", Minor:"0", GitVersion:"v1.0.3", GitCommit:"61c6ac5f350253a4dc002aee97b7db7ff01ee4ca", GitTreeState:"clean"}
</code></pre>

<p>Any ideas?</p>

<p>Another possible reason why you might see "image not found" is if the namespace of your secret doesn't match the namespace of the container. </p>

<p>For example, if your Deployment yaml looks like</p>

<pre><code>apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: mydeployment
  namespace: kube-system
</code></pre>

<p>Then you must make sure the Secret yaml uses a matching namespace:</p>

<pre><code>apiVersion: v1
kind: Secret
metadata:
  name: mysecret
  namespace: kube-system
data:
  .dockerconfigjson: ****
type: kubernetes.io/dockerconfigjson
</code></pre>

<p>If you don't specify a namespace for your secret, it will end up in the default namespace and won't get used. There is no warning message. I just spent hours on this issue so I thought I'd share it here in the hope I can save somebody else the time.</p>
