<p>In Kubernetes container repository I have my permission set to Private:
<a href="https://i.stack.imgur.com/K1iNY.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/K1iNY.png" alt="enter image description here" /></a></p>
<p>When I create a pod on my cluster I get the the pod status ending in <code>ImagePullBackOff</code> and when I describe the pod I see:</p>
<pre><code>Failed to pull image &quot;gcr.io/REDACTED&quot;: rpc error: code = Unknown desc = Error response from daemon: pull access denied for gcr.io/REDACTED, repository does not exist or may require 'docker login': denied: Permission denied for &quot;v11&quot; from request &quot;/v2/REDACTED/manifests/v11&quot;.
</code></pre>
<p>I am certainly logged in.</p>
<pre><code>docker login
Authenticating with existing credentials...
Login Succeeded
</code></pre>
<p>Now if I enable public access (top image) on my Container Repository things work fine and the pod deploys correctly. But I don't want my repository to be public. What is the correct way to keep my container repository private and still be able to deploy. I'm pretty sure this used to work a couple weeks ago unless I messed up something with my service account although I don't know how to find out which service account is being used for these permissions.</p>

<p>If your GKE version is &gt; 1.15, and the Container Registry is in the same project, and GKE uses the default Compute Engine service account (SA) it should work out of the box.</p>
<p>If you are running the registry in another project, or using a different service account, you should give to the SA the right permissions (e.g., <code>roles/artifactregistry.reader</code>)</p>
<p>A step by step tutorial, with all the different cases, it is present in the official documentation: <a href="https://cloud.google.com/artifact-registry/docs/access-control#gcp" rel="nofollow noreferrer">https://cloud.google.com/artifact-registry/docs/access-control#gcp</a></p>
