<p>I have installed K8S with <code>kubeadm</code> and <code>docker 18.09.4</code> and it works fine. Then I installed <code>gcloud</code>, ran <code>gcloud init</code> and select my project where <code>gcr</code> is activated, continued with <code>gcloud components install kubectl docker-credentials-gcr</code>, followed by <code>docker-credentials-gcr configure-docker</code>.</p>

<p>At that stage, <code>docker</code> can pull images from my own <code>gcr</code> registry, while <code>kubelet</code> cannot.</p>

<p>Basically, if I run <code>docker run --rm --name hello gcr.io/own-gcr/hello-world</code> it pulls the image from the registry and starts the container.
If I delete the image from my local registry and ran `` it fails with the following description:</p>

<pre><code>  Events:
  Type     Reason     Age                From                       Message
  ----     ------     ----               ----                       -------
  Normal   Scheduled  23s                default-scheduler          Successfully assigned default/node-hello-6b99957775-9dvvw to lfr025922-docker
  Normal   BackOff    20s (x2 over 21s)  kubelet, lfr025922-docker  Back-off pulling image "gcr.io/own-gcr/node-hello"
  Warning  Failed     20s (x2 over 21s)  kubelet, lfr025922-docker  Error: ImagePullBackOff
  Normal   Pulling    9s (x2 over 22s)   kubelet, lfr025922-docker  Pulling image "gcr.io/own-gcr/node-hello"
  Warning  Failed     9s (x2 over 21s)   kubelet, lfr025922-docker  Failed to pull image "gcr.io/own-gcr/node-hello": rpc error: code = Unknown desc = Error response from daemon: unauthorized: You don't have the needed permissions to perform this operation, and you may have invalid credentials. To authenticate your request, follow the steps in: https://cloud.google.com/container-registry/docs/advanced-authentication
  Warning  Failed     9s (x2 over 21s)   kubelet, lfr025922-docker  Error: ErrImagePull
</code></pre>

<p>I of course, followed all instructions on page <a href="https://cloud.google.com/container-registry/docs/advanced-authentication" rel="nofollow noreferrer">https://cloud.google.com/container-registry/docs/advanced-authentication</a> and none of them were successful.</p>

<p>Are you aware of any issue with <code>kubelet 1.14</code> and <code>docker 18.09.5</code>? Isn't <code>kubelet</code> supposed to rely on the underlying <code>CRI</code> (here <code>docker</code>)? Have you any idea of what could cause that issue?</p>

<p>@VasilyAngapov was true.</p>

<p>I followed the tricks provided here <a href="https://container-solutions.com/using-google-container-registry-with-kubernetes/" rel="nofollow noreferrer">https://container-solutions.com/using-google-container-registry-with-kubernetes/</a> and it works perfectly well (using the Access Token with <code>oauth2accesstoken</code>)</p>

<p>Thanks a lot.</p>
